So ... i've been been unfortunate with my linux VPS server running 12.04.3 lts. I had a bad php script running that basically opened up for a mysql injection. And because of a stupid configuration from my side this mysql injection ended with a escalation exploit where the person gained access to everything.
I managed to catch this in time and backed up my stuff and wiped the server.
So, i've re-installed and re-evaluated everything i thought i knew and started from scratch.
What do i have running ... well.
- apache2 2.2.22
- php5 5.3.10-1ubuntu3.8 with Suhosin Patch 0.9.10)
I've installed all of these individually, i didn't do "apt-get install lamp". apt-get install ssh apache2 mysql-server php5 php5-mysql postfix iptables ... is pretty much it i think.
For apache2, i've followed a few guides which i can't seem to find among my 300+ tabs in firefox. I'm sure there must be some more stuff i need to do to fully secure apache.
For php5 i made sure i installed suhosin patch and i followed a guide or two where i edited the config. I'm sure there must be something here as well that i could do to protect myself.
My mysql server is set up to only accept from localhost. I use ssh tunnel to be able to connect to it with navicat so i can do backups and such. I've made sure that all users besides root does not have any server privileges, this was what screwed the pooch the last time (yes i know, silly me ... i had completely forgotten that i had used a user in the past to remote connect then used that for something else which then let to the escalation exploit). And i've added a line in the config that stops mysql from being able to load local files into tables and such. Either way ... i feel that i've done what i can with mysql server for now.
Postfix was a default install, i did nothing. I later uninstalled it because i did not find a suitable guide for it. And i saw so many said that postfix is a disaster to configure and if left in default state, you are begging for a hack. Or so they said... shrugs
What i've done so far is secured ssh by running it on a alternative port and i've used puttygen to generate a rsa key with 4096bit encryption with a passphrase. I've disabled root login via ssh config and pam. The only way to log in to ssh now is via the rsa pubkey using the key i generated. And this works really great. And i feel confident that ssh is secure now. No way in without the private key and the password as far as i understand.
iptables, well, every server needs iptables. I have a bunch of ip's i've blocked. And probably more to be blocked in the future.
Alright ... soo, now on my freshly installed server, i've managed to revert almost everything. I have removed the php page that was the entry point for the hacker and i've used a clean install of files for my SMF forum software. I've kept the attachments of the forum though as they were an important part of my forum. Basically i'm ready to boot up my forum with the old database and force all users to change passwords.
Now, the hacker, is a former forum user on my forum. So i sort of know him. He saw hacking my server as a gift to me so i could clean up the security hole. Now this might be so ... it has indeed made me more security aware. So much so that i've spent almost 2 weeks non-stop reading up on the internet about how to secure these services that i am running.
Now, with my freshly installed server, i get a private message over steam from the same guy (the hacker), stating he found another loop hole, but he's not going to tell me what it is this time because i iptabled him and his VPN.
The guy feels that he should be rewarded for breaking into my server. Personally, if a person breaks in, you don't offer him cake and coffee. You break his legs ... then call the cops. coughs
Anyway, this brings me to postfix. I installed this because i don't want to pay for a mail delivery system for my forum when all i need to do is send a few emails a day. It's not a huge forum, so the odd chance is that the only times i will send a lot of emails is when i do newsletters to my 250+ members.
I feel sure that apache, php5 and ssh are secure. And i feel secure that my wordpress frontpage and SMF forum are secure as well (i uninstalled almost all most and went with only the most basic mods). Like i said, all files are fresh but my attachments from the SMF forum.
But i feel that i might be getting trolled here. Though i might be wrong ...
I am in need of a postfix service tho, just so the forum can send mail. I don't need to recieve any. So i'm wondering, can i keep postfix with default settings? Or will these open me for attack?
The guy, like i said, is either trolling me because he wants me to be more paranoid or he's telling me the truth.
Could anyone shed some light here? I mean, apache, php, mysql and ssh seem secure. If there are more php files laying around that he can mysql intject into, then he at least won't get far as none of the users have grant, nor do they have server privileges. So i'm guessing the postfix is his entry point? Or am i just being trolled?