Home Network Security

[Pulsar]

Ok - I recently got my home network up and running thanks to help from you guys. My set up is:

Modem => Buffalo Router (dd-wrt firmware)=> 3 computers & voip adapter

The Buffalo Router has the firewall enabled. The 3 computers all have windows xp, Zonealarm, Kaspersky, and Windows Firewall running on them. I have Zonealarm configured to allow the local network addresses only for file sharing. I have the wireless client on the Buffalo Router enabled with encryption (though this isn't really a problem because I live in the middle of no where).

My computers are set up with two computers that are regularly "used" and the third which is only a storage server. I also have my .pst outlook mail files saved on the storage server so either computer can be used to easily check email, etc.

I have FTP enabled on my main computer by using Filezilla server, with ports forwarded through the router. This now functions without an issue. I use no-ip.com to give a domain name to my ftp because dd-wrt natively supports updating the no-ip site with the correct IP.

Finally, I want to set up a small web-server as well. I was looking at using this free solution:
http://www.download.com/Abyss-...23239.html?tag=lst-0-1

My question: is there anything I'm missing or anything I'm opening myself up to with my setup and the programs I'm using? I get a free pass at shields-up port scan, but with an FTP and web server running I'm leary of just how much access I'm allowing people to my computers.

I have filezilla set up to auto-ban any IP for 24 hours if it mis-logs-in 5 times consecutively. I can't find an option in dd-wrt to keep folks from hitting the web interface, and though it's password protected that still makes me nervous. Anything else I'm missing?

 

[xSauronx]

check under Administration -> Management in DD-WRT to enable/disable web GUI access and SSH access

it should be disabled by default.

 

[nweaver]

I wouldn't use that web server. It's obscure, and unknown. Go with something that is known. If you have Windows 2003, IIS6 is pretty secure by default. Otherwise, the standard web server is Apache. It's hard to beat apache.

 

[JackMDS]

Abyss is not obscure it actually a nice entry level free server.

Using simple entry levle hardware you did a good Job.

Are you totally secure? No since any server that sit on the Internet is Not totaly secure.

There is a away to gain extra security.

Configure the network to share with NeBEUI and unbind TCP/IP from File sharing, by doing so if the Servers computer is compromised there is No access to the other computer through the Internet.

http://www.ezlan.net/netbeui.html

 

[nweaver]

Originally posted by: JackMDS
Abyss is not obscure it actually a nice entry level free server.

Using simple entry levle hardware you did a good Job.

Are you totally secure? No since any server that sit on the Internet is Not totaly secure.

There is a away to gain extra security.

Configure the network to share with NeBEUI and unbind TCP/IP from File sharing, by doing so if the Servers computer is compromised there is No access to the other computer through the Internet.

http://www.ezlan.net/netbeui.html

ok, maybe it isn't obscure, I have just never heard of it in Enterprise land. I myself, based on experience, would run Apache on Windows in this instance, as Apache is a tried and true web server. Again, that's just because I've never heard of/used Abyss. I would think that Apache is the standard free, nice, entry level web server

 

[Pulsar]

Thanks guys.

I like the Netbeui idea, but I have a lot of people coming and going for computer parties and I don't want to have to reconfigure their computers. I think I'll keep the tcp/ip for now.

I did install apache. It was amazingly easy to install - point and click and done. Now I need to learn a bit of PHP, I want to password the website since it's only going to be serving files for people I work with.

 

[Nothinman]

Abyss is not obscure it actually a nice entry level free server.

I guess that depends on your definition of obscure. I know that I've never heard of it and no one that I know has never heard of it so I would most definitely consider it obscure. That coupled with the fact that it was made closed source ~6 years ago I don't see a good reason to use it over Apache.

Now I need to learn a bit of PHP, I want to password the website since it's only going to be serving files for people I work with.

You can do that with an .htaccess file without any PHP.

 

[Pulsar]

Yep. That's what I did. Interesting that the apache tutorial says using .htaccess isn't the way to do it "correctly" - seems like that's what a lot of websites say .htaccess should be used for. It took me a bit, but it's up and running and passworded.