How do I secure a production server after inheriting it from the previous development vendor?

Question

We received access to the environment, but I now need to go through the process of securing it so that the previous vendor can no longer access it, or the Web applications running on it. This is a Linux box running Ubuntu. I know I need to change the following passwords:

• SSH
• FTP
• MySQL
• Control Panel Admin
• Primary Application Admin

However, how do I really know I've completely secured the system using best practices, and am I missing anything else that I need to do other than just changing passwords?

Answer 1

You will probably get more responses at serverfault.com on these kinds of questions.

Answer 2

There are several things you can do to secure SSH by editing your sshd_config file which is usually in /etc/ssh/:

1. Disable Root Logins

   PermitRootLogin no

2. Change the ssh port from Port 22

   Port 9222

3. Manually specifying which accounts can login

   AllowUsers Andrew,Jane,Doe

SecurityFocus has a good article about securing MySQL, although it's a bit dated.

Answer 3

3 simple steps

1. Backup configurations / source files from HTTP / SQL tables
2. Reinstall operating system
3. Follow standard hardening steps on fresh OS

Regardless of who it was, they could have installed any old crap on there (rootkits) that you can't configure away.

Answer 4

The best thing you could do would be reinstall and make sure when you bring over files from the old system to the new that it is just data, and not executables that could be nasty. If this is to much, changing all the passwords, and watching the logs for a few weeks, as well as playing with iptables to block former vendor. Also given that it could have a rootkit at the kernel level its probably good idea to change that out, and also watch traffic coming out of the box fro something that might be going to the vendor. It really is a hassle to take someone else's machine and say that is safe now, I would go as far to say it is nearly impossible.

side note. This isn't really programming related so probably shouldn't be on this site.