{"id":206,"date":"2011-04-24T00:30:22","date_gmt":"2011-04-23T22:30:22","guid":{"rendered":"http:\/\/www.ayhanarda.com\/blog\/?p=206"},"modified":"2015-09-18T12:03:50","modified_gmt":"2015-09-18T10:03:50","slug":"cpanel-server-installation-security","status":"publish","type":"post","link":"https:\/\/www.ayhanarda.com\/blog\/2011\/04\/cpanel-server-installation-security\/","title":{"rendered":"Cpanel Server Security"},"content":{"rendered":"

cPanel Installation and Security<\/p>\n

This documentation covers how to install cPanel on a fresh Linux server and how to do initail server security.<\/p>\n

cPanel Installation :<\/p>\n

* cPanel can be install on Redhat based Linux servers and FreeBSD
\n* A freshly build latest stable Centos server is highly recommended<\/p>\n

How to Install cPanel :<\/p>\n

* Yum must be installed before installing cPanel. All most all Redhat based servers will have yum preinstalled, if not installed install it from rpm ( http:\/\/rpm.pbone.net\/ ).<\/p>\n

# Update the system using Yum<\/p>\n

$ yum update<\/p>\n

# Disable selinux on dedicated servers. Set SELINUX=disabled in \/etc\/selinux\/config<\/p>\n

# Reboot the system<\/p>\n

$ reboot<\/p>\n

# Download the cPanel installer and run<\/p>\n

$ cd \/root; wget http:\/\/httpupdate.cpanel.net\/latest; chmod +x latest; .\/latest<\/p>\n

Server security:<\/p>\n

* Remove telnet server; we dont want that.<\/p>\n

$ rpm -e telnet-server
\n* Check xinetd enabled services and dsiable them. Run below command and disable all services which shows ‘disable = no’<\/p>\n

$ cd \/etc\/xinetd.d; grep disable .\/*<\/p>\n

* Disable xinetd service itself. cPanel donot use xinetd<\/p>\n

$ \/etc\/init.d\/xinetd stop; chkconfig xinetd off<\/p>\n

# Add a system user eg:- administrator<\/p>\n

$ useradd administrator<\/p>\n

# Reset the administrator password. A strong password can be generated using following command<\/p>\n

$ mkpasswd -l 16<\/p>\n

# Also reset the root password to a strong one<\/p>\n

# Add administrator user to sudoer list. After this verify administrator user can sudo to root user.<\/p>\n

$ visudo<\/p>\n

# Permit ‘su’ for only wheel group members. Open \/etc\/pam.d\/su and add (order is important) or uncomment<\/p>\n

auth\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 required\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 pam_wheel.so use_uid<\/p>\n

# Disable SSH protocol 1 and enable SSH protocol 2 in \/etc\/ssh\/sshd_config<\/p>\n

# Disable rootlogin in \/etc\/ssh\/sshd_config (Make sure some user eg:- administrator is added in sudoer list with full privilege)<\/p>\n

# Set a banner of legal warning in SSH. Add the contents in \/etc\/sshBanner.txt and add following to \/etc\/ssh\/sshd_config<\/p>\n

Banner \/etc\/sshBanner.txt<\/p>\n

# Restart SSH service<\/p>\n

$ \/etc\/init.d\/sshd restart<\/p>\n

# Change SSH port. Open \/etc\/ssh\/sshd_config and change Port 22<\/p>\n

# Install AFICK. Download latest afick rpm from http:\/\/sourceforge.net\/projects\/afick\/files\/afick\/<\/p>\n

$ rpm -ivh afick-x.x.x.x.noarch.rpm<\/p>\n

# Open \/etc\/afick.conf and set email id and enable cron run.<\/p>\n

@@define MAILTO email_id
\n@@define BATCH 1<\/p>\n

# Ensure that AFICK donot update its database after a cron run. Database update should be run manually by sysadmin, else if we miss a cron email we will miss the file changes alert. Open \/etc\/cron.daily\/afick_cron and set ACTION=”-k”.<\/p>\n

# Initialize AFICK database<\/p>\n

$ afick -c \/etc\/afick.conf -i -P<\/p>\n

# Disable DNS recursion and version publish. Open \/etc\/named.conf and set<\/p>\n

Options {
\nrecursion no;
\nversion “No version for you”;
\n…..<\/p>\n

# Restart bind<\/p>\n

$ \/etc\/init.d\/named restart<\/p>\n

# Disable Exim version printing. Add following to \/usr\/local\/cpanel\/etc\/exim\/config_options<\/p>\n

smtp_banner = “${primary_hostname} ESMTP Mail service ready”<\/p>\n

# Rebuild eximconf and restart exim service<\/p>\n

$\u00a0 \/scripts\/buildeximconf && \/scripts\/restartsrv_exim<\/p>\n

# Disable anonymous user login in \/etc\/pure-ftpd.conf<\/p>\n

NoAnonymous yes<\/p>\n

# Disable pure-ftpd default banner. This shows server time and ftp service name. Create a file \/etc\/ftpWelcome.txt and add “FTP Service Is Ready”. Now open \/etc\/init.d\/pure-ftpd and add<\/p>\n

OPTIONS=”-F \/etc\/ftpWelcome.txt”<\/p>\n

# Restart ftp serivce<\/p>\n

$ \/scripts\/restartsrv_ftpserver<\/p>\n

# Disable apache signature. Open \/usr\/local\/apache\/conf\/httpd.con and add\/edit as follows<\/p>\n

ServerSignature Off
\nServerTokens Prod<\/p>\n

# Permanently save the change<\/p>\n

$ \/usr\/local\/cpanel\/bin\/apache_conf_distiller –update<\/p>\n

# Restart apache<\/p>\n

$ \/etc\/init.d\/httpd restart<\/p>\n

# Install Rkhunter. Download latest rkhunter from http:\/\/www.rootkit.nl\/projects\/rootkit_hunter.html<\/p>\n

$ tar -xvzf rkhunter-x.x.x.tar.gz; cd rkhunter-x.x.x; .\/installer.sh –layout \/usr\/local –install; \/usr\/local\/bin\/rkhunter –update<\/p>\n

# Create rkhunter cron job. Create file \/etc\/cron.daily\/rkhunter.sh and add the following. Make sure to replace replace-this@with-your-email.com with the system administrator email address<\/p>\n

#!\/bin\/bash
\n(\/usr\/local\/bin\/rkhunter -c –cronjob 2>&1 | mail -s “RKhunter Scan Details” replace-this@with-your-email.com)<\/p>\n

# Give execute permission for the script<\/p>\n

$ chmod +x\u00a0 \/etc\/cron.daily\/rkhunter.sh<\/p>\n

# Securing tmp<\/p>\n

$ \/scripts\/securetmp<\/p>\n

# Root and administrator (sudo user) login alerts. Add following to both \/root\/.bashrc and \/home\/administrator\/.bashrc (Change the subject line as needed)<\/p>\n

echo “ALERT – Root Shell Access on `hostname`:” `date` `who` |mail -s “Alert: Root Access from `who | cut -d”(” -f2 | cut -d”)” -f1`” replace-this@with-your-email.com<\/p>\n

# Install apf (firewall)<\/p>\n

$ wget http:\/\/www.rfxn.com\/downloads\/apf-current.tar.gz
\n$ tar -xvzf apf-current.tar.gz
\n$ cd afp-x.x.x
\n$ .\/install.sh<\/p>\n

# The installer will display the current opened TCP and UDP ports. Copy them and add it to IG_TCP_CPORTS and IG_UDP_CPORTS respectively in \/etc\/apf\/conf.apf. We also need to enable ports 0-1024 (both TCP and UDP) in apf for portscanner detector to work, so add 0_1024 to IG_TCP_CPORTS and IG_UDP_CPORTS<\/p>\n

# Start apf<\/p>\n

$ apf -s<\/p>\n

# Install BFD (brute force detector)<\/p>\n

$ wget http:\/\/www.rfxn.com\/downloads\/bfd-current.tar.gz
\n$ tar -xvzf bfd-current.tar.gz
\n$ cd bfd-x.x.x
\n$ .\/install.sh
\n$ bfd -s<\/p>\n

# Install portsentry (port scanner detector) from ftp:\/\/ftp.pbone.net\/mirror\/ftp.falsehope.net\/home\/tengel\/fedora\/4\/te\/i386\/RPMS\/portsentry-1.2-1.te.i386.rpm<\/p>\n

# open \/etc\/portsentry\/portsentry.conf and comment KILL_ROUTE and add<\/p>\n

KILL_RUN_CMD=”\/usr\/local\/sbin\/apf -d $TARGET$ ‘Portscan detected on port $PORT$'”<\/p>\n

$ \/etc\/init.d\/portsentry restart<\/p>\n

# Enable suphp and suexec<\/p>\n

$ \/usr\/local\/cpanel\/bin\/rebuild_phpconf –no-htaccess 5 none suphp 1<\/p>\n

# Run \/scripts\/easyapache and enable mod_security<\/p>\n

# Load mod_esecurity rules<\/p>\n

$ cd \/usr\/local\/apache\/conf\/
\n$ wget http:\/\/updates.atomicorp.com\/channels\/rules\/delayed\/modsec-2.5-free-latest.tar.bz2
\n$ tar -xvjf modsec-2.5-free-latest.tar.bz2
\n$ cd modsec\/
\n$ perl -i -pe ‘s\/\\\/etc\\\/asl\\\/whitelist\/whitelist\\.txt\/’ *
\n$ > domain-spam-whitelist.conf
\n$ mkdir \/usr\/local\/apache\/conf\/modsec\/ip
\n$ mkdir \/usr\/local\/apache\/conf\/modsec\/global<\/p>\n

# open \/usr\/local\/apache\/conf\/modsec\/00_asl_rbl.conf and add<\/p>\n

SecDataDir \/usr\/local\/apache\/conf\/modsec<\/p>\n

# open \/usr\/local\/apache\/conf\/modsec2.conf and add<\/p>\n

Include “\/usr\/local\/apache\/conf\/modsec\/*.conf”<\/p>\n

# Restart apache<\/p>\n

$ \/etc\/init.d\/httpd restart<\/p>\n

cPanel Settings :<\/p>\n

# Goto Main >> Server Configuration >> Basic cPanel & WHM Setup and set the contact information<\/p>\n

# Goto Main >> Server Configuration >> Tweak Settings >> All and<\/p>\n

Enable SpamAssassin spam filter = enabled
\nGIEmail and CGIEcho = disabled
\nCookie IP validation = strict
\nGenerate core dumps = off
\nSend passwords when creating a new account = off
\nBlank referrer safety check = on
\nReferrer safety check = on
\nRequire SSL = on
\nEnable HTTP Authentication = off
\nAllow PHP to be run by resellers in WHM = off
\nUse MD5 passwords with Apache = on
\nSecurity Tokens = on
\nDefault shell jailed = on<\/p>\n

# Goto Main >> Security Center >> Apache mod_userdir Tweak and enable “Enable mod_userdir Protection”<\/p>\n

# Goto Main >> Security Center >> Compiler Access and disable compilers for unprivileged users<\/p>\n

# Main >> Security Center >> Configure Security Policies and<\/p>\n

Password Age = enabled (30 days)
\nPassword Strength = enabled (15 characters)
\nXML-API and JSON-API requests = enabled
\nDNS cluster requests = enabled<\/p>\n

# Goto Main >> Security Center >> cPHulk Brute Force Protection and enable burte force protection<\/p>\n

# Goto Main >> Security Center >> PHP open_basedir Tweak and enable “Enable php open_basedir Protection.”<\/p>\n

# Goto Main >> Security Center >> Security Questions and setup the security question<\/p>\n

# Goto Main >> Security Center >> Shell Fork Bomb Protection and enable protection<\/p>\n

# Goto Main >> Security Center >> SMTP Tweak and enable protection<\/p>\n

# Goto Main >> Security Center >> Traceroute Enable\/Disable and disable traceroute<\/p>\n

# Goto Main >> Account Functions >> Manage Shell Access and disable shell access for all user. If shell access is required only enable jailed shell<\/p>\n

# Goto Main >> cPanel >> Manage Plugins and install Clamav<\/p>\n

Daha g\u00fcvenli bir cpanel i\u00e7in cpanel g\u00fcvenlik<\/a> ile ileti\u015fime ge\u00e7ebilirsiniz.<\/p>\n

Ayhan ARDA<\/p>\n

\"Share<\/a>