alessandra.s
Newbie
- Dec 24, 2018
- 18
- 3
Since I am preparing myself to the world of making money online and just gotten myself a dedicated server. I think it would be good to contribute to the forum while I am at it, installing the server. I came from IT background, I have a fair amount of experience in security, I am not an expert but able to cover the basics of security. This is my installation, it may differ from yours in terms of operating system, services, and others but I will try to be as general as possible.
1. Mirror the latest stable version of the Linux distribution of your preference. CenTOS/Ubuntu.
2. Once its done, apt-get update and apt-get dist-upgrade all features in the server to the latest version.
3. Install Webmin|VirtualMin. Webmin and Virtual will install the LAMP stack package for you which includes Apache, PHP, and MYSQL.
The basics: FIREWALL! FIRST LINE OF DEFENCE
A lot of times, admins leave firewall settings to the default and there are a lot of services that are not needed. Why leave so many doors open for attackers? SEAL THEM UP do not give any opportunity for them to find vulnerabilities. How do you find out which ports are open? You can use nmap port scanner or other windows port scanner. DONT use nmap on the server to scan itself, preferably use a machine which is out of the server's network. This way you are able to see how is your firewall is set up.
Here's a port scan of my server after webmin|virtualmin installation.
pi@raspberrypi:~ $ sudo nmap -sS <ip>
Starting Nmap 6.47 ( http://nmap.org ) at 2018-12-29 10:48 +08
Nmap scan report for <ip>
Host is up (0.21s latency).
Not shown: 843 closed ports, 144 filtered ports
PORT STATE SERVICE
22/tcp open ssh
53/tcp open domain
80/tcp open http
110/tcp open pop3
143/tcp open imap
443/tcp open https
587/tcp open submission
993/tcp open imaps
995/tcp open pop3s
2222/tcp open EtherNet/IP-1
3306/tcp open mysql
10000/tcp open snet-sensor-mgmt
20000/tcp open dnp
Port 22: SSH
This is an important port, you need this port to SSH into your server. The question here is everyone knows this port number. Can you move this main door to somewhere else? Instead of a door in front of the house (every house has a door in front of the house) move it to the back? Yes, you can. You can make SSH listen to a specific port. I choose somewhere around 10000 - 11000. You can specify it in SSH configuration inside Webmin. It will open up the firewall ports too when you make a switch. After you have moved the SSH listening port, remove the entry from the firewall. SEALING IT.
Port 53: Domain (DNS, Bind)
Unless you want to manage the domain yourself. Then just skip this.
I have it disabled because I manage my DNS records using ClouDNS and CloudFlare. I am sure a lot of you are. If your server is not using it why open up the port? SEAL IT. Remove the entry from firewall and shutdown BIND daemon.
Port 80/443 (HTTP/HTTPS)
This is where apache sits on we can't do anything here. Leave it open unless you want your website not reachable by your visitors if you close it.
Port 110(pop3)/143(IMAP)/587(Submission)/993(Secure IMAP)/995(Secure pop3s) (Emails Sending/Viewing/Receiving)
It depends on how you use your email. I know some admins who just want basic email sending and form submission from Contact Us page to email to your mailbox. Just a contact point for all your sites.
How am I doing it? I close them up. I use ClouDNS mail forwarding service where I can create user aliases and email it to my Gmail, Hotmail or Yahoo.
50 over sites with different domain all pointing to my Gmail, I need to setup mail filtering into folders to organize incoming emails.
Since all my emails are forwarded by my DNS service, I do not need mailbox capability in my server. I turned them off. 5 ports SEALED.
Port 2222: I am not sure what is this for. Leave it open, I will come back to this later.
Port 3306: MYSQL
You want to administer your MYSQL remotely, and you leave it open. Wait, you can use Standard TCP/IP over SSH in your client. I am using MySQL workbench and it has that option in the connection method. What this does is that the client will first connect to your SSH server and then make a normal MySQL connection to port 3306 locally in your server.
MySQL Client -> SSH Port(Port 22? No you changed it remember?) -> SSH Server -> MySQL 3306 (connects locally)
What good does this have?
1. It closes another port for vulnerabilities. 3306 now not exposed to the internet yet you still can administer your MySQL database.
2. Uses two-level authentication, first, you need to pass through SSH authentication. Then you need to pass through MySQL authentication.
#note you can use FTP over SSH too. Same way to set it up. Then you can close the FTP ports too. Your FTP client Filezilla will connect to the SSH server and then make a FTP connection to the server.
Port 10000: VirtualMin
VirtualMin web configuration. You can make VirtualMin listen to a particular port. Set it to 1XXXX. Another port close and moved.
Port 20000: UserMin
Usermin web configuration. You also can change this port to some other ports number.
How is the outside world seeing my ports? Here's a scan from the nmap port scanner.
pi@raspberrypi:~ $ sudo nmap -p- <ip>
Starting Nmap 6.47 ( http://nmap.org ) at 2018-12-29 11:53 +08
Nmap scan report for <ip>
Host is up (0.22s latency).
Not shown: 64507 closed ports, 1022 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp open https
2222/tcp open EtherNet/IP-1
1XXXX/tcp open unknown (Your SSH)
1XXXX/tcp open unknown (VirtualMin)
1XXXX/tcp open unknown (UserMin)
Nmap done: 1 IP address (1 host up) scanned in 577.48 seconds
The nmap shows my server having 6 ports opened, 3 known and 3 unknown.
13 open ports when I started and now comes down to 6 ports open. That's 50% chance reduced.
Now your server is secure at the internet facing level. I wouldn't say is 100% secure but it is better than leaving it as default. Even you moved the ports to custom number ports. Expert attackers can find a way to know what that port is for but it takes an expert to find out. You want to filter out 90% of the nonexperts or hackers wannabe, bots. Leaving 10% chance of your server being hacked. And if you keep apache, virtualmin, webmin, usermin updated regularly, it gives even less room for experts to find vulnerabilities. That is what I want to achieve here in my servers.
I hope this guide can help you. If you need any advice, you can just send me a message. I will be willing to help you out if I have spare time.
DISCLAIMER: I do not hold any responsibility of what you do to your server when following this guide. If you have no clue what I am talking about and just want to follow step by step in securing your server, it is better you don't do it. That is the reason why this is written without a step by step instruction but rather a guide. If you can't find where to set the listening port, means you do not know what you are doing. Remember, you can secure your servers from attackers, you can also lock yourself out.
1. Mirror the latest stable version of the Linux distribution of your preference. CenTOS/Ubuntu.
2. Once its done, apt-get update and apt-get dist-upgrade all features in the server to the latest version.
3. Install Webmin|VirtualMin. Webmin and Virtual will install the LAMP stack package for you which includes Apache, PHP, and MYSQL.
The basics: FIREWALL! FIRST LINE OF DEFENCE
A lot of times, admins leave firewall settings to the default and there are a lot of services that are not needed. Why leave so many doors open for attackers? SEAL THEM UP do not give any opportunity for them to find vulnerabilities. How do you find out which ports are open? You can use nmap port scanner or other windows port scanner. DONT use nmap on the server to scan itself, preferably use a machine which is out of the server's network. This way you are able to see how is your firewall is set up.
Here's a port scan of my server after webmin|virtualmin installation.
pi@raspberrypi:~ $ sudo nmap -sS <ip>
Starting Nmap 6.47 ( http://nmap.org ) at 2018-12-29 10:48 +08
Nmap scan report for <ip>
Host is up (0.21s latency).
Not shown: 843 closed ports, 144 filtered ports
PORT STATE SERVICE
22/tcp open ssh
53/tcp open domain
80/tcp open http
110/tcp open pop3
143/tcp open imap
443/tcp open https
587/tcp open submission
993/tcp open imaps
995/tcp open pop3s
2222/tcp open EtherNet/IP-1
3306/tcp open mysql
10000/tcp open snet-sensor-mgmt
20000/tcp open dnp
Port 22: SSH
This is an important port, you need this port to SSH into your server. The question here is everyone knows this port number. Can you move this main door to somewhere else? Instead of a door in front of the house (every house has a door in front of the house) move it to the back? Yes, you can. You can make SSH listen to a specific port. I choose somewhere around 10000 - 11000. You can specify it in SSH configuration inside Webmin. It will open up the firewall ports too when you make a switch. After you have moved the SSH listening port, remove the entry from the firewall. SEALING IT.
Port 53: Domain (DNS, Bind)
Unless you want to manage the domain yourself. Then just skip this.
I have it disabled because I manage my DNS records using ClouDNS and CloudFlare. I am sure a lot of you are. If your server is not using it why open up the port? SEAL IT. Remove the entry from firewall and shutdown BIND daemon.
Port 80/443 (HTTP/HTTPS)
This is where apache sits on we can't do anything here. Leave it open unless you want your website not reachable by your visitors if you close it.
Port 110(pop3)/143(IMAP)/587(Submission)/993(Secure IMAP)/995(Secure pop3s) (Emails Sending/Viewing/Receiving)
It depends on how you use your email. I know some admins who just want basic email sending and form submission from Contact Us page to email to your mailbox. Just a contact point for all your sites.
How am I doing it? I close them up. I use ClouDNS mail forwarding service where I can create user aliases and email it to my Gmail, Hotmail or Yahoo.
50 over sites with different domain all pointing to my Gmail, I need to setup mail filtering into folders to organize incoming emails.
Since all my emails are forwarded by my DNS service, I do not need mailbox capability in my server. I turned them off. 5 ports SEALED.
Port 2222: I am not sure what is this for. Leave it open, I will come back to this later.
Port 3306: MYSQL
You want to administer your MYSQL remotely, and you leave it open. Wait, you can use Standard TCP/IP over SSH in your client. I am using MySQL workbench and it has that option in the connection method. What this does is that the client will first connect to your SSH server and then make a normal MySQL connection to port 3306 locally in your server.
MySQL Client -> SSH Port(Port 22? No you changed it remember?) -> SSH Server -> MySQL 3306 (connects locally)
What good does this have?
1. It closes another port for vulnerabilities. 3306 now not exposed to the internet yet you still can administer your MySQL database.
2. Uses two-level authentication, first, you need to pass through SSH authentication. Then you need to pass through MySQL authentication.
#note you can use FTP over SSH too. Same way to set it up. Then you can close the FTP ports too. Your FTP client Filezilla will connect to the SSH server and then make a FTP connection to the server.
Port 10000: VirtualMin
VirtualMin web configuration. You can make VirtualMin listen to a particular port. Set it to 1XXXX. Another port close and moved.
Port 20000: UserMin
Usermin web configuration. You also can change this port to some other ports number.
How is the outside world seeing my ports? Here's a scan from the nmap port scanner.
pi@raspberrypi:~ $ sudo nmap -p- <ip>
Starting Nmap 6.47 ( http://nmap.org ) at 2018-12-29 11:53 +08
Nmap scan report for <ip>
Host is up (0.22s latency).
Not shown: 64507 closed ports, 1022 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp open https
2222/tcp open EtherNet/IP-1
1XXXX/tcp open unknown (Your SSH)
1XXXX/tcp open unknown (VirtualMin)
1XXXX/tcp open unknown (UserMin)
Nmap done: 1 IP address (1 host up) scanned in 577.48 seconds
The nmap shows my server having 6 ports opened, 3 known and 3 unknown.
13 open ports when I started and now comes down to 6 ports open. That's 50% chance reduced.
Now your server is secure at the internet facing level. I wouldn't say is 100% secure but it is better than leaving it as default. Even you moved the ports to custom number ports. Expert attackers can find a way to know what that port is for but it takes an expert to find out. You want to filter out 90% of the nonexperts or hackers wannabe, bots. Leaving 10% chance of your server being hacked. And if you keep apache, virtualmin, webmin, usermin updated regularly, it gives even less room for experts to find vulnerabilities. That is what I want to achieve here in my servers.
I hope this guide can help you. If you need any advice, you can just send me a message. I will be willing to help you out if I have spare time.
DISCLAIMER: I do not hold any responsibility of what you do to your server when following this guide. If you have no clue what I am talking about and just want to follow step by step in securing your server, it is better you don't do it. That is the reason why this is written without a step by step instruction but rather a guide. If you can't find where to set the listening port, means you do not know what you are doing. Remember, you can secure your servers from attackers, you can also lock yourself out.
Last edited:
