one more security concern...

[cotfessi]

ok... in the last few days I've posted a few questions about firewalls and general security because I'm kinda worried about someone hacking my machine. I know nothing is totally secure, but I don't want to have a big sign on my machine that says "hackers welcome"!

All i have running now is a single debian box with exim and apache running as well as ssh. That's all I really need. Although I have a dynamic IP address, I have everything setup so that my domain name will point to my box.

When I've been reading these security howto's they suggest having the smtp server and the webserver in "dmz" away from the internal netwrok like such:


internet
|
|
firewall box ----> http/smtp box
|
|
|
internal network

What if I want to run all of these services from one box? Am I really creating a security mistake? Does anyone else run mail and web servers from their own boxes or am I just being paranoid??

thanks
-cotfessi

[ 05 February 2001: Message edited by: cotfessi ]

[ph34r]

Disable every service you don't need, don't use cleartext things like telnet and ftp (use ssh instead, which you are doing, which is a Good Thing), and you should be OK. Keep updates on what current security problems are (recently a exploit was found in bind, etc.).

[whiterabbit]

Someone much smarter than I once stomped this lil tidbit of knowledge into my a$$.

"The first rule of network site security is, that which is not strictly permitted is prohibited."

Some days if still means....NOT A DAMN THING.

You have to decide what *your* risk threshold is, plain and simple. You will read FAQ's till your blue in the face, track down advice from guru's that sit on digital mountains, etc. A service is a risk, ultimately you must weigh *your* acceptable level, not mine, not some pompous know it all a$$hole with tons of corp money to get a job done.

My personal feeling....go for it! Install the sendmail postfix, use the pm's from bastille (you do not have to use the whole thing) to help secure it against certain commands.