Hardening a Home Server

Question

I am thinking about setting up a modest web server using some old hardware and Ubuntu 12.04 or Debian 6. I am aware that by exposing a machine on my LAN to the outside world I become vulnerable to security breaches and attacks. That being, and since I have almost no experience into securing computers using Linux, I would like to ask for some recommendations about what I should do to secure this web server, especially since there are other computers in my home LAN which contain sensitive information (about home-banking accounts and such). Thank you very much.

Answer 1

FIrst, you are probably aware of that but if you have dynamic IP, you'll need a dynamic DNS like DynDNS or DNSexit.

On the securing part, I think using iptables (or a firewall GUI like firestarter if you prefer) opening only port 80 for inbound connection is sufficient for a home server if you don't need to open ssh port (port 22) or ftp (21) and you will not install a mail server.

If your site have a login page or if you need to open ssh, ftp or smtp, I would recomment to at least install something like fail2ban to ban IP who try connections without success so they don't try forever.

One important thing to note is that you must have a look at your logs, to keep an eye on them easily install logwatch (should be in your default repositories on Debian & Ubuntu) to alert you by mail daily or weekly. You'll rapidly learn to find what's wrong by reading them frequently.

If you need to connect from outside to administer the server, use a VPN and anyways, keep the OS always updated!

Update: For SSH and sftp, I think fail2ban + only ssh keys (or keys + password but not only password) is the minimum you need (and do not allow root access).

If the machines you use to connect have fixed IP, open the firewall only for these incoming IP.

An encrypted VPN (I use openvpn) helps a lot to secure your access too.
Have a look here for the 'quick' official tutorial, in 15-30 minutes you'll have a working VPN server for one client - one server. For a better setup with client certificate authentication and a CA (your free own CA) you'll have to take a few more minutes :D

If your sites require MySQL or for any other reason you need to administer MySQL (or another database) from internet, if you don't use a VPN, use a ssh tunnel so you connect to a local port on your machine and the tunnel encrypts the connection to the server so you don't need to open the database port, have a look at the -L and -D arguments in man ssh.
I would not install phpmyadmin to listen on a public IP as that opens your database to the world. If you need I can put an example script for a tunnel here.