I'm considering the possibility of running an Open Server, as I would call it, that is, a server where as much of its contents are publicly visible as possible. I would like to give read access to everyone for as much content as possible. I'm wondering what content on a linux server, such as an Ubuntu one, with the typical Apache, Mysql, PHP setup, would need to be hidden. I can move the database password to another server and transmit it through an encrypted exchange. I can use an NIS system for the system passwords. Then, I'm not sure what else needs to be hidden. It seems I can allow read access for the entire server that way. Is there anything else that would have to remain hidden?
1 Answer
Assuming your server doesn't use any credentials besides system-level accounts and the MySQL password, there's one thing you need to protect: the swap file. Programs are supposed to take steps to prevent credentials from winding up in swap, but they don't always do so.
There are some sensitive things in /dev and /proc (such as /dev/mem and /proc/kcore). The proc filesystem driver should prevent you from making dangerous changes to /proc, but in a udev-based system /dev has no such protections, so don't change anything there.
Keep in mind that giving read access to everything means users have read access to the MySQL database by inspecting the files directly. Make sure any web applications you install don't store credentials (user or application) there.
