3

I run a private virtual server on Ubuntu 14.04 and I use Nginx as my http server and/or reverse proxy. I run multiple webapps on this server, most of them are fresh open source projects.

UPDATE : The server is a VPS that I rent to a hosting company. Setup will be a subdomain per app.

I am wondering what are the various possibilities of securing nginx in a simple environment. As for now this server is only used for dev/private use I would like to achieve the followings :

  • Use an authenficiation for apps that don't have their own. Otherwise anyone can use it.
  • Restrict access to certain machines. I know Nginx can deny access based on IP adress, I was wondering if I could achieve this using other variables such as mac adress for example?

  • Prevent search engines to index what is on my server. I have read that I could use an Apache .htaccess but can I do it with nginx ? What is the difference with robots.txt files ?

  • How would one isolate webapps ? I was wondering if I could run each apps as separate users in order to harden security. Otherwise (someone tell me if I'm wrong) a security breach in one of them (and that may happen often with young projects) could allow an attacker to have access to all www-data user files. Regarding this thread I don't know if I must investigate in php5-fpm pools or only nginx or both.

Thanks !

UPDATE

Interesting readings about Docker and Sandstorm

I usually set folders to 755 and files to 644. (Some apps recommend 777 on entire folders :0) For a server I prefer to stay on ubuntu for now (easier) despite I had a really great time discovering Arch few months ago. However I've seen this. I should be able to set SE linux.

I always use https. Nginx is only listening on ssl port. The "problem" is I use a self-signed certificate (maybe not for long) and I don't know a lot about cyphers so I'll investigate ssl first before I ask some questions. I've just learned this morning that I could use TLS in nginx config ^^

I don't really understand what hash is. Neither where to use it (I mean in the "server/nginx" config). I still don't understand where to use hash except for ssl config. --> I could use hash as passwords ?

I currently use Mitro. But useless on Android (Clipboard hijacking)

I also do use some basic options of rkhunter and fail2ban.

closed as too broad by Jens Erat, Mark, RoraΖ, schroeder, TildalWave Feb 18 '15 at 1:26

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

1
* Use an authenficiation for apps that don't have their own. Otherwise anyone can use it.

You can use HTTP basic auth for that. It's basic, like the name says. https://www.digitalocean.com/community/tutorials/how-to-set-up-http-authentication-with-nginx-on-ubuntu-12-10

* Restrict access to certain machines. I know Nginx can deny access based on IP adress, I was wondering if I could achieve this using other variables such as mac adress for example?

I actually wouldn't recommend that. Mac addresses can be spoofed. I.P auth plus a password should be plenty. IP addresses can be spoofed too, but it's a little more problematic to pull off in this context.

https://superuser.com/questions/19383/why-is-mac-based-authentication-insecure

* Prevent search engines to index what is on my server. I have read that I could use an Apache .htaccess but can I do it with nginx ? What is the difference with robots.txt files ?

Use Robots.txt to tell the search engine what you want it to stay away from. Use htaccess/basic auth to make sure. The search engine can't read anything it doesn't have a password to, although it might see that there is a page there (a forbidden is sort of proof of the existence of a page in a way.)

http://en.wikipedia.org/wiki/Robots_exclusion_standard

* How would one isolate webapps ? I was wondering if I could run each apps as separate users in order to harden security. Otherwise (someone tell me if I'm wrong) a security breach in one of them (and that may happen often with young projects) could allow an attacker to have access to all www-data user files. Regarding this thread I don't know if I must investigate in php5-fpm pools or only nginx or both.

You can run the app in a safe container of some sort, like docker offers. I believe SystemD also has a native container as well. This way there is one more "sandbox" to break out of before you're in deep, deep trouble. Keep in mind that if there is a binary exploit on your server, the attacker will often up as apache or Nginx user wise, and have access to what those servers have access to. The way a lot of hosting providers do things, is that they run each site in a virtual machine of it's own. If your box has the horsepower for this, it may be a nice solution.

You do want to make sure the permissions on all of your folders are set correctly. If you use centOS or RedHat Linux it's also possible to add another layer of fine grain permissions on to web related folders to further lock them down (investigate SE linux.) Since you are on Ubuntu, that's not an option, but if you ever change you should check it out. Likewise, freeBSD has a concept of "Jails" that limits an apps access to the whole system. You may find this interesting too.

Some extra things you didn't ask about but I'll tell you

  • Make sure and hide version numbers wherever you can
  • Use HTTPS on everything
  • Encrypt everything you can, whenever you can.
  • Use the strongest ciphers you can all of the time
  • Use the strongest hashes you can.
  • Use very large passwords. Use a password manager that generates secure passwords for you. (Keepass is nice.)
  • If it is life and death that no one access this thing, don't put it on the internet. If people want it bad it enough, they will find a way.
  • Don't be afraid to use a hosting solution, where some of the security responsibility (IDS and such) fall on the hosting provider. No guarantee they will do it well, but if you are a new web developer, it will be very difficult to worry about all of that while you learn to program.
  • Thanks so much for your complete answer ! For auth I have heard about LDAP, isn't that better ? The question for mac adress was stupid as I have already "spoofed" a mac adress when teachers used to cut my internet access at school. Indeed, so easy.. Glad you extend with extra things I was thinking about, but I thought it would be too much here. I am going to uplaod the question regarding those points. – Lich4r Feb 18 '15 at 0:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.