[Help] Server and web security

[SmoKey]

Hello guys, for securing a server i can use the tutorial with firewall sygate or is to old? Or is another metod to secure the server.. with diferent firewall ?
And for the web ?

Tnx ! Octa

 

[pafa7a]

Hello guys, for securing a server i can use the tutorial with firewall sygate or is to old? Or is another metod to secure the server.. with diferent firewall ?
And for the web ?

Tnx ! Octa

For the web - the best suggestion is to check every function in your website manually. There are some free vulnerability scanners, such as OWASP ZAP, but dont trust them on 100%.

About server - close all ports, except CS and GameServer's

 

[dota-sdso]

pafa7a is absolutely right, as usual !

They are many automate tools out there such as metasploit, sqlmap, hydra, acunetix and so on that may help you find a holes/suggestions, but none of them will save you from advanced attacks in a specific conditions.

For example you can be invulnerable to a simple sql injects, xss or any application related exploits, but one unsecured badly configured module/function can cause the same damage to you and open another holes.

 

[SmoKey]

Tnx guys for the answers !
Can u recomand me an firewall ? or sygate is enough for blocking ports?
And for mysql wich port i have to block ?

 

[pafa7a]

Tnx guys for the answers !
Can u recomand me an firewall ? or sygate is enough for blocking ports?
And for mysql wich port i have to block ?

Tbh I don't trust on firewalls. I can't recomment you one.
About port blocking - I think that the better option is to block all ports except those that you will use for external data transfer. You dont need to have sql port opened. If you are in MuOnline community those are the default ports that only needs to stay open:
80 - apache
44405 - connect server
55901 - GameServer
55919 - GameServerCS

Keep in mind, that the ports may not be the same for you.

 

[^TheLast^]

All replies here are good. My suggestion is to simply use Windows Firewall. As pafa7a said just leave the needed ports open and close all others. Ports like 22 and 23 for Telnet and SSH must be closed if you use paid hosting. Delete the phpmyadmin, security and webdav folders in xammp if you use it. Disable mysql you dont need it at all. The default port of it is 3369 if i remember well but if your windows firewall is up that port will be blocked by default. SQL works on port 1433 and deff. must be blocked for external connections. If your SQL password is weak and the port is open can be easily bruteforced.