Ubuntu 14.04 Laravel Web Server - What should I be concerned about? [closed]

Question

This is my first web-server which I'm looking to construct for my client. I have developed a Laravel application which has been fully deployed onto this server; now i'm looking for any security issues.

What security concerns are there regarding Ubuntu 14.04 running Apache, Laravel, PHP7 & MySQL?

What steps should I take to secure my web server from attacks?

Answer 1

Wow. I'm afraid no answer will be sufficient, and you'll likely need to hear from several different experts. Perhaps I will provide a simple overview [0].

• Uninstall all unnecessary services (complexity is the enemy of security)
• Enable and configure the firewall (UFW)
• Consider upgrading to 16.04 LTS [1]
• research and change all default passwords (for the remaining services)
• use ssh public key authentication and disable ssh password authentication and ssh root login (assuming ssh is enabled)[2]
• Follow hardening guides for each service running on your server.
• Updates need to be applied quickly (or if they can't be applied, workarounds to the issues they fix should be implemented)
• Backups. Eventually something will fail. Be ready to redeploy quickly.

[0]

• You've already built your application, so I can only assume your design doesn't have any security flaws, and your code handles user data very carefully.

[1]

• 2 extra years to upgrade before it falls out of support
• not all patches are provided to older releases. Occasionally the security benefit of a patch is recognized long after release.

[2]

• The world will continuously attempt to brute force your passwords. Forcing public key authentication will render these attempts futile.
• use a firewall LIMIT rule for SSH. It isn't perfect, but it reduces the log noise, and perhaps a trivial amount of CPU and network bandwidth.
• moving SSH to a non-standard port reduces the log noise even more, but you'll have to remember the new port to perform maintenance.