Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 0 down vote favorite
1

I just finished installing Ubuntu Server 12.10 on an Asus Eee PC 1000H (to be used as a home server/sandbox) from USB. I installed this software during installation:

  1. OpenSSH server
  2. LAMP server
  3. Samba file server
  4. Virtual Machine host

I won't use 2, 3 or 4 for a while though. Can/should I turn these off somehow?

  • I have turned home directory encryption on.
  • Security updates are installed automatically.
  • I have chosen a strong password for the single user.

I have never plugged in the internet cable so far. Before doing so I'd like to ask:

What can/should I do/install to increase security before connecting to the internet?

Firewall? Fail2ban? Users/Passwords? Encryption? Enable/Disable functionality? etc.

I'm sorry if you get this question a lot. I've searched around quite a while, but it still feels like I might overlook something important.

share|improve this question

migrated from serverfault.com Nov 27 '12 at 13:40

5 Answers

up vote 2 down vote accepted

If you are connecting this server to a router that multiple devices connect to in order to access the internet, your network is likely behind a NAT firewall already, so unless you specifically configure your router to allow it, no one, including you, can contact your server from the outside anyway.

If you're plugging straight into the internet, totally different story. I'd recommend the following:

  1. Learn either iptables or ufw, both of which are firewall config tools that come with Ubuntu. If you're doing anything with any kind of Linux server, these are practically a must anyway. They both let you be very specific about how your server can be accessed, and from where. Usually the firewall has everything open by default, and you will want to configure your server firewall to have everything CLOSED by default and only open what you need.

https://help.ubuntu.com/community/UFW

http://www.netfilter.org/projects/iptables/index.html

  1. Make sure to know all the port numbers for ALL the servers you'll have running. Based on what you list, SSH is port 22 by default, so definitely close that, and fail2ban is a recommended tool as well. Might want to change the default port for SSH from 22 to something else, which can be done in the SSH config file. With a LAMP stack, you have 80 and possibly 443 to watch, and MySQL runs on 3306 but usually MySQL only listens on localhost by default. Samba listens on 137-139 and 445.
share|improve this answer
Weird, my points are 1 and 2 when I edit, but they show up as 1 and 1. – trpt4him Nov 28 '12 at 0:24
up vote 0 down vote

I don't think anyone has pointed out how to "turn off" unwanted services/software...

  1. LAMP server

    service apache2 stop [start/restart]

  2. Samba file server

    service smbd stop [start/restart]

  3. Virtual Machine host: Um... don't run it!

share|improve this answer
up vote 0 down vote

Perhaps the most significant part of any computers (online) security is the firewall. If you are really paranoid (not unreasonable in some situations), disable all traffic and open only the needed ports.

Start here

share|improve this answer
Well, the most significant part of security is installing updates and securely configuring your services. If you only have services listening which are meant to be exposed then a firewall doesn't add much additional security. – Holger Just Nov 27 '12 at 15:03
1  
If a host is compromised through a service (non super user) the attacker would be severely limited by a strict firewall because they would be unable to get any information out. If there is no firewall, on the other hand, the compromised service could be used to start listening arbitrary sockets or even sending spam to arbitrary locations. I doubt we will find "the most" significant part of a security system through a discussion here because they consist of many important parts. This is also why I said "Perhaps the most significant". I firmly believe that a solid firewall goes a long way. – Ярослав Рахматуллин Nov 27 '12 at 15:18
1  
If your host is compromised, you lost. And the attacker can push stuff through the same channel he compromised your box in the first place. – Holger Just Nov 27 '12 at 15:22
up vote 0 down vote

Just plug in the internet... Besides, you can't even get security software without the internet. How will you download them?

share|improve this answer
1  
Download them onto a secure computer, transfer to USB, install on unsecure computer while it is still offline. If you're really paranoid you can scan the files on the USB and hash chcek everything. – Joe Taylor Nov 27 '12 at 15:00
up vote 1 down vote

To answer your first question: as a rule of thumb - never expose more than you need. If you don't use a particular service then there really is no point in having them on.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.