1

My case is

I just registered at dyndns.com to get a domain for a website I am staging on my home computer (I know it's not considered good to do so). But the website is not big, and I don't expect to have much traffic; about a maximum of 50-80 per day. My website is served by IIS 7.5, on a system with Windows 7 installed.

My question is:

As people say it's not good to have a web-server on a home computer because of security reasons. What security measures should I take to secure my computer from intelligent but bad guys? ( Also, how should they be configured?).

Edit

I just want something like a checklist and a link to some sort of website that tells me how to configure it.

|improve this question
  • 3
    Your question is too broad. IMO a good & comprehensive answer could easily fill some pages. Can you be more specific? – jweyrich Dec 25 '10 at 0:32
8

As jweyrich said - the more specific you can be about requirements, the better. Having said that, there are some simple industry good practices you should follow:

Have the web site hosted on an entirely separate computer - you should expect a server open to the Internet to be a likely point of compromise, and I'm guessing you don't also want a successful attacker to have all your online banking details, passwords, emails etc.

Separate your web server from your home network with a firewall - a layer of defence to help with the above point :-) Do not allow anything through the firewall except just those connections your application requires. Also use an external firewall to limit the connections from the internet to your web server.

Keep your web server up to date with patches, security fixes, versions etc. Do not use deprecated versions of software, or languages known to be vulnerable.

I'll try and pop up a couple of useful links to online guides, but for now I'm opening presents so it'll have to wait :-)

|improve this answer
2

Hosting at home is never 100% safe. But if you want to learn how it exactly work then go for it.

If you are hosting website in home network i would recommend you to separate your Web server from your own computer because if any damage made to web-server it could harm your own computer.

If your are running Windows operating system keep windows updated and IIS too,if you could setup apache for web-hosting it would be better to manage security for your website.

Security problems are sometimes found in server software, and these can be exploited to gain access to or damage your files.

Install Best Firewall software like "comodo" and configure inbound traffic rules for HTTP port 80 well suited.

I would recommend to keep your web-server separate and keep web-server in "Demilitarized zone" and "Intranet for your personal computer".

|improve this answer
  • 1
    why do you say that its better to install apache? – AviD♦ Dec 25 '10 at 22:58
  • Apache is the Open source web server software developed to fullfill user needs where as IIS is microsoft product need to protect with licensed and incremental updates you will waste much amount of time for IIS as compared to Apache. – mr_eclair Dec 26 '10 at 4:16
  • Security : as Apache is open source model thought their are security issues in apache too but the end users fixed with a ease as compared to IIS is closed source microsoft doesn't allow you to view the code so when they find the vulnerability they fixed it. – mr_eclair Dec 26 '10 at 4:20
  • 2
    @mr_eclair - from looking at web server farms from 1 machine to large clusters of RS6000 nodes, security is not a differentiation issue here. I have seen both types implemented securely, and both tpes implemented insecurely. I think I would agree with you on the scalability front, but as the OP suggested, this is not a large scale installation. – Rory Alsop♦ Dec 26 '10 at 17:53
  • 2
    "Hosting at home is never 100% safe" Hosting from ANYWHERE is NEVER 100% safe. Ever. I am pro-Apache, but I think your implications are false, they both have the potential to be relatively secure or insecure. – Purge Dec 28 '10 at 16:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.