Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I use an old Mac mini with latest Ubuntu server to have a "home Gmail": with minimal time spent on configuration I have my webserver with wiki, mail server etc. (and no Google Ads)

All ports not used are closed but I am not more protected than that. I routinely check security with sudo rkhunter -c or using clamav.

Is it relevant? Enough to avoid being rootkitted? Is there a minimal list of stuff to check?

share|improve this question

migrated from serverfault.com Feb 6 '10 at 19:26

This question came from our site for professional system and network administrators.

add comment

4 Answers

If security is a real concern to you, I recommend you spend at lot more time on configuration and less time on running rkhunter and clamav. Your server can be compromised in hundreds of ways without ever involving a rootkit or a virus.

Rootkit functionality is still pretty rare. Criminals these days want to place their content on your webserver so they can use it to serve exploits, influence page rankings and run zombies. They don't need to develop a rootkit to do that.

Do netstat -an | grep LISTEN. Each of those listening ports is a potential way in and some may have millions of lines of code running. Your biggest concern is probably the webserver, all the modules it has loaded and the custom code you've installed on top.. like that wiki or your webmail interface.

If at all possible, restrict which IP addresses can make connections to your services. Cases where that's not possible, use authentication to prevent bad guys from attempting to access, say. your webmail.

There's many more options for you, but we'll need a complete description of your setup to make any specific recommendations.

Just know that rkhunter and clamav doesn't do anything to improve the security of your server. One might argue that it's just more code with potential security bugs.

share|improve this answer
    
This deserves a million upvotes :) –  shylent Feb 6 '10 at 19:17
add comment

If you are running 8.04 or later, you may also wish to install the "unattended-upgrades" package. It automatically downloads and installs security updates for your version of Ubuntu.

share|improve this answer
add comment

ubuntu has also the harden* packages.

and here is a comprehensive guide how to secure your ubuntu installation.

share|improve this answer
add comment

I would also recommend installing the apticron package. It will email you when there are pending updates for your system. It's in the Ubuntu Universe Repository so a simple sudo apt-get install apticron should install it.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.