How to set up a safe and secure Web server

Learn a lot by doing it yourself instead of going with a hosting company.

Read the whole story

 

[abj]

I recommend Leafy Host!

 

[issor]

Apache 2.4 is supposed to close the gap with nginx performance, and surpass it in certain respects. Never used it myself but it has been out awhile now.

 

[pokrface]

I recommend Leafy Host!

I was writing an article about them, but my backup failed and the data were obfuscated. Not to worry, though--I'll have it all recovered by next week. Tuesday at the latest.

 

[Boskone]

If you go *nix only without saying IIS is pretty robust/secure out of the box, then it's really not a good article imo.

Why bother? It isn't more robust or secure than Apache or Nginx, and it is considerably more expensive. Apache wasn't discussed in detail either.

 

[pokrface]

If you go *nix only without saying IIS is pretty robust/secure out of the box, then it's really not a good article imo.

Security and robustness can't be discussed in a vacuum, though. The Internet is fundamentally a Unix-y construct, and if you want to learn about how it works, doing it with *nix technologies is the way to go. A *nix operating system is absolutely the right tool for the job here. (Though there's a holy war to be fought over whether running a web server based on a Linux distro is better than a web server based on a BSD, and Nginx is really a BSD-minded application from BSD-minded folks.)

Besides, I can't think of a way an average person can get up and running with a Windows box + IIS without some outlay of money (disregarding mooching a copy of Windows from someone else). Doing it with Linux in a VM costs zero dollars.

 

[harteman]

Thanks Lee, I'm going to delve into this just because of you.

 

[ni1]

The "average person" is going to be running Windows 7 most likely, which includes IIS at no charge.

 

[bersl2]

Speaking of nginx, I was pointed to this particular file in the code base. I sure hope that particular witchcraft is worth it.

 

[Boskone]

The "average person" is going to be running Windows 7 most likely, which includes IIS at no charge.

Nitpick, perhaps, but flavors of XP are still the most common OS.

I was, myself, unaware that IIS was rolled into 7.

 

[Hinton]

Arstechnica wrote about hosting a Raspberry Pi for free, which seems like something that would suit a lot of people.

Gerrynjr made a thread about it

 

[luipugs]

Regarding SSH access, you can change the listening port for SSH in your web server to further reduce the number of automatic logon attempts. Most of them are configured to poke only at port 22, so doing this simple change would save you a lot of trouble. This can be done by changing the Port option in /etc/ssh/sshd_config.

 

[yd]

Well, I appreciate these kind of articles - but in this one's case, yea, I am simply not hardcore enough to do that and would be saying "hello online provider, please remove this baggage from me so I can just post my silly little blog pictures".

Great article though. I sort of knew what was going on, just don't want that job.

 

[mohaine]

Holy biased article batman. ........

Fanboy much? The article was about how to setup a cheap web server and it did that. Don't cry that your favorite tech wasn't selected.

 

[fake-name]

Going with the server flavor of the distro instead of a desktop flavor means that you'll end up without a GUI on the system when you're done installing it. This is a good thing. Don't fear the command line! It's faster and more efficient to edit a few configuration files to get things up and running than it is to wade through screens and screens of preference panes, clicking on options that you have to visually identify, crippled by the lack of a quick way to search for what you want. GUIs are available for the server distros if you need that crutch, but we're not going to get into them—the command line is the best way to interact with your Web server and that's what we're going to use here.

Bull. Fucking. Shit.

Config files will never be significantly faster then a properly designed GUI. The *one* area where config files shine is when you need to deploy the same setup to many systems.

On top of that, a config file is absolutely HORRIBLE when it comes to option *discovery*. If you're just setting up a server using an OS and tools you are not familliar with, a good GUI is priceless, as it shows you all the commands and options that are available, hopefully with tool-tips and so on that explain what does what.

Yes, there are man pages, but I have yet to see a man page or support document that does a good job of explaining the why behind the options, or effectively and clearly document the commands interactions. They all read like they were written by lawyers.


I set up a SVN server on top of xubuntu a year or so back, and it was a giant pain in the ass. Oh look, it's not working. Now which of the five or six log files did the error error message get written to? Now, what does that error mean? The docs sure didn't help.

Anyways, a bunch of googling later, It's working fine. However, It sure took a hell of a lot more work then the Windows server I set up a few months later.

 

[JRod]

"I can't think of a way an average person can get up and running with a Windows box + IIS without some outlay of money"

Desktop Windows has come with its own webserver built in since Win98 for sure and probably Win95 but I never used it back then so I'm not sure.

That said - if you're interested enough in setting up a website to go through all these steps to setup your site, I really doubt you're only going to expect the max of 10 users to connect to it. On the same token, I've run my mother in laws two business websites for years now via IIS without ever purchasing a server operating system, and haven't experienced any known security issues. I just patch it and use NAT, nothing fancy. A couple of my old business clients who failed to patch their IIS servers suffered security issues so I totally understand where it gets the stigma of being insecure...

All comes down to different strokes for different folks.

 

[baloroth]

"The Internet and the services that make it run are fundamentally Unix-grown and Unix-oriented. Playing in this playground means you need a Linux or a BSD server, full stop."

Holy biased article batman. Thats like saying if you need to surf the web and play angry birds, the iPad is the only way to play in that playground.

It's not biased if it is true. The fact is that the Internet and most of it's components are based on some *nix variant, full stop. I can nearly guarantee the router you used to post this was some flavor of Unix (some modification of Busybox is the most likely). So to were most of the intermediate routers and the Ars server. Only makes sense to focus on that if you want an article that serves as an introduction to that world. So yes, if you want to play in the Internet playground, you need to learn *nix controls, simple as that. Sure, you could set up a simple IIS server quite easily, but the knowledge from that is a lot less flexible and useful than the knowledge from setting up an nginx server.

 

[JRod]

Holy biased article batman. ........

Fanboy much? The article was about how to setup a cheap web server and it did that. Don't cry that your favorite tech wasn't selected.

I just explained how to do it with windows for free...I fail to see your point. Unless of course you don't run windows at all, in which case - why would you bother.

 

[mohaine]

Regarding SSH access, you can change the listening port for SSH in your web server to further reduce the number of automatic logon attempts. Most of them are configured to poke only at port 22, so doing this simple change would save you a lot of trouble. This can be done by changing the Port option in /etc/ssh/sshd_config.

This is really good idea, but it is kind of a pain to always have to change the port.

You can also setup some iptables rules that will drop connections if they try to start too many connections over a set amount of time. i.e. After 4 ssh connections in 60 seconds it will quit listening to you for an hour. This stopped all of my automatic logon attempts.

 

[JRod]

Sure, you could set up a simple IIS server quite easily, but the knowledge from that is a lot less flexible and useful than the knowledge from setting up an nginx server.

I guess I don't know what flexiblity you would need for small and medium sized businesses or for just setting up a "Geopages-like" site at home, but I never run into it. I wasn't trying to infer that IIS is the only tool you need for every possible scenario. I also am not trying to bash this article or the author.

I should add that my iPad example wasn't all that great, when put into the context you added about unix's other fundemental roles on the net. I am trying to stick with simple here. I mean Geopages users and $270 rigs don't exactly makeup the fundementals of the internet.

 

[pokrface]

That said - if you're interested enough in setting up a website to go through all these steps to setup your site, I really doubt you're only going to expect the max of 10 users to connect to it. On the same token, I've run my mother in laws two business websites for years now via IIS without ever purchasing a server operating system, and haven't experienced any known security issues. I just patch it and use NAT, nothing fancy. A couple of my old business clients who failed to patch their IIS servers suffered security issues so I totally understand where it gets the stigma of being insecure...

All comes down to different strokes for different folks.

FWIW, my closet server runs five sites (including the chronicles of george) and has weathered a couple of Ars front page links. By far the limiting factor is my little home connection's upload bandwidth--it's only 2Mbps, and it saturates at about 100 concurrent connections per second, according to benching with Blitz.io.

It's all personal stuff, though--total PV count across all of them is maybe 5k on a good day. If I were actually doing anything "real", I'd absolutely be doing it through a hosting company. I ain't that crazy

 

[reflex-croft]

Security and robustness can't be discussed in a vacuum, though. The Internet is fundamentally a Unix-y construct, and if you want to learn about how it works, doing it with *nix technologies is the way to go.

Can you elaborate on this? How is the internet 'fundamentally' a Unix-y construct and what disadvantages, besides potentially price, would someone using IIS be at if they went that route instead?

For the claim to be valid, it needs to have some evidence. Is there any? The article is great for someone who wants to know how to build a nginx webserver from scratch on Ubuntu, but I do not understand why you are basing the reasoning on claims about the fundamental nature of the internet.

 

[gamoniac]

If you go *nix only without saying IIS is pretty robust/secure out of the box, then it's really not a good article imo.

Security and robustness can't be discussed in a vacuum, though. The Internet is fundamentally a Unix-y construct, and if you want to learn about how it works, doing it with *nix technologies is the way to go. A *nix operating system is absolutely the right tool for the job here. (Though there's a holy war to be fought over whether running a web server based on a Linux distro is better than a web server based on a BSD, and Nginx is really a BSD-minded application from BSD-minded folks.)

Besides, I can't think of a way an average person can get up and running with a Windows box + IIS without some outlay of money (disregarding mooching a copy of Windows from someone else). Doing it with Linux in a VM costs zero dollars.

Assuming most people are milked by cell phone companies like I am ($140/mo with 2 years contract = $3360), shelling out $500 for a copy of Windows Server 2012 Essential (link -- http://www.microsoft.com/en-us/server-c ... r/buy.aspx) is not really that big an investment. Especially for folks who are already familiar with Windows, the time saved in not having to learn LAMP easily outweighs the cost. As someone who used to spend so much time on OpenSuSE and Ubuntu (for a period of 6 years), I eventually opted to go back to Windows for its simplicity (time is more important as I get older). So... it would be a good read, too, if you decided to write an article on basic techniques to secure a IIS7.5 or IIS8.

Thanks for the great article, Lee.

 

[praetor_alpha]

Regarding SSH access, you can change the listening port for SSH in your web server to further reduce the number of automatic logon attempts. Most of them are configured to poke only at port 22, so doing this simple change would save you a lot of trouble. This can be done by changing the Port option in /etc/ssh/sshd_config.

This. Select the port carefully if you want to access your server from behind a corporate firewall. They often block all but a handful of destination ports (5 or so) on remote hosts.

Also, sort of do the same for the web server. I have my web server as a non-root user and listen on a non-privileged port, and have my router forward port 80 on the outside to that non-privileged port on the server.

 

[JRod]

That said - if you're interested enough in setting up a website to go through all these steps to setup your site, I really doubt you're only going to expect the max of 10 users to connect to it. On the same token, I've run my mother in laws two business websites for years now via IIS without ever purchasing a server operating system, and haven't experienced any known security issues. I just patch it and use NAT, nothing fancy. A couple of my old business clients who failed to patch their IIS servers suffered security issues so I totally understand where it gets the stigma of being insecure...

All comes down to different strokes for different folks.

FWIW, my closet server runs five sites (including the chronicles of george) and has weathered a couple of Ars front page links. By far the limiting factor is my little home connection's upload bandwidth--it's only 2Mbps, and it saturates at about 100 concurrent connections per second, according to benching with Blitz.io.

It's all personal stuff, though--total PV count across all of them is maybe 5k on a good day. If I were actually doing anything "real", I'd absolutely be doing it through a hosting company. I ain't that crazy

I totally see where you're coming from. I mean in part of your example you're able to leverage your exposure from a massive site like Ars to run some fun and interesting side projects.

 

[Blacken00100]

Assuming most people are milked by cell phone companies like I am ($140/mo with 2 years contract = $3360), shelling out $500 for a copy of Windows Server 2012 Essential (link -- http://www.microsoft.com/en-us/server-c ... r/buy.aspx) is not really that big an investment. Especially for folks who are already familiar with Windows, the time saved in not having to learn LAMP easily outweighs the cost.

Nonsense. IIS has almost nothing to do with "Windows" as is known by the sort of person this article is targeting.

 

[flameboy]

Lee, the security stuff really needs to come before making the box accessible from the internet. Otherwise you risk getting popped by a bot while you work on it.

Setting a static IP has been overlooked too, and is rather important. Also since you discuss running in a VM it is worth discussing setting up the VM networking appropriately (most desktop Virtualization software will NAT VM's by default).

I would also recommend looking at securing the box long term. Patching is really important, and needs to be discussed with a few different options. There are quite a few more steps that should be taken to have a truly safe and secure web server.

I could keep talking about things that need fixing in the article, but instead I suggest scraping the article and write about something simple and with an achievable end goal - say using Wordpress on paid webhosting.

 

[praetor_alpha]

Security and robustness can't be discussed in a vacuum, though. The Internet is fundamentally a Unix-y construct, and if you want to learn about how it works, doing it with *nix technologies is the way to go.

Can you elaborate on this? How is the internet 'fundamentally' a Unix-y construct and what disadvantages, besides potentially price, would someone using IIS be at if they went that route instead?

I'm puzzled about that claim too. The idea of the internet does not evoke ideas of pipes, shell scripts, and other "Unix-y constructs" to me. Perhaps it was just luck that Unix matured with the Internet? Other platforms don't seem to have any trouble at all being internet hosts.

 

[flash__]

Question for Lee:

I noticed that you were running postfix on your server there. but I also noticed you have your main domain's mail handled by Google, presumably using Google Apps. Can I ask what you're utilizing Postfix for on your home server, and maybe how much time you've spent tinkering with the Postfix configuration? It looks like you've at least configured TLS for it, so I would imagine you've done some non-trivial tinkering there.

I ask because I've been configuring Postfix myself as a personal mail server, and I would have never dreamed it would be this complex before I started. It just requires so much more in the way of security than your average web server. I'm getting close to finishing it up, though.

Nice article, too, though I generally advocate digging down into the documentation before really going live with this stuff. I usually use these types of guides as starting points and really flesh out the configuration with official documentation. I also usually advocate hosting through a provider such as Linode to better isolate Internet offerings like a web server from my home network, but that might be a little tinfoil-y of me.

Thanks.

EDIT: Just realized I read the about page on your website several months ago before actually starting my own configuration. That line about being a "masochist" was in the back of my head all this time I've been working on it, and I've gotta say, I can confirm that characterization. Still, I'm interested as to what you're using Postfix for on your sever. Intranet mail, perhaps?

 

[flash__]

Security and robustness can't be discussed in a vacuum, though. The Internet is fundamentally a Unix-y construct, and if you want to learn about how it works, doing it with *nix technologies is the way to go.

Can you elaborate on this? How is the internet 'fundamentally' a Unix-y construct and what disadvantages, besides potentially price, would someone using IIS be at if they went that route instead?

I'm puzzled about that claim too. The idea of the internet does not evoke ideas of pipes, shell scripts, and other "Unix-y constructs" to me. Perhaps it was just luck that Unix matured with the Internet? Other platforms don't seem to have any trouble at all being internet hosts.

1) If your operating system doesn't allow you to install to on a server without a GUI, something has gone horribly, horribly wrong.

2) Most of the Internet's servers run Linux. Nearly all of the top sites use LInux exclusively.

3) A lot of the top server software is written by people who work on Unix/Linux machines. Their software is really tailored to Unix machines; they might make the necessary changes to make it portable, but they aren't focused on Windows... not by a long shot. Postfix, for instance, seems to be completely unsupported for Windows.

 

[reflex-croft]

Security and robustness can't be discussed in a vacuum, though. The Internet is fundamentally a Unix-y construct, and if you want to learn about how it works, doing it with *nix technologies is the way to go.

Can you elaborate on this? How is the internet 'fundamentally' a Unix-y construct and what disadvantages, besides potentially price, would someone using IIS be at if they went that route instead?

I'm puzzled about that claim too. The idea of the internet does not evoke ideas of pipes, shell scripts, and other "Unix-y constructs" to me. Perhaps it was just luck that Unix matured with the Internet? Other platforms don't seem to have any trouble at all being internet hosts.

Its so fundamentally flawed a statement that I am astounded any serious network admin would believe or state it. The Internet is fundamentally a *open standards* construct. Which is awesome! Its got nothing to do with Unix though, much of which, especially in the early years of the internet, was proprietary and owned by mega corps. No client attempts to retrieve a page from a server and goes "Oh, IIS, I'll just deprioritize these packets" and no server declines to serve non-Unix hosts at the same levels as Unix based hosts.

The statement is so misguided as to qualify as 'not even wrong'. IIS predates almost every 'fundamental' internet technology mentioned in the article.

You know what did not exist back when the first version of IIS was released? Apache

 

[WereCatf]

One tip that people still do not seemingly know about: install Denyhosts or similar and configure it to your liking. It's a small application that tracks SSH login attempts for break-in attempts and bans the IP-addresses responsible. For how long and for which services the bans apply can be configured by you; personally I just like to ban such indefinitely and on ALL services, not just SSH, but YMMV.

Of course, Denyhosts doesn't help against lost SSH keys, but if you don't wish to disable regular passwords on your server then I strongly recommend using it.

 

[Personne]

Just... thank you.

 

[Discoceris]

Security and robustness can't be discussed in a vacuum, though. The Internet is fundamentally a Unix-y construct, and if you want to learn about how it works, doing it with *nix technologies is the way to go.

Can you elaborate on this? How is the internet 'fundamentally' a Unix-y construct and what disadvantages, besides potentially price, would someone using IIS be at if they went that route instead?

For the claim to be valid, it needs to have some evidence. Is there any? The article is great for someone who wants to know how to build a nginx webserver from scratch on Ubuntu, but I do not understand why you are basing the reasoning on claims about the fundamental nature of the internet.

Evidence? Android? You can start there. Much of the internet (Outside of the US) still has roots in Unix. Microsoft would like to have you believe otherwise but then we'll just devolve into a discussion that completely gets away from the actual spirit of the article.

 

[flash__]

Security and robustness can't be discussed in a vacuum, though. The Internet is fundamentally a Unix-y construct, and if you want to learn about how it works, doing it with *nix technologies is the way to go.

Can you elaborate on this? How is the internet 'fundamentally' a Unix-y construct and what disadvantages, besides potentially price, would someone using IIS be at if they went that route instead?

I'm puzzled about that claim too. The idea of the internet does not evoke ideas of pipes, shell scripts, and other "Unix-y constructs" to me. Perhaps it was just luck that Unix matured with the Internet? Other platforms don't seem to have any trouble at all being internet hosts.

Its so fundamentally flawed a statement that I am astounded any serious network admin would believe or state it. The Internet is fundamentally a *open standards* construct. Which is awesome! Its got nothing to do with Unix though, much of which, especially in the early years of the internet, was proprietary and owned by mega corps. No client attempts to retrieve a page from a server and goes "Oh, IIS, I'll just deprioritize these packets" and no server declines to serve non-Unix hosts at the same levels as Unix based hosts.

The statement is so misguided as to qualify as 'not even wrong'. IIS predates almost every 'fundamental' internet technology mentioned in the article.

You know what did not exist back when the first version of IIS was released? Apache

You should look at my answer above and re-evaluate yours. As for the whole "a client or server would never discriminate against specific software/operating systems" argument, I point you to the fact that Internet Explorer contains the word "Mozilla" in its user-agent string.

 

[reflex-croft]

Security and robustness can't be discussed in a vacuum, though. The Internet is fundamentally a Unix-y construct, and if you want to learn about how it works, doing it with *nix technologies is the way to go.

Can you elaborate on this? How is the internet 'fundamentally' a Unix-y construct and what disadvantages, besides potentially price, would someone using IIS be at if they went that route instead?

I'm puzzled about that claim too. The idea of the internet does not evoke ideas of pipes, shell scripts, and other "Unix-y constructs" to me. Perhaps it was just luck that Unix matured with the Internet? Other platforms don't seem to have any trouble at all being internet hosts.

1) If your operating system doesn't allow you to install to on a server without a GUI, something has gone horribly, horribly wrong.

Windows Server has been able to run this way for quite some time now.

2) Most of the Internet's servers run Linux. Nearly all of the top sites use LInux exclusively.

Linux certainly has gained in this market, it wasn't doing so well just a few years ago but the rise of cloud hosting changed that.

3) A lot of the top server software is written by people who work on Unix/Linux machines. Their software is really tailored to Unix machines; they might make the necessary changes to make it portable, but they aren't focused on Windows... not by a long shot. Postfix, for instance, seems to be completely unsupported for Windows.

This really isn't the point. Nobody is trying to say its wrong to choose Linux. The contention is why would he claim the internet is itself a 'unix-y construct'. Its not. Its a TCP/IP construct with several dozen open standards on top of(and below) that. Many OS's implement those standards and there is no discrimination between them(by design).

 

[issor]

Security and robustness can't be discussed in a vacuum, though. The Internet is fundamentally a Unix-y construct, and if you want to learn about how it works, doing it with *nix technologies is the way to go.

Can you elaborate on this? How is the internet 'fundamentally' a Unix-y construct and what disadvantages, besides potentially price, would someone using IIS be at if they went that route instead?

I'm puzzled about that claim too. The idea of the internet does not evoke ideas of pipes, shell scripts, and other "Unix-y constructs" to me. Perhaps it was just luck that Unix matured with the Internet? Other platforms don't seem to have any trouble at all being internet hosts.

Its so fundamentally flawed a statement that I am astounded any serious network admin would believe or state it. The Internet is fundamentally a *open standards* construct. Which is awesome! Its got nothing to do with Unix though, much of which, especially in the early years of the internet, was proprietary and owned by mega corps. No client attempts to retrieve a page from a server and goes "Oh, IIS, I'll just deprioritize these packets" and no server declines to serve non-Unix hosts at the same levels as Unix based hosts.

The statement is so misguided as to qualify as 'not even wrong'. IIS predates almost every 'fundamental' internet technology mentioned in the article.

You know what did not exist back when the first version of IIS was released? Apache

IIS is nothing. How about BIND? Look at "internet things" outside of a single service. Regardless, talking about who was first doesn't change the fact that most web servers are apache, most DNS is BIND, most mail servers run on Linux, most routers run BSD (junOS for example) or nix variants(Linksys,etc).

His statement is not wrong, nor does it contradict your assertion that windows is not a second class citizen when passing packets.

 

[reflex-croft]

Security and robustness can't be discussed in a vacuum, though. The Internet is fundamentally a Unix-y construct, and if you want to learn about how it works, doing it with *nix technologies is the way to go.

Can you elaborate on this? How is the internet 'fundamentally' a Unix-y construct and what disadvantages, besides potentially price, would someone using IIS be at if they went that route instead?

For the claim to be valid, it needs to have some evidence. Is there any? The article is great for someone who wants to know how to build a nginx webserver from scratch on Ubuntu, but I do not understand why you are basing the reasoning on claims about the fundamental nature of the internet.

Evidence? Android? You can start there. Much of the internet (Outside of the US) still has roots in Unix. Microsoft would like to have you believe otherwise but then we'll just devolve into a discussion that completely gets away from the actual spirit of the article.

Whats Android have to do with the internet as a construct? Its just a client. The dispute is not over whether there is a lot of Unix used online. The issue is the idea that you are somehow at a disadvantage if you run something that is not Unix. This is false, and there is nothing inherently 'unix-y' about the internet.