Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm taking over as a system administrator on an existing LAMP server for a site with a number of individual applications. The person I'm replacing has done a pretty good job with security as far as I know, but I'd like to take any preventative measures I can.

With the OWSAP top ten web vulnerabilities as a good place to start, what are critical things to check? I'm looking for both high-level concepts as well as specific things to look for (e.g. file permissions, open ports).

share|improve this question
2  
Well, you're asking for a guide to secure a server on all fronts (web applications, the server itself, etc.). I think this is too broad to fit here. –  Adnan Jun 1 '13 at 19:28
    
Possibly a duplicate, but could have a slightly different scope: serverfault.com/questions/212269/… –  BrianAdkins Jun 1 '13 at 22:15
add comment

closed as not a real question by Adnan, TildalWave, Terry Chia, NULLZ, Gilles Jun 2 '13 at 19:18

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers

Center for Internet Security (CIS) has extensive guides on how to secure Apache and MySQL. It include everything from file permissions, partition layout, log files best practices etc. For the OS hardening, you would find specific hardening advice for the specific OS as well. It doesn't mean like CIS is the end of the world but what it means is you will find a comprehensive list of security best practices that is not only high level but go on into as much detail as specific commands to run.

The good thing about CIS benchmarks is that once you implement the security settings, you can use many configuration bench-marking tools to audit the security settings against CIS configuration benchmarks. Nessus professional has such a service that I use regularly to audit my own servers.

share|improve this answer
    
You should add these comments to the canonical here serverfault.com/questions/212269/… –  BrianAdkins Jun 1 '13 at 22:15
    
@BrianAdkins You are right. The question is a duplicate of the one you mentioned. I think it will be closed as duplicated shortly. Also, I don't feel any need to paste my comments there because what I have describe here, ScotPack has described in his answer as well. –  void_in Jun 2 '13 at 6:22
add comment

I think the recommendations should be the same as for securing ANY web server...

This may be a duplicate of the canonical question, but I'll leave that to the mods:

http://serverfault.com/questions/212269/tips-for-securing-a-lamp-server

... Plus, change all the passwords.

.

share|improve this answer
    
Thanks for the link! –  jandjorgensen Jun 6 '13 at 1:09
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.