How to setup a home server securely

Question

I have a Windows XP (media center edition) box, on which I'd like to host a publicly accessable Bitnami RubyStack. What steps should I take to be sure I'm not vulnerable to attack from evildoers?

Answer 1

A very good router and firewall will eliminate a good percentage of vulnerabilities. I'm not sure what your budget is or what else is on your network. Bear in mind all a good firewall/router will do is keep traffic limited to what you all and can link your Bitnami on MCE to the outside world. There's always vulnerabilities within the app itself so keep up to date on any patches that the application might announce as well.

As far as the router goes, if you have something like a Linksys WRT54G, there's DDWRT or Tomato to override the manufacturer's firmware and give you more security options.

If you have some cash, I'd highly recommend pfSense to build a small/cheap firewall/router with even more extensive options. I've found that after a while, in spite of good/cheap routers like the WRT54G, overtime with all the power surges and 'stuff' they eventually go bad. I've built my own firewall just because I was tired of the slow and eventually degradation of performance from consumer level router/firewalls. That's not to say they won't work for you as needed, but in my experience they eventually break down. Maybe I just need to get a UPS for it.

Another major attack vector that people tend to forget about is uPnP (universal PnP). I'm not sure if this needs to be available with MCE and Bitnami, but bear in mind uPnP is all over the place on numerous computers, devices (like printers!), etc. A good FW/Router can block this traffic and nearly eliminate that threat.

Another (simple) tactic: use a password. Most people at home don't have passwords on their computer systems whether its' Vista/XP/MCE/whatever. Laziness prevails at home. Hell, I don't like passwords like everyone else, but even just putting SOME protection at the system level would be at the least something.

I'm sure there are other steps/techniques/measures but the suggestions I've listed are at the very least the cheapest and most effective for time+money. I'm assuming you're doing this from home so this should be adequate for your needs.