up vote 0 down vote favorite
share [g+] share [fb]

I am setting up an Ubuntu 10.04 LTS linux server which I would like to configure as a minimal FTP/WWW server. I will not store any critical information on this server, but I would still want to make sure it is not a very easy target.

What are the most basic/fundamental security measures I shall take? I am considering the following services:

  • Apache WWW Server (I guess still the defacto standard)
  • FTP Server (not sure which one yet)
  • ssh
  • Firewall (only allowing www, ftp and ssh)

Thanks in advance! Paul

link|improve this question
feedback

closed as not constructive by DragonLord, studiohack♦ Nov 22 '11 at 0:46

This question is not a good fit to our Q&A format. We expect answers to generally involve facts, references, or specific expertise; this question will likely solicit opinion, debate, arguments, polling, or extended discussion. See the FAQ for guidance on how to improve it.

1 Answer

up vote 0 down vote

General

  • Change your SSH port
  • Disallow direct root logins (su user)
  • A bruteforce detection/block daemon such as BFD

FTP

  • If you create FTP users using /etc/passwd set their shell to /bin/false
  • Require SSL connections (FTPES) on the auth and data channels
  • Disable anonymous FTP
  • Do NOT allow FTP logins with root

Apache

  • Disable directory indexes
  • Set FileETag None
  • Set TraceEnable Off
  • Set ServerSignature Off
  • Set ServerTokens Prod
  • Compile/install only the Apache modules you need

There are many other recommendations if you plan to use other modules such as PHP, but these will get you started.

link|improve this answer
feedback

Not the answer you're looking for? Browse other questions tagged or ask your own question.