Make cPanel/WHM VPS more Secure

Justin

Use secure passwords

Insecure passwords are the most common security vulnerability for most servers. If an account password is unsecured and is compromised, client sites can be defaced, infected, or used to spread viruses. Having secure passwords is paramount to having a secure server. You can edit /etc/login.defs to configure many password options on your system. It is well documented. Generally, a password utilizing at least 8 characters including alphanumeric and grammatical symbols is sufficient. Never use passwords based upon dictionary words or significant dates.

Secure SSH

• Enable public key authentication for SSH and disable password authentication;
• Move SSH access to a different port. People are looking for port 22 as a possible way to access your servers. Moving SSH to a different port will add a simple way to deter those without specific knowledge of your server from easily discovering your SSH port.

Secure Apache

It is important to take steps to secure your Apache installation. One of the best tools for preventing malicious Apache use is mod_security. This can be installed in Addon Modules in the cPanel section of WHM. You can find information about mod_security at https://documentation.cpanel.net/display/EA4/Apache+Module:+ModSecurity. When compiling Apache, you should include suexec to ensure that CGI applications and scripts run as the user that owns / executes them. This will help identify where malicious scripts are and who is running them. It will also enforce permission and environment controls. We also recommend compiling Apache + PHP with PHPsuexec. PHPsuexec forces all PHP scripts to run as the user who owns the script. This means that you will be able to identify the owner of all PHP scripts running on your server. If one is malicious, you will be able to find its owner quickly to resolve the issue. To compile Apache + PHP with PHPsuexec, select the PHPSuexec option in the Apache Upgrade interface in WHM or when running /scripts/easyapache from the command line.

You should enable PHP's open_basedir protection. This protection will prevent users from open files outside of their home directory with PHP. This can be enabled in Tweak Security within WebHost Manager.

Secure your /tmp partition

We recommend that you use a separate partition for /tmp that is mounted with nosetuid. Nosetuid will force a process to run with the privileges of its executor. You may also wish to mount /tmp with noexec after installing cPanel. Also, Running /scripts/securetmp will mount your /tmp partition to a temporary file for extra security.

Upgrade your mail to maildir format

Maildir format adds extra security and speed to your mail system. If you're running an older copy of cPanel, you'll probably want to upgrade using /scripts/convert2maildir. Make sure to back up your current mail before converting to maildir, this can be done within /scripts/convert2maildir. If you see maildir is enabled when running /scripts/convert2maildir, you are already using maildir, and will not need to convert.

Lock down your system's compilers

Most users do not require the use of C and C++ compilers. You can use the Compilers Tweak within Tweak Security in WHM to turn off use of the compilers for all unprivileged users, or to disable them for specific users only. Many pre-packaged exploits require working compilers. Disabling compilers will help protect against many exploits.

Turn off unused services and daemons

Any service or daemon that allows a connection to be established to your server is a way for hackers to gain access. To reduce security risks, you should disable all services and daemons that are not being used.

• For Daemons on Linux - Check /etc/xinetd.conf for services that you are not using;
• For Services - Go to the Service Manager in the Service Configuration section of WHM and disable any services that you are not using.

Monitor your system

It is important to be up to date on what is going on with your system. Make sure that you know when accounts are being created, what software is being installed, when software packages need updates, etc. Check your system frequently to ensure it is functioning in the way you expect. Make sure to check things like:

netstat -anp - Look for programs attached to ports that you did not install / authorize;
find / \( -perm -a+w \) ! -type l >> world_writable.txt - Look at world_writable.txt to see all world writable files and directories. This will reveal locations where an attacker can store files on your system. NOTE: Fixing permissions on some PHP/CGI scripts that are not properly coded will break them;
find / -nouser -o -nogroup >> no_owner.txt - Look at no_owner for all files that do not have a user or group associated with them. All files should be owned by a specific user or group to restrict access to them;
ls /var/log/ - There are many different logs on your system which can be valuable resources. Check your system logs, apache logs, mail logs, and other logs frequently to make sure your system is functioning as expected.

There are many readily available utilities to monitor your system and to detect rootkits, backdoors, etc. Here are some commonly available utilities:

• Tripwire - Monitors checksums of files and reports changes.
• Chrookit - Scans for common rootkits, backdoors, etc.
• Rkhunter - Scans for common rootkits, backdoors, etc.
• Logwatch - Monitors and reports on daily system activity.

Enable a Firewall

Installing a firewall to limit access to your server is useful. Removing all unused software on your system is more useful. Before you have the chance to remove all unused services and daemons, or the chance to figure out which services / daemons are unused, you can enable a firewall to prevent unwanted access.

We recommend installing ConfigServer firewall addon for WHM. The tutorial is located right here.

Stay up to date

It is important to make sure that you are running the latest stable versions of the software on your system to ensure that it has been patched of any security issues that past versions may be susceptible to. Make sure to keep on top of updates for:

• cPanel and WHM (automated)
• User Applications (bulletin boards, CMS, blog engines, etc) (within WHM)
• System Software (automated)

Install ClamAV antivirus with daily scan

ClamAV is an open source (GPL) antivirus engine designed for detecting Trojans, viruses, malware and other malicious threats on Linux.