help with Apache2Triad

[StrongShock]

i just got my feet wet with internet servers the other day. i'm running a Apache/MySQL/PHP package called apache2triad (link below):

http://www.hotscripts.com/PHP/Software_and_Servers/Installation_Kits/index.html

i have a few questions:

1) It seemed way too easy to get my website & ftp running using that app with the defualt settings. I've read many stories about what a nightmare keeping a server secure can be, so my simple server seems too good to be true. Is there a basic way I can keep the security up to date? maybe only a mailing list for the apps in necessary?...

2) Ports... I'm a n00b, so i'm not sure which TCP ports must be opened or closed. web=80, ftp=21, smtp=25, & pop3=110 right? do those ports need to be forwarded to my server for the corresponding services to work right?

3) I'm having issues with Xmail. I added myself as a user & setup my friends outlook to test it. His outlook doesn't show errors unless I send mail through my SMTP. Even though outlook has no errors checking the pop3 account, no messages get through. Heck, i'm not even seeing mail that should be in the inbox when i log on the localhost as root (one exception, the Xmail test message worked when sent from the localhost). i have no idea where to start fixing my mail server from reading the Xmail manual (i've done C coding, but those tags are greek to me). can anyone help?

 

[Bleep]

Apache is very easy to get going. Before doing all this print out the httpd file, these will be seen on page 9 of the printout

once you have Apache installed and working properly. Go into the htdocs file and creat a new folder, rename the folder to anything like "site" dump all your html file and the other things that are used on the page into this folder. Save your changes

Switch over to the httpd file and go down 9 pages until you come to document root at the end of the line /htdocs just add /(whatever you named the folder that you made.)

Scroll down to Directory and do the same there, save the changes. start up the server and just type in your wan address <http://123.456.789.000> or whatever it is.

Bleep

 

[StrongShock]

like i said in 1), i know apache is easy to start.

after getting my domain & dns working, i of course got hacked. I woke up this morning to hundreds of friggin e-mails being scanned by NAV. i guess i was asking for it since i'm a n00b with a mail server.

in desperation i attempted to stop the spams by: disconnecting, shutting down Xmail, & removing SMTP & pop3 port forwarding.

well, the spam seems to have slowed significantly, but i still get NAV outgoing scans once in a while. lord only knows what is going out to the internet without that scan window popping up.

since this was a hard lesson for me, i'll definately be more careful from now on. i'm leaving the mail & ftp alone for now, but i'm still concerned if there is still a hole in my server that is letting ppl access & modify my server. i feel like a failure, but i'm trying to maintain dignity by saying to myself, "i'm only a n00b".

PLEASE, someone with experience in securing a simple apache/sql server help!!! all i want is my site & phpBB forums to work without ppl hacking me.