[Imc-miami-tech] imc web comments

[radio head]

to: web tech group

here is a comment i found on the site
http://miami.indymedia.org/news/2005/04/1256_comment.php#1276

what do you think?

eos
============================================
what to do
by Benjamin Monday, May. 02, 2005 at 10:51 PM

Here's what you do:

Run on Linux (or bsd) with no ports open other than 80.
Run Apache latest production version.
Make sure your PHP is tight (ie. no publicly accessible
variables).
Run a firewall in front of your local director like
Checkpoint.
Make sure your inside network addresses are non routables
and that yer hosting facility border routers are actually
discarding the non routables.

Have your sys admins read bugtraq religiously and
patch your s**t ASAP when a remote exploit comes
to light.

What NOT to do:
Do NOT run yer s**t on anything other than UNix.
Do not run yer s**t on anything other than open source
softwares, because they get fixed much faster than non
open sourced products.
Do not allow project managers to have anything to do
with the design of networks or installations.
They simply do not have the skillz necessary.
(Example, tardo wants to put the firewall between
the webservers and the database box because it will
"run faster" and have no firewall in front of the
webservers. This is Wrong.)


Finally, if you're getting exploited or taken down by
some obscure mal aligned packet infoze ICMP etc
then do make sure your firewall ruleset is correct.
Make sure your firewall LOGS the ip's of any
funky packets it receives. You'll need this for
proper forensics after the fact.
Course, this might be a sploit 4 PHP or something.
Dunno.

Do probe around your hosting centers s**t to see if
_they_ have any vulnerabilities and promptly inform
them of any you find.

Take it easy.

PS. I am out of a Job courtesy this administration.
Someone in India is making a few bucks so I can
sit on my ass in America and watch chemtrails in my skies.

www.bugtraq.com

add your comments

_________________________________________________________________
Don’t just search. Find. Check out the new MSN Search! 
http://search.msn.click-url.com/go/onm00200636ave/direct/01/