How to install and secure egroupware - Directory UMM

6 Basic Server Security
6.1 The server platform
There are many ways you can secure your server platform. The most important security measure you can
perform is to keep your installation up-to-date. Consider subscribing to the mailing list egroupware-
announcement@lists.sourceforge.net. This is where we publish new releases as well as necessary security
updates for eGroupWare.
6.1.1 Checking your server for running services and open ports
� An open port indicates that your server is offering a service to the public. This could be a Fileserver, DNS
Server, Telnet server, X server or one of many other services. More open ports means that an attacker has a
better chance of gaining access to your server. You server should only have the ports and services available
which are necessary to run eGroupWare. If you need other open ports that are not necessary for eGroupWare,
then you should secure your installation with a firewall or with TCP wrappers. If it’s possible, only allow services to
run on your eGroupWare server that have Secure Socket Layer (SSL) enabled.
6.1.1.1 Ports which the eGroupWare server needs to run
Ports which are needed are:
Web server Port: HTTP/80
Web server SSL Port: HTTPS/443
Remote Administration , Secure Shell: SSH/22
If you must run an E-Mail server on the same machine, then you will need a few more ports open. If you can
run your E-Mail server on a separate machine, then please do so. You’ll need these extra ports open for an E-
Mail server to run:
Email Server MTA: SMTP/25
Email Server MTA: SMTPS/465
To pick up the E-Mail from your server with a client program (such as the eGroupWare clients), you need one
of the following ports:
IMAP server: IMAP/143
IMAP server SSL: IMAPS/993
POP-3: POP-3/110
POP-3 over SSL: POP-3/995
If you block ports with a firewall, please remember that you will need to allow certain outbound traffic. This
can include NTP, DNS lookups, etc.
Reiner Jung Install and Secure eGroupWare Page 20 of 67