4

Obvious things:

  1. Disable root login (rather, don't enable it)
  2. Secure SSH (no root login, key auth only, timeout after inactivity, whitelist users who can SSH in, etc.)
  3. IP Tables firewall whitelisting only the proper traffic on 80/443/22
  4. Update all packages
  5. Disable Control-Alt-Delete for the console

The OS is Ubuntu 12.04.1 x86-64 (server) and the use is as a web application server. The software used is:

  1. Nginx (run as www-data)
  2. Supervisor (run as root with no HTTP server or RPC server)
  3. uWSGI (run as www-data)
  4. Celery (run as www-data)
  5. Redis (run as www-data)
  6. Memcached (run as www-data)

I ask because I'm not sure what things that are installed with Ubuntu 12.04.1 which might be have potential security vulnerabilities, which things I may have accidentally left off my "obvious" checklist and which of the packages I've mentioned above which might have security vulnerabilities (all installed as packages vs manually compiling, btw).

Improve this question
4
  • Might add some SYN packet rate limiting on the IPTables firewall too, it won't stop a DDoS attack, but it it can help weather the effects.
    – ewanm89
    Commented Dec 7, 2012 at 19:06
  • Was it ubuntu server edition installed? Not desktop edition stripped?
    – ewanm89
    Commented Dec 7, 2012 at 19:08
  • @ewanm89 - yeah, server edition. Thanks btw (for the tip on SYN packet rate limiting).
    – orokusaki
    Commented Dec 7, 2012 at 19:45
  • total and complete disregard for application separation.
    – rook
    Commented Dec 7, 2012 at 20:05

1 Answer 1

Reset to default
2
  • Run your web application as a different user than everyone else. This is what www-data is for!!!!!
  • Remove write access to your web root! (And only your web application (www-data) should have read/execute)
  • Use a Web Application Firewall (WAF). Naxsi for Nginx is an option however mod_security is a better WAF.
  • Remove access to port 22 using Port Knocking Or Bastion Host (Bonus points for using both!)
  • Force HTTPS only to avoid OWASP a9 violations. HTTP should only be used to set HSTS and redirects to HTTPS.
  • Last I checked Ubuntu doesn't have AppArmor rule sets for ngix, where as they do for the LAMP install. Also be aware that nginx is very young and as a result more advisories are released for ngix than [Apache]
  • setup apt autoupdate for security related updates.
  • If you have the money, get a pentest
Improve this answer
3
  • Thanks - regarding your "total and complete disregard..." comment: Did you mean, because I've used www-data so gratuitously? Which programs should be running as www-data? My web application is really a combination of uWSGI and Nginx. Should both run as www-data?
    – orokusaki
    Commented Dec 7, 2012 at 20:30
  • 1
    @orokusaki Ok, you probably have never written an exploit. But the best exploits are using the services against each other. For instance using the database to write a .php file in the web root. AppArmor helps with this, but your using ngix and everyone is running as www-data so you absolutely no separation what so ever. You just threw a bunch of criminals with construction equipment in the same jail cell.
    – rook
    Commented Dec 7, 2012 at 20:36
  • Thanks Rook. That's good info to have. I did typo when I said Memcached and Redis would run as www-data, but the rest were www-data :( lesson learned the easy way though :)
    – orokusaki
    Commented Dec 7, 2012 at 21:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .