Hello everyone.

I'm planning on hosting several websites for some friends. I already setup my server and is up and running with virtual hosting. Now, I would like this server to be as secured as possible since there is going to be users login in and putting content into their folders. I know there are web injection and other threads around. What you recommend to do in order to prevent hacking and/or others?

Thanks in advanced for your help.

What webserver you are using? and what is your OS environment?

I'm using apache2 on Debian Lenny.

Hola!

You can use mod_security to help block web injections.

You will want to have a firewall and other stuff on there as well.

I already have a firewall in place only allowing connetions to ports 80 and 22.

What about mail ? You should open ports for email.

Open port 22 is not a good idea. Just change this port for something else (higher than 1024). Default port for ssh will be intensively molest by robots. Install and configure fail2ban.

Like Abefroman said install mod_security.

If Your application is with SQL background You can also install SQL Firewall.

From my side I suggest put this configuration to:

To /etc/apache2/apache2.conf



##################################################################
# Removing bad robots from the traffic #
##################################################################
SetEnvIfNoCase user-agent "^w00tw00t.at.ISC.SANS.DFind" bad_bot=1
SetEnvIfNoCase user-agent "^Baiduspider" bad_bot=1
SetEnvIfNoCase user-agent "^BlackWidow" bad_bot=1
SetEnvIfNoCase user-agent "^Bot\ mailto:craftbot@yahoo.com" bad_bot=1
SetEnvIfNoCase user-agent "^ChinaClaw" bad_bot=1
SetEnvIfNoCase user-agent "^Custo" bad_bot=1
SetEnvIfNoCase user-agent "^DISCo" bad_bot=1
SetEnvIfNoCase user-agent "^Download\ Demon" bad_bot=1
SetEnvIfNoCase user-agent "^eCatch" bad_bot=1
SetEnvIfNoCase user-agent "^EirGrabber" bad_bot=1
SetEnvIfNoCase user-agent "^EmailSiphon" bad_bot=1
SetEnvIfNoCase user-agent "^EmailWolf" bad_bot=1
SetEnvIfNoCase user-agent "^Express\ WebPictures" bad_bot=1
SetEnvIfNoCase user-agent "^ExtractorPro" bad_bot=1
SetEnvIfNoCase user-agent "^EyeNetIE" bad_bot=1
SetEnvIfNoCase user-agent "^FlashGet" bad_bot=1
SetEnvIfNoCase user-agent "^GetRight" bad_bot=1
SetEnvIfNoCase user-agent "^GetWeb!" bad_bot=1
SetEnvIfNoCase user-agent "^Go!Zilla" bad_bot=1
SetEnvIfNoCase user-agent "^Go-Ahead-Got-It" bad_bot=1
SetEnvIfNoCase user-agent "^GrabNet" bad_bot=1
SetEnvIfNoCase user-agent "^Grafula" bad_bot=1
SetEnvIfNoCase user-agent "^HMView" bad_bot=1
SetEnvIfNoCase user-agent .HTTrack. bad_bot=1
SetEnvIfNoCase user-agent "^Image\ Stripper" bad_bot=1
SetEnvIfNoCase user-agent "^Image\ Sucker" bad_bot=1
SetEnvIfNoCase user-agent "Indy\ Library" [NC,OR]
SetEnvIfNoCase user-agent "^InterGET" bad_bot=1
SetEnvIfNoCase user-agent "^Internet\ Ninja" bad_bot=1
SetEnvIfNoCase user-agent "^JetCar" bad_bot=1
SetEnvIfNoCase user-agent "^JOC\ Web\ Spider" bad_bot=1
SetEnvIfNoCase user-agent "^larbin" bad_bot=1
SetEnvIfNoCase user-agent "^LeechFTP" bad_bot=1
SetEnvIfNoCase user-agent "^Mass\ Downloader" bad_bot=1
SetEnvIfNoCase user-agent "^MIDown\ tool" bad_bot=1
SetEnvIfNoCase user-agent "^Mister\ PiX" bad_bot=1
SetEnvIfNoCase user-agent "^Navroad" bad_bot=1
SetEnvIfNoCase user-agent "^NearSite" bad_bot=1
SetEnvIfNoCase user-agent "^NetAnts" bad_bot=1
SetEnvIfNoCase user-agent "^NetSpider" bad_bot=1
SetEnvIfNoCase user-agent "^Net\ Vampire" bad_bot=1
SetEnvIfNoCase user-agent "^NetZIP" bad_bot=1
SetEnvIfNoCase user-agent "^Octopus" bad_bot=1
SetEnvIfNoCase user-agent "^Offline\ Explorer" bad_bot=1
SetEnvIfNoCase user-agent "^Offline\ Navigator" bad_bot=1
SetEnvIfNoCase user-agent "^PageGrabber" bad_bot=1
SetEnvIfNoCase user-agent "^Papa\ Foto" bad_bot=1
SetEnvIfNoCase user-agent "^pavuk" bad_bot=1
SetEnvIfNoCase user-agent "^pcBrowser" bad_bot=1
SetEnvIfNoCase user-agent "^RealDownload" bad_bot=1
SetEnvIfNoCase user-agent "^ReGet" bad_bot=1
SetEnvIfNoCase user-agent "^SiteSnagger" bad_bot=1
SetEnvIfNoCase user-agent "^SmartDownload" bad_bot=1
SetEnvIfNoCase user-agent "^SuperBot" bad_bot=1
SetEnvIfNoCase user-agent "^SuperHTTP" bad_bot=1
SetEnvIfNoCase user-agent "^Surfbot" bad_bot=1
SetEnvIfNoCase user-agent "^tAkeOut" bad_bot=1
SetEnvIfNoCase user-agent "^Teleport\ Pro" bad_bot=1
SetEnvIfNoCase user-agent "^VoidEYE" bad_bot=1
SetEnvIfNoCase user-agent "^Web\ Image\ Collector" bad_bot=1
SetEnvIfNoCase user-agent "^Web\ Sucker" bad_bot=1
SetEnvIfNoCase user-agent "^WebAuto" bad_bot=1
SetEnvIfNoCase user-agent "^WebCopier" bad_bot=1
SetEnvIfNoCase user-agent "^WebFetch" bad_bot=1
SetEnvIfNoCase user-agent "^WebGo\ IS" bad_bot=1
SetEnvIfNoCase user-agent "^WebLeacher" bad_bot=1
SetEnvIfNoCase user-agent "^WebReaper" bad_bot=1
SetEnvIfNoCase user-agent "^WebSauger" bad_bot=1
SetEnvIfNoCase user-agent "^Website\ eXtractor" bad_bot=1
SetEnvIfNoCase user-agent "^Website\ Quester" bad_bot=1
SetEnvIfNoCase user-agent "^WebStripper" bad_bot=1
SetEnvIfNoCase user-agent "^WebWhacker" bad_bot=1
SetEnvIfNoCase user-agent "^WebZIP" bad_bot=1
SetEnvIfNoCase user-agent "^Widow" bad_bot=1
SetEnvIfNoCase user-agent "^WWWOFFLE" bad_bot=1
SetEnvIfNoCase user-agent "^Xaldon\ WebSpider" bad_bot=1
SetEnvIfNoCase user-agent "^Zeus" bad_bot=1
SetEnvIfNoCase user-agent "^MRSPUTNIK" bad_bot=1
<FilesMatch "(.*)">
Order Allow,Deny
Allow from all
Deny from env=bad_bot
</FilesMatch>

Have fun.