2
votes
4answers
76 views

Keeping my production webserver updated

I have a production webserver (CentOS 6.5) and I just wanted to know how do I keep this updated interms of security updates and stable. For example, is it safe interms of not breaking anything on the ...
5
votes
2answers
275 views

Setting ulimit correctly for PHP on Linux

I have /etc/security/limits.conf set to the following: nobody soft nofile 409600 nobody hard nofile 1024000 phpuser soft nofile 409600 phpuser hard nofile 1024000 httpd soft nofile 409600 httpd hard ...
0
votes
1answer
112 views

iptables - why the stun, turn ports are not working to allow end points to access the server?

I have this iptables where all working except tcp/udp port 3478 and 5349. $ cat /etc/sysconfig/iptables # Generated by iptables-save v1.4.7 on Thu Nov 21 10:21:41 2013 *filter :FORWARD ACCEPT [0:0] ...
2
votes
1answer
122 views

GlassFish/Tomcat security issue between domain users in linux server (alternate docroot issue)

Let's suppose we give to different users(clients) different domains (one domain for one user) in our glassfish application server for their work. This glassfish works in centos 6 server. Every user ...
1
vote
1answer
1k views

Postfix, Amavis-new, ClamAV: Permission denied. ERROR

Error lines in /var/log/maillog Sep 22 12:08:20 sun amavis[4493]: (04493-09) (!)run_av (ClamAV-clamd) FAILED - unexpected , output="/var/spool/amavisd/tmp/amavis-20130922T052321-04493-crApLkq5/parts: ...
1
vote
2answers
488 views

Minimize PHP.CGI.Argument.Injection and further hardening of the Centos 6.4 web server

We have Centos 6.4 server with a physical firewall. We keep seeing quite an number of PHP.CGI.Argument.Injection is detected by the firewall. On the server itself we have done the basic apache ...
0
votes
1answer
198 views

Is setting CentOS user home-dir as NGINX server block root secure for vsftpd?

This is what I did: CentOS 6.2 server installed nginx installed vsftpd in vsftpd.conf I set chroot_local_user=YES created a new user "bleh" created directory /home/bleh/public_html/ in virtual.conf ...
5
votes
7answers
298 views

Are there additional ways to protect SSH connections besides firewall and RSA Keys?

Sometimes I don't have a static IP and need to administrate my web server remotely. I'm looking for any additional layers of protection I could add to make opening port 22 safer. Currently I have ...
7
votes
0answers
2k views

OpenSSL Package Rebuild CentOS 6.4

Rebuilding openssl with Elliptic Curves on CentOS 6.4 The strategy is: 1) Download the "official" CentOS source package (.src.rpm) 2) Modify the .spec file to enable elliptic curves. (change no-EC ...
0
votes
0answers
105 views

CentOS security update Repository

I need to apply all security patches and updated to my CentOS 6.2 running servers. However we use a mechanism to verify all the security updates first and then push them to the production environment ...
0
votes
0answers
96 views

Installing Ossec on an existing centos 6.4 machine

I have an existing machine running centos 6.4. Is it ok to install now the Ossec or it's not worth any more as the machine is already running for few months. Which is the best mechanism to install ...
1
vote
0answers
184 views

How to add my own created certificate authority to system trusted repositories

I was told that I can add my created CA to trusted repositories/authorities in my system instead of adding it from browser and configuring in in ssl.conf. Yet I can't find anything similar on the ...
3
votes
2answers
792 views

Sign a module after kernel compilation

I've built a kernel in tmpfs, then I rebooted. Now I see a message when I compile the 3rd party module, NO SIGN [M] XXXX.ko How can I get it signed? The key pair generated during rpmbuild is lost ...
1
vote
3answers
131 views

Taking away a User's Read/Write/Execute Permission

So I have a user that is able to go in /etc and read files like httpd.conf. I would like to deny that user access to any critical locations such as /etc, /var and so on. What would be the best way ...
2
votes
1answer
326 views

Properly Set Permission to /home/user folder for webserver

I'm currently setting up my own Linux server running CentOs 6. To test the security on my server I wrote a PHP script that acts like a sort of "navigator". I can go one directory up, open the files, ...
1
vote
2answers
2k views

iptables blocking from internet side on eth1?

How to use iptables to deal with two Ethernet ports? eth0 port for LAN use (192.168.1.50 Private IP). eth1 port is connected to the internet via cable modem (80.0.xxx.xxx public IP). ifconfig ...
1
vote
1answer
144 views

Accounts attacked

I have run two commands below. I find some of the accounts attack as below. I do not have the account test,teste,oracle and admin in my home directory. As there system account. How to know which are ...
2
votes
1answer
131 views

is it secure /not dangerous to ssh with keys through public transparent proxy?

I use pub key for ssh. Is it normal practice to connect to own server through public proxy? I think with plain pass it is surely dangerous but how about RSA keys?
6
votes
1answer
367 views

/etc/passwd sql with bash access

I just got a CentOS VPS and was reviewing the passwd file and saw this: mysql:x:498:499:MySQL server:/var/lib/mysql:/bin/bash Is bash necessary for mysql?
3
votes
1answer
160 views

In my secure log there is a new group added that Im unsure about after adding semanage

I installed semanage onto my CentOS 6.2 box and I was going through my secure log after the install and noticed this entry: Aug 31 22:12:17 xxxx groupadd[12929]: group added to /etc/group: ...
3
votes
2answers
395 views

Is it possible for a CentOS system on EC2 to not have a bootloader?

I'm attempting to look for grub: [root /]# find / -iname "*grub*" /sbin/grubby /usr/share/man/man8/grubby.8.gz /usr/share/vim/vim70/syntax/grub.vim /usr/share/vim/vim70/ftplugin/grub.vim ...
8
votes
2answers
1k views

Should you run automatic updates

I'm running production Centos web servers. I want to know what is best practice for running updates. Should I automate this with yum-cron or yum-updatesd? Or is there a danger of updates breaking ...
1
vote
0answers
563 views

Any better alternative to chroot on an OpenVZ VPS?

Are there any better alternative to chroot environment? I'm thinking about running nginx on a jailed environment. BTW, I'm on OpenVZ VPS, so modifying the Kernel is a no-no. (I think that prevents ...
3
votes
1answer
410 views

SELinux outbound access to other sites with restrictions

We have CentOS 6 configured with SELinux to host a number of websites. Unfortunately SELinux is preventing websites from accessing (outbound) sites, such as download.wordpress.com to update ...
1
vote
1answer
382 views

portsentry and IPTables on constant reboot, but not sure why

I have been doing some hardening on a new server [ centos 5.7 final ] i also have logwatch and seem to be getting these strange logs Commands Run: User root: /sbin/service portsentry restart ...
0
votes
1answer
1k views

How to secure CentOS and FreeBSD by disabling USB ports and VGA output on-site?

Is it possible to disable USB ports and CDRom and VGA output in the Dell R310 from CentOS or FreeBSD (without BIOS)? A demo server is running in a customer test laboratory, where they can simply get ...