I am developing bussines application based on php and mysql on ubuntu 12.04 lts server. I have closed all ports except :80 and php code can be executed only by security login and not using cookies but session.

What other vulnerability can server have and what security precaution i need to take for hight security???

  • Ditching php might be one. – Lucas Kauffman Dec 2 '13 at 11:03
  • 1
    @LucasKauffman Thank you for your replay, but I am more interested in servers security. what can I do beside disabling ports? – mandza Dec 2 '13 at 11:12

First of all:

  • create a user to run your PHP code as who has no more user rights than needed, including being jailed within his user context
  • configure suphp
  • get a hardening guide for ubuntu and follow it thoroughly
  • configure apparmor
  • limit user access and have a remote logging tool set up
  • implement auditd for sensitive folders
  • set up SSL with a valid certificate (443) if your app handles sensitive information

For MySQL preferably you have a table to which you can only add records. Every record has a field "deleted, to which your user mysql application user can have access. This record can be set to True or False. Your user can insert rows but cannot delete any, he can also only update those fields within a record which should be updated. Deleting can be done by setting True or False (your application needs to account for this).

Use as much stored procedures as possible, off-load as much database logic to your database as you can.

Configure a WebApplication firewall and HIDS.

  • Thank you again, i will do all of this. i dont use remote logging to server. The only remote access is :80 php pages. – mandza Dec 2 '13 at 11:17
  • If you've got "security login" to port 80 then implementing SSL on port 443 and using that instead should be one of your steps. – gowenfawr Dec 2 '13 at 12:25

If you want to hard your system you can also fail2ban. It's a script that watch log files and set blocking rules to the firewall in case of illegal access.

I use it to monitoring and block the access to not available websites and the ssh login trails.

It's easy to configure, without attracting attention and works fine :-)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.