LAMP-based reinforcement (III)

# Rpm-a -- testrpmname: detects possible conflicts in the deleted package. 22. disable dangerous php functions to prevent high webshell performance.

21. delete unused rpm packages
# Rpm-qa list Installation List
# Rpm-qi rpmname more trusted information
# Rpm-a -- test rpmname check possible conflicts when deleting a package
22. disable dangerous php functions to prevent high webshell permissions.
23. install and configure the firewall.
24. install and configure BFD (brute-force cracking detection): You must install the TDs firewall.
25. kernel reinforcement (sysctl. conf)
Avoid DOS and spoofing attacks
# Vi/etc/sysctl. conf
26. change the ssh Port
# Vi/etc/ssh/sshd_config Port xxx
27./tmp,/var/tmp,/dev/shm partition security. do not perform operations on temporary directories.
Mount noexec nosuid
/Tmp Directory:
# Cd/dev
# Dd if =/dev/zero of = tmpMnt bs = 1024 count = 100000
# Mke2fs/dev/tempMnt
# Cp-R/tmp/tmp_backup backup temporary files
# Mount-o loop, rw, nosuid, noexec/dev/tmpMnt // tmp
# Chmod 777/tmp
# Cp-R/tmp_backup/*/tmp
# Rm-rf/tmp_backup
# Vi/etc/fstab
/Dev/tmpMnt/tmp ext2 loop, rw, nosuid, noexec 0 0
/Var/tmp Directory:
# Mv/var/tmp/var/tmpbak
# Ln-s/tmp/var/tmp
Cp/tmp/bak/*/tmp/
/Dev/shm Directory:
# Vi/etc/fstab
Add nosuid and noexec fields
# Mount-
27. install the snort detection system in PHP IDs
28. DoS deflate-defend against/mitigate DDOS attacks in Linux
# Wget http://www.inetbase.com/scripts/ddos/install.sh
# Chmod + x install. sh
#./Install. sh
#/Usr/local/ddos. conf APF_BAN = 0
#/Usr/local/ddos. sh -- cron
/Usr/local/ddos/ignore. ip. list whitelist
127.0.0.1
10.2.4.4
10.2.4.6
10.2.4.8
10.2.4.9
10.2.4.10
10.2.4.11
10.2.4.12
Comment out this line in row 134th of/usr/local/ddos. sh and add the '#' sign before it.
Modify row 117
Netstat-ntu | awk '{print $5}' | \
Egrep-o "[0-9] {1, 3 }\. [0-9] {1, 3 }\. [0-9] {1, 3 }\. [0-9] {1, 3} "| \
Sort | uniq-c | sort-nr> $ BAD_IP_LIST
29. apache vhosts:
Php_admin_value open_basedir/wwwroot/phpMyAdmin/:/tmp/prevents cross-directory webshell

Author: www.phpdesigner.org ReferCon