Hey, I have to rebuild a web server that will act as a web server, DNS server, email server, ftp server, samba server and possibly some other web related servers. I would like to use CentOS but what security measuers should I install/run to prevent hacking. I had one running fedora core 2 and it got hacked and bad. I need to prevent this. I will be running two NIC cards for an interna and external IP. The external will be a 66.224.xx.xx and serve websites on the same. The internal will be a 10.10.10.x network. A breif walkthrough and hints/ideas are helpful. I recall in the past that I had difficulty with the internal network getting out to the internet. I would also like to be able to VPN into it from home.

Thank you in advance!!

A good link for firewalls for this situation is

http://iptables-tutorial.frozentux.net/

I have to rebuild a web server that will act as a web server, DNS server, email server, ftp server, samba server and possibly some other web related servers.
With all due respect but this sounds like a typical "all eggs in one basket" solution. Services have different requirements and impact wrt users, risk and performance. So first thing IMHO would be to give a thought or two to the design of it all. One way could be to make a list of information that must be secure and services that must be accessable only to LAN (that is, if you can trust your users) users and put those services on a separate box. Split off publicly accessable services that present a risk (or will likely be abused) like FTP, HTTP and any PHP-based apps and confine them to a separate box. Another way, if you have only one box to work on and it isn't underspecced, could be to look into virtualisation (I know, it's a buzzword) as a means of separating services. Whatever way you choose, please make a choice based on objective, measurable criteria. If you're using CentOS-4 I would definately get a grip on SELinux. It may seem a bit of a burden but if you look back at the latest 2.6 kernel /proc exploit you see SELinux did stop that. Also have a look at the LQ FAQ: Security references, next to the section on system hardening there's (a budding one) on hardening services.

I will give the IP tables a good look over. I can't quite get my brain around it though. Seems I fix one problem with it and create another problem.

The two machine method is fabulous! I never even gave that a thought! I have several free IP's available so I can put one for a firewall and another for the server.

Thank you for your help

Two machines? With all those services I would be trying to get my hands on more than two.