3

Ok so this is probably a basic question but I would like to expand my knowledge.

I have created an AWS Ubuntu EC2 server. I am running software on the server that provides 2 services , firstly a website that will be available to the Internet. Secondly a password protected user environment where suppliers can view things like invoices and create new users ect.

So what I am basically asking is where do I even start to secure this environment. What would be the best steps to secure the server. It runs Nginx, Python and php .

Any input would be highly appreciated, I have a basic understanding of security having studied security at honors in uni, but that was a while ago and theoretical knowledge is useless compared to practical knowledge which I lack.

|improve this question

closed as too broad by Jens Erat, Mark, Xander, Bob Brown, schroeder♦ Apr 19 '15 at 15:46

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

2

Some starting points which are by no means an exhaustive list (I will edit the post as people comment; and credit them too):

  • Firewall - only allow access to ports that explicitly require it (in your case probably only SSH and HTTP/S). I've linked to UFW because it's easy.
  • Disable root login - furthermore consider limiting to a particular set of users - you will need to sudo (info here and here) and ensure that passwords are required (see man visudo)
  • SSH PubKey Authentication - instead of logging in with a password, the SSH server has a list of public keys that are authorised for access.
  • Make sure that you regularly upgrade software: sudo apt-get update; sudo apt-get upgrade;
  • My preference would be to install NGINX from source as the repositories lag the bug (including security) fixes.
  • Force HTTPS (a certificate is no more than $15 annually) with HSTS. Do not disable HTTP entirely, but rather create a regular HTTP server (i.e. port 80) block in NGINX and use return 301 https://yourdomain.tld;. Do not include either of the $uri or $request_path variables as these can be manipulated over HTTP.
|improve this answer
  • Fantastic, Tahnks. I have setup the firewall currently for SSH , HTTP and HTTPS because I am still setting up HTTPS (will disable HTTP once HTTPS is up and running). I will look at root login and SSH is already set up with AWS and I have the keys for myself. The SSH Auth will only be for direct login onto the OS correct? @arran-schlosberg – wwalford Apr 19 '15 at 9:40
  • You shouldn't disable HTTP entirely; just redirect all HTTP requests to HTTPS with NGINX's return 301 https://yourdomain.tld;. I will update the post to reflect this. I'm not exactly sure what you mean regarding direct login onto the OS. As against? – Arran Schlosberg Apr 19 '15 at 10:22
  • I have not used SSH for very much, when I created the EC2 instance on AWS it created the SSH keys and this is what I use with putty to access the Instance. How else would you use SSH? – wwalford Apr 19 '15 at 10:31
  • That is the primary use of SSH; to access a Secure SHell (you can think of a shell as a command line). I haven't used Putty very much, but from memory it requires keys in a particular format and you may have to modify the AWS-created ones. You should really be generating your own private key rather than having it produced by a 3rd party as this undermines the security of PubKeyAuthentication. – Arran Schlosberg Apr 19 '15 at 10:37
  • Thanks yes you have to convert the keys to work with putty , but putty gen cando this for you. Then I have to ask monitoring, how would you monitor the server to identify if someone has accessed when they shouldn't? I mean do you have to wait for the server to crash, or see that files have been changed? – wwalford Apr 19 '15 at 11:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.