3

Ok so this is probably a basic question but I would like to expand my knowledge.

I have created an AWS Ubuntu EC2 server. I am running software on the server that provides 2 services , firstly a website that will be available to the Internet. Secondly a password protected user environment where suppliers can view things like invoices and create new users ect.

So what I am basically asking is where do I even start to secure this environment. What would be the best steps to secure the server. It runs Nginx, Python and php .

Any input would be highly appreciated, I have a basic understanding of security having studied security at honors in uni, but that was a while ago and theoretical knowledge is useless compared to practical knowledge which I lack.

|improve this question
2

Some starting points which are by no means an exhaustive list (I will edit the post as people comment; and credit them too):

  • Firewall - only allow access to ports that explicitly require it (in your case probably only SSH and HTTP/S). I've linked to UFW because it's easy.
  • Disable root login - furthermore consider limiting to a particular set of users - you will need to sudo (info here and here) and ensure that passwords are required (see man visudo)
  • SSH PubKey Authentication - instead of logging in with a password, the SSH server has a list of public keys that are authorised for access.
  • Make sure that you regularly upgrade software: sudo apt-get update; sudo apt-get upgrade;
  • My preference would be to install NGINX from source as the repositories lag the bug (including security) fixes.
  • Force HTTPS (a certificate is no more than $15 annually) with HSTS. Do not disable HTTP entirely, but rather create a regular HTTP server (i.e. port 80) block in NGINX and use return 301 https://yourdomain.tld;. Do not include either of the $uri or $request_path variables as these can be manipulated over HTTP.
|improve this answer
  • Fantastic, Tahnks. I have setup the firewall currently for SSH , HTTP and HTTPS because I am still setting up HTTPS (will disable HTTP once HTTPS is up and running). I will look at root login and SSH is already set up with AWS and I have the keys for myself. The SSH Auth will only be for direct login onto the OS correct? @arran-schlosberg – wwalford Apr 19 '15 at 9:40
  • You shouldn't disable HTTP entirely; just redirect all HTTP requests to HTTPS with NGINX's return 301 https://yourdomain.tld;. I will update the post to reflect this. I'm not exactly sure what you mean regarding direct login onto the OS. As against? – Arran Schlosberg Apr 19 '15 at 10:22
  • I have not used SSH for very much, when I created the EC2 instance on AWS it created the SSH keys and this is what I use with putty to access the Instance. How else would you use SSH? – wwalford Apr 19 '15 at 10:31
  • That is the primary use of SSH; to access a Secure SHell (you can think of a shell as a command line). I haven't used Putty very much, but from memory it requires keys in a particular format and you may have to modify the AWS-created ones. You should really be generating your own private key rather than having it produced by a 3rd party as this undermines the security of PubKeyAuthentication. – Arran Schlosberg Apr 19 '15 at 10:37
  • Thanks yes you have to convert the keys to work with putty , but putty gen cando this for you. Then I have to ask monitoring, how would you monitor the server to identify if someone has accessed when they shouldn't? I mean do you have to wait for the server to crash, or see that files have been changed? – wwalford Apr 19 '15 at 11:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.