A Firewall is a part of a computer system designed to block or permit network communication based on set of predefined rules. The design and operation of the Internet is based on the Internet Protocol Suite, also commonly called Transfer Control Protocol / Internet Protocol (TCP/IP). In this system, hosts and host services are referenced using two components: an address and a port number. For example, HTTP—standard web protocol uses port 80 by default. In general, most services use a limited number of ports. A common technique for detecting running services on a public server is port scanning. It is used by administrators for verification of their security policies and by hackers for obtaining lists of potential targets for later attack. To prevent this and other types of misuse we should block access to all ports except the ones we want to expose to the public. This blocking is done by firewalls. They can be available either as hardware appliances or software service running on the server.

In this chapter and throughout this book, any practical examples offered for Linux apply to CentOS 5 Linux, which is an open source version of Red Hat Enterprise Linux 5 server. Firewall comes as standard in the out of the box product, so we will first show how to enable and configure it for safer functioning of our Moodle server.

As you can see, we have selected the SSH, WWW, and Secure WWW options. These three are what are usually needed to have properly exposed web-server service. SSH service is enabled because it offers a standard access for remote administration of the server. In case you have another way of configuring your server, you can disable SSH.

In the 1983 movie "WarGames" there is a very characteristic scene with a young Matthew Broderick. In that scene we see him in front of the principal's office waiting for his meeting. On his left side there is an empty seat with a computer terminal linked to the school's computer system. As a young hacker he is keen on entering into the system without being noticed. The curse of forbidden fruit is again at work. In order to enter into the system he needs a valid password. Knowing how people hate remembering passwords, he assumes that it is probably written somewhere near the terminal so that whoever works there will be able to login without too much hassle. He opens a bottom drawer and voila! A piece of paper is glued to the drawer with the latest passwords, ready for use. We also note that all of the passwords are simple dictionary words like effort, points, double, pencil, etc. He later uses that knowledge to enter the school computer system and modify his grades to the desired level.

This example from a Hollywood movie is actually based on some real facts. People hate remembering more than two or three passwords, so they try to apply them to all their services and accounts. This is exactly what a responsible administrator must not do. Using simple and standard dictionary words (dog, cat, table), or other personal or institutional names and idioms as your password is a serious security breach. It exposes your system to a possible "dictionary attack".

This example from a Hollywood movie is actually based on some real facts. People hate remembering more than two or three passwords, so they try to apply them to all their services and accounts. This is exactly what a responsible administrator must not do. Using simple and standard dictionary words (dog, cat, table), or other personal or institutional names and idioms as your password is a serious security breach. It exposes your system to a possible "dictionary attack".

An important step in securing your Linux server is to determine its primary role. An administrator should know exactly what is installed on his system because otherwise it could be difficult to secure everything available, and overall security will be lower than it should be. You should review the list of packages installed and remove unnecessary packages that do not comply with your security policy. If you do this properly, you will have a lean system that occupies minimal resources and a limited list of packages to update and maintain when security alerts and patches are released. For example, if you do not use FTP, remove it. It is also a good policy not to have any development packages on a production server. Unless you need custom compiled packages, try to build them on a separate machine and deploy them precompiled to all the other production boxes.

All software has bugs, and those bugs can prevent it from functioning properly. Some of the bugs do not directly affect program functioning, but instead create security holes. These security holes can be (and often are) exploited by malicious attackers. It is therefore crucial to update all of your essential packages either from a distribution repository or by manual installation. CentOS offer updates through YUM.

As a responsible administrator you should evaluate all package updates and decide if you should perform the update or not. It is recommended to have a written security policy and procedure to handle Linux security updates and issues. Assuming we will have Moodle installed on a single production machine with Linux, Apache, MySQL, and PHP (also known as LAMP); we should primarily focus on these packages and make sure they are updated accordingly.