A Beginner's Guide to Securing Your Server

[chirpy]

Probably simpler to setup a forwarder on a domain through cPanel that sends to two addresses and then use that single forwarder address in the file instead.

Alternatively, put the email addresses in quotes might work

[Manuel_accu]

Same deal.

bash: insmod: command not found

Brian

Use below command, it should work now

touch /var/lock/subsys/local
modprobe iptable_nat
modprobe ip_nat_ftp

[uwhost]

A big thank you to the maker of this post, though I did run into an issue when installing BFD;

epsilon# /usr/local/sbin/bfd -s
BFD version 0.9 <bfd@r-fx.org>
Copyright (C) 1999-2004, R-fx Networks <proj@r-fx.org>
Copyright (C) 2004, Ryan MacDonald <ryan@r-fx.org>
This program may be freely redistributed under the terms of the GNU GPL

[: unexpected operator
[: /var/log/exim_mainlog: unexpected operator
[: unexpected operator
[: unexpected operator
[: unexpected operator
[: unexpected operator
[: unexpected operator
[: /var/log/maillog: unexpected operator
[: 1027096: unexpected operator
[: unexpected operator
[: /var/log/secure: unexpected operator
[: /var/log/secure: unexpected operator
[: /var/log/secure: unexpected operator
[: /var/log/secure: unexpected operator
[: unexpected operator

Does anyone know what I did wrong?

[ashokjp]

i get this error in my clients invision power board email logs
This server does not support authorisation
503 This server does not support authorisation

his settings of smtp are right
i have disabled pop over smtp.
I have enabled relay for * in exim.conf

everything is fine
still mail doesnt go thru.

any solution ?

[chirpy]

I would suggest that you post in your own thread or a different one as your post is off-topic WRT this thread.

[Bruno]

After you are sure everything is working fine, change the DEV option

At command prompt type: cd /etc/apf

At command prompt type: pico -w conf.apf


Scroll down and find

DEVM="1"

change it to

DEVM="0"


Save changes, exit and then restart firewall,

At command prompt type: /usr/local/sbin/apf -r

Hello,

I did not find this line, I only found one similar one to this. She is This?

#Set firewall cronjob (devel mode)
# 1 = enabled / 0 = disable
DEVEL_MODE="1"

Thanks,

Bruno

[virtuose]

Great post! Very good work thanks!

I have a little problem with OpenSSL on my last cpanel release because my OpenSSL is insecure:

Module Latest Installed
OpenSSL 0.9.7h 0.9.7a

Someone can tell me how to upgrade OpenSSL ? Because cpanel dont upgrade it...

[chirpy]

What OS are you using?

[amal]

Great post! Very good work thanks!

I have a little problem with OpenSSL on my last cpanel release because my OpenSSL is insecure:

Module Latest Installed
OpenSSL 0.9.7h 0.9.7a

Someone can tell me how to upgrade OpenSSL ? Because cpanel dont upgrade it...

Upgrading OpenSSL and OpenSSH can cause issues at times, and even cause the server to go down.. I'll recommend you to use the help of a server admin to get this done..

If you still want to proceed, follow the procedures below...
That's how i did the install, and it worked perfect for me...

If there's an easier method, do post it..

===============================================


Download latest OpenSSL source from

http://www.openssl.org/
./config --prefix=/usr shared
make
make install

Download latest openssh source from http://openssh.com/portable.html
./configure --prefix=/usr --sysconfdir=/etc/ssh
make
make install

edit /etc/ssh/sshd_config and change
#Protocol 1, 2
to
Protocol 2

FOLLOW THE STEPS BELOW VERY CAREFULLY AFTER INSTALLATION OR ELSE THE SERVER WON'T BE UP AGAIN..

After you do this uninstall the openssl rpm
then recompile openssl again using the steps given above..

Then uninstall openssh rpm and again recompile openssh using the steps mentioned above...

after running everything, just try running the wget, php commands etc... They won't work, since they are using the libraries of old version of openssh.. Just create a link for the missing filename to the new library files, and they will work fine..

MOST IMPORTANT.. Make sure that every service is restarting fine before restarting sshd....

=================

[Sinewy]

I would not go uninstalling the openssl/openssh rpms....

[chirpy]

...and the reason why I asked aboout which OS is that if you're running a supported one, i.e. CentOS/RHE then there is no need whatsoever to touch openssl or openssh.

If you do manually recompile openssl and openssh you'll probably find there are a lot more applications that use their libraries that you also need to recompile if you're using a dead OS.

[spaceman]

Would it be fair to say that most people here would consider it perfectly OK to have APF (software) firewall protecting their machine, and not go with a hardware firewall as well, i.e because a hardware firewall is simply unnecessary (APF is that good) and/or it adds another layer of complexity.

Thanks for your feedback.

[gupi]

APF is ok for most of the situations, but a hardware firewall is very useful in dDos (or very high traffic) situations, taking the load and leaving the server to do the job was designated for.

A similar approach:
we some routers with onboard encryption, and in on high traffic the response times were bad, due to the encryption job to be done. As soon as we switched to a better model, with separate hardware encryption, the load dropped significantly.

[chirpy]

Indeed.

Software firewalls do add an additional load to your server and, of cours, the processing of in/outbound data packets. On busy systems or those under attack, this overhead can be extreme. Also, iptables with 100's of blocked IP's can render a server unusable/unbootable (not an untypical situation if you use APF and use automated IP blocking such as BFD/exim rule or APF antidos).

If you can afford it, off-loading the responsibility to a hardware firewall - if it is sufficiently configurable - will usually be of more benefit that relying on a software one on the server.

[Ishware]

Would it be fair to say that most people here would consider it perfectly OK to have APF (software) firewall protecting their machine, and not go with a hardware firewall as well, i.e because a hardware firewall is simply unnecessary (APF is that good) and/or it adds another layer of complexity.

It would probably be fair to say that most people have dedicated servers with no option of a hardware firewall-- or at least, they have the system resources to use APF, which is free, vs. talking their provider into setting up a hardware firewall, which would not be free. Further, some people do move providers every few months/years, which makes that even harder-- maybe less hard in a colo situation...