Securing Access to Home Hosted Web Server

[Intercontinental]

Hoping for some advice here.

Currently running a small web server for a few bits and pieces for probably a dozen users.

It is running in a KVM VM, with a PCI NIC Passthrough, with port 80 and only port 80 forwarded to the fixed IP of this machine. Ubuntu Server 14.04.3 - automatic updates on and most of http://blog.mattbrock.co.uk/hardening-the-security-on-ubuntu-server-14-04/ done too.

Currently there is only the login pages for the apache 2 based software, but I'd like to add another layer before that and ideally completely separate that machine from the rest of the network.

For the latter, I can't separate it electrically (i.e. Server is plugged in to a 24 port switch which is in turn connected to the router (RT-N66U running tomato) in another room), so I assume there is nothing I can do to prevent my server, if it is 100% compromised, from having a crack at anything else on my network?

Secondly, what would the best/easiest way of putting another login before the login pages for the software?

I.e. when the user navigates to www.mywebserver.com/softwareA, it asks for a user/pass before allowing you to continue to the normal softwareA login page?

.htaccess is a possibility, but I regularly access this outside of my network and iOS doesn't store credentials like this (Irritating and/or insecure if I don't use a decent combo!). So could I allow any IP in my home network range access this without the .htaccess login prompt and also setup something (some sort of proxy perhaps?) to allow my iPhone external access?

Any thoughts or tips? I would consider adding another NIC and VM to control access if it thought benefical?

Cheers.

 

[sfx2000]

It's a good guide - with KVM and a home hosted public server, having a physical NIC is actually a preferred way to sandbox the VM away from the host OS, and gives more flexibility if one wants to put the VM guest on a VLAN..

htaccess, while a bit painful, is a good way to keep folks at bay..

 

[RMerlin]

Apache lets you control access by IP through an htaccess file (regardless of whether you decide to also add authentication to it or not). The procedure is different depending on whether you are on Apache 2.0/2.2 or 2.4 (which introduced a whole new syntax). Look up the documentation on the "allow from" settings.

Another security measure to consider if you are worried about security is mod_security. I haven't looked into that module in over ten years, but it generally has good feedback, provided you are willing to devote the time required to finetune it for your particular application.

 

[coxhaus]

If you are going to access from your phones then you will not be able to lock down the IPs so maybe a remote control from a device on your network.

The only way to totally isolate your server from your inside network would be to create a VLAN or separate network. This of course would effect any kind of remote control to devices on your inside network. A layer 3 switch would allow access from one device on your isolated network either by IP or IP port level, You can also do this with some routers which have VLAN and ACL, access control lists.

 

[sfx2000]

And for internal, can always add the local IP's to dnsmasq to resolve inside without having to hairpin the connection - which is also nice for PC/Mac/Linux, as one doesn't have to edit hosts files

 

[Intercontinental]

Regarding VLANs, surely if the attacker has 100% control they can find the IP, etc. Of my normal network? How does that work? I'll have a google in the mean time.

The switch is a Dell 2407 if that helps any!

Is there a list of UK IPs? I've in the past limited the access to O2 only IPs. Whilst not foolproof if the server doesn't initially respond to an IP outside the UK then they might temporarily move on?

I think mod_security is installed already, or it is the one I removed as it was causing issues with the default config (404 not found if you refresh the page too quickly AFAIK).

Sfx2000, dnsmasq? What does this solve? Allowing the server to respond to internal network IPs whilst limiting external ones?

Thanks all.

 

[sfx2000]

Sfx2000, dnsmasq? What does this solve? Allowing the server to respond to internal network IPs whilst limiting external ones?

DNSMasq allows you to have both internal and external hostnames/addresses, and then you can play around with the .htaccess (user/pass for external, not for internal) - makes life easier inside the network, esp. when doing development or moving files around.