Hi.

I'm relatively new to Linux administration and I've been running a (dedicated) home server running Debian Etch consisting of SSH, LAMP, NFS and SAMBA for a while now. I've set up some simple security measures, such as setting up Apache to only listen to local requests and setting SAMBA passwords/accounts.

This is set behind a router with a built-in firewall which I am not forwarding any ports through (I don't need outside access to this server, at least for the foreseeable future). Is this sufficient security, or should I consider setting up iptables and/or taking other security measures?

Thanks for any suggestions!

If your router isn't forwarding any ports through, then it really boils down to how much you trust other computers on the internal network. Obviously, if you're using a wireless router with no encryption passphrase, the answer to that should be "Not very much!"

But if your internal network consists only of your own personal computers, then you really don't need any further security measures. Obviously, this assumes your other computers are kept secure.

Personally, I would still try to make the server as secure as your time is worth. A virus or something could get onto another computer on your network and then compromise your server. Also, there are still ways to get to your computer through the router without forwarding any ports. Things like PPPOE and stuff. Bittorrent still works through routers.

I've spent a lot of time thinking about that problem and for my situation I just can't see any real solution other than "make darn sure no virus or something ever gets on any of my computers".

In my situation, the basic problem is that my file server is essentially a single user file server. I don't have a bunch of different users, it's really just me. For my file server to do any job at all, my personal account needs to have access to the main file share. This seems to be more or less an "all or nothing" thing. Either my workstation has no access at all, or it has access to everything I care about.

Sure, if a virus "only" infects my user account, the "only" thing it can do is trash all of my user account's data. Yippee! That means I still have...what? The OS? The OS that I can reinstall in about fifteen minutes?

So far, the only security solution I've come up with is a total comprehensive solution.