I run a private virtual server on Ubuntu 14.04 and I use Nginx as my http server and/or reverse proxy. I run multiple webapps on this server, most of them are fresh open source projects.
UPDATE : The server is a VPS that I rent to a hosting company. Setup will be a subdomain per app.
I am wondering what are the various possibilities of securing nginx in a simple environment. As for now this server is only used for dev/private use I would like to achieve the followings :
- Use an authenficiation for apps that don't have their own. Otherwise anyone can use it.
Restrict access to certain machines. I know Nginx can deny access based on IP adress, I was wondering if I could achieve this using other variables such as mac adress for example?
Prevent search engines to index what is on my server. I have read that I could use an Apache .htaccess but can I do it with nginx ? What is the difference with robots.txt files ?
- How would one isolate webapps ? I was wondering if I could run each apps as separate users in order to harden security. Otherwise (someone tell me if I'm wrong) a security breach in one of them (and that may happen often with young projects) could allow an attacker to have access to all www-data user files. Regarding this thread I don't know if I must investigate in php5-fpm pools or only nginx or both.
Interesting readings about Docker and Sandstorm
I usually set folders to 755 and files to 644. (Some apps recommend 777 on entire folders :0) For a server I prefer to stay on ubuntu for now (easier) despite I had a really great time discovering Arch few months ago. However I've seen this. I should be able to set SE linux.
I always use https. Nginx is only listening on ssl port. The "problem" is I use a self-signed certificate (maybe not for long) and I don't know a lot about cyphers so I'll investigate ssl first before I ask some questions. I've just learned this morning that I could use TLS in nginx config ^^
I don't really understand what hash is. Neither where to use it (I mean in the "server/nginx" config). I still don't understand where to use hash except for ssl config. --> I could use hash as passwords ?
I currently use Mitro. But useless on Android (Clipboard hijacking)
I also do use some basic options of rkhunter and fail2ban.