7 Security And Settings Questions (cpanel/WHM) Server
Aug 30, 2007
Just have some questions regarding server settings and security
1) What will happen if
Open_basedir in php.ini is changed to
Open_basedir = /home:/tmp
?
2) What will happen if all hosted users in passwd file are set to /sbin/nologin ???
Dose it effect running the web site?
What are the effects if
Sync if set to /sbin/nologin default is /bin/sync
shutdown if set to /sbin/nologin default is /sbin/shutdown
halt if set to /sbin/nologin default is /sbin/halt
news if set to /sbin/nologin default is empty
netdump if set to /sbin/nologin default is /bin/bash
Mysql if set to /sbin/nologin default is /bin/bash
mailman if set to /sbin/nologin default is /bin/bash
cpanel if set to /sbin/nologin default is /bin/bash
3) How to make /bin/bash in passwd file is the default path for each new user added (automatically) in cpanel/whm server
4) What is the effect if base64_encode and base64_decode if been added in disable functions?
5) How to secure host.conf and nsswitch.conf to prevent DNS lookup poisoning and also provide protection against spoofs?
6) How to secure the system configuration file sysctl.conf to prevent the TCP/IP stack from syn-flood attacks?
7) What is ClamAV and how to disable it?
View 2 Replies
ADVERTISEMENT
Mar 4, 2007
This is my list (from my head) of things to install or do on a webhosting server to enhance security (not in any particualr order):
- rkhunter.
- chkrootkit.
- secure /tmp and similars.
- install mod_security.
- install mod_deflate.
- change ssh port.
- disable root login.
- install and tweak apf.
- install bfd.
- setup logwatch.
- add know "bad" IPs to apd list.
- enforce long and secure passwords.
- syctl.conf Hardening
- Mod_LimitIPConn
- System Integrity Monitor
- System Priority
- Process Resource Monitor
- Port Scan Attack Detection
- In php.ini, disable:
exec,system,passthru,readfile,shell_exec,escapeshellarg,escapeshellcmd,proc_close,proc_open,ini_alter,dl,popen
- Prevent Apache and bind to show their versions.
View 5 Replies
View Related
Jul 7, 2009
I have the following config:
Centos 4.7 Final
Apache 2.2
PHP 5.2.9 (suphp / suhosin disabled)
MySQL 5
Server: Dual Xeon, 4GB Memory
I'd like input on the most optimal settings overall
php.ini
Quote:
; Memcache Section
extension = memcache.so
memcache.allow_failover = 0
extension="eaccelerator.so"
eaccelerator.shm_size="16"
eaccelerator.cache_dir="/tmp/eaccelerator"
eaccelerator.enable="1"
eaccelerator.optimizer="1"
eaccelerator.check_mtime="1"
eaccelerator.debug="0"
eaccelerator.filter=""
eaccelerator.shm_max="0"
eaccelerator.shm_ttl="0"
eaccelerator.shm_prune_period="0"
eaccelerator.shm_only="0"
eaccelerator.compress="1"
eaccelerator.compress_level="9"
;;;;;;;;;;;;;;;;;;;
; Resource Limits ;
;;;;;;;;;;;;;;;;;;;
max_execution_time = 300
max_input_time = 600
memory_limit = 256M
httpd.conf
Quote:
RLimitMEM 473331029
RLimitCPU 240
ErrorLog logs/error_log
DefaultType text/plain
AddType text/html .shtml
ServerLimit 1000
KeepAlive On
MaxKeepAliveRequests 64
KeepAliveTimeout 1
MinSpareServers 5
MaxSpareServers 15
StartServers 30
MaxClients 850
MaxRequestsPerChild 64
HostnameLookups Off
UseCanonicalName Off
my.cnf
Quote:
[mysqld]
local-infile=0
datadir=/var/lib/mysql
skip-locking
skip-networking
safe-show-database
query_cache_limit=2M
query_cache_size=128M ## 32MB for every 1GB of RAM
query_cache_type=1
max_user_connections=350
max_connections=600
interactive_timeout=10
wait_timeout=28800
connect_timeout=20
thread_cache_size=128
key_buffer=512M ## 128MB for every 1GB of RAM
join_buffer=8M
max_connect_errors=20
max_allowed_packet=32M
table_cache=1024
record_buffer=8M
sort_buffer_size=4M ## 1MB for every 1GB of RAM
read_buffer_size=4M ## 1MB for every 1GB of RAM
read_rnd_buffer_size=4M ## 1MB for every 1GB of RAM
thread_concurrency=8 ## Number of CPUs x 2
myisam_sort_buffer_size=64M
server-id=1
collation-server=latin1_swedish_ci
[mysql.server]
user=mysql
old-passwords = 1
[safe_mysqld]
err-log=/var/log/mysqld.log
pid-file=/var/lib/mysql/mysql.pid
open_files_limit=8192
View 4 Replies
View Related
Feb 15, 2009
How I can enable the following options on my VPS:
LF_HTACCESS
PT_SKIP_HTTP
PT_ALL_USERS
View 3 Replies
View Related
Nov 20, 2007
I have a zone.net VPS with 1152mb of RAM.
I don't resell, I am using the VPS for personal use to run a small vBulletin board (30-60 members on at a time), a Mambo site that is used to aggregate news (12,000 or so news items), and then a couple small personal static sites, and about 25 email addresses.
My VPS has the following versions listed in WHM:
WHM 11.11.0 cPanel 11.15.0-R17853
CENTOS Enterprise 4.5 i686 on virtuozzo - WHM X v3.1
It is currently setup with the default update settings that came when Zone.net set it up, which are:
cPanel/WHM Updates = Manual Updates Only (STABLE tree)
cPanel Package Updates = Automatic
Security Package Updates = Automatic
Question 1:
So, for the type of site I am running, is the stable tree the best? While it is a small vBulletin community, lack of down time is my main goal, so I need to balance getting updates fast enough to keep it secure, but not getting 'bleeding edge' bugs introduced. Which tree is the best balance?
Question 2:
Should I be running automatic updats on cPanel/WHM or keep it manual and check here and other forums for important updates?
Question 3:
I recently had a problem where Horde stopped working. Zone.net's support staff helped me, and suggested two things to attempt to fix it, and this "/scripts/fullhordereset" fixed it. So, since I am new to VPS's and more specifically, working with Linux, how to I learn/research things like this in the future. Should I be checking out forums/communities for each individual app (like Horde), or is there a better option?
Question 4:
Unfortunately, I don't know what I don't know. Such as what tree to run, when to do cPanel updates, when to do Apache updates, how to make sure all my configs are right. Any suggestions on how to both make sure my WHM is configured the best way for my purposes, and more importantly, what is the best way of moving from WHM
View 1 Replies
View Related
Oct 8, 2007
I'm rather new to hosting so I still don't get everything, but maybe you can help me. I am hosting a web page on a computer that is hooked into the same network as my personal computer. They are both hooked into an openBSD router, which has the connection to the internet. My recently purchased domain name is set to forward all requests directly to the computer with the website on it (named 'b2.') When you visit the domain from an outside computer it does this just fine, but when you try to access it from one of the computers on my network it does not work. From my computer you can not access the website from the domain, but you can still access it just straight through the local network (i.e. typing 'b2' directly into the address bar ) From the computer which is actually the host to the website, it is accessible neither way, though the local network option was working before. Does anyone know what the problem is and how I can fix it? Keep in mind that I really only understand the basics of web hosting, and terminology and stuff.
View 3 Replies
View Related
Apr 25, 2008
I was reading this
vbulletin.com/forum/archive/index.php/t-6868.html
but that was quite some time back.
If any user has current experience of using Zeus w.r.t
- running of standard vbb, photopost etc
- zend and / or ioncube
- some php scripts need url rewrite, is it possible
- creating subdomains when the host does not provide it
View 0 Replies
View Related
Dec 4, 2008
I just signed up for dedicated server at Softlayer with cPanel, mySQL and CentOS. I'm moving a site that is on a VPS with WHM. I know that cPanel has a transfer site feature.
I was considering hiring a service to migrate my site and to harden my server. Is this necessary or should I simply move it via cPanel? Things are tight and I don't want to incur an unnecessary cost if I don't have to. I defer to the members here at WHT for your recommendations.
View 3 Replies
View Related
Sep 23, 2007
I am aiming to offer VPS based on OpenVZ. Have some questions, please help to answer
- in OpenVZ, is there any monitor script, that will release an email to say one VPS is down? Or will I need to use external monitoring?
- can I do the backup / restore of full VPS within OpenVZ? Can customers do it themselves?
- how hard to change the VPS configuration? For example, upgrading from 256MB RAM to 512MB RAM, or adding more CPU, space...?
- how about the IP control in OpenVZ? Let's say each VPS will have 2 IPs, so to prevent customers adding more IPs, I will need to setup VLAN, is that correct? How hard is it in OpenVZ?
- how about the ideal hardware for running OpenVZ? Saying SATA, or SCSI disks, how many RAM... for example
View 14 Replies
View Related
Dec 26, 2008
I have a few questions about tektonic, I talked to their costumer service but maybe you guys out of experience can tell me a bit more.
Also if anyone knows of a XEM server that is located near Atlanta, that provides the same as TekTonic I would appreciate the info. and if anyone has one of those lifetime promo codes, that would be apprecialoved.
ok I plan to get 2 VPS from tektonic ( this is my top choice so far ) I want to have one 100% dedicated on the intranet for MYSQL, the other for apache and all the other stuff you know.
I also Need cpanel to move things around, so I need that one ( however someone told me I can buy a cpanel license separately )
ok I am going for the 294MB one for the Mysql and the 1178MB one for the apache and all that.
they say that they warantee the CPU 2.6GHZ on the 294MB one and 7.x GHZ on the 1178MB one, is this for real they really guarantee this CPU, or that's what you can burst.
the costumer service guy told me that CPU is guaranteed, and you can't burst, however they work on virtuosso and all virtuosso VPS I have worked do allow bursts, I would like to know from experience how fast are those servers processing, I mean for real.
because if I get 300MHZ of CPU and I can burst to 2.6GHZ, that would suck because I already have CPU intensive apps on my other VPS, and I plan to move.
View 2 Replies
View Related
Sep 30, 2009
I need another server upgrade, hosting package upgrade.
I'm looking into cloud hosting because of the scalability.
What's the best
#1 Reliable
#2 Great Support
#3 Affordable
cloud hosting company.
Rackspace seems to be great on #1 and #2 i guess but #3 they are a bit more expensive. I know someone is going to say "you get what you pay for", but thats why i put Affordable at #3.
View 14 Replies
View Related
May 18, 2007
I have a small network at my colo provider.
Colo Provider
|
My HP 2650
| |
server1 serverN
I want to setup static routes on my servers so that my colo provider won't bill me for traffic among my servers.
I use FreeBSD 6 on my servers. I read the FreeBSD handbook on this and it looks like i should do this:
route add -net 0.0.0/24 0.0.0.3
where 0.0.0/24 is the C class I have from my provider and 0.0.0.3 is the IP address of my server (one of them/any of them).
However, this route appears to already exist as i get this error when running that route command:
route: writing to routing socket: File exists
add net 0.0.0: gateway 0.0.0.3: route already in table
Do I need to use a non-routeable ip block (eg 192.168.x.x) for this? Can I use "real"/routeable ips? Does FreeBSD take care of this for me automatically?
View 5 Replies
View Related
Apr 7, 2008
I have a dedicated server and have 5 IP addresses in all.
3 IP addresses i am using already.
I want to give 2 IP address to a site, i have created DNS for that site:
ns1.domainname.com
ns2.domainname.com
for both NS i have given 2 spare IPs.
Now i want to edit the DNS of that domain name, which section i edit of the DNS in WHM and in which field what i write?
View 5 Replies
View Related
Nov 13, 2006
Hi I've never worked with a dedicated host, and I was considering going with hostgator, because they provide managed hosting and cPanel, which I'm fond of.
This is not for my own sites, but for someone I work for as a programmer/webmaster. He has asked that I make the decision on this, even though I've basically advised against it, due to my lack of experience with dedicated hosting.
I've also looked at lunarpages, doesn't seem to be much different than hostgator. Here are links to their pages...
http://www.hostgator.com/dedicated.shtml
http://www.lunarpages.com/dedicated-hosting/
Does anyone have experience from either of these? I don't think the sites hosted on the server are going to be particularly high bandwidth sites (I don't really think they even need a dedicated host) ... do you think we'll be okay with a single 2.8 Ghz processor?
Also, does anyone have any advice as far as the number of sites hosted on the server? He wants to move ALL of them to the same server. Any thoughts on whether or not this is a good idea?
I know I've asked a lot here but I'm really getting into new territory. If you can provide any input on ANY of the above items, I'd greatly appreciate it.
View 8 Replies
View Related
Nov 13, 2008
I had a few specific questions about ADULT hosting. I've been refining an idea I had for an adult website after getting some good feedback from this site, but I had a few specific questions I still need addressed. If you think this forum is the wrong place to be asking about this, do you happen to know of any other forums that specialize in discussing adult web hosting?
My general plan is to set up a video-based adult site that charges people money (a monthly fee) to see the premium content. I have a general idea about my start-up investments, but not necessary how much each would cost, and I'm trying to put together a budget. If anyone could help me fill in some of these blanks I would really appreciate it!!
I'll need a lawyer to set up site disclaimers, contracts, etc. - I assume this will be a few hundred dollars - does this sound correct?
I need to build the site- this is where I'm not sure about costs. The general specifications are like any other adult website - users pay to register - so I would go with one of the established companies that deals with secure online credit card transactions - any ideas which ones are good? How much do they normally take?
Users then can watch the videos, rate and give feedback. Since I don't really know any programming besides HTML, I'm assuming I need to hire someone to build the site and make sure it is secure. I'm also assuming this will be the most expensive part of the investment. Can someone give me some estimates about this? Are there general templates online that I can use that will save money? Is guru.com a trusted place to hire programmers? Is this something I could do myself without spending years learning a new programming language? How DO I make the site secure, and how can I keep people from stealing my premium content and posting it on other sites? I'm obviously trying to make this as cheap as possible without sacrificing all the quality - but unfortunately I have thousands to invest and not tens of thousands (i don't know if this will be a problem or not).
Also - hosting. I was told that a popular adult video site will cost a fortune in bandwidth. If I'm charging a monthly membership fee I'm hoping that can offset the costs. Can someone recommend good, scalable adult video hosting - and give me a general idea about what kind of server I need, how much bandwidth etc. I figure since this is membership driven I can start small and then increase bandwidth depending on how many members join, so I'm always making a profit. Does that sound realistic?
Finally, can adult pay sites still make money today? Not just a couple bucks here and there, but enough so I can eventually quit my day job?
The wonderful feedback I got here before helped me to reshape my ideas, and now I'd like to begin the next steps. Thank you all very much again for ANY help you can give me - I sincerely appreciate all the generous, knowledgeable people that make this forum a pleasure to visit!
View 5 Replies
View Related
Aug 4, 2008
What are some of the general questions your customers have with HyperVM?
And a VPS in general.
View 10 Replies
View Related
Dec 18, 2007
I recently contacted 'theprimehost' with some pre-sales questions about their service.
However I received no replies, so posted on their forums in hope to get a reply from Darrell. However I found that the thread was removed. The questions I asked were as below:
1. Can I host MODx/Textpattern on Primehost space?
2. Do I get access to mod_rewrite / SSH with your account? (As an individual and as reseller)
3. How much do you charge for a dedicated IP?
4. Do you oversell or allow overselling with reseller accounts? How is the bandwidth calculated?
5. How can I monitor the uptime of your servers?
6. Is domain alias enabled?
7. Does mail enable me to set vacation auto-replies?
8. How frequently do you backup data?
9. Do you accept payments for 2 years at a time?
10. I didn't find information about your datacenter on the site. Can you please tell me more about it?
11. Can I avail of the 20% discount in addition to the 2 for 1 offer? Till when are these two offers valid?
I wonder why nobody at 'theprimehost' bothered to reply to my queries and deleted the thread so promptly. Anybody knows whats up with the guys? I have seen great reviews about them on the forum so this was unexpected.
I know Darrell is active on this forum - maybe he can clarify...
View 5 Replies
View Related
Feb 25, 2008
I will be moving my vBulletin forums to a new dedicated server soon. I have been looking around for a suitable server specs, and I would like to ask you the following questions:
1- If I have the option to maximize one of the following only: the Processor, The Memory, or The Hard Disk. Which one should I go for?
2- Are there any certain settings that I can change in my server environment to get maximum performance for my forums?
3- Do you recommend a certain provider for dedicated servers? Which? And Why?
The goal is to maximize the performance of my 500 Online users vBulletin forums.
View 9 Replies
View Related
Jun 26, 2008
I'm in a quandary over which host to choose. I've narrowed my choices between the above three. While this can be a subjective decision, I am looking for insight, any opinions and also advice on what to watch out for in deciding the best host for my needs.
Speaking of my needs, its fairly simple I have one site that runs my blog (on movabletype), another site that holds images and such, and a couple of others that I use for hobby/development purposes. All are generally low bandwidth.
I used dreamhost past and got burned by their latency and downtime. So while my needs are meager compared to many others I don't want to sacrifice performance/uptime in the name of saving a dollar.
They all offer money back guarantees so that gives me a chance to play with them but I'd like some advice on what to look out for, advice or other member's experience with them
Littleoak hosting, a small newish hosting company with nearly a rabid following over on the realmacsoftware.com's forums. This is a support forums for rapidweaver which I also use. I cannot install movabletype on this host - tried for 2 days with the help of their support. Finally gave up. If I go with them, I need to convert to wordpress. I do not want to do that just so I can use a new host. They have two packages that could work for me one at 25 dollars a year and another at 80 dollars. Bandwidth and storage are the differences.
Medialayer customer support seems very good, I can run movabletype. Pricing seems a tad high especially given my needs but they offer lots of flexibility and up to 6 domains for one package at 20/mth or 3 domains for 10/mth
ICDSoft top notch support, has a great webmail client (I hate squirrelmail) Little inflexible but nothing that would be a show stopper. I was able to install movabletype, I have yet to fully try it out though. A single domain per account at 6/mth If I have multiple domains it could get pricey.
I'm not sure if it matters but I ping all three sites and medialayer came out on top with 6ms, icdsoft with 13ms and littleoaks with 30ms.
Any thoughts opinions and/or advice regarding these three hosts. I've done enough research and while there may be other fine hosting companies these three are on my short list.
View 5 Replies
View Related
Jun 7, 2008
I use a couple of different hosting companies.
Recently, I've begun setting up blogs.
I've been trying to set up blogs on Company "A" for the past month and have had nothing but problems.
While waiting to hear back - one more time - from tech support on Company "A"
I set up a blog on Company "B". Everything set up perfectly, smoothly and in about 1 hour I had the blog up and running.
I'm using 2.5.1 WPB and plugins that are NOT known to have "issues".
I've used the same themes and plugins on "A" and "B".
I changed permissions on a couple of the plugins (company A) and the plugins just disappeared.
I tried setting up widgets and none work.
if there are specific settings server side that make setting up blogs work/not work?
View 15 Replies
View Related
Sep 6, 2008
I have a problem with my csf setting dunno why now when i start csf i block my server, i come from backup before with same config and working very well dunno why not working in this time.
Code:
###############################################################################
# Copyright 2006, Way to the Web Limited
# URL: http://www.waytotheweb.com
# Email: sales@waytotheweb.com
###############################################################################
# This configuration is for use with generic Linux servers, do not change the
# following setting:
GENERIC = "1"
# Testing flag - enables a CRON job that clears iptables incase of
# configuration problems when you start csf. This should be enabled until you
# are sure that the firewall works - i.e. incase you get locked out of your
# server! Then do remember to set it to 0 and restart csf when you're sure
# everything is OK. Stopping csf will remove the line from /etc/crontab
TESTING = "0"
# The interval for the crontab in minutes. Since this uses the system clock the
# CRON job will run at the interval past the hour and not from when you issue
# the start command. Therefore an interval of 5 minutes means the firewall
# will be cleared in 0-5 minutes from the firewall start
TESTING_INTERVAL = "5"
# Enabling auto updates creates a cron job called /etc/cron.d/csf_update which
# runs once per day to see if there is an update to csf+lfd and upgrades if
# available and restarts csf and lfd. Updates do not overwrite configuration
# files or email templates. An email will be sent to the root account if an
# update is performed
AUTO_UPDATES = "1"
# By default, csf will auto-configure iptables to filter all traffic except on
# the local (lo:) device. If you only want iptables rules applied to a specific
# NIC, then list it here (e.g. eth1, or eth+)
ETH_DEVICE = "venet0"
# If you don't want iptables rules applied to specific NICs, then list them in
# a comma separated list (e.g "eth1,eth2")
ETH_DEVICE_SKIP = ""
# Lists of ports in the following comma separated lists can be added using a
# colon (e.g. 30000:35000).
# Allow incoming TCP ports
TCP_IN = "21,22,25,53,80,110,143,443,993,995,3306,3784,7776:7779,8767,10000,35000:36000,14534,51234,25000:26000,9339,6969"
# Allow outgoing TCP ports
TCP_OUT = "20,21,22,25,53,80,110,113,443,953,995,9339,6969,5558,2222"
# Allow incoming UDP ports
UDP_IN = "20,21,53,953,3784,8767,1000"
# Allow outgoing UDP ports
# To allow outgoing traceroute add 33434:33523 to this list
UDP_OUT = "20,21,53,113,123,953,1000:3800,6100,6881"
# Allow incoming PING
ICMP_IN = "1"
# Set the per IP address incoming ICMP packet rate
# To disable rate limiting set to "0"
ICMP_IN_RATE = "1/s"
# Allow outgoing PING
ICMP_OUT = "1"
# Set the per IP address outgoing ICMP packet rate
# To disable rate limiting set to "0"
ICMP_OUT_RATE = "1/s"
# If this is a MONOLITHIC kernel (i.e. it has no LKM support, e.g. a VPS) then
# set this to 1. Because of the nature of monolithic kernels, it's not easy to
# determine which modules have been built-in, so some functionality may not be
# available and this firewall script may not work.
#
# One example is if the ip_conntrack and ip_conntrack_ftp iptables kernel
# modules are not available. If this happens, FTP passive mode (PASV) won't
# work. In such circumstances you will have to open a hole in your firewall and
# configure the FTP daemon to use that same hole. For example, with pure-ftpd
# you could add the port range 30000:35000 to TCP_IN and add the following line
# to /etc/pure-ftpd.conf (without the leading #):
# PassivePortRange30000 35000
# Then restart pure-ftpd and csf and passive FTP should then work
MONOLITHIC_KERNEL = "1"
# Drop target for iptables rules. This can be set to either DROP ot REJECT.
# REJECT will send back an error packet, DROP will not respond at all. REJECT
# is more polite, however it does provide extra information to a hacker and
# lets them know that a firewall is blocking their attempts. DROP hangs their
# connection, thereby frustrating attempts to port scan the server.
DROP = "DROP"
# Enable logging of dropped connections to blocked ports to syslog, usually
# /var/log/messages. This option needs to be enabled to use Port Scan Tracking
DROP_LOGGING = "1"
# Enable logging of dropped connections to blocked IP addresses in csf.deny or
# by lfd with temporary connection tracking blocks. Do not enable this option
# if you use Port Scan Tracking
DROP_IP_LOGGING = "0"
# Only log reserved port dropped connections (0:1023). Useful since you're not
# usually bothered about ephemeral port drops
DROP_ONLYRES = "0"
# Commonly blocked ports that you do not want logging as they tend to just fill
# up the log file. These ports are specifically blocked (applied to TCP and UDP
# protocols) for incoming connections
DROP_NOLOG = "67,68,111,113,135:139,445,513,520"
# Enable packet filtering for unwanted or illegal packets
PACKET_FILTER = "1"
# Log packets dropped by the packet filtering option PACKET_FILTER. This will
# show packet drops that iptables has deemed INVALID (i.e. there is no
# established TCP connection in the state table), or if the TCP flags in the
# packet are out of sequence or illegal in the protocol exchange.
#
# If you see packets being dropped that you would rather allow then disable the
# PACKET_FILTER option above by setting it to "0"
DROP_PF_LOGGING = "0"
# Enable SYN flood protection. This option configures iptables to offer some
# protection from tcp SYN packet DOS attempts. You should set the RATE so that
# false-positives are kept to a minimum otherwise visitors may see connection
# issues (check /var/log/messages for *SYNFLOOD Blocked*). See the iptables
# man page for the correct --limit rate syntax
SYNFLOOD = "0"
SYNFLOOD_RATE = "4/s"
# Enable verbose output of iptables commands
VERBOSE = "1"
# Log lfd messages to SYSLOG in addition to /var/log/lfd.log. You must have the
# perl module Sys::Syslog installed to use this feature
SYSLOG = "1"
# If you wish to allow access from dynamic DNS records (for example if your IP
# address changes whenever you connect to the internet but you have a dedicated
# dynamic DNS record from the likes of dyndns.org) then you can list the FQDN
# records in csf.dyndns and then set the following to the number of seconds to
# poll for a change in the IP address. If the IP address has changed iptables
# will be updated.
#
# A setting of 600 would check for IP updates every 10 minutes. Set the value
# to 0 to disable the feature
DYNDNS = "0"
# Limit the number of IP's kept in the /etc/csf/csf.deny file. This can be
# important as a large number of IP addresses create a large number of iptables
# rules (4 times the number of IP's) which can cause problems on some systems
# where either the the number of iptables entries has been limited (esp VPS's)
# or where resources are limited. This can result in slow network performance,
# or, in the case of iptables entry limits, can prevent your server from
# booting as not all the required iptables chain settings will be correctly
# configured. The value set here is the maximum number of IPs/CIDRs allowed
# if the limit is reached, the entries will be rotated so that the oldest
# entries (i.e. the ones at the top) will be removed and the latest is added.
# The limit is only checked when using csf -d (which is what lfd also uses)
# Set to 0 to disable limiting
DENY_IP_LIMIT = "100"
# Limit the number of IP's kept in the temprary IP ban list. If the limit is
# reached the oldest IP's in the ban list will be removed and allowed
# regardless of the amount of time remaining for the block
# Set to 0 to disable limiting
DENY_TEMP_IP_LIMIT = "100"
# Temporary to Permanent IP blocking. The following enables this feature to
# permanently block IP addresses that have been temporarily blocked
# LF_PERMBLOCK_COUNT times in the last LF_PERMBLOCK_INTERVAL seconds. Set
# LF_PERMBLOCK to "1" to enable this feature
#
# Care needs to be taken when setting LF_PERMBLOCK_INTERVAL as it needs to be
# at least LF_PERMBLOCK_COUNT multiplied by the longest temporary time setting
# (TTL) for blocked IPs, to be effective
#
# Set LF_PERMBLOCK to "0" to disable this feature
LF_PERMBLOCK = "0"
LF_PERMBLOCK_INTERVAL = "86400"
LF_PERMBLOCK_COUNT = "4"
# Permanently block IPs by network class. The following enables this feature
# to permanently block classes of IP address where individual IP addresses
# within the same class LF_NETBLOCK_CLASS have already been blocked
# LF_NETBLOCK_COUNT times in the last LF_NETBLOCK_INTERVAL seconds. Set
# LF_NETBLOCK to "1" to enable this feature
#
# This can be an affective way of blocking DDOS attacks launched from within
# the same networ class
#
# Valid settings for LF_NETBLOCK_CLASS are "A", "B" and "C", care and
# consideration is required when blocking network classes A or B
#
# Set LF_NETBLOCK to "0" to disable this feature
LF_NETBLOCK = "0"
LF_NETBLOCK_INTERVAL = "86400"
LF_NETBLOCK_COUNT = "4"
LF_NETBLOCK_CLASS = "C"
# The follow Global options allow you to specify a URL where csf can grab a
# centralised copy of an IP allow or deny block list of your own. You need to
# specify the full URL in the following options, i.e.:
# http://www.somelocation.com/allow.txt
#
# The actual retrieval of these IP's is controlled by lfd, so you need to set
# LF_GLOBAL to the interval (in seconds) when you want lfd to retrieve. lfd
# will perform the retrieval when it runs and then again at the specified
# interval. A sensible interval would probably be every 3600 seconds (1 hour)
#
# You do not have to specify both an allow and a deny file
#
# You can also configure a global ignore file for IP's that lfd should ignore
GLOBAL_ALLOW = ""
GLOBAL_DENY = ""
GLOBAL_IGNORE = ""
LF_GLOBAL = ""
# Enable login failure detection daemon (lfd). If set to 0 none of the other LF
# settings have any effect as the daemon won't start.
# When the trigger level of failures is reached lfd will use csf to add the IP
# to the /etc/csf/csf.deny file and block it
LF_DAEMON = "1"
# The following[*] triggers are application specific. If you set LF_TRIGGER to
# "0" the value of each trigger is the number of failures against that
# application that will trigger lfd to block the IP address
#
# If you set LF_TRIGGER to a value greater than "0" then the following[*]
# application triggers are simply on or off ("0" or "1") and the value of
# LF_TRIGGER is the total cumulative number of failures that will trigger lfd
# to block the IP address
#
# Setting the application trigger to "0" disables it
LF_TRIGGER = "0"
# If LF_TRIGGER is > 1 then the following can be set to "1" to permanently
# block the IP address, or if set to a value greater than "1" then the IP
# address will be blocked temporarily for the value in seconds. For example:
# LF_TRIGGER = "1" => the IP is blocked permanently
# LF_TRIGGER = "3600" => the IP is blocked temporarily for 1 hour
#
# If LF_TRIGGER is 0, then the application LF_[application]_PERM value works in
# the same way as above
LF_TRIGGER_PERM = "1"
# To only block access to the failed application instead of a complete block
# for an ip address, you can set the following to "1", but LF_TRIGGER must be
# set to "0" with specific application[*] trigger levels also set
LF_SELECT = "0"
#[*]Enable login failure detection of sshd connections
LF_SSHD = "5"
LF_SSHD_PERM = "1"
#[*]Enable login failure detection of pure-ftpd connections
LF_FTPD = "10"
LF_FTPD_PERM = "1"
#[*]Enable login failure detection of SMTP AUTH connections
LF_SMTPAUTH = "5"
LF_SMTPAUTH_PERM = "1"
#[*]Enable login failure detection of courier pop3 connections. This will not
# trap the older cppop daemon
LF_POP3D = "10"
LF_POP3D_PERM = "1"
#[*]Enable login failure detection of courier imap connections. This will not
# trap the older cpimap (uwimap) daemon
LF_IMAPD = "10"
LF_IMAPD_PERM = "1"
#[*]Enable login failure detection of Apache .htpasswd connections
# Due to the often high logging rate in the Apache error log, you might want to
# enable this option only if you know you are suffering from attacks against
# password protected directories
LF_HTACCESS = "5"
LF_HTACCESS_PERM = "1"
#[*]Enable failure detection of Apache mod_security connections
# Due to the often high logging rate in the Apache error log, you might want to
# enable this option only if you know you are suffering from attacks against
# web scripts
LF_MODSEC = "5"
LF_MODSEC_PERM = "1"
#[*]Enable detection of suhosin triggers and blocking of attackers
# Example: LF_SUHOSIN = "5"
LF_SUHOSIN = "0"
LF_SUHOSIN_PERM = "1"
# Check that csf appears to have been stopped. This checks the status of the
# iptables INPUT chain. If it's not set to DROP, LF will run csf. This will not
# happen if TESTING is enabled above. The check is done every 300 seconds
LF_CSF = "1"
# Send an email alert if anyone logs in successfully using SSH
LF_SSH_EMAIL_ALERT = "1"
# Send an email alert if anyone uses su to access another account. This will
# send an email alert whether the attempt to use su was successful or not
LF_SU_EMAIL_ALERT = "1"
# Enable Directory Watching. This enables lfd to check /tmp and /dev/shm
# directories for suspicious files, i.e. script exploits. If a suspicious
# file is found an email alert is sent. Only one alert per file is sent until
# lfd is restarted, so if you remove a suspicious file, remember to restart lfd
#
# To enable this feature set the following to the checking interval in seconds.
# Set to disable set to "0"
LF_DIRWATCH = "60"
# To remove any suspicious files found during directory watching, enable the
# following. These files will be appended to a tarball in
# /etc/csf/suspicious.tar
LF_DIRWATCH_DISABLE = "0"
# This option allows you to have lfd watch a particular file or directory for
# changes and should they change and email alert using watchalert.txt is sent
#
# To enable this feature set the following to the checking interval in seconds
# (a value of 60 would seem sensible) and add your entries to csf.dirwatch
#
# Set to disable set to "0"
LF_DIRWATCH_FILE = "0"
# This is the interval that is used to flush reports of usernames, files and
# pids so that persistent problems continue to be reported, in seconds.
# A value of 3600 seems sensible
LF_FLUSH = "3600"
# System Integrity Checking. This enables lfd to compare md5sums of the
# servers OS binary application files from the time when lfd starts. If the
# md5sum of a monitored file changes an alert is sent. This option is intended
# as an IDS (Intrusion Detection System) and is the last line of detection for
# a possible root compromise.
#
# There will be constant false-positives as the servers OS is updated or
# monitored application binaries are updated. However, unexpected changes
# should be carefully inspected.
#
# Modified files will only be reported via email once.
#
# To enable this feature set the following to the checking interval in seconds
# (a value of 3600 would seem sensible). This option may pur an increased I/O
# load onto the server as it checks system binaries.
#
# To disable set to "0"
LF_INTEGRITY = "3600"
# System Exploit Checking. This enables lfd to check for the Random JS Toolkit
# and may check for others in the future:
# http://www.cpanel.net/security/notes/random_js_toolkit.html
# It compares md5sums of the binaries listed in the exploit above for changes
# and also attempts to create and remove a number directory
#
# Modified files will only be reported via email once, though will be reset
# after an hour
#
# To enable this feature set the following to the checking interval in seconds
# (a value of 300 would seem sensible).
#
# To disable set to "0"
LF_EXPLOIT = "300"
# This comma separated list allows you to (de)select which tests LF_EXPLOIT
# performs
#
# For the SUPERUSER check, you can list usernames in csf.suignore to have them
# ignored for that test
#
# Valid tests are:
# JS,SUPERUSER
LF_EXPLOIT_CHECK = "JS,SUPERUSER"
# Set the time interval to track login failures within (seconds), i.e.
# LF_TRIGGER failures within the last LF_INTERVAL seconds
LF_INTERVAL = "300"
# Set the log file parsing interval (seconds). This is how long the daemon
# sleeps before processing the log file entries since the last scan finished
LF_PARSE = "5"
# Send an email alert if an IP address is blocked
LF_EMAIL_ALERT = "1"
# Send an email alert if an account exceeds LT_POP3D/LT_IMAPD logins per hour
# per IP
LT_EMAIL_ALERT = "1"
# Block POP3 logins if greater than LT_POP3D times per hour per account per IP
# address (0=disabled)
LT_POP3D = "15"
# Block IMAP logins if greater than LT_IMAPD times per hour per account per IP
# address (0=disabled) - not recommended for IMAP logins due to the ethos
# within which IMAP works. If you want to use this, setting it quite high is
# probably a good idea
LT_IMAPD = "0"
# Enable IP range blocking using the DShield Block List at
# http://www.dshield.org/block_list_info.php
# To enable this feature, set the following to the interval in seconds that you
# want the block list updated. The list is reasonably static during the length
# of a day, so it would be appropriate to only update once every 24 hours, so
# a value of "86400" is recommended
LF_DSHIELD = "86400"
# The DShield block list URL. If you change this to something else be sure it
# is in the same format as the block list
LF_DSHIELD_URL = "http://feeds.dshield.org/block.txt"
# Enable IP range blocking using the Spamhaus DROP List at
# http://www.spamhaus.org/drop/index.lasso
# To enable this feature, set the following to the interval in seconds that you
# want the block list updated. The list is reasonably static during the length
# of a day, so it would be appropriate to only update once every 24 hours, so
# a value of "86400" is recommended
LF_SPAMHAUS = "86400"
# The Spamhaus DROP List URL. If you change this to something else be sure it
# is in the same format as the drop list
LF_SPAMHAUS_URL = "http://www.spamhaus.org/drop/drop.lasso"
# Enable IP range blocking using the BOGON List at
# http://www.cymru.com/Bogons/
# To enable this feature, set the following to the interval in seconds that you
# want the block list updated. The list is reasonably static during the length
# of a day, so it would be appropriate to only update once every 24 hours, so
# a value of "86400" is recommended
#
# Do NOT use this option if your server uses IP's on the bogon list (e.g. this
# is often the case with servers behind a NAT firewall using ip routing)
LF_BOGON = "0"
# The BOGON List URL. If you change this to something else be sure it
# is in the same format as the drop list
LF_BOGON_URL = "http://www.cymru.com/Documents/bogon-bn-agg.txt"
# Connection Tracking. This option enables tracking of all connections from IP
# addresses to the server. If the total number of connections is greater than
# this value then the offending IP address is blocked. This can be used to help
# prevent some types of DOS attack.
#
# Care should be taken with this option. It's entirely possible that you will
# see false-positives. Some protocols can be connection hungry, e.g. FTP, IMAPD
# and HTTP so it could be quite easy to trigger, especially with a lot of
# closed connections in TIME_WAIT. However, for a server that is prone to DOS
# attacks this may be very useful. A reasonable setting for this option might
# be arround 200.
#
# To disable this feature, set this to 0
CT_LIMIT = "200"
# Connection Tracking interval. Set this to the the number of seconds between
# connection tracking scans. Don't set this too low or you will affect server
# performance as lfd runs netstat each time to determine the connections
CT_INTERVAL = "60"
# Send an email alert if an IP address is blocked due to connection tracking
CT_EMAIL_ALERT = "1"
# If you want to make IP blocks permanent then set this to 1, otherwise blocks
# will be temporary and will be cleared periodically or whenever the firewall
# is restarted
CT_PERMANENT = "0"
# If you opt for temporary IP blocks for CT, then the following is the interval
# in seconds that the IP will remained blocked for (e.g. 1800 = 30 mins)
CT_BLOCK_TIME = "3200"
# If you don't want to count the TIME_WAIT state against the connection count
# then set the following to "1"
CT_SKIP_TIME_WAIT = "0"
# If you only want to ount specific states (e.g. SYN_RECV) then add the states
# to the following as a comma separated list. E.g. "SYN_RECV,TIME_WAIT"
#
# Leave this option empty to count all states against CT_LIMIT
CT_STATES = ""
# Process Tracking. This option enables tracking of user and nobody processes
# and examines them for suspicious executables or open network ports. Its
# purpose is to identify potential exploit processes that are running on the
# server, even if they are obfuscated to appear as system services. If a
# suspicious process is found an alert email is sent with relevant information.
# It is then the responsibility of the recipient to investigate the process
# further as the script takes no further action. Processes (PIDs) are only
# reported once unless lfd is restarted.
#
# The following is the number of seconds a process has to be active before it
# is inspected. If you set this time too low, then you will likely trigger
# false-positives with CGI or PHP scripts.
# Set the value to 0 to disable this feature
PT_LIMIT = "60"
# How frequently processes are checked in seconds
PT_INTERVAL = "60"
# If you want process tracking to highlight php or perl scripts that are run
# through apache for greater than PT_LIMIT seconds then disable the following,
# i.e. set it to 0
#
# While enabling this setting will reduce false-positives, having it set to 0
# does provide better checking for exploits running on the server
PT_SKIP_HTTP = "1"
# User Process Tracking. This option enables the tracking of the number of
# process any given linux account is running at one time. If the number of
# processes exceeds the value of the following setting an email alert is sent
# with details of those processes. A user is only reported once, so lfd must be
# restarted to reinstate checking of all users. If you specify a user in
# csf.pignore it will be ignored
#
# Set to 0 to disable this feature
PT_USERPROC = "10"
# This User Process Tracking option sends an alert if any linux user process
# exceeds the memory usage set (MB). To ignore specific processes or users use
# csf.pignore
#
# Set PT_USERKILL to have lfd kill off the process
#
# Set to 0 to disable this feature
PT_USERMEM = "100"
# This User Process Tracking option sends an alert if any linux user process
# exceeds the time usage set (seconds). To ignore specific processes or users
# use csf.pignore
#
# Set PT_USERKILL to have lfd kill off the process
#
# Set to 0 to disable this feature
PT_USERTIME = "3200"
# If this option is set then processes detected by PT_USERMEM or PT_USERTIME
# or PT_USERPROC are killed
PT_USERKILL = "0"
# Check the PT_LOAD_AVG minute Load Average (can be set to 1 5 or 15 and
# defaults to 5 if set otherwise) on the server every PT_LOAD seconds. If the
# load average is greater than or equal to PT_LOAD_LEVEL then an email alert is
# sent. lfd then does not report subsequent high load until PT_LOAD_SKIP
# seconds has passed to prevent email floods.
#
# Set PT_LOAD to "0" to disable this feature
PT_LOAD = "30"
PT_LOAD_AVG = "5"
PT_LOAD_LEVEL = "6"
PT_LOAD_SKIP = "3600"
# If a PT_LOAD event is triggered, then if the following contains the path to
# a script, it will be run in a child process. For example, the script could
# contain commands to terminate and restart httpd, php, exim, etc incase of
# looping processes
PT_LOAD_ACTION = ""
# Port Scan Tracking. This feature tracks port blocks logged by iptables to
# syslog. If an IP address generates a port block that is logged more than
# PS_LIMIT within PS_INTERVAL seconds, the IP address will be blocked.
#
# This feature could, for example, be useful for blocking hackers attempting
# to access the standard SSH port if you have moved it to a port other than 22
# and have removed 22 from the TCP_IN list so that connection attempts to the
# old port are being logged
#
# This feature blocks all iptables blocks from the iptables logs, including
# repeated attempts to one port or SYN flood blocks, etc
#
# Note: This feature will only track iptables blocks from the log file set in
# IPTABLES_LOG below and if you have DROP_LOGGING enabled. However, it will
# cause redundant blocking with DROP_IP_LOGGING enabled
#
# Warning: It's possible that an elaborate DDOS (i.e. from multiple IP's)
# could very quickly fill the iptables rule chains and cause a DOS in itself.
# The DENY_IP_LIMIT should help to mitigate such problems with permanent blocks
# and the DENY_TEMP_IP_LIMIT with temporary blocks
#
# Set PS_INTERVAL to "0" to disable this feature. A value of between 60 and 300
# would be sensible to enable this feature
PS_INTERVAL = "0"
PS_LIMIT = "10"
# You can specify the ports and/or port ranges that should be tracked by the
# Port Scan Tracking feature. The following setting is a comma separated list
# of those ports and uses the same format as TCP_IN. The default setting of
# 0:65535 covers all ports
PS_PORTS = "0:65535"
# You can select whether IP blocks for Port Scan Tracking should be temporary
# or permanent. Set PS_PERMANENT to "0" for temporary and "1" for permanent
# blocking. If set to "0" PS_BLOCK_TIME is the amount of time in seconds to
# temporarily block the IP address for
PS_PERMANENT = "0"
PS_BLOCK_TIME = "3600"
# Set the following to "1" to enable Port Scan Tracking email alerts, set to
# "0" to disable them
PS_EMAIL_ALERT = "1"
View 9 Replies
View Related
Apr 9, 2007
I have purchased a proxy website using phproxy script hosted at dedicated server. Its now about 4 months and everything is fine but i want to move my site to another dedicated server provider because current one has some issues.
When i purchased that site seller told me that he has optimized server and installed some scripts {server scripts} to get best out of proxy website. Now seller is out of my contact.
I am very much pleased with current server settings but i need to move. So i want to make sure that i can optimize new server and install same scripts to keep going with current performance.
I only know about http.conf settings and i have noted it ... plz help me about copying every other settings which that guy had done to optimize the server and how can i know which and where those scripts are installed which has made server quite efficient?
View 0 Replies
View Related
Feb 11, 2008
I've done some manual change of document root in httpd.conf for a user. I know that now, I don't need to to manual change since user can set there own folder!
Now, If I rebuild Apache, he will re-do all the configuration to the original one. Where can I find the settings for domain document root so I can change it and EasyApache will rebuild the httpd.conf correctly?
I don't want to remove the domain since I'll lost all email account!
View 8 Replies
View Related
