Network security issues that need to be paid attention to when building a web server on CentOS

Network security issues that need to be paid attention to when building a Web server on CentOS

With the rapid development of the Internet, more and more companies and individuals have begun to build their own Web servers to host websites. However, network security issues have also become a factor that cannot be ignored. This article will introduce some network security issues that need to be paid attention to when building a CentOS server, and give some code examples to illustrate the solutions.

1. Update the system and software

Before setting up a web server, you first need to update the CentOS system and software. Use the following commands to update your system and packages and install the latest security patches.

yum update -y

2. Disable unnecessary services

When building a web server, in order to reduce the potential attack surface, some unnecessary services should be disabled. For example, turn off unsafe services such as FTP and Telnet, and only enable necessary HTTP and HTTPS services.

Use the following command to disable unnecessary services:

systemctl disable vsftpd
systemctl disable xinetd

3. Configure the firewall

CentOS has a built-in firewalld firewall, and you can restrict IP access to the server by configuring firewall rules. and port. The following is a simple firewall configuration example:

firewall-cmd --zone=public --add-port=80/tcp --permanent
firewall-cmd --zone=public --add-port=443/tcp --permanent
firewall-cmd --reload

The above configuration allows HTTP and HTTPS access.

4. Use HTTPS encryption

When building a web server, you should consider using HTTPS to encrypt the transmitted data. HTTPS uses the SSL/TLS protocol to encrypt data, which can effectively prevent data from being eavesdropped and tampered with.

First, you need to generate an SSL certificate and private key for the server. The following is an example of using OpenSSL to generate a self-signed certificate:

openssl req -newkey rsa:2048 -nodes -keyout server.key -x509 -days 365 -out server.crt

The generated server.key and server.crt are the private key and certificate files respectively. Then, you need to place these two files in the SSL directory of the web server and configure the web server to support HTTPS access.

5. Disable unnecessary directory browsing

When building a Web server, unnecessary directory browsing functions should be disabled to prevent hackers from obtaining file list information on the server. This can be achieved by modifying the configuration file of the web server.

Taking the Apache server as an example, you can modify the httpd.conf file and add the following lines in the target directory:

Options -Indexes

6. Restrict file uploads

When building a Web server , the type and size of uploaded files should be limited to avoid uploading malicious files. This can be achieved by configuring the web server.

Taking the Nginx server as an example, you can modify the nginx.conf file and add the following line in the http block:

client_max_body_size 10m;

The above configuration limits the maximum size of the uploaded file to 10MB.

7. Protect the database password

When building a Web server, if a database is used, attention should be paid to protecting the database password. This can be accomplished by storing the database password in a configuration file and setting appropriate file permissions.

Code example:

import os

def read_db_password():
    with open('/var/www/config/db_config.txt', 'r') as f:
        password = f.read().strip()
    return password

def main():
    db_password = read_db_password()
    # do something with the password

if __name__ == '__main__':
    main()

The above example code stores the database password in the /var/www/config/db_config.txt file and reads the password from the file . Make sure the file is readable only by the web server user.

Summary:

When building a CentOS web server, network security issues cannot be ignored. By updating the system and software, disabling unnecessary services, configuring firewalls, using HTTPS encryption, disabling unnecessary directory browsing, restricting file uploads, and protecting database passwords, the network security of the server can be effectively improved. Developers and server administrators should pay close attention to the latest security threats and take appropriate security measures to protect server and user data security.

The above is the detailed content of Network security issues that need to be paid attention to when building a web server on CentOS. For more information, please follow other related articles on the PHP Chinese website!