how can i check if a web site is secure

[queen]

I am trying to check if http://www.channelnewsasia.com/ is a secure site.

I tried to use nmap and wireshark.

nmap to scan all the ports 0-65535 takes quite a long time (tcp & udp).

So I tried with ports 0-150 on tcp and udp.

[pdr]

Keep in mind that there's two "types" of security you are talking about here:

1. The server is secure from a socket-level point of view.

2. The web site is secure.

nmap and such are testing item 1. If this is your server then securing it just involves making sure it is not "serving" anything you don't want it to (ie that any software - including, say, iptables in the kernel - is only listening to a port because you NEED that service). Use "ps ax", netstat, "iptables -L tnat" and "iptables -L" to see what is running and listening (and in the case of iptables, possibly translating). It does not matter if a port is open if no process is listening to it (discounting if there is a bug in the tcp stack of the kernel - don't know if I've ever seen one that was actually exploitable). So, for example, port 23 can be open all day long and there is no vulnerability - unless, of course, you have sshd running and listening to that port.

What you want this for is by knowing what services you are actually running you can check the GLSAs to keep up on any vulnerabilities they might have.

Item 2 is where a LOT of sites get hacked. From the item 1 perspective you would be noting that apache(2) is listening to port 80, and you would be checking the GLSAs for apache vulnerabilities. However this is how a very small number of hacks (any in recent years?) occur; where you get bitten is that you have a vulnerable apache config or - most probable - some php pages that were written unsecurely and allow malicious users to access/modify data. Of course just having mod_php, or mod_perl, etc means you have to check GLSAs for vulnerabilities in the modules, but again most reports I see are from poorly written sites.

Another example: sshd might be secured properly, but the server has accounts that can be hacked (just check your /var/log/messages for bots that are trying to log in with well-known accounts to see what I mean).

Security is a bottom-up thing. Start with nothing listening, no accounts except root. Add user accounts as actually necessary, keeping track after you emerge packages that they didn't add an account - and if they did, that either the account is not allowed to log in (ie is only used for filesystem accessibility, such as the apache user) or that if for some reason it DOES need to log in, that it has a "good" password. Be very careful of the auto-service kinda stuff (haven't used it in so long I don't even remember what its name is! - the daemon that listens to ports and, when a connection is made, fires up the appropriate service for it); I never use this on any of my servers.

When first bringing up a service that listens to ports, make sure you lock it down before testing it. For example, before bringing up apache for testing, set iptables first so that packets can only get to port 80 if they are from localhost or the local intranet. And you should have the apache first set up to do almost nothing (or consider running it in a chroot jail) and, if possible, CHECK that your iptables are correct and only "good people" can access it (ie try hitting it from non-allowed ip addresses)! Now you can test the apache config to see that it is only performing operations you want it to.

Web site security: this is actually a piece of cake, and probably 90% of web sites get it wrong. Just assume that someone is going to post your url on Warez-R-Us and code accordingly. Validate every single piece of information that can come from the user. It does not matter if the data, say was "supposed" to come from a hidden input value that your previous page filled in - a cracker can send any data he wants. He can send unicode characters that might get interpreted differently than you want them to be, he can insert characters that allow him to do SQL injection - anything. This is called software engineering, and is nothing more than validating preconditions. Also perform consistency checks in the software. If a user is supposed to be logged in as an administrator by the time they get to a particular page, don't just check that they are logged in - make sure they are an administrator too. If a user value is going to be inserted into a SQL integer column, ensure that the value matches the regular expression for your fields data type (eg if it is a dec(9,0) field, actually validate it is a "[1-9][0-9]{0,8}" string).

The point here is that you have to design your security. While testing if something is secure can be fun and lets you use up empty hours where you had nothing else to do, the problem is that you have to test every single method a cracker might use to access your server - and that is evolving all the time - and there is an exponential growth problem when you are running multiple services.

[queen]

Thanks a lot for the explanation, but i can't do anything alike, because i don't have access to their computer. I was only asked "can you tell if this site is secure"?

Which tools as an external user I can try in order to check if that web site is secure?
I used nmap and wireshark to check if ports are open.

Scripts?

And I'd like to be legal as much as possible considering the situation. Meaning to check if there are vulnerabilities, without exploiting them.

[Hu]

[madisonicus]

[queen]

[madisonicus]

[queen]

[Varsuuk]

[queen]

[pdr]

Varsuuk -

I have seen either here or on gentoo-wiki.com a howto on running apache in a chroot jail.

If you are serving just static pages (markup, images - not php, etc) and OPS (Other People's Software) then its just a case of 1) lock down your server itself, 2) lock down apache, 3) check readme, install notes, etc for phpbb et al for any security-related config items, and 4) check for GLSA notices.

The great thing I love about Gentoo is that it starts out secure - with the base install you don't even have sshd running and you only have two login accounts - root, and the "normal" user the guide recommends to add. So if you install gentoo and then, piece by piece add/start services, you have the opportunity to make sure each new piece is locked down before it goes online. To me this is tremendously better than, say, slapping on Ubuntu and then hunting furiously through ps et al to find out what is already running and securing it.

There are lots of guides out there on securing a web server. I don't run apache in a chroot jail as I don't feel it is required - the apache user is configured to have pretty limited access so I wouldn't gain much. The first thing I do when I install apache is, before starting it up:

1. Edit /etc/conf.d/apache2. By default it only enables the default vhost and is set to only keep the PATH env variable; for a home server (not using virtual hosts) this is probably fine.

2. Edit /etc/apache2/httpd.conf. In particular I comment out all of the LoadModule lines unless I know I need it for a base install.
Handy note here: don't just put an octothorpe (#) in front of the LoadModule line - personalize it like: