Removal of insecure packages and unnecessary software from server.
Please check to see the packages that are not needed on a web server. You can use the command rpm -qa to list all the installed rpm packages on the server. From the list remove packages choose the packages that are not required.
Some common examples of unnecessary packages are given below.
mtools
yp-tools
redhat-config-nfs
redhat-config-samba
tftp-server
ypserv
redhat-config-printer-gui
samba
samba-swat
cups
gmp-devel
ElectricFence
doxygen
Xfree86-xfs
redhat-config-printer
cups-libs
samba-common
samba-client
These packages are specific to RHEL 3. It varies in different distributions.
January 1, 2010
Server Security steps and the quote details
Do the Following : For Server Security for Cpanel Servers
1. sysctl http://www.eth0.us/sysctl
2. noexec, nosuid /var/tmp /tmp http://www.eth0.us/tmp
3. LES Linux Environment Security http://www.securecentos.com/temp/installing-les-linux-environment-security.html
4. Removal of Insecure packages http://pcgeo.blogspot.com/2009/12/removal-of-insecure-packages-and.html
5. RPM upgrades [Yum Update]
6. Firewall (CSF + LFD) http://www.configserver.com/free/csf/install.txt
7. AIDE (Advanced Intrusion Detection Environment) http://pcgeo.blogspot.com/2009/12/installing-aideadvanced-intrusion.html
8. Logwatch Installation and configuration http://pcgeo.blogspot.com/2009/12/install-logwatch-in-server.html
9. ClamAV (virus scanner) Installation with Exim on cPanel servers http://pcgeo.blogspot.com/2009/12/clamav-installation.html
10. chkrootkit http://pcgeo.blogspot.com/2009/12/install-chkrootkit-on-server.html
11. LibSafe Installation http://pcgeo.blogspot.com/2009/12/libsafe-installation.html
more steps
* WHM -> ConfigServer Security&Firewall -> Check Server Security (You need to get atleast 105 points out of 119)
* WHM -> Update Config -> Select Manual Updates Only (STABLE tree) and run "/scripts/upcp --force"
* Run Easy apache..
You can enable below modules,
Mod SuPHP
IonCube Loader for PHP
Zend Optimizer for PHP
Bcmath, Bz2, CGI, Calendar, Curl , CurlSSL, Curlwrappers, FTP, GD , Iconv , Imap ,MM ,Magic Quotes, MailHeaders , Mbregex, Mbstring , Mcrypt , Mhash , Mime Magic, Mysql , Mysql of the system, Openssl , POSIX , Path Info Check, Pear, SafeMode , Sockets , TTF (FreeType), XmlRPC , Zip , Zlib
LAST STEP
** Deny direct root access
** change the SSH PORT (Dont forget to add the new port to CSF)
** Create a wheel user
1. sysctl http://www.eth0.us/sysctl
2. noexec, nosuid /var/tmp /tmp http://www.eth0.us/tmp
3. LES Linux Environment Security http://www.securecentos.com/temp/installing-les-linux-environment-security.html
4. Removal of Insecure packages http://pcgeo.blogspot.com/2009/12/removal-of-insecure-packages-and.html
5. RPM upgrades [Yum Update]
6. Firewall (CSF + LFD) http://www.configserver.com/free/csf/install.txt
7. AIDE (Advanced Intrusion Detection Environment) http://pcgeo.blogspot.com/2009/12/installing-aideadvanced-intrusion.html
8. Logwatch Installation and configuration http://pcgeo.blogspot.com/2009/12/install-logwatch-in-server.html
9. ClamAV (virus scanner) Installation with Exim on cPanel servers http://pcgeo.blogspot.com/2009/12/clamav-installation.html
10. chkrootkit http://pcgeo.blogspot.com/2009/12/install-chkrootkit-on-server.html
11. LibSafe Installation http://pcgeo.blogspot.com/2009/12/libsafe-installation.html
more steps
* WHM -> ConfigServer Security&Firewall -> Check Server Security (You need to get atleast 105 points out of 119)
* WHM -> Update Config -> Select Manual Updates Only (STABLE tree) and run "/scripts/upcp --force"
* Run Easy apache..
You can enable below modules,
Mod SuPHP
IonCube Loader for PHP
Zend Optimizer for PHP
Bcmath, Bz2, CGI, Calendar, Curl , CurlSSL, Curlwrappers, FTP, GD , Iconv , Imap ,MM ,Magic Quotes, MailHeaders , Mbregex, Mbstring , Mcrypt , Mhash , Mime Magic, Mysql , Mysql of the system, Openssl , POSIX , Path Info Check, Pear, SafeMode , Sockets , TTF (FreeType), XmlRPC , Zip , Zlib
LAST STEP
** Deny direct root access
** change the SSH PORT (Dont forget to add the new port to CSF)
** Create a wheel user
SSTP Configuration step by step
http://www.netcal.com/blog/?p=135
http://www.windowsecurity.com/articles/Configuring-Windows-Server-2008-Remote-Access-SSL-VPN-Server-Part2.html
http://www.windowsecurity.com/articles/Configuring-Windows-Server-2008-Remote-Access-SSL-VPN-Server-Part2.html
HTTP 500 error message displays instead of ASP error message / ASP debugging mode
To enable ASP debugging
1.
In IIS Manager, double-click the local computer, right-click the Web Sites folder or an individual Web site folder, and then click Properties.
Configuration settings made at the Web Sites level are inherited by all of the Web sites on the server. You can override inheritance by configuring the individual site or site element.
2.
Click the Home Directory tab, and then click Configuration.
3.
Click the Debugging tab, and then select the Enable ASP server-side script debugging check box.
4.
Click Send detailed ASP error messages to client if you want to send the client very detailed debugging information, or click Send the following text error message to client and type the text you want to send to the client.
5.
Click OK.
==========================================
You can also customize the 500 internal error created by the IIS using 500-100.asp file.
Note The 500-100.asp file should not be implemented on production Web sites. The 500-100.asp file may expose custom code to users.
To use the 500-100.asp file for error handling on the nondefault Web site(The website for which you wish to setup this functionality), perform the following steps:
1. Start the Internet Service Manager (ISM), which loads the Internet Information Services snap-in for the Microsoft Management Console (MMC).
2. Right-click the appropriate Web site, click New, and then click Virtual Directory.
3. In the Virtual Directory Creation Wizard, click Next. In the Alias text box, type IISHelp, and then click Next.
4. When you are prompted for the path to the content directory, click Browse, select the C:\Windows\Help\IisHelp folder, and then click Next.
5. On the Access Permissions page, accept all the defaults, click Next, and then click Finish. Give Read permission only.
6. Right-click the Web site again, and then click Properties.
7. On the Custom Errors tab, select the 500;100 error line, and then click Edit Properties.
8. In the Message Type list box, select URL, and then type /iisHelp/common/500-100.asp in the URL text box.
9. Click OK twice to return to the ISM.
1.
In IIS Manager, double-click the local computer, right-click the Web Sites folder or an individual Web site folder, and then click Properties.
Configuration settings made at the Web Sites level are inherited by all of the Web sites on the server. You can override inheritance by configuring the individual site or site element.
2.
Click the Home Directory tab, and then click Configuration.
3.
Click the Debugging tab, and then select the Enable ASP server-side script debugging check box.
4.
Click Send detailed ASP error messages to client if you want to send the client very detailed debugging information, or click Send the following text error message to client and type the text you want to send to the client.
5.
Click OK.
==========================================
You can also customize the 500 internal error created by the IIS using 500-100.asp file.
Note The 500-100.asp file should not be implemented on production Web sites. The 500-100.asp file may expose custom code to users.
To use the 500-100.asp file for error handling on the nondefault Web site(The website for which you wish to setup this functionality), perform the following steps:
1. Start the Internet Service Manager (ISM), which loads the Internet Information Services snap-in for the Microsoft Management Console (MMC).
2. Right-click the appropriate Web site, click New, and then click Virtual Directory.
3. In the Virtual Directory Creation Wizard, click Next. In the Alias text box, type IISHelp, and then click Next.
4. When you are prompted for the path to the content directory, click Browse, select the C:\Windows\Help\IisHelp folder, and then click Next.
5. On the Access Permissions page, accept all the defaults, click Next, and then click Finish. Give Read permission only.
6. Right-click the Web site again, and then click Properties.
7. On the Custom Errors tab, select the 500;100 error line, and then click Edit Properties.
8. In the Message Type list box, select URL, and then type /iisHelp/common/500-100.asp in the URL text box.
9. Click OK twice to return to the ISM.
Windows Security Check/Auditing
To secure the windows servers, please take the following actions in our servers.
1) Go through the event viewer logs of the server to check any hack incidents. From the event viewer you can obtain information regarding the hack attempts from the various IPs. If any such incidents are noted, you can block access to such IPs by writing the required firewall rule in
Start >> Programs >> Administrative Tools >> Local Security Policy >> IP Security Policies on Local Computer .
You can ban or accept an IP/Host by writing the required rule.
2) Install the antirootkit softwares in our windows servers. You can install the antirootkit softwares like
a) RootkitRevealer - Provided by Microsoft. It is required to be installed by DC end itself, since the installation can be done only from the physical location of the server. Installation cannot be donw via the terminal services.
b) Malicious Software Removal Tool Kit - Provided by Microsoft. It is available with all Microsoft OSes. To use, type the command mrt in run.
Start >> Run >> mrt
c) Install a good antirootkit software.
Free Software :
-----------------
Sophos antirootkit
Paid Software
----------------
RootKit Buster - Trend Micro
Refer : http://www.antirootkit.com/software/index.htm
3) Install the Nessus Network Security Scanner. Use the version 3. It is free while the nessus4 is a paid software. You can download the following software from the following link.
http://www.nessus.org/download/nessus_download.php
Select Nessus 3.2.1.1.exe
http://downloads.nessus.org/nessus3dl.php?file=Nessus-3.2.1.1.exe&licence_accept=yes&t=00e6d5dee038bea390ddcc3f5fdf197f
After the install create a user named 'localuser'. To create the localuser
Start >> Programs >> Tenable >> Nessus >> Manage Users
Once the user is created, take the nessus client.
In nessus client add a new network by clicking the '+' button. Name the network as 'localhost'.
then click the button 'connect'. You will get a pop up window. Click edit in popup window. Add the user 'localuser' and its password. Then proceed.
Select the 'default policy' in the succeeding window. then select 'Scan now'. You will get a detailed report about the various vulnerabilities if anything present.
4) Next aspect of security auditing in the windows server is to find the anonymous users/hack users etc. So we need to remove them from the registry. Be careful when you edit the windows registry keys. Careless editing of the windows registry keys may damage/corrupt the windows OS. So make sure to take a copy/backup of the windows registry, before touhing it.
To access the windows registry.
Start >> run >> regedit
In regedit, take
My computer >> HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> Windows NT >> Current Version >> ProfileList
At this location, you can see various profiles. Check for the hacker profile here. If you are finding the hacker profile, say;support, remove that key from the registry. Note down the image path. before making ANY CHANGE in keys.
Before deleting the user from the registry profile, have a look at the Computer Management.
Start >> Programs >> Administrative Tools >> Local Users and Groups >> Users.
Here you should double check the hacker profile is existing or not. If it is existing, check the permissions assigned to it. Remove the administrator/Full privilieges if any. Also upon checking the image path, you willl get an idea about the directories to which the hacker user have the access. Also check the permissions assigned to the folder. If you are finding the hacker user have the access to that folder, remove that user from the permission list. Then remove the hacker user from the Start >> Programs >> Administrative Tools >> Local Users and Groups >> Users.
Also make sure to remove the profile from the registry. Keep an eye at the server and keep on checking the logs for any other hack attempts.
5) Install a good antivirus software in the server. Always prefer only the paid ones like Karspersky,Trend Micro, Avira etc. If the customer is asking for free one itself, you can go for free anti virus softwares like AVG Free Edition, Panda Free Edition. It is recommeded to the firewall software provided by the anti virus software, since it may block access the web users.
6) Make sure to provide only the required premissions to the users. Only the Administrator user should be given with the full privilege. Other users should not be given with full privilege/write/execute privileges.
7) If you are finding any server software is in a degraded status, please make sure to upgrade them to their latest versions. Apply windows updates regularly to ensure maximum security. You can obtain windows updates/patches from the technet,microsoft sites. Make sure that server is applied with the latest service pack available.
8) Reset the server/software/account passwords regularly(once in a week/month). Use only complex passwords having a mix of letters,symbols and extra characters etc. Do not use easy to remember passwords like password 123 etc.
1) Go through the event viewer logs of the server to check any hack incidents. From the event viewer you can obtain information regarding the hack attempts from the various IPs. If any such incidents are noted, you can block access to such IPs by writing the required firewall rule in
Start >> Programs >> Administrative Tools >> Local Security Policy >> IP Security Policies on Local Computer .
You can ban or accept an IP/Host by writing the required rule.
2) Install the antirootkit softwares in our windows servers. You can install the antirootkit softwares like
a) RootkitRevealer - Provided by Microsoft. It is required to be installed by DC end itself, since the installation can be done only from the physical location of the server. Installation cannot be donw via the terminal services.
b) Malicious Software Removal Tool Kit - Provided by Microsoft. It is available with all Microsoft OSes. To use, type the command mrt in run.
Start >> Run >> mrt
c) Install a good antirootkit software.
Free Software :
-----------------
Sophos antirootkit
Paid Software
----------------
RootKit Buster - Trend Micro
Refer : http://www.antirootkit.com/software/index.htm
3) Install the Nessus Network Security Scanner. Use the version 3. It is free while the nessus4 is a paid software. You can download the following software from the following link.
http://www.nessus.org/download/nessus_download.php
Select Nessus 3.2.1.1.exe
http://downloads.nessus.org/nessus3dl.php?file=Nessus-3.2.1.1.exe&licence_accept=yes&t=00e6d5dee038bea390ddcc3f5fdf197f
After the install create a user named 'localuser'. To create the localuser
Start >> Programs >> Tenable >> Nessus >> Manage Users
Once the user is created, take the nessus client.
In nessus client add a new network by clicking the '+' button. Name the network as 'localhost'.
then click the button 'connect'. You will get a pop up window. Click edit in popup window. Add the user 'localuser' and its password. Then proceed.
Select the 'default policy' in the succeeding window. then select 'Scan now'. You will get a detailed report about the various vulnerabilities if anything present.
4) Next aspect of security auditing in the windows server is to find the anonymous users/hack users etc. So we need to remove them from the registry. Be careful when you edit the windows registry keys. Careless editing of the windows registry keys may damage/corrupt the windows OS. So make sure to take a copy/backup of the windows registry, before touhing it.
To access the windows registry.
Start >> run >> regedit
In regedit, take
My computer >> HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> Windows NT >> Current Version >> ProfileList
At this location, you can see various profiles. Check for the hacker profile here. If you are finding the hacker profile, say;support, remove that key from the registry. Note down the image path. before making ANY CHANGE in keys.
Before deleting the user from the registry profile, have a look at the Computer Management.
Start >> Programs >> Administrative Tools >> Local Users and Groups >> Users.
Here you should double check the hacker profile is existing or not. If it is existing, check the permissions assigned to it. Remove the administrator/Full privilieges if any. Also upon checking the image path, you willl get an idea about the directories to which the hacker user have the access. Also check the permissions assigned to the folder. If you are finding the hacker user have the access to that folder, remove that user from the permission list. Then remove the hacker user from the Start >> Programs >> Administrative Tools >> Local Users and Groups >> Users.
Also make sure to remove the profile from the registry. Keep an eye at the server and keep on checking the logs for any other hack attempts.
5) Install a good antivirus software in the server. Always prefer only the paid ones like Karspersky,Trend Micro, Avira etc. If the customer is asking for free one itself, you can go for free anti virus softwares like AVG Free Edition, Panda Free Edition. It is recommeded to the firewall software provided by the anti virus software, since it may block access the web users.
6) Make sure to provide only the required premissions to the users. Only the Administrator user should be given with the full privilege. Other users should not be given with full privilege/write/execute privileges.
7) If you are finding any server software is in a degraded status, please make sure to upgrade them to their latest versions. Apply windows updates regularly to ensure maximum security. You can obtain windows updates/patches from the technet,microsoft sites. Make sure that server is applied with the latest service pack available.
8) Reset the server/software/account passwords regularly(once in a week/month). Use only complex passwords having a mix of letters,symbols and extra characters etc. Do not use easy to remember passwords like password 123 etc.
Few linux Tips.. Its really helpful to you.
Please go through the following tips in linux. I am sure that it will helpful to you guys.
1.) Flush DNS cache in Linux
You registered a domain and you can’t access it, it may be your DNS cache that holds the problem. Here’s how to flush DNS cache in Linux
/etc/rc.d/init.d/nscd restart
2.) Find files that are older than X years using Linux
If you want to find out what files are older than - let’s say - ten years and still residing on your hard drive, do a
cd /
find . -mtime +3650
This will search for such files on all your Linux partition and display them in verbose mode at the end of the search. In this case, 3650 stands for the number of days to go back.
Limit the CPU usage of a certain application in Linux
You can do this by installing cpulimit. You can limit a certain running application either by name or by process ID:
cpulimit -e firefox -l 30
This won’t let Firefox go beyond a 30% CPU usage limit.
Limit the cpu usage by process ID
cpulimit -p 3493 -l 40
This will limit process number 3493 to 40% CPU consumption.
What uses your resources?
By using top you can find out what processes are using your resources and in what amount. Another way to do this is by executing the following command:
ps -eo pcpu,pid,user,args | sort -r -k1 | more
This will output something like
6.5 6077 user pidgin
6.5 5535 root /usr/X11R6/bin/X :0 -br -audit 0 -auth /var/lib/gdm/:0.Xauth -nolisten tcp vt7
6.1 7027 user transmission
5.7 6563 user /usr/lib/firefox-3.0.5/firefox
1.2 9 root [events/0]
0.7 6070 user nautilus --no-desktop --browser
0.4 29888 user gedit
0.2 6555 user /usr/lib/thunderbird/thunderbird-bin
…nicely formatted and structured.
Make the lights of your NIC blink
If you work on a large network and you get sent to the server room to check out a certain network card, you might get lost in the multitude of network hardware. To find your certain NIC, SSH to the machine in question and do a
sudo ethtool -o eth0
The lights of the network card should start blinking repeatedly.
1.) Flush DNS cache in Linux
You registered a domain and you can’t access it, it may be your DNS cache that holds the problem. Here’s how to flush DNS cache in Linux
/etc/rc.d/init.d/nscd restart
2.) Find files that are older than X years using Linux
If you want to find out what files are older than - let’s say - ten years and still residing on your hard drive, do a
cd /
find . -mtime +3650
This will search for such files on all your Linux partition and display them in verbose mode at the end of the search. In this case, 3650 stands for the number of days to go back.
Limit the CPU usage of a certain application in Linux
You can do this by installing cpulimit. You can limit a certain running application either by name or by process ID:
cpulimit -e firefox -l 30
This won’t let Firefox go beyond a 30% CPU usage limit.
Limit the cpu usage by process ID
cpulimit -p 3493 -l 40
This will limit process number 3493 to 40% CPU consumption.
What uses your resources?
By using top you can find out what processes are using your resources and in what amount. Another way to do this is by executing the following command:
ps -eo pcpu,pid,user,args | sort -r -k1 | more
This will output something like
6.5 6077 user pidgin
6.5 5535 root /usr/X11R6/bin/X :0 -br -audit 0 -auth /var/lib/gdm/:0.Xauth -nolisten tcp vt7
6.1 7027 user transmission
5.7 6563 user /usr/lib/firefox-3.0.5/firefox
1.2 9 root [events/0]
0.7 6070 user nautilus --no-desktop --browser
0.4 29888 user gedit
0.2 6555 user /usr/lib/thunderbird/thunderbird-bin
…nicely formatted and structured.
Make the lights of your NIC blink
If you work on a large network and you get sent to the server room to check out a certain network card, you might get lost in the multitude of network hardware. To find your certain NIC, SSH to the machine in question and do a
sudo ethtool -o eth0
The lights of the network card should start blinking repeatedly.
Subscribe to:
Posts (Atom)