Centos+nginx+php+mysql (3) (EXT)

[Setup Ngnix to provide download of AVI, MP3, etc.]

# Vi/usr/local/webserver/nginx/conf/mime.types
↑ Edit Mime.types File
Change the file type to "Application/octet-stream" before you need to provide the downloaded format
# Vi/usr/local/webserver/nginx/conf/mime.types.default
↑ Edit Mime.types.default File
Change the file type to "Application/octet-stream" before you need to provide the downloaded format

[Set number of Web site concurrency limits]
Added concurrency limit when configuring nginx.conf file, see official Wikipedia (Http://wiki.codemongers.com/NginxChsHttpLimit_zoneModule) httplimit_ Zonemodule "section

[Set Nginx program limit 1M upload problem]
Removed 1M upload limit when configuring nginx.conf file, see note in nginx.conf file

[Optimized PHP]
See section "PHP Optimization Settings" for details (http://www.cnprint.org/bbs/blogs/1/blog312.html)
Only part of the necessary content is set here

# Vi/usr/local/webserver/php/etc/php.ini
↑ Edit PHP.ini File

1. Add "disable_functions ="
Modified to "disable_functions = Phpinfo,passthru,exec,system,popen,chroot,escapeshellcmd,escapeshellarg,shell_exec,proc_ Open,proc_get_status "
↑** This recommendation after the site has been built modified * * This option can be set which PHP functions are forbidden, some of the functions in PHP are risky or quite large, you can directly execute some system-level script commands, if you allow these functions to execute, when the PHP program vulnerabilities, the loss is very serious!
Note: If your server contains some PHP programs for system State detection, do not disable functions such as Shell_exec,proc_open,proc_get_status.

2. "Upload_max_filesize = 2M"
Modified to "upload_max_filesize = 50M"
↑ This option sets PHP to allow the maximum upload file size, which defaults to 2MB. Depending on the actual application needs, this setting can be increased appropriately.

[Optimized MySQL]
See the "MySQL Optimization and security Settings" section (http://www.cnprint.org/bbs/blogs/1/blog312.html) for details
Only part of the necessary content is set here

# vi/usr/local/webserver/mysql/my.cnf↑ Edit my.cnf file

1. Place "Table_cache = 64"
Modified to "Table_cache = 512"
↑ Specifies the size of the table cache. Whenever MySQL accesses a table, if there is room in the table buffer, the table is opened and put into it, which allows for faster access to the table contents. By checking the status values of peak time open_tables and Opened_tables, you can determine whether you need to increase the value of Table_cache. If you find that open_tables equals Table_cache, and opened_tables is growing, you need to increase the value of Table_cache (the above status values can use Show status like ' Open_ Tables ' obtained). Note that you cannot blindly set the Table_cache to a very large value. If set too high, it may cause insufficient file descriptors, resulting in performance instability or connection failures.

2. "Sort_buffer_size = 512k"
Modified to "sort_buffer_size = 2M"
↑ the desired buffer for each thread sort

3. "Read_buffer_size = 128k"
Modified to "read_buffer_size = 2M"
↑ When a query constantly scans a table, MySQL allocates a memory buffer for it. The read_buffer_size variable controls the size of this buffer. If you think that the continuous scan is going too slowly, you can improve its performance by increasing the value of the variable and the size of the memory buffer.

4. "Read_rnd_buffer_size = 512k"
Modified to "read_rnd_buffer_size = 4M"
↑ Read data After speeding up the sorting operation, increasing the speed of the read classification line. If you are performing a group by or order by operation on a table that is much larger than the available memory, you should increase the value of read_rnd_buffer_size to speed the row reads after the sort operation. Still don't understand the usefulness of this option ...

5. "Myisam_sort_buffer_size = 8M"
Modified to "myisam_sort_buffer_size = 32M"
↑ for repair TABLE. Do not understand the usefulness of this option, Baidu found on the set direction is also a variety of 128M, 64M, 32M, etc., choose one.

[MySQL security Settings]
See the "Mysql Security Settings" section for details (http://www.cnprint.org/bbs/blogs/1/blog312.html)
Only part of the necessary content is set here

**iptables Set * * Close the remote connection, which is Port 3306. This is the default listening port for MySQL. Since MySQL only serves local scripts here, no remote connection is required. Although MySQL built-in security is strict, listening to a TCP port is still a risky behavior, because if the MySQL program itself is a problem, then unauthorized access can completely bypass MySQL's built-in security mechanism. (You must determine if you really do not need to connect to MySQL remotely)

[Overall system security adjustment]

1, * * finally set **rhel or red had Enterprise Linux 5.X users want to open SELinux first, the method is to modify the/etc/selinux/config file selinux= "" for enforcing. It will ensure that your system does not crash abnormally. Some people think that should be closed, I strongly do not recommend, of course, just the use of Rhel to play, not for the actual server does not matter.
2. * * FINALLY set * * Enable Iptables firewall, there are many benefits to increase system security. Set the rules for the firewall.
Iptables Requirements:
* Block All ports
* Set the default port of SSH to 56565
* Open 56565, 80, 3306 ports
* Set 3306 port to allow only native access

Iptables rules:
# vi/usr/local/webserver/fw.sh
Paste the following script command into the fw.sh file
#!/bin/bash
# Stop Iptables Service
/sbin/service iptables Stop
# inital Chains Default Policy
/sbin/iptables-f-T Filter
/sbin/iptables-p INPUT DROP
/sbin/iptables-p OUTPUT ACCEPT
# Enable Native Network Transfer
/sbin/iptables-a input-i lo-j ACCEPT
# Accept established Connections
/sbin/iptables-a input-m State--state established,related-j ACCEPT
# ICMP Control
/sbin/iptables-a input-p icmp-m limit--limit 1/s--limit-burst 10-j ACCEPT
# WWW Service
/sbin/iptables-a input-p TCP--dport 80-j ACCEPT
# SSH Service
/sbin/iptables-a input-p TCP--dport 56565-j ACCEPT
# Anti DDOS
/sbin/iptables-i input-p tcp--syn-m ttl--ttl-eq 117-j DROP
/sbin/iptables-i input-p tcp--syn-m length--length:40-j DROP
# MySQL 3306 Accept
/sbin/iptables-a input-p tcp-s 127.0.0.1--dport 3306-j ACCEPT
/sbin/iptables-a output-p tcp-s 127.0.0.1--dport 3306-j ACCEPT
# Start Iptables Service
/sbin/service iptables Start

After saving, execute the following command
# chmod 755/usr/local/webserver/fw.sh
# echo '/usr/local/webserver/fw.sh ' >>/etc/rc.d/rc.local
#/usr/local/webserver/fw.sh

3, the implementation of the setup to shut down those services that do not need to open a service, less a danger, has been installed in the < system after the initial environment settings > set
4, Prohibit control-alt-delete keyboard close command
Comment out the following line in the "/etc/inittab" file (using #):
# Vi/etc/inittab
Modify "Ca::ctrlaltdel:/sbin/shutdown-t3-r Now" to: "#ca:: Ctrlaltdel:/sbin/shutdown-t3-r Now"
To make this change work, enter the following command:
#/sbin/init Q
5. Set permissions for the "/etc/rc.d/init.d" script file
Sets permissions for the script file that executes or shuts down a program that executes at startup.
# Chmod-r 700/etc/rc.d/init.d/*
This means that only root is allowed to read, write, and execute script files in that directory.
6, so that "/etc/services" file immunity
Immunize "/etc/services" files against unauthorized deletion or addition of services:
#chattr +i/etc/services
7. Block your system from responding to any external/internal ping requests.
Since no one can ping your machine and receive a response, you can greatly enhance the security of your site. You can add the following line of commands to/etc/rc.d/rc.local so that it runs automatically after each startup.
# vi/etc/rc.d/rc.local
Echo 1 >/proc/sys/net/ipv4/icmp_echo_ignore_all
8. Set resource limits on all users on your system to prevent DOS type attacks (denial of service attacks)
such as the maximum number of processes, the amount of memory, etc. For example, the restrictions on all users are as follows:
# vi/etc/security/limits.conf
In the following code example, all users per session are limited to ten MB and allow four logins at a time. The third line disables the kernel dump for everyone. Row four removes all restrictions for the user bin.
* Hard RSS 10000
* Hard Maxlogins 4
* Hard Core 0
Bin-
Activate these restrictions
# Vi/etc/pam.d/login Add a line at the bottom: Session required/lib/security/pam_limits.so.
9. Use the chattr command to add an immutable attribute to the following file.
# chattr +I/ETC/PASSWD
# chattr +i/etc/shadow
# chattr +i/etc/group
# chattr +i/etc/gshadow
**mysql Database Password Change after setting * * Note that after performing this operation, you cannot add users or change passwords to the system as root.
If we want to add the user or change the password. You should first use Chattr-i/etc/passwd and other commands to remove the non-writable settings, and then to operate.
10, modify the sshd port:
Modify the firewall configuration to open a new remote port (56565)
# Vi/etc/sysconfig/iptables

Modify/etc/ssh/sshd_config:
# Vi/etc/ssh/sshd_config
Change the port inside to 56565, (the specific ports are arbitrary and cannot conflict with other programs ' ports). and comment out the previous # number

To make the SSHD service effective:
# Pkill Sshd
# service sshd Start

Modify the firewall configuration to close the old remote port (22)
# Vi/etc/sysconfig/iptables
Note: After modifying the firewall profile, you must not use Setup to modify the firewall settings, or the settings will now expire
11. Kernel parameter adjustment
Edit sysctl.conf File:
# vi/etc/sysctl.conf
Modify the following:
Net.ipv4.conf.default.accept_source_route=0
Net.ipv4.icmp_echo_ignore_broadcasts=1
Net.ipv4.icmp_echo_ignore_all=1
Net.ipv4.icmp_ignore_bogus_error_responses=1
net.ipv4.ip_conntrack_max=65535
Net.ipv4.tcp_syn_retries=1
Net.ipv4.tcp_synack_retries=1
net.ipv4.route.gc_timeout=100
net.ipv4.tcp_max_syn_backlog=32768
Net.ipv4.conf.default.rp_filter=0
Net.ipv4.tcp_max_syn_backlog = 8192
Net.ipv4.tcp_max_tw_buckets = 5000
Kernel.shmmax = 134217728
View Status:
# sysctl-p
12, check the system log frequently. The system log is primarily located in the/var/log/directory. Nip

