Linux Centos 5 Web Server Security Settings

 

1. Centos System Security

1. Use a firewall to close unnecessary ports. If someone else fails to PING the server, the threat is naturally reduced by more than half.

2. Change the SSH port to over 10000, and the chances of others scanning the port will also decrease.

3. delete unused accounts with a bloated system:

Userdel adm

Userdel lp

Userdel sync

Userdel shutdown

Userdel halt

Userdel news

Userdel uuucp

Userdel operator

Userdel games

Userdel gopher

Userdel ftp if you do not allow anonymous FTP, delete this User Account

Groupdel adm

Groupdel lp

Groupdel news

Groupdel uuucp

Groupdel games

Groupdel dip

Groupdel pppusers

4. Change the following file permissions so that no one has the permission to change the account:

Chattr + I/etc/passwd

Chattr + I/etc/shadow

Chattr + I/etc/group

Chattr + I/etc/gshadow

5. chmod 600/etc/xinetd. conf

6. Disable Anonymous FTP User Login

Ii. PHP security

1. Enable the security mode (not recommended for commercial application servers)

# Vi/usr/local/Zend/etc/php. ini (when ZO is not installed, the php. ini file is located at/etc/php. ini)

Safe_mode = On

2. Lock the PHP application directory

# Vi/etc/httpd/conf. d/virtualhost. conf

Join

Php_admin_value open_basedir/home/*** (*** indicates the site directory)

3. Do not grant write permissions to unnecessary directories, that is, 777 permissions. Keep the root directory as 711. If you cannot run PHP, change it to 755.

4. Shielding PHP unsafe parameters (webshell)

# Vi/usr/local/Zend/etc/php. ini (when ZO is not installed, the php. ini file is located at/etc/php. ini)

Disable_functions = system, exec, shell_exec, passthru, popen

The following are my server blocking parameters:

Disable_functions = passthru, exec, shell_exec, system, set_time_limit, ini_alter, dl,

Pfsockopen, openlog, syslog, readlink, symlink, link, leak, fsockopen, popen, escapeshell

Cmd, error_log

Generally

 

Disable_functions = dl, exec, passthru, proc_open, proc_close, shell_exec, system