Elevated Community - Resource

HOW-TO: Harden A Fresh CentOS 5.x Server

Fri, 23 Apr 2010 08:13:00 -0700

#!/bin/sh

set -ve

# Script to harden a fresh CentOS 4 or 5 base server install, which installs

# any updated packages plus a few useful extras, removes unnecessary

# services and setuid bits, and does a little performance tuning. Running it more than once shouldn't hurt anything.

#

# Run with:

Code:

wget -O- http://ftp.die.net/pub/harden-centos/harden-centos | sh

PATH=/bin:/usr/bin:/sbin:/usr/sbin

# Update rpm and yum if possible. (Limit dependencies.)

Code:

yum -y install rpm yum

# Installing useful packages

Code:

yum -y install joe tcpdump mtr postfix strace zsh gdb perl vixie-cron logrotate

# Removing unnecessary daemons and setuid binaries

Code:

yum -y remove squid krb5-workstation cups at rsh sudo isdn4k-utils sendmail \

slocate apmd irda-utils mt-st gpm samba-common sendmail-cf talk \

up2date ypbind yp-tools wvdial lockdev procmail xorg-x11-font-utils \

pam_ccreds gdm bluez-utils yum-updatesd

# Upgrading to latest packages

Code:

yum -y upgrade

# Removing unnecessary setuid bits

Code:

find / /usr -xdev -type f -perm +04000 | \

grep -vP '^(/bin/(su|ping|traceroute)|/usr/bin/(passwd|chsh|crontab)|/usr/libexec/openssh/ssh-keysign)$' | \

xargs -r chmod ug-s

# Removing unnecessary setgid bits

Code:

find / /usr -xdev -type f -perm +02000 | \

grep -vP '^(/usr/sbin/(utempter|postdrop|postqueue)|/usr/bin/ssh-agent)$' | \

xargs -r chmod g-s

# Setting nosuid,nodev on user partitions, noatime on ext2 and ext3

Code:

perl -i~ -p -e 's/(\sext[23]\s+)(defaults)(?=\s)/$1$2,noatime/;next if m#\s/(?:usr|bin)?\s#;next unless m#\s(ext[23]|tmpfs|auto)\s#;s/(?<=\s)(defaults(?:,noatime)?)(?=\s

)/$1,nosuid,nodev/' /etc/fstab

# Adding blackhole routes for bogons

Code:

[ -f /etc/sysconfig/network-scripts/route-lo ] || cat < /etc/sysconfig/network-scripts/route-lo

blackhole 0.0.0.0/8

blackhole 10.0.0.0/8

blackhole 169.254.0.0/16

blackhole 172.16.0.0/12

blackhole 192.168.0.0/16

blackhole 198.18.0.0/15

EOF

# Add useful settings to /etc/sysctl.conf

Code:

grep -q kernel.panic /etc/sysctl.conf || cat<> /etc/sysctl.conf

# Reboot a minute after an Oops

Code:

kernel.panic = 60

# Syncookies make SYN flood attacks ineffective

Code:

net.ipv4.tcp_syncookies = 1

# Ignore bad ICMP

Code:

net.ipv4.icmp_echo_ignore_broadcasts = 1

net.ipv4.icmp_ignore_bogus_error_responses = 1

# Reply to ARPs only from correct interface (required for DSR load-balancers)

Code:

net.ipv4.conf.all.arp_announce = 2

net.ipv4.conf.all.arp_ignore = 1

EOF

sysctl -p

# Allow any following commands to fail without stopping

Code:

set +e

# Shutting down unwanted services

Code:

for d in acpid rpcidmapd rpcgssd nfslock netfs portmap avahi-daemon avahi-dnsconfd pcscd bluetooth; do

chkconfig $d off

service $d stop

done

# Turn on cron-based auto-updates

Code:

yum -y install yum-cron

for d in crond yum yum-cron; do

chkconfig $d on

service $d start

done

# COMPLETED!

Thanks to webicero for creating this guides.
For more informations and guides about harndening and securing your server, you may also read the guides in SecureCentOS.com

Setting up Kloxo for Websites

Mon, 24 Aug 2009 02:04:08 -0700

Now before trying to use Kloxo, update to the latest version but clicking the Kloxo Management table along the top of your control panel and clicking the Update Home icon. This will forward you to the update function of Kloxo and display the version number installed and the current version available. Simply click update if these do not match. The update task is very quick and should complete within 5 minutes.

Now you are ready to login to the Kloxo interface at https://your-vps-ipaddress:7777 or http://your-vps-ipaddress:7778

Before anything else, the first thing you should do is to create a DNS Template. Look for DNS Templates icon in the resources section, once you clicked it, click on the Add DNS Template button. This will need you to specify your DNS Template name and specify what nameservers will be used for sites hosted within your VPS. The task should be similar at most registrars, you will need to create 2 nameservers, but you only have 1 IP and it is perfectly acceptable to create more than 1 registered nameserver using the same IP address. The IP you will use is the IP of your VPS. The name of the nameserver, or FQDN, will be something like ns1.yourdomain.com and ns2.yourdomain.com. After all these has been done, you can save your template and you are ready to add sites.

lxadmin/Kloxo

Mon, 18 May 2009 09:55:55 -0700

Kloxo, (formerly known as lxadmin) comes with Lighttpd preinstalled. For you who does not know what is lighttpd, please refer to this link: Wikipedia - Lighttpd

Since lighttpd does not support .htaccess files, most will find that they will need to install apache web server on their server. Good news is with kloxo, you can switch to Apache from inside the control panel (remember, the switch works for all the domains hosted inside your vps, you can't have some domains with apache and some with lighttpd):

1. login as 'admin'
2. click on the 'server tab'
3. on the box 'server linux' click on 'switch program'
4. make your choice for the web server you prefer
5. lxadmin will convert conf files appropriately and install apache automatically
6. wait a few minutes to let lxadmin do this and to restart the new server
7. you can check which http server is running choosing 'component info' in the 2nd box 'services' of the 'server home' page.

You might want to backup any existing data on your server prior to switching web server as a standard precaution measures.

How-To - cPanel Account Migration with No Root Access

Tue, 12 May 2009 10:20:17 -0700

This method is best suited those who don't have root access on their old server. Please be aware that the duration it takes for a backup to complete will vary depending on the size of that particular account and we all know FTP transfer will take longer time to complete as well.

To start the tutorial, you will need:
-cPanel on both servers
-WHM with root access of the new server

Instructions:
1. In your new server, log into WHM and create a new temporary account. You can name it anything you want but I recommend naming it into something easier to remember and distinguish like "backup", "transfer", "restore". Let's assume you've created an account named "backup". After account creation, please note the FTP details (address or IP, username, password)

2. Log into your old server's cpanel. Go to the function "Backup >> Generate/Download a Full Backup".

3. Choose "Remote FTP Server" and fill in all necessary details which you note down earlier together with your email address.

4. After you're done filling in all the required details, click on "Generate Backup". Like I mentioned above, this process might take a few minutes to a few hours depending on the size of the files. Rest assured, you should be receiving an email once it is complete.

5. Assuming the transfer has been completed, SSH into your new server using root.

6. Type in the following command:
"cd /home/backup/public_html"

You should be inside public_html folder of your newly created account. Then, type in the following command:

ls

You should see the tar.gz file of the account from the old server. If you're not seeing the backup file created earlier, please repeat the process again and checked all the details making sure they are correct.

7. Now you need to move the backup to your /home/ directory for cpanel to detect and restore your accounts. Type in the following command:

mv backup_file_name /home/backup_file_name

Make sure the file has been moved by typing the following 2 commands:

cd /home/

ls

You should see the backup file here.

8. Now, log into WHM on your new server and click on "Backup >> Restore a Full Backup/cpmove file". You should see WHM detects the backup file which you just moved earlier under the "Possible cpmove archives found:".

9. Type in the account name in the text field in WHM, which is proceeded by "Enter the username for the account you wish to restore:" and click "Restore".

This method is best used if you have less than 10 accounts to transfer. If you have more than 10, then it is advisable for you to use "Copy multiple accounts/packages from another server" option from your WHM.

The Advantages Of RVSkin

Fri, 08 May 2009 01:45:22 -0700

Did you wonder why does we offer RVSkin on all our reseller hosting plan?
Taken from RVSkin site itself, RVSkin is actually the best choice to differentiate your hosting services, lesser support needed, which results in lower operating costs for your business.

These are RVSkin features that you might find interesting. For latest features, please visit this link: http://www.rvskin.com/index.php?page=public/features

languages
feature manager
marketing tools
- upsale manager
- sub-reseller system
design and skin editor
branding
news and alert system
integration
update and configuration management
other useful features