Dedicated Server

For a Dedicated Hosting system, the user can either run their own physical hardware or rent this hardware from a provider. The former solution offers total control of the physical hardware, however, there are significant downsides to this approach and should be avoided; it is only recommend under special circumstances such as storing sensitive data. In the latter case, the hosting agent provides the hardware but the user has total control of the server via remote access. In this scenario, the provider is responsible for replacement of hardware parts that fail or malfunction - this support is generally done through a ticket system and relies on the user to report errors.

Examples

• http://www.ovh.com/ca/en/dedicated-servers/hosting/
• http://www.soyoustart.com/ie/offers.xml
• http://www.hetzner.de/en/hosting/produktmatrix/rootserver
• http://www.coolhousing.net/hosting-dedicated-servers.html

Benefits

• User has total control of the system's software
• User has total control of access rights
• User has control of physical network connection, allowing them to whitelist or block connection from allowed or spurious connections
• Financial cost of hardware malfunction is not an issue as the host is responsible for replacing/repairing failing hardware
• The host can be chosen to place the server in a different jurisdiction from that of the user to prevent seizure

Downsides

• The user does not have physical access to the server
• The host is not responsible for data loss or downtime if the physical server fails
• The user is responsible for detecting and reporting hardware faults on some providers
• The time taken to repair a hardware malfunction depends on the provider chosen. See Choosing a hosting provider.
• The contract can be terminated by the host and access to the server can be terminated or suspended depending on the host's terms of use.

VPS

A Virtual Private Server(VPS) is an instance of a Virtual Operating System running on a much larger server. Typically multiple VPS will be run on a single server. In a VPS environment, you have a dedicated virtual private server but do not control the server on which it is hosted. Resources will be limited, you can not control or harden the outer server.

Examples

• https://www.linode.com/pricing
• https://chhost.net/virtual-server/
• https://www.tilaa.com/orders/add

Benefits

• The cost of this type of server will typically be significantly cheaper than a dedicated server
• Depending on the host, the server will be capable of running most standard server software, up to a certain limit
• Hardware is managed by the hosting provider unless self hosting
• If self hosting, a single server can be used for multiple purposes and to provide multiple distinct servers

Downsides

• Processing power will be limited over a dedicated server but, depending on the hosting provider, should be capable of running small to medium capacity websites
• Bandwidth will also be restricted
• Potential risk of provider, law enforcement or other state forces accessing contents of virtual server without user's awareness.
• The user will not have access to the outer server and will thus not be able to harden it

Threats

• Social engineering attack
• Password brute force
• Service interruption through denial of service attack
• System software exploits
• SSL man-in-the-middle attacks
• Data loss or data theft

Mitigation

Password management is the core of any security strategy. For the dedicated and VPS hosting options, there are several modes of control that administrator can apply.

1. Enforce strong password - a strong password should contain Upper and Lower case characters, Numbers and Special Characters and should be long; greater than 20 characters. It is also possible to restrict the use of previously used passwords. On Linux systems the following command can be used to force complex passwords for users:

password required pam_cracklib.so minlen=12 lcredit=1 ucredit=1 dcredit=2 ocredit=1

For more detail, refer to the guide Force strong passwords

2. Use password aging: the chaging command on Linux servers allows checking of password age by user and setting of password aging parameters link.
3. In some cases it may be prudent to enabled account locking for accounts that have been under particularly concerted attacks. On Linux systems, the faillog command can be used to check failures and to set failure limits. For more details see Faillog. Great care should be taken when enabling user locking as an attacker can simply deny users access to their own services by intentionally locking an account. Generally it is better practice to ban the attacker before the need for account locking is encountered.
4. Use Password Management software - a tool such as Keepass, or KeepassX for Linux and Mac, allows users to easily generate, store and mange complex difficult to crack passwords. Refer to this guide for details on Keepass

User Management on dedicated or VPS systems allow administrators fine grained control of user login and access permissions.

1. Root user login should be disabled by default - the sudo package should be installed and all superuser actions should be run through it.
2. Secure Shell(SSH) login should be forced, telnet and ftp login access should be disabled by default. To upload files to the server securely user can use Secure FTP(SFTP) clients.
3. Private keys should be used for SSH login access. The following guide gives details on generating and setting up public/private keys for SSH login, SSH tutorial. Once SSH keys have been set up for all relevant users, disabling password-based logins should be considered.
4. File permissions should be restricted for critical files. User should only be allowed access to files relevant to their work. Execution as root should be restricted. Discussion of linux file permissions.

Software Management

1. System software must always be up to date. Critical patches are released by software vendors and operating system providers on a regular basis. Updates frequently contain fixes for potential vulnerabilities and bugs, if your system is not up to date it may be at risk. A recent example of this is the SSL bug HeartBleed.
2. Minimising installed software is an important step in reducing potential vulnerabilities. The system should have the bare minimum of packages and software installed to support its purpose.

System Management

1. Firewall can be enabled via iptables the guides here and here describe iptables configuration.
2. To protect the server it is important to audit the open ports on the machine. To check listening ports you can run
   netstat -tulpn
3. Logging and Auditing is a key aspect of server security. All hacking, brute force, DDoS or other attacks should be captured, monitored and analysed.
   This guide describes the location and purpose of common Linux log files.
   To ensure that information is not lost, overwritten or that the logs do not grow infinitely the tool Logrotate can be used.
   Installing a tool like Logwatch allows you to monitor and respond to suspicious activity. The following guide describes installing and configuring Logwatch.
4. Security Enhanced Linux(SELinux) is a kernel level security control mechanism, which enforces a set of rules and procedures for the system. SELinux provides fine grained control for access rights and permissions.
   To check if it is enabled run
   sestatus
   To enable run
   setenforce enforcing
   To adjust the SELinux config is available at
   /etc/selinux/config
5. Fail2ban is an excellent tool that can be used both to combat simple DDoS attacks but also to detect and block brute force login attempts.

Apache hardening As well as considering the physical server and it's operating system users must thinking in terms of application security. Especially for those applications which either contain sensitive data or those that provide access routes to the machine for an attacker. Below is a set of guides for Apache webserver hardening.
• 13 Apache Web Server Security and Hardening Tips
• Apache 2.0 Hardening Guide

Database hardening A key approach discussed elsewhere in protecting data, both at rest - on disk - and in use - in memory, is to encrypt these data stores either as part of full disk encryption or as individual restricted encrypted mount points. Below are further guides for specific hardening techniques for the MySQL database system.
• MySQL Security Best Practices
• Security and Hardening Tips for MySQL
• 12 steps for Hardening MySQL from Attackers

Hosted platform

For organisation that wish to setup their own custom site based on an existing platform such as Wordpress.com, there are a setup of steps that should be taken to ensure a good level of security. The choosing a hosting provider guide should also be consulted.

Platform Security

1. Limiting access - Making smart choices that reduce possible entry points available to a malicious person.
2. Containment - Your system should be configured to minimize the amount of damage that can be done in the event that it is compromised.
3. Preparation and knowledge - Keeping backups and knowing the state of your WordPress installation at regular intervals. Having a plan to backup and recover your installation in the case of catastrophe can help you get back online faster in the case of a problem.
4. Passwords
5. File Permissions
6. Admin user
7. SSL
8. SFTP client
9. Platform updates

Hosting install of pre-built software platform, such as Wordpress,

Shared Hosting

In a Shared Hosting environment, your and other website owners shared one server. This includes sharing the physical server and the software applications within the server. Shared hosting services are affordable because the cost to operate the server is shared between you and these other owners. There are, however, a number of down sides, such as being slower.

Examples:

• http://www.easyweb.com
• http://www.dreamhost.com/web-hosting/
• http://wpengine.com/ (wordpress only)

Threat Mitigation

For a basic setup providing a content distribution platform such as a blog user's have the option of using existing free services such as Wordpress, Journoportfolio or similar.

Threat Mitigation

strong passwords, 2 factor auth,