Essential Web Site Security
Submitted by confusion on Fri, 11/09/2007 - 14:13.
Background
The “cost of entry” to run a website is very low now, and we have seen an explosion of small sites on the Internet. Supporting this trend has been the availability of free and open source applications that allow site owners to do nearly anything they want, from blogs to wikis to forums.
Unfortunately, nearly all of the software has inherent bugs that can be exploited by bad people. The exploitation of such bugs has matured in a similar fashion to the applications themselves. Compromised web sites are a foundation to many threats currently on the Internet. Site owners are unknowingly supporting illegal activities such as:
- Hosting warez
- Hosting copyrighted files
- Hosting tools to compromise other sites
- Sending massive amounts of spam
- Host phishing sites to steal money
- Become part of command and control for botnets
Running a web site properly is truly becoming a social responsibility. If you are not part of the solution, you are likely part of the problem.
This guide outlines some general and basic security measures that you MUST take if you want to make sure your site is not defaced or otherwise compromised.
Key elements needed in a web hosting platform
Use a host that uses suphp
Try as you might, if another site on the server you share does not follow prudent security measures, then your site it still vulnerable. Suphp executes php scripts as the user-id and group-id of the account – not the userid/group id of the web server.
This will allow more restrictive permissions on your directories and will prevent an attacked from being able to read your php files.
Some hosts will not want to use suphp, as it can cause performance problems.
Build a relationship with provider on dealing with security issues
Firewall outbound connections
This is not always practical or possible, but firewalling traffic originating from the server – other than what is expected – can prevent backdoor tools from phoning home.
Run suhosin patch for php
Suhosin can stop the exploitation of many different types of coding weaknesses and some vulnerabilities in php itself.
Keeping up with the web software you use
- Subscribe to mailing list for any application software used as part of your site. Nearly all such applications have an "announcement" list that is low traffic.
- Attempt to participate regularly in the forums or discussion lists for the software you use. You will often get advanced warning of security issues and interim fixes. You will also know if the software is at risk of being abandoned and not updated.
- Upgrade after a security fix release within 3 days. Vulnerabilities are often exploited soon after they are discovered.
- If an application you use becomes abandon, plan to migrate your site to a new tool as fast as possible.
- Try not to customize software. This will slow down your ability to patch or upgrade, because you'll have to rewrite code, test, etc, and that can be difficult to do when it's not on your timeline.
- Attempt to remove 'powered by' and version number references. Nearly all open source web applications proudly, but this has turned out to be an extrodinarily efficient way to systematically identify sites running vulnerable software.
- Create a file with a random name in your html directory. Do not reference the file in your site. Grep your web logs daily for the file being accessed. Any hits may indicate that your site has been compromised.
- Scan for file differences and notify of differences
Your responsibilities as a site owner
- Perform frequent off-site backups. Even if you have a local backup strategy, such as to another server, it is imperative to maintain an offsite backup. While it doesn't happen often, datacenters are broken into and servers are phyically stolen.
- Do not store sensitive data like credit card numbers. Just don't do it.
- Change account passwords regularly