[CentOS] some security measures I would like to share

I apologize for the html, but it is a copy from a web post I did.
I wanted to share this with list members and hope it helps others.
I tried not to be redundant and add things I have not seen posted before.
Always interested in constructive thoughts, better ideas, etc.
**


  *Security thoughts for server admins/webmasters*

------------------------------------------------------------------------
I would like to add some security measures I like to use. These are not 
listed on security sites and I feel it is time someone posted this stuff.

This concerns programs/items used by webmasters/server admins on a very 
irregular basis. (not very often).

This list assumes you have an IPMI card with its own eth port or an 
onboard IPMI interface, both having video access.
Or accessing the shell of a virtual host to access virtual servers 
located on it. (if no IPMI)

Quote:
*PHPMYADMIN* - This is a wonderful tool for use by web programmers. Most 
security with this program lists just two protections.
a)Use htaccess to password protect, force SSL
b)Alias the folder from /phpmyadmin to something like /examp

This is where security measures, aside from keeping updated, seem to 
end. This is bad. There is more you can do to protect that access to 
your database.

PhpMyAdmin is a program you will use at times, but 99% of the time you 
will never touch it at all. So why would you leave it open to hackers 
all the time?
Simply disable the 'alias' in httpd to prevent it from being accessed.
For example in CentOS 6 the file /etc/httpd/conf.d/phpmyadmin.conf 
contains this directory information. (or something like it.)

I have added 'Deny from ALL and commented out 'Allow from ALL' and 
restarted httpd. (the allowoverride is allowing htaccess protection for 
the folder). You could comment out everything except the allowoverride 
and deny from all...

Quote:
<Directory /usr/share/phpMyAdmin/>
*Order Deny,Allow*
Deny from All
Allow from 127.0.0.1
Allow from ::1
*#Allow from All*
allowoverride All
</Directory>

Once httpd is restarted no one can access the phpmyadmin folder if it is 
not in the html folder. (in centos 6 the program is usually located in 
/usr/share/phpmyadmin).

This prevents the hacking of your phpmyadmin program.
If you think about it, outside of a small fix or initial programming you 
will almost never use the program.

So why do you leave it open to everyone 24 hours a day?


Quote:
*IPMI*
IPMI is great but if you are a webmaster you are probably leaving this 
open to the internet.

If you are local to the datacenter, or the datacenter is really cool, 
you can remove the eth cable from the ipmi port. And ask them to plug it 
in when there is an issue.

This only works if you have a separate ipmi card with its own eth port. 
(and helps if you tag the cable and port for the center)

I think most of us seldom, if ever, use our IPMI during the course of a 
year once the system is set up.

This prevents root access, IPMI card getting hacked, and still allows 
emergency access with a quick visit or a phone call


*IPMI, Virtual Host, Virtual Machines*

Quote:
*Your Virtual Host server*
I seldom ever need to go into my virtual host. It is set up correctly 
and I get my logwatches every day. I have no ports open up on it.

If I never use it, why would I leave a shell port open 24 hours a day? 
If I have an IPMI card I can log in and open that port. Then I can do 
what I need to do.

Safest, if IPMI is available (with video) is to comment out/disable the 
ssh port. On a virtual host you most likely use a physical bridge. This 
means nothing is touching the host. Great Security tip.


Quote:
*Virtual Machines- DNS*
Are your DNS servers virtual machines on a server (or on a dedicated 
with an IPMI card in it)? I bet you never access shell except to make 
that very rare dns change. And if you use rndc you never use shell.
If you have IPMI with video disable ssh port. Enable it via IPMI on 
those very rare instances you need to access it.
Logwatch can still send out.
Only port 53 should be open 24 hours a day (and if rndc that port 
too...and 5353 if you are doing that.)

There is no reason to leave this system open to the net at all. Enable 
shell when you need it and then disable when done.
You do not need to open port 25 (or any port) to send emails out of the 
system.

So why do you leave port 22 (or other shell port) on 24 hours a day if 
you never ever use it?

Quote:
*MYSQL servers*
Again, if on a virtual host or even its own dedicated disable port 22 
(ssh port) and only enable via IPMI on those rare times you need to use it.

Quote:
*Your website/webserver*
The same issue remains. Outside of the times you are using shell OR 
FTP...these ports should be disabled. Enable using IPMI.

This simple act prevents a lot of hack attempts, log filling, and gives 
massive peace of mind.

Yes, you use shell and ftp....but not that much. Think about it.
You might use ftp and shell a lot, but you are leaving those ports open 
24 hours a day, 7 days a week. I guarantee outside of massive program 
days you use less than 5% of that time on those ports.

So why open your server to being hacked? Close the ports.


Quote:
*Your open source or commercial web application*
.htaccess protect any folder that does not need to be accessed by a user 
via http. Most files are grabbed by a index file and are still able to 
be used even with htaccess protection. Try it.

Definitely do this with your administrative folders. There is no reason 
not to do this.

But how many times do you really access that admin folder?

I would say put a fake htacces protection file in all the folders you 
can. Fake meaning the user required does not exist and there is no 
password for it. Then it will not be passed.
The admin folder can also be done this way, but add commented out 
sections with real user/pass info.

Then when you need to go to the admin section, you shell/ftp in, change 
the htaccess file, then do what you need to do. Then comment out the 
real access info.

This prevents any access from an external user to these folders for the 
99% of the time you are not using your admin...and 100% of the time for 
the folders they should never be visiting.




Outside of a programming/fix/update you will seldom be doing admin work, 
program work, and your system/web apps will be running without your 
input. So why leave all this open to hackers 24 hours a day?

These simple things can block 100% of brute force shell attacks across 
your system...if you can unplug the ipmi card (with an easy way to 
replug it) then you cannot be accessed via shell across all your 
systems. Sleep in peace.

A majority of hacks on open source revolve getting to that admin 
folder....or some other folder of a plug in.. The hacker will have a 
heck of a time brute forcing an htaccess protected folder where no 
user/pass combo will ever work.


*On a final note....*

If you are building a web application you should use a mysql user that 
is only allowed to update and select...
With proper programming you can set up items to be deleted via a cron 
job using a mysql user that has a bit more access.

This prevents a hacker from actually deleting or altering any 
data....and easily rolled back.

This is how I program and I think it should be standard. As far as I 
know not one single program does this...and that is a shame.