Can you help me formulate a better question (re: server security)

Question

I would like to learn more about how to secure a webserver including topics like which OS to use, what policies to consider, which pieces of OSS are available that can help, what (human) processes are considered the best practices, etc.

I tried asking, "What is the “state of the art”, “best practice” in securing a colocated webserver, or EC2 instance running Linux?" on serverfault, https://serverfault.com/questions/474762/what-is-the-state-of-the-art-best-practice-in-securing-a-colocated-webserve, but it was closed within an hour as "not a real question".

I had been hoping to be directed to perhaps a well known and respected book, or perhaps a well known and respected website, or perhaps, an organization's checklist dedicated to such things, or even to an online community like serverfault, or maybe a subreddit.

I was a bit dismayed that my question was closed as vague.

Can you help me formulate a better question that is more appropriate to serverfault and will not be closed as vague and answers the question I have, which is where can I look, what are the best and most up to date sources to learn about securing servers, securing "stacks", and securing web applications?

Thanks.

Answer 1

Actually the primary problem here is that the question is overly broad.

From the FAQ:

Your questions should be reasonably scoped. If you can imagine an entire book that answers your question, you’re asking too much.

This question would take at least a book to answer properly, and probably several books.

Moreover, you've asked for recommendations for learning material, which is expressly disallowed on Server Fault.

I can't see any good way to improve the question so that it could be reopened. In the future, try to scope your questions to specific practical issues that you are facing.

You may also want to visit our sister site IT Security and search there for information of interest to you. Their site rules are slightly different, as well, so be sure to check their FAQ as well as search.

Answer 2

We generally expect questions to be reasonably scoped. You can write whole books about securing servers, stacks etc. - that's the reason why your question was closed - it's way too broad.

Having said that we have an excellent canonical Q&A on securing a LAMP server which would be a good place to start. Once you've done that then you could also work your way through the Q&A in this search.