Hello,

I'd like to have some advice on web server security issues. I am running a LAMP system on my linux box with port 80 for incoming traffic.

What are the risks?
What precautions should I take ?

Thank you in advance for your help !

Paraiso

There are so many things to be on top of if you're doing this seriously - I don't like just posting links, but the volume of information really is huge...

Get your box port scanned from somewhere on the internet - make sure that the open ports are the ones you expect. Sites like http://www.hackerwatch.org/probe/, http://scan.sygatetech.com/, and even http://www.grc.com/default.htm can do this. Then check each of the services running for known vulnerabilities, http://www.google.com/ is your friend

Update your kernel and LAMP components to get the latest security patches via yum or http://fedora.redhat.com/download/updates.html. Then start locking down the components.

Linux - get your firewall configured - have a look at http://www.netfilter.org/documentation/index.html;
Apache - go through the steps at http://httpd.apache.org/docs/2.0/mis...rity_tips.html;
MySQL - have a look at http://dev.mysql.com/doc/ and http://www.bugzilla.org/docs/2.22/ht...ity-mysql.html; and
PHP - start at http://www.php.net/.

There's other stuff as well - read your log files (maybe look at logwatch), checkout intrusion detection software (snort, tripwire, chkrootkit, rkhunter, etc.) - the list goes on...

Oh, and keep posting here

Thanks gilead for the links! That's a lot but like usually with computer security that's the way to go. So as I understood it, there is no shortcuts for securing my web server?

Well, if you're happy with your firewall setup - go to the Apache site first and make sure your web server is OK, then try the PHP stuff. I have to admit I haven't thought through the ordering of stuff, I usually have the luxury of setting up the box before connecting it to the network.

NMAP is also a really good program to use from a management machine to port scan your systems. Only allow what services you want to run. Example - The systems I protect only have three ports active: Port 22, 80, and 113 (Closed). I have set it setup so when our web-master wants to upload new information he establishes an encrypted SSH connection. WINSCP is a good program for this also. Never forget to look into IPtables. Again like others have suggested and pointed out. Keep reading and updated... there will always be never ways to exploit systems.