0

I am planning to install Ubuntu Server on an old desktop for testing purposes at home. I also plan to install a web server (most probably Apache) and open it to the internet. The web server will not contain any critical information.

I think of using ufw (allowing all traffic on lan, only allowing port 80 TCP on wan) will be enough for security. I'd like to know if any unseen security issues possible with this configuration.

Improve this question
1
  • 1
    Good security is not a single magical application. Good security is a set of skills and habits. You need to understand exactly what the most likely vectors of attack are, and how ufw does --or does not-- affect those vectors. For example, ufw does nothing useful if you have no exploitable open ports. Also, ufw does not block php or sql injection attacks, which are common ways of attacking webservers.
    – user535733
    Dec 17, 2019 at 0:41

1 Answer 1

Reset to default
2

Just think about it! If someone is able to hack the webserver and gain root access on your Ubuntu machine, the intruder has good chances to detect and infiltrate other machines in that same network.

I would use a firewall like pfsense and use a DMZ (DeMilitarizedZone) for that purpose.

Add another small machine put it directly behind your router. The firewall splits and inspects the traffic and will (NAT) forward it to two separate cables and/or switches in two totally seperate networks.

In this scenari the attacker can still attack the webserver, but there is no other server to work with, your personal data is a way safer that way. You yourself can "poke" a hole from the "GREEN" net to your server, to fill it with data.

FYI - you can also use ufw instead of pfsense. But the add. features pfsense has are quite good, it is easy to use, so I personally prefer it that way.

Improve this answer
5
  • Thank you very much for your quick answer. I guess I'd need another computer (which I don't have at the moment) with 2 network interfaces for DMZ. Maybe I should postpone web server idea. I'll check it again when I find another computer and improve myself on linux.
    – NK_
    Dec 16, 2019 at 23:12
  • Actually depending on your setup you would need three, incoming, dmz, green
    – s1mmel
    Dec 16, 2019 at 23:13
  • Quite right. Thanks again, appreciated.
    – NK_
    Dec 16, 2019 at 23:14
  • 1
    I'm using smtg. like this apu-board.de/produkte/apu2d4.html but you can use any old a** pc you can find , as long as it fits 3 NIC's with enough speed, you are good. "Playing router combined with a bit of iptables" does not take that much mem or cpu.
    – s1mmel
    Dec 16, 2019 at 23:18
  • You do not need a second computer, you can bridge your network interface and give LXD a try. This will boost your linux knowledge a bit and let you run all of the DMZ machines needed from one computer. If you want to know more leave a message below and I will write up a long answer. LXD lets you run multiple containers on a single machine that will allow you to do what you want with the DMZ and use a single computer. How much ram do you have in the old computer? You may need another network interface for PF sense but maybe not depending on what you want to do.
    – m_krsic
    Dec 18, 2019 at 1:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .