I set up a webserver on my PC

[bobsmith1492]

I'm running Vista Business 64-bit with Apache 2.2.8 hosting a simple website (all basic HTML) with WebDAV for an SVN server and basic authentication required to view files from my computer on a couple of links - these are on a secondary HDD partition separate from the Apache and Windows installs.

Apache is running as a service (so no administrator privileges). Vista firewall is, of course, on with only port 80 open and I'm behind a router that forwards port 80 to the server.

Are there any sites that run security checks I might do to check things out? I tried Symantec's but couldn't get it to run (too many Vista security obstacles...) and didn't want to run stuff from a Googled-up site.

Also, what other risks may be run if I start an FTP server and a VPN as well?

The goal is to be able to access data on my server while I'm not here and possibly develop a useful website alongside.

Thanks!


EDIT: I now have Filezilla FTP server running and a Vista VPN host so there are three open ports forwarded through the router and open in the firewall.

 

[Dravic]

just keep apache patched, and look into some open source WEB vulnerability testers(dont know names off hand). Its uncommon to have apache fall over to hackers, but very common to take advantage of insecure web code. Gets even worse if you though access to a sql database in the mix


dont use FTP, set up an ssh daemon, FTP in insecure.

if your ports are blocked run ssh on a high random port, you get less script kiddies knocking on its door. either way look into only allowing the ssh connections from the remote network you will be coming from on the firewall.

something like

permit tcp host 123.123.23.1 any eq 22
depending on your firewall type and rule set syntax of course.

 

[Fullmetal Chocobo]

Shields Up -- good place to test for vulnerabilities.

 

[kamper]

Originally posted by: Dravic
dont use FTP, set up an ssh daemon, FTP in insecure.

It's no worse than running webdav on port 80.