12

I am interested in running our company's web server from our local office. The office makes use of file sharing and NAS devices among other common office protocols. The worst case scenarios I've envisioned would be someone eavesdropping onto company emails, doing packet traces, etc.. I want to take the necessary precautions that will help ensure it is harder for someone with malicious intent to gain access to our internal network via the web server or potentially listening to outgoing traffic if our company's dedicated IP is made known. Here are some of the things I'm considering:

  • Disabling SSH/FTP port access from outside our network.
  • Changing defaults ports (e.g. changing default HTTP/HTTPS/SSH/FTP ports)
  • Implementing firewall rules on the web server itself
  • Restricting sharing and internal network access on this Linux server so that it's harder to communicate with other computers on the network

Is there anything else that stands out? Some common security practices that I should adhere to? Thanks in advance.

Improve this question
4
  • 2
    changing default ports to another is only a matter of time for an attacker to find them, its security through obscurity which needs extra effort such as firewall and IPS
    – Akam
    Commented Oct 21, 2015 at 17:12
  • How about getting a second internet connection and network equipment? Some ISPs will let you do this. And it will completely isolate your network.
    – Mark Buffalo
    Commented Oct 21, 2015 at 18:21
  • 2
    I think you under-imagine the worst case scenario. Worse possibilities I can think of: ransom-ware infects your systems and you lose company data (code, documents, customer databases, any kind of file), your site is quietly compromised and starts distributing malware to your customers, your customer database gets downloaded and an attacker gets access to your customer's bank account because they use the same username and password on both accounts.
    – jpmc26
    Commented Oct 21, 2015 at 22:28
  • At the core of the matter, the most important thing you need to do is conceptual (ie. in your head): you need to assume that the web server will be breached at some point. That will lead to ensuring that you have robust separation from the rest of your network, using one or more of the good methods people are recommending here.
    – mostlyinformed
    Commented Oct 22, 2015 at 17:31

3 Answers 3

Reset to default
15

Unless you have a very good reason to do this, you are likely to find that this not only introduces potential risks for your site and office infrastructure, but also provides a detrimental experience to website users.

At the very least, you should use a firewall to drop all traffic to unexpected ports (probably 80 and 443, depending whether you use HTTPS or not), and ensure that the web server system is isolated from other office computers and networks.

Changing the default HTTP and HTTPS ports will cause you headaches relating to users having to specify a port in order to connect to your website, and provides very limited protection for any other service (it takes a matter of minutes to scan all possible ports on a given IP address - if someone is looking at your server, they would find that SSH was running on 2020 rather that 22).

You should also consider how your network could be affected by denial-of-service attacks, if you are sharing the internet connection with your web server. If you do not have complete isolation between the web server and the rest of the network, it would also probably be possible for a determined attacker to pivot from your web server to attack other systems, which are probably not hardened for attack in this way.

It would also be important to keep the web server patched with the latest security patches, since the impact of an attack could potentially extend beyond just the one server.

On the other hand, if you host your site through a managed hosting provider, they will have dedicated bandwidth, firewall systems to minimise connections between servers, may well install security patches as they are released, and, depending on the provider, may handle basic backups and fall over procedures.

There are very few reasons for any small to medium business to self-host, so any decision to do so should only be made if there are specific reasons which cannot be overcome in other ways.

Improve this answer
5
  • 1
    Nice answer. Want to add that the blended network architecture also makes the production server easily accessible by every employee. You probably want the production server to be a bit further than on the same network.
    – Neil Smithline
    Commented Oct 21, 2015 at 17:35
  • Depending on the scale of the operation, number of servers and availability of skills there can be big savings in running your own datacentre but for a single server managed by a single non-expert, not in this case.
    – symcbean
    Commented Oct 21, 2015 at 21:15
  • 2
    @Matthew Indeed ensure that the web server system is isolated from other office computers and networks. Isolation, isolation, isolation. Your whole starting point of 'running from our office' is a red flag, so it's good that you are asking here. Split your hardware and your software infrastructure. As pr- says in his/her answer, use a DMZ. The large Sony hacks were possible because they had all their networks connected. The isolation between networks made the 2015 Lastpass (suspected) breach a non-issue.
    – user13695
    Commented Oct 22, 2015 at 7:18
  • 2
    It may not truly improve security, perhaps, but I certainly got a lot fewer SSH attacks on my server when I moved the port from 22 to 443. (I didn't do it for security reasons, though, but to punch through a firewall at a former workplace which only allowed outgoing connections to ports 80 and 443.) I'm guessing most script kiddies run SSH attacks on random IPs only on port 22. Now I keep getting a bunch of Bad protocol version identification '\200F\001\003\001' and similar messages instead. (Presumably attempted TLS/SSL handshakes.)
    – Alex
    Commented Oct 22, 2015 at 7:38
  • @symcbean - Very true, but those savings only kick in at quite a high level, where there is likely to be a distinct office network and datacentre network. I would be very worried if I saw a datacentre which shared network infrastructure with associated offices! Alex - It depends whether you are looking at general low level "internet noise", or a specific attack. You'll see less noise on a weird port, but it won't slow down someone attacking a specific box particularly.
    – Matthew
    Commented Oct 22, 2015 at 8:05
5

I'm surprised that the other answers haven't addressed the most basic of security concepts regarding websites and corporate networks: DMZs

The concept is that you place your webserver on it's own network segment away from the corporate LAN. This can be done via VLANs or by hardwired routing. These connections between your office lan and the DMZ should also be firewalled off. The Firewall should only allow specific NEEDED ports to communicate between the systems. This should not include nice to have things like being able to SSH from the webserver.

The goal is to think if you have access to the webserver, how might you reach your office LAN? If you can think of ways that might allow office access from the DMZ, you should plug them using the firewall.

Improve this answer
2
  • 1
    This. If you create a separate subnet (DMZ) that cannot be broken out of, then a compromise of the web server will have limited impact on the rest of the corporate network; since it cannot be used to "hop" to other servers and get around firewall/NAT.
    – Herringbone Cat
    Commented Oct 21, 2015 at 18:18
  • 1
    What happens when a new/old DMZ exploit shows up? ;)
    – Mark Buffalo
    Commented Oct 21, 2015 at 18:23
1

In overall, I would suggest to have below devices to have better security 1. IPS 2. Anti-Virus protection 3. Firewall

Sample Security Model

IPS(Intrusuion Prevention System) in order to detect suspicious traffic based on pattern signatures...

There are certain linux based open source products available in IPS/IDS which you may consider like Suricata, Snort... Take a look at this link for better understanding

http://blog.securitymonks.com/2010/08/26/three-little-idsips-engines-build-their-open-source-solutions/

There are certain Open source firewall also you can build like PFSense which will permit/block packets entering/exiting your network based on the rules configured.. There are lot more technical features if you take firewall which you can utilize for better security..

If you are looking security devices that worths its cost, you can go for Checkpoint or Palo-Alto UTM security products.. You can go for base models incase of small office..

The other suggestion would be to use SSL traffic(https instead of http) for protecting the traffic per session.. Use SFTP instead of FTP.. Use SSH instead of Telnet.. Use VPN for connecting your office server from home through Internet instead of exposing the server directly to Internet on remote desktop port 3389..

Improve this answer
6
  • This answer is about general network configuration and doesn't address the special problems that come from sharing the company network with a production server. Which is what the question is about.
    – Neil Smithline
    Commented Oct 21, 2015 at 17:32
  • 1
    The question is about suggestions on some common security practices and thats what my answer is to... you please consider verifying the question once again....
    – G K
    Commented Oct 21, 2015 at 18:04
  • Are you proposing the IPS and firewall be between the corp and production network? Between both networks and the internet? Both places? Elsewhere?
    – Neil Smithline
    Commented Oct 21, 2015 at 18:09
  • I am suggesting to separate that server from corp network with Firewall DMZ with necessary rules blocked at firewall and have IPS installed between Internet and firewall outside to scan for possible attacks..
    – G K
    Commented Oct 24, 2015 at 19:00
  • Link is 404....
    – Braiam
    Commented May 31, 2016 at 19:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .