I am jumping into hosting a Linux server on AWS, and I need a place to ask my question that I could not find online about hidden vulnerabilities to Linux servers. Is it acceptable to post this question on Server Fault? What changes would improve this question?
I want to become more mindful of what hidden vulnerabilities there are to hosting a Linux user database server written in Java on AWS, and how do I avoid them. By hidden vulnerability, I don't mean coding mistakes like allowing login forms over insecure HTTP or management mistakes like giving someone unattended access to the server who installs rootkits. Rather, I feel compelled to "look under the hood" of the Linux OS because I'm the sort of guy who has a compulsive desire to be absolutely thorough in his code and leave nothing to chance. I use libraries only when absolutely necessary so that I can "feel" the entire flow of data through every aspect of my application and proactively prevent any possible vulnerabilities caused by my code, not Linux's code. I could not find any good articles on securing the Linux OS itself, so I am asking here about what do I need to learn and where do I go to learn it. Specifically,
- How many of the cases where websites got "hacked" and usernames/passwords were copied were very preventable? Of the attacks not targeted at poorly written code, misconfigured servers, some running application granting a backdoor, or an insider job, how were these attacks carried out and where can I learn more about them?
- Which Linux OS distro should I use for optimal server security without too steep of a learning curve (haphazardly guessing on things I don't entirely understand is always a recipe for disaster)?
- Which applications/configurations/things should I look out for that might compromise security?
- What other questions should I be asking? (I don't know what I don't know, and I came here to figure out which things I don't know).
One particular thing I had in mind is to disable the root account, create separate user account for both my server files and my server data stores, and prevent any other account for accessing any aspect of the server. The server data store files would be on a rotating password. That way, in principle, one needs the random password I have written down at home just to log in as the owner of the server files and access them. As I shall only put the final JAR files on my server and keep the source code at home, even if someone got the password for the server files, accessing the actual data stores would be a lengthy ordeal involving decompiling and analyzing the server JARs to figure out how the rotating password system works. Would this add any extra security, or are there other better approaches that my time would better be spent on?
Many thanks!
