1

This is my first web-server which I'm looking to construct for my client. I have developed a Laravel application which has been fully deployed onto this server; now i'm looking for any security issues.

What security concerns are there regarding Ubuntu 14.04 running Apache, Laravel, PHP7 & MySQL?

What steps should I take to secure my web server from attacks?

closed as too broad by Anders, Steffen Ullrich, Teun Vink, mricon, Conor Mancone Oct 4 '18 at 2:30

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

2

Wow. I'm afraid no answer will be sufficient, and you'll likely need to hear from several different experts. Perhaps I will provide a simple overview [0].

  • Uninstall all unnecessary services (complexity is the enemy of security)
  • Enable and configure the firewall (UFW)
  • Consider upgrading to 16.04 LTS [1]
  • research and change all default passwords (for the remaining services)
  • use ssh public key authentication and disable ssh password authentication and ssh root login (assuming ssh is enabled)[2]
  • Follow hardening guides for each service running on your server.
  • Updates need to be applied quickly (or if they can't be applied, workarounds to the issues they fix should be implemented)
  • Backups. Eventually something will fail. Be ready to redeploy quickly.

[0]

  • You've already built your application, so I can only assume your design doesn't have any security flaws, and your code handles user data very carefully.

[1]

  • 2 extra years to upgrade before it falls out of support
  • not all patches are provided to older releases. Occasionally the security benefit of a patch is recognized long after release.

[2]

  • The world will continuously attempt to brute force your passwords. Forcing public key authentication will render these attempts futile.
  • use a firewall LIMIT rule for SSH. It isn't perfect, but it reduces the log noise, and perhaps a trivial amount of CPU and network bandwidth.
  • moving SSH to a non-standard port reduces the log noise even more, but you'll have to remember the new port to perform maintenance.
  • This is great. Thanks Jeff! Any firewall recommendations? – Oliver Kuchies Feb 24 '17 at 4:00
  • Ubuntu (indeed all linux Operating Systems) comes with a firewall built in, but not configured or enabled. Different distributions have different tools for configuring it and 'UFW' is the name of Ubuntu's firewall configuration tool. Browsing the software center you can find GUI firewall configuration utilities, which may be a bit easier to learn. help.ubuntu.com/lts/serverguide/firewall.html – Jeff K Feb 24 '17 at 4:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.