Is portforwarding to my localhost on my personal Ubuntu computer secure?

Question

After installing Lamp on my personally Ubuntu computer, I am running a application that needs to connect to the web to send SMTP mail; for example, paypal needs a www address to notify about successful or failed payments...

I managed to fix the issue by acquiring a free .tk domain, changing my router preference, and port forwarding to my computer IP.

Is this secure? I have a firewall, restricting only access to port:80. It is my personal computer, where I have personal files (with exception of my /var/www folder).

Is there a better alternative?

I was thinking of installing a Ubuntu Server on VMware Workstation, and port forwarding to the virtual server instead, but it might take too much resources.

Answer 1

It will be as secure as your Web server configuration and your Web application, just like it would be were it deployed on a "real" Web server. If the Web server is running as the www-data user, you could change your home directory permissions to something that the www-data user cannot read:

cd ~
chmod 750 .

Run that while logged in as your own username. The rest cannot be guessed without lots information from you including the Web application itself. But, at least this much may offer a little more peace of mind knowing your files in your home directory will not be read.

Add another layer by creating a .htaccess file in the DOCUMENT_ROOT (/var/www/ ?) so that anyone who access the Web server will need to supply a username and password first. This could always be removed at deployment time.

Assuming you are using Apache... edit your Apache config file to make sure that any AuthConfig directives you add will work. Within the 'Directory' directive that specifies your document root, make sure you have AuthConfig in your AllowOverride statement:

AllowOverride AuthConfig

Or, you could use "All":

AllowOverride All

This lets us put Apache directives in .htaccess files. Now create a password file somewhere outside the public portion of the Web site. Here I create (-c) a password file named passwords in /usr/local/etc/apache/ with the initial user, my_username. It will prompt for password.

sudo mkdir -p /usr/local/etc/apache/
sudo htpasswd -c /usr/local/etc/apache/passwords my_username

Then put some Apache AuthConfig directives in the document root. If the document root is /var/www/, then use your favorite editor to create a new file name .htaccess...

sudo vim /var/www/.htaccess

The contents of that file ...

AuthType Basic
AuthName "My Web App"
AuthUserFile /usr/local/etc/apache/passwords
Require user my_username

Save. Change owner and permissions, if running as www-data:

sudo chown www-data /var/www/.htaccess
sudo chmod 400 /var/www/.htaccess

Now no one can use the Web server without username and password, plus the Web server cannot read your personal files. I do not know how or if this password method could work, though, when PayPal is redirecting back to you.

I suppose you could move the .htaccess in and out of the /var/www directory as needed while you are developing the PayPal return portion of your Web app.

Answer 2

I think it is better to understand the implications of port forwarding.

Normally your router is acting as a firewall, and normally it will block all NEW connections attempting to access your server, in your case apache.

So if you do NOT forward port 80 from your router to your local web server, it can only be accessed from internal, from other users on your LAN.

When you forward port 80 and register a FQDN, others, from outside your LAN can now access your server as well.

FQDN = Fully Qualified Domain Name , in your case = your .tk name.

This has benefits, you can run your mail server and share your personal files, it also exposes your server to crackers.

So yes, it is a (potential) security hole. You should look at securing apache and monitor the logs for suspicious activity.

I would not be overly paranoid, but I would not port forward without understanding how to secure your mail server and apache and learning to watch the logs (it takes a little time just to understand what is "normal" activity in the logs).

Work you way through the security documentation on Apache , don't feel overwhelmed, it is a ton of information, but do not ignore it either.

In general the need to secure a web server is proportional to the value of the data on the server, so you are not as big a target as say a financial institution.