I have disabled lamed server logging which tends to clutter daily
log
files.
All notifications are sent to your root email account. We recommend to
setup
a forward from root account to your main email account. Let us know if
you
need help with this.
I have installed a 24x7 System Internal Monitor which checks all
services
and restarts them when they are down. It will also dispatch an email
whenever downed service is detected.
I have installed SPRI which changes priority of different processes in
accordance to level of importance. You should see a 5-20% decrease in
the
average load level of your server.
I have installed PRM which monitors your server for processes that use
extensive server resources for prolonged periods of time. These
processes
will be logged and killed, preventing server from overloading and
potential
server crashes. An email will be dispatched whenever a process is
logged and
killed.
/dev/shm & /var/spool/mail have been hardened in order to prevent the
execution of malicious scripts.
I have disabled all insecure scripts that come with cPanel.
MySQL server has been optimized.
Apache Web Server has been secured and optimized.
Mod_security with mild ruleset and mod_dosevasive have been compiled
and
installed in Apache in order to prevent common web-based DoS attacks
and
filter php-based attack trends (i.e: php injection exploits).
OpenSSH and OpenSSL servers have been upgraded to the very latest
secure
versions. OpenSSH has also been hardened.
I have removed all unused software from the server. it will
significantly
decrease the chance of server compromise due to software exploits. All
unnecessary services have also been suspended.
I have removed all default system users and groups that aren't being
used
and pose additional security threat.
LCAP limitation has been put into place. It will limit the ptrace
option
which allows attaching to, and controlling the execution of, arbitrary
and
malicious processes.
I have tweaked sysctl.conf in order to harden the TCP/IP stack from
syn-flood attacks and other network abuse.
I have installed BFD, which notifies you of authentication failures.
BFD
works with the firewall to place real time bans on offending IPs. This
system will send you an email if it detects an attack on the system so
we
may investigate further.
Libsafe has been installed, it filters common software attacks and
overflows.
I have hardened host.conf in order to prevent dns lookup poisoning &
spoofing protection.
CHKRootKit and RKhunter have been installed. They will detect rootkits
and
notify you via email if any have been found.
/tmp and /var/tmp have been hardened in order to prevent the execution
of
malicious scripts.
APF Firewall has been installed. Anti-Dos / Anti-Spoof rulesets have
been
activated on the firewall.
Tripwire has been installed and will dispatch emails whenever
filesystem
integrity is breached.
Snort is up and running and is set to auto-block any IPs that try to
flood
any of the servers. Detailed report is dispatched every time DoS/DDoS
attack
takes place.
LES has been installed to add an additional level of local environment
security to prevent against environment based attacks.
Please let me know if you have any questions.
Best regards
Mike