Mac webserver, MySQL security [closed]

Question

I know its not really practical, but anyway recently I got interested in making my mac a server, possibly to host a blog, with WordPress. Right now I have a free DynDns account and host with gets the IP updated through the DynDns Updater application I downloaded. I have AirPort Extreme Base Station router, and it forwards port 80 to my mac's port 80. DHCP reserves 10.0.1.2 for my mac, so it will always get that local IP, and the port forwarding will always point to it. The firewall on my mac is turned on, although I'm not sure if that matters for this.

So anyway, with this setup, is that secure enough? Would there be a way that someone could hack into it? It would be impossible for someone to actually hack into the system (like all the files on my computer other then the actual webpage files read from the web server), right? I don't have remote login or SSH or anything like that turned on.

And about MySQL, I need that to use WordPress, and by default the root account has no password, and I've read that is insecure. But wouldn't you have to be on my machine to log into it anyway?

I'm just playing around with it now, and I just want to make sure I'm not putting the system in danger. Right now I'm not so much concerned about hacking into the web server, like deleting the web page files or something, but I'd like to here whatever you have to say.

And don't recommend that I use some free hosting service, the only reason I'm doing this is to see if I can get it to work and to learn about it.

If you could just explain a bit and answer some of my questions, that would be great. Thanks.

Answer 1

You could run iptables on your mac, for extra security.

Keep your apache updated with all the security patches, make sure you have all the permissions correct on all the directories you're serving. Assign wordpress a different mysql account, grant the tightest restrictions you can on it (I don't remember what the wordpress installer does). Disable mysql remote login (should be disable by default, but double check). Give that root account a password, something non-standard.

The reason you want to restrict the mysql user accounts is to better protect against sql injection attacks. If you're just running wordpress, it shouldn't be too much of an issue, but better safe than sorry (the wordpress community does a pretty good job of making sure the glaring security holes are filled).