2

I have a virtual Server with Ubunto 10.04 on. My host Mediatemple have a few guides on trying to secure the apache config, but I think they are missing some details, or at least it makes no sense to me. I have followed the guide on creating a web user and group but I can't seem to get the groups to be setup right and I don;t trust that they are secure.

I have read the question and answers on Securing a fresh Ubuntu server and have made some of the steps to securing my server. This includes setting up a new admin user and disabling root logon. I also would like to be able to sftp into my server (I user Transmit) and upload files to the websites directories but when I logon as my newly created web or new admin user it says I don't have permission to create or save files. I assume with the admin account I need sudo permissions (which I have setup already)

Currently my web directory structure is:

/var/www/website.com/{html,django,logs}
/var/www/website.net/{html,django,logs}

What users/groups/permissions do I need to setup and apply to the folders. Can I have it so new websites added to the www folder are running under the correct user automatically. I will be running django from the django folders so I assume I need the execute ability?

I also need to have it possible to upload files to the web folders. How can I setup a good way of doing this?

Thanks

Community
  • 1
Designer023
  • 183
  • 1
  • 1
  • 8

1 Answers1

1

Have a read of this question on hardening Apache over on Security Stack Exchange

As well as links to various hardening guides (NSA, CIS, DISA and Pete Freitag), the question looks at the following:

  • Use SSH key based logins
  • Secure MySQL
  • Disable phpMyAdmin, webmin, etc
  • Close all ports/processes that are not needed
  • Use a file integrity checker
  • Use mod_security Set the proper permissions/groups
Community
  • 1
Rory Alsop
  • 1,184
  • 11
  • 20