>> Specifically, I will be creating a how-to guide for securing standard
>> LAMP servers as well as a script that will help Linux users set them up.
>> I have a few ideas for locking down apache, php, etc. but I would
>> appreciate any other ideas admins of hidden services have as well as
>> suggestions on how to implement them.
> Interesting. I've always been conflicted about whether it's possible to
> distill enough how-to advice that novices can actually safely set up a
> complex (i.e. more than just static html) website.
Not to get into a « my Emacs is better than your vi » discussion, but
I've had excellent experiences with Lighttpd. I've also found the code
to be much cleaner than that of thttpd.
Whatever the web server, PHP is a security disaster, and I wouldn't
dream of putting it on a hidden service.
Juliusz
P.S. « PHP is a minor evil perpetrated and created by incompetent amateurs,
whereas Perl is a great and insidious evil, perpetrated by skilled
but perverted professionals. » — Jon Ribbens
