Erudite Relics of Loc Huu Ho

Original Document Here

How to install and configure Linux as a Web server? What are the main steps to go? This article should cover the main configuration steps for LAMP – Linux Apache MySQL PHP server.

1. Which Linux distribution to install?
2. Before installation
3. Partitioning
4. Package selection
5. Set runlevel to 3
6. Turn off needless services
7. Firewall
8. Forbid ssh access for root

1. Which Linux distribution to install?
List of Linux distributions are huge, please see Linux distribution list (after page load, click on Go button). Among that list, there exists several main Linux distributions (streams): RedHat, Debian, Suse, Ubuntu … Choose the one that looks most familiar to you. In my case for Web server, I choose CentOS (current version CentOS 5) from RedHat family. CentOS is an Enterprise-class Linux Distribution derived from freely provided sources. It should be stable distribution with minimum bugs and large community. The most important thing is – I have experience with RedHat tools and the way of RedHat system configuration.

2. Before installation
Check if server has redundant components: power supply, RAID, Ethernet adapters … It is good to have at least RAID arrays. Linux will see hardware RAID as one disk that should be partitioned. Depending on number of disks in RAID array, you can create RAID1 (mirroring) or RAID5 (striped disks with parity). In case of 4 disk, it will be wise to take 3 disks and create RAID5 array, and define last disk as a spare disk. In such RAID5 configuration, if one disk in array fail, RAID controller should automatically reuse spare disk and start content reconstruction. If your server doesn’t have hardware RAID, you have software RAID/LVM option during Linux installation process – but this is more advanced task.

3. Partitioning
Linux installation is easy. Nice graphical interface with built in help and wizards. This could proceed everyone with windowsland installation experience. Step in which care should be taken is the disk partitioning. If you click on next at partitioning step, installer will create default disk partitions which will be generally OK – swap, /boot and / (slash) partition, but in any serious LAMP installation, choose Manually partitioning and create seven partitions. In case of 140Gb disk size, partition arrangement can be:

1Gb  swap  # mark as primary
1Gb  /     # mark as primary
1Gb  /tmp  # mark as primary
1Gb  /home
8Gb  /usr
70Gb /var
58Gb /backup

Size of swap depends on amount of memory and as I was monitoring server with 4Gb of RAM, 1Gb of swap is good enough. Web server should not dive deep to swap. If it does, increase RAM memory or reduce running services. In old Linux school, good practise was to create big enough / (slash) partition because of kernel upgrade. /boot was only directory beneath / (slash) partition. As you know, every new kernel doesn’t overwrite the old one because backup reboot option. So, good administrator have to manually delete old kernel after some time of new kernel production and there should be enough disk space to contain more than one kernel on the system. Frequently used partitions are marked as primary to minimize access time. I usually give 1Gb for /tmp which is maybe oversized, but in case of database export or unpacking tars it is very handy. /home partition size depends on the purpose of web server. If users will exist on the Web server, you will have to dimension size of /home partition with more care. 8Gb for /usr partition is enough for LAMP server and it will not be in use more than 50%. After sizing swap, / (slash), /tmp, /home and /usr all remaining free space share between /var and /backup partition. /var partition contains MySQL files, log files, spool mail and web document root, so in case of 140Gb disk space, I give 70Gb to /var and 58Gb to /backup (because of arrangement to hold 3 days of database export – one database export is 15Gb). Good practise is also to save daily backup of configuration files (whole /etc directory), document root, MySQL dump (export), cron files and /root directory. I call it first backup level. Real backup plan should not stop here. All tars from /backup partition should be placed on dedicated backup server or simply copied with scp to another (physically distant) server.

4. Package selection
After disk partitioning, there come few easy tasks: root password (set strong password), user creation, IP address, DNS … and then package selection. Don’t forget to check Web server and database MySQL or PostgreSQL. Web server package contains Apache with PHP module. If needed, FTP server can be also included in installation and that will be all for package LAMP setup. Installer will include all dependencies, so relax and enjoy in Linux installation.

5. Set runlevel to 3
After installation and first restart, server will probably boot to runlevel 5 – if you install GNOME or KDE. Nice graphic interface gdm will awaiting users to login. Open /etc/inittab and find line with initdefault. Simply replace number 5 with 3 and save file. After reboot, system will boot to runlevel 3 (without X server). Inside inittab you will also find definition of spawn 6 gettys in standard runlevels. You can comment bottom four because server configuration and monitoring will mostly go through ssh.

# Default runlevel. The runlevels used by RHS are:
#   0 - halt (Do NOT set initdefault to this)
#   1 - Single user mode
#   2 - Multiuser, without NFS (The same as 3, if you do not have networking)
#   3 - Full multiuser mode
#   4 - unused
#   5 - X11
#   6 - reboot (Do NOT set initdefault to this)
id:3:initdefault:
...
...
# Run gettys in standard runlevels
1:2345:respawn:/sbin/mingetty tty1
2:2345:respawn:/sbin/mingetty tty2
#3:2345:respawn:/sbin/mingetty tty3
#4:2345:respawn:/sbin/mingetty tty4
#5:2345:respawn:/sbin/mingetty tty5
#6:2345:respawn:/sbin/mingetty tty6

In FC9 configuration of gettys are handled by /etc/event.d/tty[1-6] so I suppose that change will propagate in forthcoming CentOS 6.

6. Turn off needless services
It is good to see which services will be started during booting to runlevel 3. In RedHat family, there is utility chkconfig and in combination with grep, list runlevel 3 services. You will see long list of services and many of them are needless for LAMP setup.

chkconfig --list | grep 3:on

Minimum and sufficient list of running services for LAMP setup should look like:

> chkconfig --list | grep 3:on
crond           0:off   1:off   2:on    3:on    4:on    5:on    6:off
httpd           0:off   1:off   2:on    3:on    4:on    5:on    6:off
iptables        0:off   1:off   2:on    3:on    4:on    5:on    6:off
irqbalance      0:off   1:off   2:on    3:on    4:on    5:on    6:off
microcode_ctl   0:off   1:off   2:on    3:on    4:on    5:on    6:off
mysqld          0:off   1:off   2:on    3:on    4:on    5:on    6:off
network         0:off   1:off   2:on    3:on    4:on    5:on    6:off
sshd            0:off   1:off   2:on    3:on    4:on    5:on    6:off
syslog          0:off   1:off   2:on    3:on    4:on    5:on    6:off

All other services can be turned off by executing “chkconfig <service> off” command:

chkconfig cups off
chkconfig gpm off
...

After turning off needless services and before production launch, reboot server to see if everything works as expected.

7. Firewall
Web server will be probably placed behind DMZ’s firewall, but it is good to protected LAMP server with his own firewall. This firewall should accept HTTP requests from any source and SSH request from intranet side only (in example from one IP address). All other types of connections will be forbidden. You can use system-config-securitylevel utility to create file /etc/sysconfig/iptables and it’s content should look like:

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state –state NEW -m tcp -p tcp –dport 80 -j ACCEPT
-A INPUT -m state –state NEW -m tcp -p tcp –dport 22 -s 123.123.123.123 -j ACCEPT
-A INPUT -j REJECT –reject-with icmp-host-prohibited
-A FORWARD -j REJECT –reject-with icmp-host-prohibited
COMMIT

… or you can open file /etc/sysconfig/iptables copy/paste this configuration and restart iptables.

8. Forbid ssh access for root
Before production, create at least one user more without any administration rights – normal user with strong password (if you didn’t in step 4.).

useradd <username>

In /etc/ssh/sshd_config find option PermitRootLogin and write it to:

PermitRootLogin no

Restart sshd and root will no longer be able to access LAMP server through ssh – that’s why additional user exists. To obtain administrator rights, execute “su -” (substitute user) command.

After finishing all this steps, LAMP server should be secured with minimum running services, firewall and disabled root ssh access. Now it’s time for Apache and PHP configuration …

Original Document Here

WHM

Step one was to login to Web Host Manager (the server management front-end for cPanel), and run their configuration wizard. The only things that required non-default action were:

• setting the hostname
• added a resolver (DNS) server ip

After the wizard was complete, these additional settings were performed manually:

• Server Contact E-Mail
• Turned on awstats web stats reporting tool
• Changed hostname. (Even though the wizard set it, this was an additional, different place.)
• Changed system mail preferences to send root email to an admin alias.
• Changed root password.
• Set Nameservers

Also ran Update Server Software and Update System Software within WHM to update as many components as reasonable.

Linux Kernel

The original configuration as delivered by the server farm:

WHM 10.1.0 cPanel 10.2.0-R82
RedHat Enterprise 3 i686 – WHM X v3.1.0
Linux kernel version: 2.4.21-27.ELsmp

Since that’s not the latest kernel at the time of delivery, and cPanel will not update the kernel automatically, I was advised to update. I upgraded the kernel to 2.4.21-32.0.1.ELsmp, which went smoothly.

Remote Access

One of the areas for almost immediate security tweaking is remote access. If you’ve ever examined a server’s logs, you know that they’re regularly probed with various types of attacks. There are several modifications to render those attacks pointless, as well as secure remote access in general.

SSH

SSH, or secure shell, is the remote command-line access mechanism of choice. It’s single biggest claim to fame is simply that everything is encrypted, though it includes many more features as well.

I first created a couple of non-root login accounts, and installed RSA public keys for eventual RSA/public key-only logins. (Also created end-user instructions for creating, and using, SSH key pairs.)

I then made the following changes to /etc/ssh/sshd_config:

• Protocol 2 – this disables protocol version 1, which is known to have security issues.
• PermitRootLogin without-password – this disables root login, unless a public key is used.
• PasswordAuthentication set to no – this disables the ability to login with just a username and password. A username and public key are required.

Telnet

I disabled telnet, as it allows passwords to be transmitted in the clear, and is a known security risk.

FTP

Normally at this point I would also disable the FTP service for the same reasons as Telnet – it’s a known security risk. For reasons I didn’t bother to investigate further, cPanel either complained repeatedly via email if the service was stopped, or it would restart it, depending on the technique I was attempting to use. I gave up on this and left the FTP service running, but blocked at the firewall, discussed below.

TMP

The /tmp directory is an interesting and apparently common place for hackers to exploit to breech a system. One approach to securing it without breaking its functionality is to create it as a new partition that disallows program execution. Where in the past a hacker could use an exploit to place a file in /tmp and then execute it, the ability to execute is now removed by creating a secure /tmp partition.

Firewall

Installed APF which is, essentially, an intelligent front end to the built in Linux firewall, iptables. I found a good how-to, though I did not yet configure the antidos (denial of service) component. The one change that I did make to the default configuration is that I disabled or blocked all ports that we know are not explicitly used for something specific. For example, this is where I blocked all FTP access. I also whitelisted my own static IP address, and that of the client.

Logging

Logwatch is a server log summary tool that emails a report to the server admins nightly. An older version was installed. I updated to latest, and increased the reporting level to “medium”.

Rootkit Checks

Installed nightly backup script, which includes nightly reporting of both rkhunter and chkrootkit runs.

Apache

Installed mod_security, which guards against exploits via the Apache web server, using a basic ruleset. This how to was helpful in setting that up.

General

A few additional tweaks and settings …

• Installed LES – “LES is intended as a facility to quickly & easily secure Redhat/RPM based environments (i.e: turbo Linux, open Linux). It does such by enforcing root-only permissions on system binaries (binaries that have no place being executed by normal users), enforcing root-only path traversal on system paths, enforcing immutable bit on essential rpm package contents (i.e: coreutils), and enforcing immutable bit on shell profile scripts.”
• Added a mail line to /etc/rc.d/rc.local, to automatically notify on reboots.
• Removed the cpbackup cron job, since we don’t use cPanel’s backup approach.
• Modified reverse-DNS to be correct.

Ongoing Maintenance

Even with all the tools and updates in place, there’s still on-going work and vigilance required.

• Monitor the nightly logs and reports generated for anomalies.
• Manually install updates as reported available by up2date.
• Monitor Redhat for kernel updates, and install as appropriate.
• Monitor chkrootkit for updates, and install as appropriate.

Still More Options

I haven’t implemented these, but they’ve been recommended, and they’re on the list to evaluate at some point.

• mod_doevasive. “mod_dosevasive is an evasive maneuvers module for Apache to provide evasive action in the event of an HTTP DoS or DDoS attack or brute force attack. It is also designed to be a detection and network management tool, and can be easily configured to talk to ipchains, firewalls, routers, and etcetera. mod_dosevasive presently reports abuses via email and syslog facilities.” How To
• Evaluate BFD. “BFD is a modular shell script for parsing applicable logs and checking for authentication failures.”