[thelist] Privacy Questions

Hassan Schroeder hassan at webtuitive.com
Thu Jul 25 12:33:01 CDT 2002


Tamara Nelson wrote:

> Am I missing anything?  There's going to be some sensative content there
> that should not fall into the wrong hands... and I want to make sure that I
> cover all my bases.

Use SSL to minimize the chance of userid/password-sniffing.

Presumably this is a server that only the client is using, and only
for Web serving?

Do a security audit and shut down any unneeded services. Nmap is a
good tool to check for open ports. Use another system to re-scan on
a regular basis. Scan from inside the machine to see if anything is
only responding to 'localhost' requests; it's possible a Web server
exploit could allow that access to be hijacked. If you're not using
it, don't run it.

Make sure the only interactive access is via SSH -- and that only
from a restricted set of IP addresses. Depending on the audience,
you might even restrict HTTPS access by IP address.

If IP address restriction is possible, put a firewall in front of
the machine to screen on IP addresses (also, not instead of). Even
without IP restriction, a firewall (or properly configured router)
can block access to non-HTTPS or -SSH ports.

Make sure the two doors to the system -- SSH and HTTPS -- are being
served by daemons with all applicable security patches.

If you're running Apache, decide what modules you need and compile
from source to eliminate extraneous code; make sure your httpd.conf
file reflects exactly what you have and need.

I've never compiled PHP from source -- I don't use it much -- so
you'll have to decide if there are any potential security issues
or advantages there. If you didn't compile it, at least make sure
it's the latest binary from a reliable source.

Install tripwire, and a way to check status (pull) and for it to
report (push) to you; automate the pull side.

Install a second Ethernet card and write your syslogs to another
system 'behind' the first (with a firewall in between, of course).

That's a start; you could do more -- VPN, token cards, etc., etc. --
if your, or rather your client's, budget (and paranoia) allows ...

Oh, and make sure your client's system (that he's using to access
the system interactively for maintenance) is at least reasonably
immune to compromise itself.

Security is just a bottomless well ... :-)

HTH!
--
H*
Hassan Schroeder ----------------------------- hassan at webtuitive.com
Webtuitive Design ===  (+1) 408-938-0567   === http://webtuitive.com

    -- creating dynamic Web sites and applications since 1994 --



More information about the thelist mailing list