Hosting a secure site on a dedicated server

[omarfilip]

I have an opportunity to host a site which ought to be secured (https) on my dedicated server at GH, but I have no idea where to begin.

This would be under one domain name and the need is to secure a form where users would submit a mortgage application, and that includes SSNs.

Where do I begin?

Thanks.

[Alexander]

Hi, first of all, you need to have a free dedicated IP for this account. If you have such, assign it to this account. After that, order SSL cert, and as soon as you get it, install in your WHM. You can order SSL through us or using any third-party.
GH provide COMODO SSL certs, if you are interested, please, visit http://glowhost.com/more-products/ssl-certificates/index.php

[raicol]

Yes ,m agree with alex, you required to have a free dedicated IP for this account which you have to assign this.

Regards,
Raicol

[jacobwallace]

Follow these best measures to make your dedicated server safe:


1. Patches and security updates should be installed.
2. Run malware scans on a regular basis.
3. Protect yourself from DDoS attacks by using DDoS protection.
4. Only connect to secure networks.
5. SSH port should be changed.
6. Make sure that each user has their own account.
7. Passwords should be changed on a frequent basis.
8. Keep your databases safe.

[omarfilip]

Thanks, Alex. The Comodo link just goes back to the forums landing page...

So, what does this SSL certificate do for me? Is it just a way of saying I am who I am, or is there more?

[Matt]

I've fixed the link, please try it again.

SSL encrypts the data transmission between the client's PC and the server so that sensitive data like SSN cannot be intercepted by third parties for malicious use.

Once you have the data on the server you would want to encrypt it using mysql encrypt() and decrypt() or similar strong encryption functions so that if someone gains access to your DB the information is not in plain text for the world to see.

[omarfilip]

Would sending the submitted form data by email to the mortgage broker be considered insecure?

[AndrewGlow]

Hello. That's normal, I think. But yes, it seems to be unsecure. Anyway you can email a link to a secured page where broker would login using his username/password and will get information.

[Matt]

Email is definately not a good way to send any time of data but unfortunately there are lots of firms that still send CC and SS numbers via unencrypted email. Sending it in a encrypted and compressed archive with password authentication to deflate the file would be better, but still not a 100% great solution.

[omarfilip]

Do you guys know of an open source solution for secure forms before I start searching the web for one?