Security is of paramount importance on today's internet. We pay special attention to each server's security to provide peace of mind for our clients.
All our servers undergo a five point security inspection when they are deployed.
Point 1: Check kernel version.The Linux kernel is the core system program of every Linux system.. We always check your kernel version to make sure there are no known exploitable vulnerabilities. If any kernel vulnerabilities are discovered, we will update it immediately and contact you to schedule a reboot.
Point 2: Check PHP settings. There are several PHP settings that we recommend be disabled on servers that do not require them.
- œallow_url_fopen. This setting allows PHP to treat any URL as if it were a file. This poses a security risk for certain PHP applications that do not correctly sanitize include and fopen statements. Most applications do not require œallow_url_fopen and we strongly recommend that this be disabled (especially for servers running PHP4).
- œallow_url_include. This setting was introduced in PHP5.2. Having œallow_url_include disabled can allow PHP5.2 users to safely enable œallow_url_fopen if it is needed by an application. Almost no PHP applications require that œallow_url_include be enabled. For this reason we recommend that œallow_url_include always be disabled.
- œregister_globals. This setting allows global PHP variables to be set at runtime through a URL. Having it enabled could allow attackers to modify arbitrary PHP variables. This can lead to SQL injections, arbitrary code execution, and other exploits for vulnerable PHP applications. We generally recommend that œregister_globals be disabled.
- In addition to these three PHP settings, we also recommend that certain vulnerable PHP functions be disabled. In doing so, the effectiveness of PHP shells and other PHP based malware is reduced. The list of functions that we generally recommend that users disable is as follows:
dl, exec, shell_exec, system, passthru, popen, pclose, proc_open, proc_nice, proc_terminate, proc_get_status, proc_close, pfsockopen, leak, apache_child_terminate, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid
Point 3: Check apache mod_security ruleset. Apache mod_security is a software firewall which scans incoming HTTP requests for known exploits. We maintain an internal ruleset for many known exploits. We always check to ensure that the latest ruleset is installed on a server prior to its deployment. Optionally, we can configure your server to daily update its ruleset to ensure that your server is always using our latest ruleset.
Point 4: Check CSF/LFD configuration. CSF/LFD is a software firewall suite which supports automated brute force detection and prevention, process tracking, SYN flood protection, and a wide range of other automated security features. We install and configure CSF/LFD on all our standard Linux servers by default.
Point 5: Check system binaries. We audit your server's system binary package versions (such as BIND, apache, udev, etc.) to ensure that they are up to date and not vulnerable to any known exploits.
Point 6: Configuration partition mounting options. We change configuration on partitions to lessen risk of filesystem-based attacks, as well as reduce I/O overhead.
Point 7: Disable typically un-needed services. We disable services that are not commonly used to ensure to help ensure the security of the server.
Point 8: Deploy an initial security-focused configurations. We deploy initial security-focused configurations for MySQL, Exim, Cpanel, FTP, SSH, PHP.
Point 9: RKHunter. RKhunter is a program designed to scan your server for known rootkits and detected modified system binaries. We install RKHunter and initialize its state database.
Point 10: BusyBox. We install BusyBox and take steps to ensure its availability even if someone would chmod/chown recursively on /, whether accidentally or not.
