dear security experts: we would like to create a very safe webserver. we are in awe at the sophistication and complexity of many solutions, but they don't apply to us. we are a small shop.
by safe, we mean a php or perl based internet-open website that limits the intrusion vulnerability with respect to remote sophisticated hacker in another country. it does not mean protection against people stealing the computer physically. it does not mean keeping my clients safe.
like many small shops, we don't have the manpower and attention to constantly monitor everything. we need to do assume our server employees make mistakes all the time. we also need to assume that we will miss security fixes, or even that we wrote sloppy code ourselves. we need this to be simple and foolproof. and fools we got. well, call them unsophisticated and naive.
first, we want the internet server to boot a distro from a read-only device. the cheapest way to do this is via CD. the hard disk will probably be removed. I have yet to find a modern SSD that has a true read-only switch. (some USB flash drives have it.) this means that there will be no root-kit installation on the root device. when I reboot, all temporary storage will be wiped out. I will be pristinely clean.
second, we wonder whether we can or should add more security. on rare occasion, we need to log into the computer that is running the webserver via ssh, bash, or execute something sudo---but this is rare. I want to install a hardware button on the computer that allows or disallows this. I can write a linkable function or shell script that returns 0 if the button is disengaged or 1 if it is engaged. so, I think I need to modify the code that executes ssh, bash, sudo, etc. they just need to be wrapped to check for 0 or 1 on the button first. or, I could modify the ext4 file system driver to let only certain programs through if the button is pressed, but this seems overkill.
I would think that if one of our fools gave a remote hacker the root account and password, but the button is off and the drive is read-only, there is even less harm that they could do.
I don't see an easy way to prevent a hacker from locating something into RAM, at least until the next reboot.
my key question now is: is there a common way to wrap a list of shell and other remote access programs to work only when my button is pressed?
PS: and if anyone knows of an SSD with read-only switch, please let me know.