[CentOS] Server Hacked: Cpanel

[Jim Perrin]

<snipping everything>
Okay, here's my personal take on the matter, for the $0.000002 that it's worth.

For production machines, sometimes control panels are required for the
job. I'll preach against them, but that doesn't do much.

If you install something like Cpanel to a system, you're adding a
level of complexity. You're stepping over what's provided in the base,
and adding to it. This means you need to not only know the base inside
and out, but you need to know Cpanel inside and out as well. So, lets
go through the admin checklist:

1. Minimal packageset.
 Go through the rpms installed on your system and clean out ones that
you don't need or don't use. window managers, compilers, etc have no
business on a production box. If you need a compiler to install/update
cpanel, you might want to look at the possibility of removing them
after the install/update. If they stay on the system, you're only
giving the attacker something else to use that he doesn't have to
provide himself.

2. Regular updates and backups.
Duh, but still needs to be said. Too many people don't do this.

3. Config changes. Many default application settings are wide open.
Make sure that you lock down or disable what you don't need. For
example in php things like allow_url_fopen, globals, etc should be
off. Safe Mode should be on if you can manage it within your
application.

4. Permissions:
Unix permissions by default are DAC style, where the user has the
power to change permissions. Make sure that you stay on top of this
and keep permissions in places like your webroot to a minimum to do
the job. If you can, enable SELinux, which is MAC style based
permission, which enforces restrictions no matter what the user does.

5. Data input checking:
SQL injections and other such annoyances can be avoided with proper
input checking. Utilities like mod_security for apache are a must in
my book. If you're able, go through the code for whichever app you're
using and see if they're checking input properly. Invest some time in
mod_security and learning the rulesets. It's archaic, but the defaults
are good, and they stay updated.  If you're using a common app (phpbb
or some such) you shouldn't have to tweak much to enjoy the protection
of mod_security. (it's at centos.karan.org all packaged up for you.
Thank karanbir for it)

6. Log checking
use logwatch other other such utilities and keep up on your logs. If
someone's been poking at your site for a few days, and they've gone
from getting loads of 40(3,4)'s to 302s or 200's.. you'll want to know
about it.

Yes this is tailored mostly to web services. There are loads of other
things to do.. but these are the basics, and most people who get
bitten aren't staying on top of them.

-- 
During times of universal deceit, telling the truth becomes a revolutionary act.
George Orwell