What are the dangers of advertising my MySQL-powered amateur site?

Oh my. YES! All those things are of a concern. You only expose your server publicly if you are prepared to have that server taken over by a malicious party.

All one needs to do is to find a misconfiguration or a security hole and they can own your personal computer that you use to do things like access personal accounts (email, banks, etc.).

Public servers need to be locked down, with only the info it needs to provide a service. Best case is to have that server backed up and disposable in case it is compromised. If something bad happens, you blow it away and restore from back ups.

Do not expose your personal computer to the public in this way, especially when you are exposing custom code and you do not understand how exploitable it is.


My main concerns are someone being able to access the rest of my system, or being able to delete files off the site.

Are either of these a concern?

Yes and yes.

Why?

  • SQL Injection
  • Code Injection
  • Command Injection
  • Cross-site Scripting
  • Cross-site Request Forgery
  • Port Scans
  • Directory Traversal Attack
  • DoS Attack (doesn't give adversaries access on its own, but is something that should be prepared for, in case it were to ever happen)

Are some of the reasons that jump to mind.


To isolate your project from the rest of your system, you could set up a virtual machine, install a minimal LAMP (Linux, Apache, MySQL, PHP) configuration on it and install your application there. Even when your virtual machine gets totally pwned, your normal machine will be relatively save (only "relatively" because there were some known vulnerabilities in VM software which allowed to escape from the guest system to influence the host system, but these are relatively obscure). When your VM got turned into a malware-infested spam machine, you can easily revert it to a known good snapshot or terminate it entirely with a single click.

Deploying your project in a virtual machine is also a good way to learn how to set up a "real" server for your project later, should you decide to rent one.

A free (as in beer) software which allows this is Virtual Box, for example.

Tags:

Webserver