My very own server

I am setting up a server to run a php web app to hold sensitive information. As such, I want to setup up a secure server and have lots to learn along the way. I want to blog about this process for 2 reasons: to write down what I learn so I can find it again when I need it, and to share what I learn with others in case it might be useful.

I have installed ubuntu 9.04 server on a second hand P4 box I got for $70 at a local computer recycler. I have in the past used an old laptop to run an intranet server only available inside my home, but it is getting hard to maintain because it is so old and very much underpowered. This P4 box is small and quiet. I now want to see what is it's power consumption is compared to my old laptop. If it's reasonable, I will replace my intranet server with one of those P4 boxes too.

A bit about the php web app I want to run. It will be dealing with sensitive financial information, so only secure encoded connections will be allowed. At first, only mysql will be used to store data, but I eventually want to get the app working with postgresql, so both servers will be running. I will not be handling email through this server, for the time being anyways.

I have learned a few things since setting up the server. First, you can get a list of open ports with the command

sudo netstat -anp --tcp --udp

I get the following output:

tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 2179/mysqld
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 2448/apache2
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 2328/sshd
tcp 0 0 127.0.0.1:5432 0.0.0.0:* LISTEN 27823/postgres
tcp6 0 0 :::22 :::* LISTEN 2328/sshd
tcp6 0 0 ::1:5432 :::* LISTEN 27823/postgres
udp 0 0 0.0.0.0:68 0.0.0.0:* 2289/dhclient3
udp6 0 0 ::1:56146 ::1:56146 ESTABLISHED 27823/postgres

Ill have to turn off the mysql and postgres ports and find out what the dhclient3 is all about.

The next thing I learned was how to get security updates. The command sudo apt-get update is used to update the local list of packages. This does not install anything but should be run before any of the following commands are run to make sure the list of available packages are up to date.

To install updates use sudo apt-get -u upgrade. Some upgrades need to run sudo apt-get -u dist-upgrade. I am not sure of the difference between the two. More info can be found at ATP Howto.

The next thing I want to accomplish is to install cvs to track changes to configuration files in the etc directory.