Almost there (LEMP server)
I have some questions left:
SSH:
I use ssh with keys, no root login. Will add an AllowUsers entry. Is there anything else I can do or is there anything to gain by choosing a different port? If yes, how to choose a free port?
ISPConfig:
Is this worth the time and trouble for a server with a couple of sites? I think it is overkill.
Nginx:
Think my knowledge of Nginx is good enough. PHPMyAdmin, Munin, and stats are in password protected directories and the passwords are very strong. I guess this is safe enough.
How to limit the number of requests per IP in case of a DOS?
For a wordpress site I have enabled both http and https (with a self created certificate). The idea was that visitors access the site via http, but that I can login via https, but sooner rather then later it switches back to http by itself. From the server block in the config file:
listen 80;
listen 443 default_server ssl;
ssl_certificate /etc/nginx/server.crt;
ssl_certificate_key /etc/nginx/server.key;
Security
I use Fail2Ban and LogWatch
iptables looks difficult. As far as I can guess I only need ports 22, 80 and 443 for incoming. The output of iptables -L is:
Chain INPUT (policy ACCEPT)
target prot opt source destination
fail2ban-ssh tcp -- anywhere anywhere multiport dports ssh
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain fail2ban-ssh (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Output of nmap (from desktop to server):
Starting Nmap 5.21 ( http://nmap.org ) at 2011-11-11 10:22 CET
Nmap scan report for www.example.com (66.66.66.66)
Host is up (0.037s latency).
Not shown: 996 closed ports
PORT STATE SERVICE
22/tcp open ssh
25/tcp filtered smtp
80/tcp open http
443/tcp open https
Nmap done: 1 IP address (1 host up) scanned in 7.07 seconds
I think this looks good. It is more the output of netstat that has me worried (part of active internet connections):
udp 0 0 server1.myserver:33367 ntp1.exa-networks.c:ntp ESTABLISHED
udp 0 0 server1.myserver:40586 ntp3.0x00.lv:ntp ESTABLISHED
udp 0 0 server1.myserver:56097 www.clipsure.com:ntp ESTABLISHED
udp 0 0 server1.myserver:42466 ns1.blazing.de:ntp ESTABLISHED
Why are there connections to those sites? I understand that ntp stands for network time protocol, but clipsure is an adtracker. All I have are a couple of dummy wordpress installations on my server.
Postfix:
I only use postfix for LogWatch and sending message in case someone comments on one of the blogs. So only outgoing. Is there a way to block incoming mail connections. Occasionally I get messages like the following in LogWatch:
****** Detail (1) ******************************************************************************** **
1 Connections lost (inbound) --------------------------------------------------------------
1 After CONNECT
144 Delivered -------------------------------------------------------------------------------
144 myserver.example.com
3 Sent via SMTP ---------------------------------------------------------------------------
3 mysite.net
1 Hostname verification errors ------------------------------------------------------------
1 Address not listed for hostname
1 178.79.187.64 nbi.guv.ph
=== Delivery Delays Percentiles ============================================================
0% 25% 50% 75% 90% 95% 98% 100%
The myserver.example.com and mysite.net are mine, but nbi.guv.ph has no business on my server.
Still lots to learn, but I would like to start self-hosting this month. I have resources to further study Nginx, Bash, … but can you recommend books/sites for iptables and security (keeping hackers out and what to do if they got in, and how to detect that).
Thanx,
pannix
5 Replies
> Nginx:
How to limit the number of requests per IP in case of a DOS?
Does this look like a good anti-DDOS configuration?
You didn't mention ufw, the Ubuntu firewall, though your nmap looks good (except for postfix). Do a "ufw status" and you might need to turn it on with "ufw on". ufw can serve as a simple front end to iptables. For example, you can change your ssh from allow to limit and it'll limit the number of requests per minute through iptables, as in "ufw limit 21212/tcp" for your new random ssh port of 21212.
For the web admin stuff like phpmyadmin, I like using an alternate port as well. Create a new nginx server block with your domain but with a random listen port, for example 31313. Make it stop complaining about SSL on non-443 with a little nginx trick:
error_page 497 =301 https://mydomain.com:31313$request_uri?;
Give it password authentication. Get your domain a real SSL certificate for free from startssl.com if you like. This way it can have its own root directory, its own php setup, and it will keep it from mingling with your actual sites. It will use your regular domain certificate, no need for a subdomain cert or subdomain dns record.
nginx has two limiters. One is requests per second per IP and one is connections per IP.
Change your Postfix config so that it's only listening on the loopback address 127.0.0.1 and not on your public IP.
Do a "netstat -plntu" to see all your listening ports. Things open to the world can be listed on your public IP. Things that are internal should be listed on the loopback IP, e.g. mysql on 127.0.0.1:3306, postfix(master) on 127.0.0.1:25. Generally I avoid things binding on all ports, i.e. 0.0.0.0.
Personally I wouldn't worry about an ad company running an ntp server. /etc/openntpd/ntpd.conf will list pool.ntp.org and admins just trust them.
I've also run into problems involving stateful firewalls with short timeouts… some "know" that sessions involving port 22 will be long-lasting, idle for long periods, and otherwise well-behaved, but will timeout ssh connections on arbitrary ports much too quickly. There are workarounds, of course, but you start wondering why you're going to so much effort to make it hard to use your system…
And yup, http://www.pool.ntp.org/http://pool.ntp.org/
I found a long discussion on this issue at
About NTP:
You are right, I don't have to worry about the servers that are selected by pool.ntp.org as NTP servers.
Port 25:
After installing ufw, I had a very secure server; all ports were closed.
Nginx limiters:
This is difficult.
Do you have to specify limiters on the server level (http block) or for each virtual host (server block)?
Do you have to define a zone (or 2: 1 for httplimitreq and 1 for httplimitzone) for each virtual host?
What's the difference between connections and requests? Have I got it right when someone visits your site that is a connection and the individual files (html, css, js, png, …) are requests?
In case of a Wordpress blog: are the php-file, the css and javascript files, image files, … all "requests"? In that case should one set the rate in limitreqzone to 10r/s. To be on the safe side.