Webserver Security

[Leviathann]

ok, I'm pretty much a noob when it comes to webservers however I have mine running at http://leviathann.homeip.net and I need some security tips to keep my stuff safe. I'm running WinXP Pro and I already have the built in ICF running. I'm in the DMZ on the router because my mom get's pissed whenever I ask her to open ports for me so I just told her to put me outside the router firewall. I try to stay away from third party firewalls because configuration is a pain and on zonealarm I hate constantly having to click block/unblock whenever something tries to make a connection. I don't need uber tight security just something to keep arseholes where they're suppose to be.

[gopher_yarrowzoo]

Want security get erm xampp there is a link somewhere in the OS section for it, it's Apache 2.x + php + mysql + a whole load of other stuff

The XP firewall = Cack, it's got erm "holes" that will never be sealed as someone got paid to put them there also MS IIS or whatever they call it now I wouldn't touch an MS webserver with a barge pole
If you want it tighter run the server on a Linux box :>

[magnav0x]

Originally posted by gopher_yarrowzoo
Want security get erm xampp there is a link somewhere in the OS section for it, it's Apache 2.x + php + mysql + a whole load of other stuff

The XP firewall = Cack, it's got erm "holes" that will never be sealed as someone got paid to put them there also MS IIS or whatever they call it now I wouldn't touch an MS webserver with a barge pole
If you want it tighter run the server on a Linux box :>

The last thing you want to do is load all kinds of stuff on your webserver that you don't need. That's how servers get compromised. If you aren't going to use something, don't install it. And just because it comes with 2 or 3 other apps that you want in a bundle it doesn't make it ok. I too am a anti-MS guy when it comes to servers, but to tell you the truth gopher..... a server is only as secure as the admin of the box. Anyone with know how can correctly secure a Windows server and have no problems with hack attempts. I would also like to point out more Linux servers get compromised than Windows servers now. The reason for this:

A) Open source leads to finding vulnerabilities more quickly
B) People using it thinking it's more secure, but don't know how to properly configure a Linux server.

One main reason Linux IS more secure "out of the box" is because it doesn't come preloaded with a lot of crap (well depends on what distro you use).

There is no true security advantage that Linux has over Windows. Don't get me wrong, I love Linux to death and use it religiously, but I get tired of people saying MS is insecure. MS is only as insecure as you let it be.

Leviathann, be minimal with what you put on the computer. Don't load all kinds of crap on it that will open ports. Antivirus/Spyware detection programs are a must. If you do use a 3rd party app, use something like F-Secure (it has a very nice firewall and antivirus built into it). Disable any services you do not need running. Keep windows up to date with patches released by Microsoft. If you insist on having shares open on the hard drive, you must password protect them. The number one thing to do....use common sense. I've had many windows computers on the net for years with no firewall what-so-ever and have never had them compromised. Unless your computer has something people want, then you don't have to worry about direct attacks, just random attacks (which all computers suffer from, regardless of operating system).

If you really want some direct ideas on how to secure your Windows XP box, I would suggest hitting up google.com and searchin for "how to secure windows xp" or something along those lines. There are endless numbers of sites with info on how to do just that.

If you have any specific questions regarding something, ask here and we can help. Your question is pretty general, I could write a entire book on it.

Good luck :thumbs:

[Leviathann]

Thanks, mag!

For spy/adware I use SpySweeper. It was top rated in PC Magazine. Just too bad it isn't free. But I'm not about to pay for it.

For net/virus security I use ZoneAlarm. It is free.;)