Last updated:9/06/03

Orginally Posted by me at rackshack.
http://forum.rackshack.net/showthread.php?s=&threadid=30333

There are alot of things floating around the forums on what to install to get the best degree of safety. Alot of these things are basic, and should be done right after getting ANY server. I have taken the time to do the homework for you and put it in a simple checklist form. To me, an unsecure box on RS's network is a threat to me and anyone else on the network, so please, take the time to secure your box.

The main goal of this checklist will be to help any one person setup a working, secure server.

I run mostly Cpanel servers, but control panel upgrades should be around the same method and most basic thing to perform; therefore I will not go indepth on other control panels.

This checklist assumes you know the basics of linux, the shell, and are using this all VIA SSH with the program putty.

Note: This is a common mistake people have; anything listed here must be done in root. To get root, please use the command "su -" not "su".

######################
~~~~~~~~~~~~~~~~~~~~
######################

Things to do on your server in order of importance:

Full Cpanel (stable) upgrade [Already installed Cpanel/WHM Feature] [Link] (http://forum.rackshack.net/showthread.php?s=&threadid=21619)
Note: This should upgrade openssh and all of that good stuff so all those locks show locked.
Recompile Apache [Already installed Cpanel/WHM Feature]
Bind sshd to only 1 ip, and make it a different ip then your main site, and on a different high level port. Not to forget, disable direct root login.


pico -w /etc/ssh/sshd_config

Find the line '#Port 22' and uncomment it and change it to look like 'Port [Random high level port here]'.

Request an ip from rackshack and create a nameserver using your registar (like the first time) that will point to that ip and wait till it resolves. (Note: You may have to add an A entry/DNS zone using cpanel or whatever you use as your control panel to get this to function.) Make the name of it something like 'ssh.domain.com', or 'shell1.domain.com'.

When it resolves, ssh into your box and find the line '#ListenAddress 0.0.0.0' and make it look like 'ListenAddress ##.##.##.##' replacing the number signs with the ip address.

Find the line '#Protocol 2, 1' and uncomment it and change it to look like 'Protocol 2'

Find the line '#PermitRootLogin yes' and uncomment it and make it look like 'PermitRootLogin no'.

Now restart SSH using the command:

/etc/rc.d/init.d/sshd restart

Now exit out, enter 'ssh.domain.com' as the host name, and put in your high level random port in the box, ssh into your box and your done.

If you have ANY problem with this, please login to your server VIA telnet, fix the problem, login using SSH2 again, and change your passwords. Telnet is a very unsecure protocol, but it'll get you out of a jam.

Note: If you do not have the most current version of putty, please get it as it will allow you to use ssh2 protocol.


Note 2: Though you could still login to root logging into admin and su - to root, it would be best to delete the admin login from your server. This'll give hackers an even harder time trying to crack your box. You should keep in mind that the admin login is only a rackshack thing, and is not a default thing, so it might be best to remove it anyways. Delete user admin, add another user, and add that user to the usergroup whell.

Have the server e-mail everytime someone logs in as root:


- Edit the .bash_profile in the users directory ( in this case /root)
commands:
su -
cd (just cd, nothing else)
pico .bash_profile

And put this at the very end:
echo 'ALERT - Root Shell Access on:' `date` `who` | mail -s "Alert: Root Access on Server #1" webmaster@X***********

Advice from freddo:
Make sure the email address you send to also forwards to an off-server email address. This way the hacker cannot delete the warning email (without hacking another server anyway).

Disable Telnet:

pico -w /etc/xinetd.d/telnet
Note: (change disable = no to yes)
Save and Exit
/etc/init.d/xinetd restart

Chroot/Jail [Link] (http://www.gsyc.inf.uc3m.es/~assman/jail/index.html)
Note: If you have a Cpanel server there is a feature already included to Jail the shell account. Please do this ASAP if you plan on giving out shell accounts.
APF Firewall
[i]Originally posted by DavidB

Follow these instructions to perform a new install of APF.

1. Make /usr/src the current working directory.
cd /usr/src

2. Fetch the most curent verison of APF.
wget http://www.r-fx.net/downloads/apf-current.tar.gz

3. Expand the APF tar.gz file.
tar -xvzf apf-current.tar.gz

4. Remove the tar.gz file.
rm -f apf-current.tar.gz

5. Locate the APF directory.
ls -la

Look for a directory named apf-#.#/ where #.# represents the version of APF being installed (APF version 0.8.7 would be in a directory apf-0.8.7/ and version 0.9 would be in a directory named apf-0.9).

6. Make the APF directory the current working directory.
cd apf-0.9

Use the directory name you located in step 5.
Note that the numbers will change as new versions are released.

7. Run the APF install.
sh ./install.sh

8. Make /etc/apf the current working directory.
cd /etc/apf

9. Edit the conf.apf file as desired.
pico -w conf.apf

A very important part of this firewall you have to edit is the ports. These ports will allow services such as mail, ftp, and ssh come in and out of the server. If you have changed any ports, please modify them below and add/remove as needed.

################

# Common TCP Ports
TCP_CPORTS="21,22,25,26,53,80,110,143,443,2082,2083,2086,2087,2095,2096,19638" // please note that ports 2082 to port 2095 is mostly used by cpanel, and port 19638 is only use in ensim.

# Common UDP Ports
UDP_CPORTS="53"

################

Note that you must set the DEVM parameter to "0" BUT only after full testing of the firewall. What DEVM does is that once you start APF with DEVM to 1, it will set a cron job to stop APF in 5 minutes so you don't end up locking yourself out.

Turn on Anti-DOS, and the block list for added security.

10. Start APF.
./apf -start
or
service apf start

Note: To stop or restart apf, use the "service apf restart/stop" commands.


Tripwire [Link] (http://forum.rackshack.net/showthread.php?s=&threadid=28002&highlight=How+to+install+tripwire)
Email Anti-Virus Scanner (MailScanner) & Anti-Virus Scanner (ClamAV) [Link] (http://www.cpanelplus.com/staticpages/index.php?page=2003073009541160)
chkrootkit [Link] (http://forum.rackshack.net/showthread.php?s=&threadid=7535&highlight=chkrootkit)
Disable direct root login [Link] (http://forum.rackshack.net/showthread.php?threadid=18437)
PRM (Process Resource Monitor) [Link] (http://forum.rackshack.net/showthread.php?threadid=25376)
MRTG bandwidth monitor
Mask apache server & services version numbers [Link] (http://forum.rackshack.net/showthread.php?threadid=13679)
Set a SSH Legal Message [Link] (http://forum.rackshack.net/showthread.php?s=&threadid=4954)
Note: I like to put a legal notice here. Something like:

This computer system is for authorized users only. All activity is logged and regulary checked by systems personal. Individuals using this system without authority or in excess of their authority are subject to having all their services revoked. Any illegal services run by user or attempts to take down this server or its services will be reported to local law enforcement, and said user will be punished to the full extent of the law. Anyone using this system consents to these terms.


######################
~~~~~~~~~~~~~~~~~~~~
######################

Thats about all I have, other then a set of 'always do this' rules.

1.) Always try to use sftp.
2.) Always use ssh2 protocol.
3.) Never ever have passwords lying around or use easily crackable passwords. Nice password holder and gen program is Personal Vault. You can check it out and download it here [Link] (http://www.soft1st.com/)

I plan on making a defintive howto page on my website on howto properly secure your cpanel box to its fullest with each howto on its proper page so you don't have to go looking around. However, that is once I get permission from each person that wrote each HOWTO. :p

If you have a comment on this or something you think that should be added, please PM me. I want to keep this thread as clean as possible so newbs don't have to scroll threw pages of stuff.

I will constantly update this when required.

Nice list. You might also want to include grsecurity:
http://grsecurity.net/

Also admin0 used to have a security manual for cpanel servers on admin0.info

The site is down right now but hope it will back soon because it also has very important tips about permissions, compilers, etc.

regards

looks like admin0 will be back in a few days, check their site now :D

Hi GetWired,

thanks for the list..it really nice...

I have tried setup the "Have the server e-mail everytime someone logs in as root:" in my RH 8.0 with WHM stable version installed but I was not able to receive the email.

I tried setup it on other server and is working :confused: , just this one not workinh....any guides?

Let me see: leave telnet enabled for login so you can get onn to edit your ssh config?

All unnecessary services should be removed or diabled on the server and that includes telnet. You are using ssh in place of telnet - that's the whole point of using ssh in the first place.

Mask apache server & services version numbers [Link] (http://forum.rackshack.net/showthread.php?threadid=13679)

Going through your killer checklist and found this:
http://forums.cpanel.net/showthread.php?s=&threadid=12153

You should not be relying on cPanel to tell you your server is vulnerable. As a server admin you should be subscribed to the various announcement lists from the software vendors you utilize. If you don't want vendor specific lists you should subscribe to the one of the other mailing lists that address these issues, Bugtraq does this, although lately they have gotten really slow at approving their posts.

Running ssh on some random high port is pointless. No hacker would ssh in, they would use a backdoor or something like nc. Even if they wanted to use ssh, simple scan would find it. I don't see a point in using that firewall in that manner. If you are not running unneeded services, then what is the point of blocking that port when nothing is listening on it? Purpose of a firewall is to filter traffic between networks and since you are not doing that, why run it? Only reason I would run a firewall on a server would be to restrict certian services per ip but even that should be upstream and not on the server. Having the machine email you when root logs in is neat and all but why would a hacker ever login with root? Just more logs he/she would need to clean up(hist file, wtmp, utmp, ect). Chroot's can easily be broken out of, if you are going to use them make sure to apply the grsec patches to your kernel which makes it extremely difficult to get out of then.

Security needs to be applied in layers, the more layers you have the better the security. There is no one solution to make your box secure. For every security procedure you can put in place it is only a matter of time before it is broken, this is no excuse not to implement the procedure. The idea being you raise the bar high enough that the skills needed to fully own the box are not possessed by every kiddie out there with a c compiler and a bookmark to packetstorm.

A properly configured host based firewall can save you, picture this for example.

You are running a vulnerable openssl install which is exposed to the world (mod_ssl) and the particular exploit spawns a root shell on the system on a non-standard port. Sure your box has been exploited but that is as far as it goes since the attacker can not connect to their remote port.

Also host based firewalls are good if you dont actually control your upstream for example the people leasing dedicated servers will have no control over the inbound/outbound filtering rules of the network so a host based firewall is the answer.

A proper firewall configuration will "deny all" by default and allow in only that which you explicitly allow can be your best friend in certain situations, like the one i mentioned above.

Now to address some of your other points.

I agree, running services on non-standard ports is not the best way to do things, security through obscurity only gives you a false sense of security, it may give you slight protection from automated worms, but if the exploits been around long enough to be included into a worm and you're still running a vuln service then you have bigger issues.

I disagree with you that an attacker would not use SSH, every rootkit these days has a trojaned SSH that hides logins from specific IP's and/or usernames. Think about it logically, if your working on a compromised system would you want your traffic in clear text? All the admin would need to do is sniff the session for a while and they would have your rootkit login/password and this makes it SO much easier to remove the kits.

nc/netcat is a great tool and is generally used to setup the initial shoveled shell back to the attacker or to bind the shell to a high port, this enables the attacker to install their rootkit which includes trojaned binaries, kernel modules etc so now they can hide their presence and use encrypted communication.

I think that pretty much covers it, if i think of anything else I'll add another post :)

If a hacker can spawn a root process listening on a port, why could they not also run a simple iptables line to open it up? Yeah they deny all in by defualt but so many allow any connections that originated from the server itself. So you could run an exploit which it initiates the connection from the server to another server you have comprised and gain access that way. Again, host based firewalls are pointless since they are easily comprimised. If you are on a server and you do not know someone is sniffing your traffic, maybe you should not be a hacker. Just because you do not use ssh does not mean you cannot encrypt your connection, it isn't difficult to write a backdoor/client which can use the openssl lib(if there isn't any already avail). Even when using ssh, they can still monitor your tty to see what you are doing.

Because there are limitations on the amount of shell code that you can run in any given exploit, some buffers are larger than orthers. 90% of the people running this code against machines would not have the 1st clue how to modify shell code to do add/remove firewalls rules, not to mention the fact adding such shell code could push the exploit code in such a way the offsets need to be reclculated for each machine. Like i said raising the bar is the goal, there is no sure fire way to keep *everyone* out unless you unplug the machine.

As for shoveling a shell you will notice i did say a correctly setup firewall with "Deny ALL" by default, this includes inbound and outbound rules.

With your mentality it is pointless to lock my apartment door because someone can just break a window right?

Can you tell me how the attacker would identify the traffic is being sniffed at the network level? I never said the sniffing would be done from the host itself :)

Cryptcat is a version of netcat that has encryption abilities. I stated that most if not all rootkits available today include trojaned SSHd's which hide specific logins. This ties in with kernel modules that hide running processes etc.

have a seperate /tmp partition and mount it noexec nodev nosuid in /etc/fstab

look for a folder vbox [I think its in /var/spool/vbox] and change its perms