Ask HN: Guidelines/steps to setup a secure Linux server for static site?

https://news.ycombinator.com/item?id=8102096

by bikamonki • 12 years ago

4 8 12 years ago

news.ycombinator.com

Any info/links are welcome. Gracias!

caw• 12 years ago

* Disable everything that's not the web server

* Turn on the firewall to only allow 80/443 and SSH in case you turn something else on

* only use passwordless SSH

* Use the latest version of (apache | nginx | other web server)

* subscribe to a mailing list for exploits for the software you're using

* Patch monthly, if not sooner for critical bugs

fnom2• 12 years ago

is there a reason that you are serving the site from a server and not from something like s3/cloundfront/etc?

bikamonki2• 12 years ago

Everything is on a CDN, but don't I need at least the index.html file hosted on a server where the domain resolves?

fnom2• 12 years ago

a least S3 has an option to turn a bucket into a static web host. i run multiple angularjs apps directly from S3 via cloudfront without any servers.

2close4comfort• 12 years ago

install/conf fail2ban and tripwire along with caw's list

Someone1234• 12 years ago

In addition to caw's list:

* Disable all modules/extensions on the web-server you aren't using (e.g. don't need PHP? Disable it). This more often have exploits than the web-servers themselves.

* Automate patching and updates (this can be done on both Linux and Windows fairly easily)

I'd also mirror fnom's suggestion. Why not just use something like S3? I just entered details for a basic site on S3 and the calculator suggests it would cost less than $1/month(!). That's with 10-20,000 requests, 1 GB of low redundancy storage, and 1 GB in each direction for data.

bikamonki2• 12 years ago

Great answers thanks!

guiambros• 12 years ago

Do yourself a favor and do NOT host a static website on a full Linux server. It's more expensive, worse performance, more work to maintain, and a lot less safe than the alternative.

The best approach for a pure static website is to host entirely using a CDN. It's cheap, scalable, and zero maintenance. You don't even need a full CDN; just an object data storage (like Amazon S3) is enough.

There are many tutorials online. Just Google "hosting static website on S3". You may optionally use CloudFront on top of S3, if latency/performance (particularly for international visitors) is important to you.

Ask HN: Guidelines/steps to setup a secure Linux server for static site?

Related Stories