I would like to improve the security of my web server...
Linux - SecurityThis forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
I would like to improve the security of my web server...
I am running Slackware 13.0. Today I found several entries in my access_log of IPs from china trying to exploit my web server. How can I prevent all this? I figure I have three options.
1. This web server is for personal/friend use. How could I limit access to my web server to a few select ISPs? How would I do that? Maybe edit the /etc/hosts.allow and just put in a wildcard figure for an ISPs IP address like i.e. 68.203.185.* or something like that. That way all http requests coming in from that ISP are allowed to view my website.
2. I could find out all the Chinese ISPs IP ranges and add those to the /etc/hosts.deny list. However, it seems like that would take forever.
3. Setup a filter on fail2ban that would detect the use of malicious code by find if html codes like 501 or 400 are detected in the entries of the access_log.
Seems like the 3rd option would be the most efficient, that way it would prevent attackers from other places other than china. However, for now, I'd like to quickly implement something so how would I go about doing option 1?
You could use something like fail2ban to block IPs that have run automated attacks on your server if you really want, but there isn't much point. Those are bots that simply scan the Internet and run known exploits against anything with port 80 open. That doesn't mean your server is actually vulnerable to those attacks however. In fact, most of the bots don't even check what server is running, a lot of times they will try to run IIS attacks on Apache.
Blocking these attempts won't increase your security at all, they will just keep them out of your log files. If you are worried about maintaining security, make sure your server is up to date and properly configured.
Notice the 218.62.13.218 IP, that's the Chinese one with an established connection to an httpd instance. That just means that the IP was viewing my website?
After seeing that Chinese IP in lsof -i, I killed my httpd instances, which was around 13:46.
My question is that when you see an IP with an established connection with httpd does that just mean that he is viewing my website? I have a user password protected database attached to my website via php, but I found no evidence that he accessed it.
Notice the 218.62.13.218 IP, that's the Chinese one with an established connection to an httpd instance. That just means that the IP was viewing my website?
See that 501? That is Apachese for "Method not found". That said, they are probably trying to do something nasty to your server, maybe cause a buffer overflow. In general, if you run a generally accessible web server, you're going to see this kind of stuff. Everyone does. So you need to make sure that you've got your machine fully patched and up to date.
You could install mod_security on your server. It requires a bit of tinkering to customize, but it does stop a lot of nonsense regardless of where it comes from. I'd also seriously suggest adding Aide or Samhain to the mix to monitor your file system.
This will allow people coming from local addresses, ip 55.55.55.55 and the range of ips starting with 33.33.33 to see your website. I don't think it blocks the actual port from anything, but it blocks access to your website (and any forms that might be there).
Code:
<Directory "/var/www/htdocs/yourwebstuffdirectory">
..... //other configuration you have
Order deny,allow
Deny from all
// Whatever local addresses you want
Allow from 10.0.0 127.0.0 192.168
// Whatever friends addresses you have
// You can also do a range
Allow from 55.55.55.55 33.33.33
</Directory>
I activated fail2ban on ssh and it works great. Also, how would I update my apache server? Svn? Or do I just stop the process, download the newer source, and just install on top of the current installation?
Also, how would I update my apache server? Svn? Or do I just stop the process, download the newer source, and just install on top of the current installation?
The easiest way it to just follow what is in the Slackware repository. Slackware will issue any updates needed for security reasons, so there is no need to follow the Apache development team. The slackpkg tool is fantastic for this as it will upgrade the packages for you. Pretty much all you would need to do is to restart Apache once the update is done.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
