cPanel Dedicated Server Security
Tuesday, November 13th, 2007
cPanel Dedicated Server Web Hosting
These are some Steps to secure your cPanel Dedicated Server:-
1) Use secure passwords:
Insecure passwords are the most common security vulnerability for many servers. If an account password is not secure and is compromised, client websites can be Hacked, infected, or used to spread viruses. Having secure passwords is paramount to having a secure server. Generally, a password utilizing at least 8 characters including alphanumeric and grammatical symbols is sufficient. Never use passwords based upon dictionary words or significant dates because it is easy to crack that.You can also edit /etc/login.defs to configure many password options on your system which is well documented.
2) Secure your SSH:
Disable password authentication and enable public key authentication for SSH .Move SSH access to a different port. People are looking for port 22 as a possible way to access your servers. Moving SSH to a different port will add a simple way to deter those without specific knowledge of your server from easily discovering your SSH port.You should always use SSHv2 only as SSHv1 is not secure.You can also set Shell Resource Limits for your users to prevent applications and scripts from using all up your resources and taking down your server.
3) Secure Apache:
The most easily available source to access a web server is the web server application. So it is important to take steps to secure your Apache installation.
a) The best tools for preventing malicious Apache use is mod_security.
b) When compiling Apache, you should include suexec to ensure that CGI applications and scripts run as the user that owns / executes them. This will help identify where malicious scripts are and who is running them. It will also enforce permission and environment controls.
c) It is also recommend compiling Apache + PHP with PHPsuexec. PHPsuexec forces all PHP scripts to run as the user who owns the script. This means that you will be able to identify the owner of all PHP scripts running on your server. If one is malicious, you will be able to find it’s owner quickly and resolve the issue.
d) Enable PHP’s open_basedir protection because this protection will prevent users from open files outside of their home directory with PHP.
e) You may also include safe_mode for PHP 5.x and below. Safe_mode ensures that the owner of a PHP script matches the owner of any files to be operated on.
4) Secure your /tmp partition:
It is recommended that you use a separate partition for /tmp which is mounted with nosetuid. Nosetuid will force a process to run with the privileges of it’s executor. You may also wish to mount /tmp with noexec after installing cPanel. Check the mount man page for more information.Also, Running /scripts/securetmp will mount your /tmp partition to a temporary file for extra security.
5)Turn off daemons and services which you are not using:
Any service or daemon that allows a connection to be established to your server is away for hackers to gain access. To reduce security risks, you should disable all services and daemons that are not being used.



















