0

I am pretty sure this may come across as a pretty dumb question but I will ask it anyways. I took some measures to secure my raspberrypi (for example creating a new user and deleting pi, changing the root password, and connecting to the pi through ssh with rsa keys).

Now I want to install apache2 on that pi to use it as my personal server. Should I also take measures to secure apache? Like those described here? (if you have any other suggestion in terms of good guides for beginners they'd be much appreciated)

Improve this question
1
  • 2
    If you went that far with securing your RPi, why wouldn't you secure Apache?
    – computercarguy
    Commented Dec 19, 2017 at 19:08

2 Answers 2

Reset to default
2

Most security questions can be answered with "what's your threat model"?

If it's on the internet, you really want it secure enough that a drive by script kiddy won't notice it, and will move onto the next site. For that that article seems to have most things covered. It also depends on the code you write for it:

  • Are you going to allow ad-hoc unix commands through the website? Probably don't.
  • Does your code follow best security practices? e.g. Don't trust the client, always perform server side validation (see OWASP top 10), etc.

If it is only on your own Network, then you really shouldn't need to go that far unless your Network has untrusted people/devices on it.

If you're worried about three letter agencies, that's one for another day :).

You can go as far as you like with hardening things, it just depends who you want to stop.

Improve this answer
2

If you're using the RPi for learning, absolutely. You'd secure Apache on the RPi the same way as on any other system, so you can learn some valuable skills. Even if you're only interested in web development, it would be good to learn to write programs that work properly in a secured configuration.

If there's any chance of your RPi being exposed to the Internet or other networks, then again, absolutely. Security is not something you want to try to fix after you've noticed a problem.

You took the effort to secure ssh, so I'm assuming you care about security enough to bother. I'd suggest maintaining that approach.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.