Steps for security hardening
The steps usually I follow:
1. Firewall Installation(APF/CSF).
2. Firewall Configuration CSF Installation steps
rm -fv csf.tgz
wget http://www.configserver.com/free/csf.tgz
tar -xzf csf.tgz
cd csf
Next, test whether you have the required iptables modules: perl
/etc/csf/csftest.pl
sh install.sh
/etc/csf/csf.conf
MONOLITHIC_KERNEL = "0" and change to MONOLITHIC_KERNEL = "1"
Specify which ports you want to allow
# Allow incoming TCP ports
TCP_IN =
"20,21,22,25,53,80,110,143,443,465,953,993,995,2077,2078,2082,2083,2087"
# Allow outgoing TCP ports
TCP_OUT = "20,21,22,25,37,43,53,80,110,113,443,587,873,953,2087,2089,2703"
# Allow incoming UDP ports
UDP_IN = "20,21,53,953"
# Allow outgoing UDP ports
# To allow outgoing traceroute add 33434:33523 to this list
UDP_OUT = "20,21,53,113,123,873,953,6277"
21 => FTP
22 => SSH
23 => Telnet
25 => SMTP Mail Transfer
43 => WHOIS
53 => name server (DNS)
80 => HTTP (Web server)
110 => POP protocol (for email)
443 => HTTP Secure (SSL for https:// )
995 => POP over SSL/TLS
9999 => Urchin
3306 = > MysQL Server
2082 => CPANEL Default
2083 => CPANEL - Secure/SSL
2086 => CPANEL WHM
2087 => CPANEL WHM - Secure/SSL
2095 => cpanel webmail
2096 => cpanel webmail - secure/SSL
Plesk Control Panel => 8443
DirectAdmin Control Panel => 2222
Webmin Control Panel => 10000
Disable the Testing Mode and Start the Firewall
nano /etc/csf/csf.conf
//Look for the first line and set testing mode to "0"
TESTING = "0"
//Now restart the firewall!
csf -r
SSHD Hardening:
/etc/ssh/sshd_config
1. edit /etc/ssh/sshd_config
2. Look for the following line: #Port 22
3. Change the line so it looks like this Port no
4. Save and close the file
5. Load the new configuration service sshd reload
disable direct root logins at the SSH
Check SSH on non-standard port. Moving SSH to a non-standard port avoids basic SSH port scans.
Edit /etc/ssh/sshd_config and setting: Port nnnn Where nnnn is a port of your choosing. Don't
forget to open the port in the firewall first!
Before doing this create the user: admin with password and add the user to wheel group
1. Edit /etc/ssh/sshd_config
2. Replace "Protocol 2, 1" to "Protocol 2" and uncomment
3. Replace "PermitRootLogin yes" to "PermitRootLogin no"
Restart SSH
1. /etc/rc.d/init.d/sshd restart
This will prevent a "root" user to login directly through SSH or other way and also we can easily
trace the log file to find out who is doing what process. Check SSH PasswordAuthentication. For
ultimate SSH security, you might want to consider disabling PasswordAuthentication and only
allow access using PubkeyAuthentication.
Temporary Space hardening
In cpanel server this can be done by using the script /scripts/securetmp
Check /tmp permissions. /tmp should be chmod 1777
Check /tmp ownership /tmp should be owned by root:root
Check /var/tmp permissions. /var/tmp should be chmod 1777
Check /var/tmp ownership. /var/tmp should be owned by root:root
Check /var/tmp is mounted as a filesystem. /var/tmp should either be symlinked to /tmp or mounted
as a filesystem
Tmp hardening in VPS
OpenVZ does not support 'BINDMOUNT' option, so I created mount an umount scripts which
automatically mounts /tmp and /var/tmp on VE start and umount on stop.
Here are the scripts:
$VEID.mount: /etc/vz/conf/ dir
============================================================================
#!/bin/bash
[ -d /vz/private/$VEID/var/rtmp ] || mkdir /vz/private/$VEID/var/rtmp
[ -d /vz/private/$VEID/var/rvtmp ] || mkdir /vz/private/$VEID/var/rvtmp
mount --bind /vz/root/$VEID/var/rtmp /vz/root/$VEID/tmp -o nosuid,noexec,nodev
mount --bind /vz/root/$VEID/var/rvtmp /vz/root/$VEID/var/tmp -o
nosuid,noexec,nodev
=============================================================================
$VEID.umount: /etc/vz/conf/ dir
=============================================================================
#!/bin/bash
mount|grep "/vz/root/$VEID/tmp" 2>/dev/null 1>&2 && umount /vz/root/$VEID/tmp
mount|grep "/vz/root/$VEID/var/tmp" 2>/dev/null 1>&2 && umount /vz/root/
$VEID/var/tmp
exit 0
==============================================================================
They should be placed as $VEID.mount and $VEID.umount into /etc/vz/conf/ dir.
It will take an effect after VE restart.
CHMOD the TMP directory to 777 in the VE.
Installing mod evasive
cd /usr/local/src
wget http://www.zdziarski.com/blog/wp-
content/uploads/2010/02/mod_evasive_1.10.1.tar.gz
tar xfz mod_evasive_1.10.1.tar.gz
cd mod_evasive
For cpanel server with apache 2.x
/usr/local/apache/bin/apxs -cia mod_evasive20.c
nano /usr/local/apache/conf/httpd.conf
Add the below codes in httpd.conf
==========================================
<IfModule mod_evasive20.c>
DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 300
</IfModule>
===========================================
/usr/local/cpanel/bin/apache_conf_distiller --update
Hosts.conf hardening
To "harden" your /etc/host.conf file just put the following into the file:
order bind,hosts
multi on
nospoof on
Hide apache software version
To hide the information, add the following two apache directives in Apache configuration file.
ServerTokens ProductOnly
ServerSignature Off
/usr/local/cpanel/bin/apache_conf_distiller --update
Hide BIND DNS Sever Version
Open your named.conf file, find out options { ... }; section, version "YOUR
Message"; Save and close the file.
Restart named, enter: # service named restart
Cpanel/WHm Tweak
Disable all instances of IRC – BitchX, bnc, eggdrop, generic-sniffers, guardservices, ircd, psyBNC, ptlink. If you are using WHM you can do this in the
Background Process Killer.
cPanel/WHM set Shell Fork Bomb Protection.
Server Setup =>> Tweak Settings
Check the following items...
Under Domains: Prevent users from parking/adding on common internet domains. (ie
hotmail.com, aol.com)
Under Mail: Attempt to prevent pop3 connection floods
Default catch-all/default address behavior for new accounts - blackhole
Under System: Use jailshell as the default shell for all new accounts and
modified accounts
Goto Server Setup =>> Tweak Security
Enable php open_basedir Protection
Enable mod_userdir Protection
Goto Server Setup =>> Manage Wheel Group Users
When setting up Feature Limits for resellers in Resellers =>> Reseller Center, under Privileges
always disable Allow Creation of Packages with Shell Access and enable Never allow creation of
accounts with shell access; under Root Access disable All Features.
Goto Service Configuration =>> FTP Configuration
Disable Anonymous FTP
Goto Account Functions =>> Manage Shell Access
Disable Shell Access for all users (except yourself)
Reject nobody from sending mails.
Compact Hardening Steps
SSHD hardening ( Change root password, Disable direct root login, ssh port changing. etc )
Software upgrade
Installing and configuring firewall ( CSF and LFD )
MySQL optimization
Installing and scanning with rkhunter
Installing and scanning with clamav
Installing and scanning with Lynis ( Fixing security issues reported by it )
Installing mod evasive
Hardening sysctl.conf
Hide Apache Version
Hide Bind Version
Things to take care during hardening
Check for web applications which use proc_open, popen, disk_free_space, diskfreespace, set_time_limit, leak, tmpfile, exec, system, shell_exec, passthru. If no applications use these function, disable it in php.ini
Checking for programs with suid
Checking for programs with suid
find / -perm -2000 2>/dev/null
Checking for programs with sgid
find / -perm -2000 2>/dev/null
For further Reference:
http://www.puschitz.com/SecuringLinux.shtml#SecuringSSH
