I apologize for the html, but it is a copy from a web post I did.
I wanted to share this with list members and hope it helps others.
I tried not to be redundant and add things I have not seen posted before.
Always interested in constructive thoughts, better ideas, etc.
**
*Security thoughts for server admins/webmasters*
------------------------------------------------------------------------
I would like to add some security measures I like to use. These are not
listed on security sites and I feel it is time someone posted this stuff.
This concerns programs/items used by webmasters/server admins on a very
irregular basis. (not very often).
This list assumes you have an IPMI card with its own eth port or an
onboard IPMI interface, both having video access.
Or accessing the shell of a virtual host to access virtual servers
located on it. (if no IPMI)
Quote:
*PHPMYADMIN* - This is a wonderful tool for use by web programmers. Most
security with this program lists just two protections.
a)Use htaccess to password protect, force SSL
b)Alias the folder from /phpmyadmin to something like /examp
This is where security measures, aside from keeping updated, seem to
end. This is bad. There is more you can do to protect that access to
your database.
PhpMyAdmin is a program you will use at times, but 99% of the time you
will never touch it at all. So why would you leave it open to hackers
all the time?
Simply disable the 'alias' in httpd to prevent it from being accessed.
For example in CentOS 6 the file /etc/httpd/conf.d/phpmyadmin.conf
contains this directory information. (or something like it.)
I have added 'Deny from ALL and commented out 'Allow from ALL' and
restarted httpd. (the allowoverride is allowing htaccess protection for
the folder). You could comment out everything except the allowoverride
and deny from all...
Quote:
<Directory /usr/share/phpMyAdmin/>
*Order Deny,Allow*
Deny from All
Allow from 127.0.0.1
Allow from ::1
*#Allow from All*
allowoverride All
</Directory>
Once httpd is restarted no one can access the phpmyadmin folder if it is
not in the html folder. (in centos 6 the program is usually located in
/usr/share/phpmyadmin).
This prevents the hacking of your phpmyadmin program.
If you think about it, outside of a small fix or initial programming you
will almost never use the program.
So why do you leave it open to everyone 24 hours a day?
Quote:
*IPMI*
IPMI is great but if you are a webmaster you are probably leaving this
open to the internet.
If you are local to the datacenter, or the datacenter is really cool,
you can remove the eth cable from the ipmi port. And ask them to plug it
in when there is an issue.
This only works if you have a separate ipmi card with its own eth port.
(and helps if you tag the cable and port for the center)
I think most of us seldom, if ever, use our IPMI during the course of a
year once the system is set up.
This prevents root access, IPMI card getting hacked, and still allows
emergency access with a quick visit or a phone call
*IPMI, Virtual Host, Virtual Machines*
Quote:
*Your Virtual Host server*
I seldom ever need to go into my virtual host. It is set up correctly
and I get my logwatches every day. I have no ports open up on it.
If I never use it, why would I leave a shell port open 24 hours a day?
If I have an IPMI card I can log in and open that port. Then I can do
what I need to do.
Safest, if IPMI is available (with video) is to comment out/disable the
ssh port. On a virtual host you most likely use a physical bridge. This
means nothing is touching the host. Great Security tip.
Quote:
*Virtual Machines- DNS*
Are your DNS servers virtual machines on a server (or on a dedicated
with an IPMI card in it)? I bet you never access shell except to make
that very rare dns change. And if you use rndc you never use shell.
If you have IPMI with video disable ssh port. Enable it via IPMI on
those very rare instances you need to access it.
Logwatch can still send out.
Only port 53 should be open 24 hours a day (and if rndc that port
too...and 5353 if you are doing that.)
There is no reason to leave this system open to the net at all. Enable
shell when you need it and then disable when done.
You do not need to open port 25 (or any port) to send emails out of the
system.
So why do you leave port 22 (or other shell port) on 24 hours a day if
you never ever use it?
Quote:
*MYSQL servers*
Again, if on a virtual host or even its own dedicated disable port 22
(ssh port) and only enable via IPMI on those rare times you need to use it.
Quote:
*Your website/webserver*
The same issue remains. Outside of the times you are using shell OR
FTP...these ports should be disabled. Enable using IPMI.
This simple act prevents a lot of hack attempts, log filling, and gives
massive peace of mind.
Yes, you use shell and ftp....but not that much. Think about it.
You might use ftp and shell a lot, but you are leaving those ports open
24 hours a day, 7 days a week. I guarantee outside of massive program
days you use less than 5% of that time on those ports.
So why open your server to being hacked? Close the ports.
Quote:
*Your open source or commercial web application*
.htaccess protect any folder that does not need to be accessed by a user
via http. Most files are grabbed by a index file and are still able to
be used even with htaccess protection. Try it.
Definitely do this with your administrative folders. There is no reason
not to do this.
But how many times do you really access that admin folder?
I would say put a fake htacces protection file in all the folders you
can. Fake meaning the user required does not exist and there is no
password for it. Then it will not be passed.
The admin folder can also be done this way, but add commented out
sections with real user/pass info.
Then when you need to go to the admin section, you shell/ftp in, change
the htaccess file, then do what you need to do. Then comment out the
real access info.
This prevents any access from an external user to these folders for the
99% of the time you are not using your admin...and 100% of the time for
the folders they should never be visiting.
Outside of a programming/fix/update you will seldom be doing admin work,
program work, and your system/web apps will be running without your
input. So why leave all this open to hackers 24 hours a day?
These simple things can block 100% of brute force shell attacks across
your system...if you can unplug the ipmi card (with an easy way to
replug it) then you cannot be accessed via shell across all your
systems. Sleep in peace.
A majority of hacks on open source revolve getting to that admin
folder....or some other folder of a plug in.. The hacker will have a
heck of a time brute forcing an htaccess protected folder where no
user/pass combo will ever work.
*On a final note....*
If you are building a web application you should use a mysql user that
is only allowed to update and select...
With proper programming you can set up items to be deleted via a cron
job using a mysql user that has a bit more access.
This prevents a hacker from actually deleting or altering any
data....and easily rolled back.
This is how I program and I think it should be standard. As far as I
know not one single program does this...and that is a shame.
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
