-
Summary of security steps for Linux
1. Exim.
Enable extended logging :
Add the following line in exim, below the first line recommended
log_selector = +address_rewrite +all_parents +arguments +connection_reject +delay_delivery +delivery_size +dnslist_defer +incoming_interface +incoming_port +lost_incoming_connection +queue_run +received_sender +received_recipients +retry_defer +sender_on_delivery +size_reject +skip_delivery +smtp_confirmation +smtp_connection +smtp_protocol_error +smtp_syntax_error +subject +tls_cipher +tls_peerdn \
Fommail Trap
http://void.thunderteam.org/fm-trap.html
For Securing Exim i found this a Good resource
http://www.rvskin.com/index.php?page=public/antispam
2. Httpd :
install mod_security
install mod_dosevasive (causes problem with FP sometimes though)
3. PHP
disable_functions = "system,exec"
eAccelerator for PHP acceleration
http://sourceforge.net/projects/eaccelerator
3.5 IPTABLES
iptables -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j IN_SANITY
4. Some small recommended apps
Install BFD from rfxnetworks.net
Install LSM from rfxnetworks.net
APF from rfxnetworks.net
rkhunter can be found on www.rootkit.nl
5. cpanel script to disable compilers incase we have not done this yet
/scripts/compilers off
6. MYSQL
mysql query cache
vi /etc/my.cnf
query-cache-type = 1
query-cache-size = 100M
100M can be changed according to how busy the server is
7. Securing some binaries
chmod 750 /usr/bin/rcp
chmod 750 /usr/bin/wget
chmod 750 /usr/bin/lynx
chmod 750 /usr/bin/links
chmod 750 /usr/bin/scp
chmod 000 /etc/httpd/proxy/
8. Some other tweaks related to linux.
Securing /tmp
/dev/sad3 /tmp ext2 loop,noexec,nosuid,rw 0 0
A good sysctl config can be found here http://www.eth0.us/sysctl
httpd.conf
Timeout 15
KeepAlive Off
KeepAliveTimeout 5
Regards,
binoy
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
Bookmarks