Easy LAMP install / Is there such a thing?

Chess · Post by **Chess** » Fri Feb 03, 2006 12:42 pm

Snarkout wrote:When you guys are DMZing your home networks, how do you go about doing it? Are you subnetting your private IP space and just placing any internet accessible boxes on a different subnet from your general use LAN? I always wonder what people mean by DMZ when they have a single public IP to play with.

Yes, that is basically it. You need to have 3 NIC's to do it with smoothwall/ipcop (or a router like the zywall that has 3 separate interfaces built in). One interfaces faces the WAN, one faces the LAN, and one faces the DMZ. You can then set different subnets, e.g. your LAN to be 192.168.x.y and your DMZ to 10.10.x.y.

Generally, the computers on the LAN can see the DMZ, but the DMZ cannot see the LAN. It is possible to poke pinholes from the DMZ to the LAN, but then that sort of defeats the whole purpose.

So, if I ssh into my webserver located at 10.10.x.y for example, the computers behind my LAN are totally invisible -- just as they are to outside.

mowestusa · Post by **mowestusa** » Fri Feb 03, 2006 2:43 pm

Wow, this has been a great thread. I'm learning a lot.

Gomer,
If I understand you well, setting up a home server can be relatively safe. In the past I have my server set up on the network, but it is a separate machine. I have a DSL modem/router/NAT. I forward only port 80 and 22 so I can see the website and can ssh into the machine from outside the network. The webserver is plugged into the DSL router/modem/NAT.

The rest of the home network is hooked up to a Linksys wireless router which assigns those computers their private IP behind another NAT. Because of your comment about ssh, the only way a hacker can get off of the webserver is to ssh onto one of these other computers, so this set up for the home is pretty secure already from your description.

Are there simple tests that a noob can run to see if anyone has gotten control of my webserver or been on my other network computers? Just watching the flashing lights on the DSL modem it doesn't even look like the webserver is getting any traffic at all. I never notice it going. Are there log files that I can turn on to monitor that?

Just wondering what the TLLTS guys are doing to keep their servers secure. I know Pat has a server at home running his blog. Linc has a server doing all sorts of stuff. Dann has the irc server and the tllts server. What are you guys doing to keep your network safe?

mowestusa

Post by **Patrick** » Fri Feb 03, 2006 2:47 pm

I'm modulating my deflector frequencies every 30 seconds. Hopefully the borg won't be able to penetrate my defenses.

Linc · Post by **Linc** » Fri Feb 03, 2006 2:55 pm

mowestusa wrote: Just wondering what the TLLTS guys are doing to keep their servers secure. I know Pat has a server at home running his blog. Linc has a server doing all sorts of stuff. Dann has the irc server and the tllts server. What are you guys doing to keep your network safe?

mowestusa

I could tell you but then I'd have to kill you.

Seriously though, I run Linux instead of microsoft products. I use Portsentry. I turn off services I am not using and I don't use inherently insecure services like telnet/finger/ftp.

Gomer_X · Post by **Gomer_X** » Mon Feb 06, 2006 12:08 pm

mowestusa wrote:Are there simple tests that a noob can run to see if anyone has gotten control of my webserver or been on my other network computers? Just watching the flashing lights on the DSL modem it doesn't even look like the webserver is getting any traffic at all. I never notice it going. Are there log files that I can turn on to monitor that?

You can watch the apache logs and see exactly what's going on. You may have to check your documentation to find the logs. Mine are in /var/log/www/. I've also got logwatch on my system, which goes through my logs daily and emails me with a summary. Any httpd errors will show up in that daily E-mail. Many attacks won't get through on the first try, so there are likely to be errors in the logs.

It sounds like your needs are more serious than mine. My server is primarily a home server, so access to it from the LAN is crucial, thus no DMZ. I don't even have it open to the web at the moment.

As Linc said, running Linux will get you a pretty solid system to start with. If all you've got open are port 80 and 22, and you watch your logs and have root logins disabled, you should be able to catch most things.

Judland · Post by **Judland** » Sat Feb 11, 2006 1:47 pm

Gomer_X wrote: I've also got logwatch on my system, which goes through my logs daily and emails me with a summary. Any httpd errors will show up in that daily E-mail. Many attacks won't get through on the first try, so there are likely to be errors in the logs.

Gomer_X, any advice or tips on how to use logwatch effectively?

mowestusa · Post by **mowestusa** » Sat Feb 11, 2006 2:52 pm

Gomer_X wrote: It sounds like your needs are more serious than mine. My server is primarily a home server, so access to it from the LAN is crucial, thus no DMZ. I don't even have it open to the web at the moment.
As Linc said, running Linux will get you a pretty solid system to start with. If all you've got open are port 80 and 22, and you watch your logs and have root logins disabled, you should be able to catch most things.

Thanks for the reply. I don't think my needs are very serious, but after your previous post I don't like the idea of a hacker getting into any personal files. I already don't blog because I want to be careful what personal information gets out on the web. So I'm setting up a computer that only is hooked up to the internet as a server, with no personal files on it. Also I won't let it see any of the other computers on the network, but they will be able to see it in the DMZ.

The main reason I want to get this set up properly, is so I can host my own hobby website, and can test things like eyeOS and other webapplications from outside of my network. I also thought I could use it to down load bittorrents and then be able to start a bittorrent by remote log in from anywhere. The more I look into it, I believe I will be opening an account with 1&1 next week, for $5 a month you get protected directories, and I can run lots of stuff there. 10 gigs on a linux server.

How do you disable root logins? And if you do that then how would you administer the box if you can't log in as root? Perhaps I'm misunderstanding something really simple here.

Thanks,

mowestusa

Chess · Post by **Chess** » Sat Feb 11, 2006 4:09 pm

mowestusa wrote:How do you disable root logins? And if you do that then how would you administer the box if you can't log in as root? Perhaps I'm misunderstanding something really simple here.

Edit your /etc/ssh/sshd_config file and look for the line that says this:

Code: Select all

#PermitRootLogin no

Uncomment this line. That way nobody can ssh in to your box as root. Only your users can ssh in. If you need to do something as root, you ssh in as your user and then "su" to root. It's much more secure this way. I would also consider only using public/private key authentication instead of passwords. Again, more secure. Finally, I would set ssh to run on a different port instead of 22. All of these options are in the sshd_config file. Just uncomment the lines you want, change the setting to whatever you need, and then restart ssh.

Gomer_X · Post by **Gomer_X** » Mon Feb 13, 2006 10:16 am

Judland wrote:
Gomer_X wrote: I've also got logwatch on my system, which goes through my logs daily and emails me with a summary. Any httpd errors will show up in that daily E-mail. Many attacks won't get through on the first try, so there are likely to be errors in the logs.
Gomer_X, any advice or tips on how to use logwatch effectively?

Install Fedora?

I've honestly never looked at the configuration. I just use the defaults. The only thing I have to do is go into /etc/aliases and uncomment the #root: line and make sure root's mail gets forwarded to me.

I'll try to look at the config when I get home and report how it's set up. I think it's a simple matter of either setting a single digit verbosity level or configuring what gets reported. It just greps the logs for errors and mails them to root daily.

Gomer_X · Post by **Gomer_X** » Fri Feb 17, 2006 9:47 am

Had a closer look at my logwatch setup. In the config file you can set a reporting level of low (0) to high (10). Mine is set on low, which is the default.

Even at low I still get daily reports on any uses of su, ssh logins, any httpd errors, disk partition summary and other stuff. I kicked the reporting level up to 5 to see what happens.

Logwatch is a set of Perl scripts that basically just greps log files, but it's pretty extensive, and very configurable. In addition to setting a reporting level in a conf file, you can also dump regular expressions in a config and have it look for custom things.

If you're interested, check out http://www.logwatch.org.