I'm taking over as a system administrator on an existing LAMP server for a site with a number of individual applications. The person I'm replacing has done a pretty good job with security as far as I know, but I'd like to take any preventative measures I can.

With the OWSAP top ten web vulnerabilities as a good place to start, what are critical things to check? I'm looking for both high-level concepts as well as specific things to look for (e.g. file permissions, open ports).

closed as not a real question by Adi, TildalWave, Ayrx, NULLZ, Gilles Jun 2 '13 at 19:18

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Well, you're asking for a guide to secure a server on all fronts (web applications, the server itself, etc.). I think this is too broad to fit here. – Adi Jun 1 '13 at 19:28
  • Possibly a duplicate, but could have a slightly different scope: serverfault.com/questions/212269/… – Brian Adkins Jun 1 '13 at 22:15

Center for Internet Security (CIS) has extensive guides on how to secure Apache and MySQL. It include everything from file permissions, partition layout, log files best practices etc. For the OS hardening, you would find specific hardening advice for the specific OS as well. It doesn't mean like CIS is the end of the world but what it means is you will find a comprehensive list of security best practices that is not only high level but go on into as much detail as specific commands to run.

The good thing about CIS benchmarks is that once you implement the security settings, you can use many configuration bench-marking tools to audit the security settings against CIS configuration benchmarks. Nessus professional has such a service that I use regularly to audit my own servers.

  • You should add these comments to the canonical here serverfault.com/questions/212269/… – Brian Adkins Jun 1 '13 at 22:15
  • @BrianAdkins You are right. The question is a duplicate of the one you mentioned. I think it will be closed as duplicated shortly. Also, I don't feel any need to paste my comments there because what I have describe here, ScotPack has described in his answer as well. – void_in Jun 2 '13 at 6:22

I think the recommendations should be the same as for securing ANY web server...

This may be a duplicate of the canonical question, but I'll leave that to the mods:


... Plus, change all the passwords.


Not the answer you're looking for? Browse other questions tagged or ask your own question.