Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.
Sign up to join this community
I use an old Mac mini with latest Ubuntu server to have a "home Gmail": with minimal time spent on configuration I have my webserver with wiki, mail server etc. (and no Google Ads)
All ports not used are closed but I am not more protected than that. I routinely check security with sudo rkhunter -c or using clamav.
Is it relevant? Enough to avoid being rootkitted? Is there a minimal list of stuff to check?
If security is a real concern to you, I recommend you spend at lot more time on configuration and less time on running rkhunter and clamav. Your server can be compromised in hundreds of ways without ever involving a rootkit or a virus.
Rootkit functionality is still pretty rare. Criminals these days want to place their content on your webserver so they can use it to serve exploits, influence page rankings and run zombies. They don't need to develop a rootkit to do that.
Do netstat -an | grep LISTEN. Each of those listening ports is a potential way in and some may have millions of lines of code running. Your biggest concern is probably the webserver, all the modules it has loaded and the custom code you've installed on top.. like that wiki or your webmail interface.
If at all possible, restrict which IP addresses can make connections to your services. Cases where that's not possible, use authentication to prevent bad guys from attempting to access, say. your webmail.
There's many more options for you, but we'll need a complete description of your setup to make any specific recommendations.
Just know that rkhunter and clamav doesn't do anything to improve the security of your server. One might argue that it's just more code with potential security bugs.
If you are running 8.04 or later, you may also wish to install the "unattended-upgrades" package. It automatically downloads and installs security updates for your version of Ubuntu.
ubuntu has also the harden* packages.
and here is a comprehensive guide how to secure your ubuntu installation.
I would also recommend installing the apticron package. It will email you when there are pending updates for your system. It's in the Ubuntu Universe Repository so a simple sudo apt-get install apticron should install it.
