0

I have linux server with root access. I need deny access for all users and accounts, or change password to deny access

On server I have standard soft such apache, mysql. also I have panel ISP manager

I have idea to edit file /etc/passwd for users with id>=1000 and set shell from /bin/bash to /usr/sbin/nologin, also remove all files /home/%user&/.ssh/authorized_keys

Also I need change all passwords in mysql, maybe from phpmyadmin

Do I missed anything? Maybe need check server for any backdoor, or any other access?

Do isp manager creates it own users which needs to disable?

closed as too broad by Stephen Rauch, Rui F Ribeiro, phk, Gilles, hildred Jun 23 '17 at 1:03

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Is this disaster recovery or fresh install? If disaster recovery, see nuke it from orbit. If this is a fresh install, then don't create users you don't want. – Centimane Jun 22 '17 at 15:27
1

You could block access to the server with a more restrictive firewall (available depending on your specific Linux distro) configuration - block all incoming traffic to all ports except TCP 80 and 443 (depending if you use HTTP and/or HTTPS). And then allow access to SSH only from specific IP addresses or set up SSH to accept only SSH key-based authentication. Same goes for access to the web admin cpanel - allow access only from specific whitelisted IP addresses (configuration depends on what web server are you using).

1

Try to

netstat -tulpn | grep -v 127.0.0.1

and you will see all apps that listen any ports, so you can't miss something.

In addition you must check crontabs and services.

1

You can also use /etc/nologin - check the man page at http://man7.org/linux/man-pages/man8/nologin.8.html

This will stop Linux users from logging in via SSH, etc. However, if you are running some control panel software like ISPConfig, etc. then you will have mail accounts, FTP accounts, etc. there as well that would need to be blocked. Perhaps by renaming database tables, etc.

I guess the more important question is

What exactly are you trying to achieve?

Not the answer you're looking for? Browse other questions tagged or ask your own question.