3

I want to run a web server at home (really for the fun and learning of web/network and other security best practices), running a web app that I plan to write with Ruby on Rails and be able to access it from outside. I plan to run it on a Linux VM + Apache web (want to install from scratch, again for the fun of it) server running in virtual box/VMWare on my Mac.

I understand I need to forward ports (plan to forward 80 to 8080 or some other unprivileged port, no other port opened from my router), potentially get dynamic DNS etc to be able to access it reliably etc, and am not worried about getting it connected to the outside world.

I have read articles and resources on hardening the Apache webserver. I plan to try and follow best security practices to mitigate common threats (XSS, CSRF, SQL injection etc) for the webapp itself (using Ruby on Rails security guide which I think is a pretty good starting point).

  1. Since I'm running it on a VM, is there a way for somebody to hack/hijack the webserver/web app to control my host machine (I don't care if they control the VM since this whole thing is for learning)?

  2. What extra precautions do I need to take to protect my host machine? Or is it simply better to get a separate system just to run the webserver?

  3. Also what extra protection can I add in my VM to prevent it from getting hacked in the first place (firewalls, intrusion detection like snort?)

  4. If the VM or dedicated webserver machine is taken over, how does it affect my local/LAN network security? How can I mitigate the threat?

  5. Is it safer to create a VM, create a web server accessible only through a VPN inside the VM, where the VPN server is sitting inside the VM, and create VPN logins through which the web server can be accessed? Similar or exactly the same as how you have a corporate intranet? I assume I will run OpenVPN as a unprivileged user and not sure if I can make it listen on unprivileged ports.

I have read the authentication wiki and other related posts on Stack Exchange such as vulnerability of other systems if one system is compromised on the network etc, but still felt the need to ask the question.

Improve this question

1 Answer 1

Reset to default
1

You dont have much to worry about regarding having your VM hijacked to attack the host of all the possible attacks thats really near the bottom of the list. Your outline above is pretty solid and would deter the majority of attackers (barring bots who will just hammer your system).

If you want to throw an ips on there, check out snort (its fantastic).

In the event your VM is taken over and DOES start attacking your host system all you'll need to do is wipe it and start fresh, of course you should have your code in a revisioning system so you dont lose it all (i like github, but bitbucket offers free private code hosting). As for it being able to attack the rest of the things on your network, it depends on how youre networking on the host OS is configured, you can have it bridged, or have it behind a private NAT; I vote for the NAT'd method as long as you can get your ports forwarded.

I think that covers your questions, let me know if you need any clarification.

Improve this answer
2
  • Private NAT it is. Would it help to whitelist outgoing ports in the private NAT ? ie block out all ports except the ports that the webserver uses(8080 or 80 in this case?)
    – Raghu
    Apr 8, 2015 at 18:06
  • you can and if youre worried about that vm getting compromised its a good idea.
    – Ajaxasaur
    Apr 13, 2015 at 18:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .