-5
votes
0answers
33 views

Why minimal install of OS? [on hold]

We are working with one of our customer on Performance Tuning. During the kick off discussion with their IT team.A best practice of slimming down the operating system with minimal install and install ...
-1
votes
1answer
74 views

How to block incoming login attempts to postfix, pop3, imap?

We are running CentOS 6.5 with Plesk and have to send email but don't need to receive. I would like to block all incoming login attempts to postfix, pop3 and imap. I have found hints to iptables or ...
0
votes
2answers
46 views

Installing SecAst on AsteriskNOW with CentOS

Having some issues installing SecAst for IPS, Followed the directions up to 2.1.6 and found a way (on this forum) to install qt5-qtbase (thanks) but when I run ldd /usr/local/secast/secast the return ...
1
vote
0answers
21 views

Should I completely rebuild my server due to Heartbleed? [duplicate]

I have a CentOS 6.5 VPS server... $ uname -a Linux mary 3.14.4-x86_64-linode40 #1 SMP Tue May 13 12:25:05 EDT 2014 \ x86_64 x86_64 x86_64 GNU/Linux When the news about the Heartbleed ...
0
votes
1answer
47 views

How to change cPanel URL? Example: mydomain.com/cpanel

I want to change my website's cPanel URL/path for security reasons. I have a VPS with shell root access, running centOS 6.5 64-bit. I want to change cPanel path for my website on the VPS to be ...
-1
votes
3answers
223 views

Is blocking SMTP ports prevent server from sending emails?

I have a Centos server with cPanel on it. Yesterday, some hackers had successfully connected to my smpt server and sent thousand of emails from it. What I want to do is blocking every ports except ...
2
votes
1answer
191 views

Outbound DDOS Attacks Being Run from Our Server

We run a mail server (postfix/dovecot/centos 6.4). The hardware is based on a supermicro chasis with IPMI features. It also runs a web interface for accesisng mails(Apache web server ) Recently our ...
3
votes
1answer
77 views

Apache upgrade strategy

I'm on CentOS 6.5 and Apache 2.2.15. I wanted my httpd to be up to date so I did: yum update httpd After that it is still version 2.2.15, but latest version is 2.2.22. I also see security updates ...
1
vote
1answer
55 views

TCP echo server security [closed]

I am setting up a Linux server similar to a TCP echo server and am wondering about security issues I should be concerned about. This will be a bare bones Centos/KDE server with no additional files ...
1
vote
2answers
120 views

What is the difference between /etc/hosts.allow and denyhosts' /var/lib/denyhosts/allowed-hosts?

Put another way, why doesn't denyhosts simply reference /etc/hosts.allow? Why does it have it's own file? Some of the denyhosts tutorials you see instruct the user to add their management IPs to this ...
3
votes
0answers
109 views

Security Warning: Enable “Jail Apache” in the “Tweak Settings”? [closed]

I have VPS running WHM on CentOS 6.5 and I have root access. A security warning appearing in the Security Advisor. Warning: Enable “Jail Apache” in the “Tweak Settings” area. I entered the tweak ...
0
votes
2answers
389 views

Filezilla or PuTTY: I have “Access granted” followed by “Server unexpectedly closed network connection”. How to troubleshoot?

Here is an extract of Filezilla debug traces : Offered public key from "(...)" Offer of public key accepted, trying to authenticate using it. Access granted Server unexpectedly closed network ...
1
vote
1answer
86 views

Which way is more secure: apache:admin or folder group owner:apache?

I have been learning in recent days how to set up var/www/ permissions. I understand the common solution is set a group owner of all new folders to apache via sticky bit. How about giving the Apache ...
-1
votes
3answers
252 views

How to fight request spam (DDOS i guess) on CentOS server [duplicate]

lately i'm trying to fight DDOS on my CentOS 6.4 server. I have installed CSF and I've set it quite strictly. Yet there is a URL that have like 1000 requests and max 2 per IP (smart ddos-er I guess). ...
-1
votes
1answer
69 views

Is this CentOS 6.2 system reasonably secure as described? [closed]

This is a CentOS 6.2 system. For my login with the hosting company website, I set a 20-character mixed case, letters, numbers, symbols password and enabled two-factor authentication. In ...
-4
votes
2answers
503 views

Allow non-root process to listen on port 80 without doing anything drastic

For reasons beyond my comprehension, GlassFish refuses to play ball with iptables. That is, with all the correct redirection rules in place, it won't receive any redirected traffic. So I'm at plan B ...
1
vote
1answer
69 views

security issue with paypal on cpanel box

Is there a way with CSF, CXS or LFD (or any other method) to automatically alert via sms or email of any new scripts, files or directory names with "paypal.com"? I've been notified by PayPal ...
2
votes
2answers
537 views

Permissions for webserver on Centos 6.3 running Plesk

I'm currently setting up an Opencart Ecom website on a VPS running Centos 6.3 which has Plesk Panel 11. I haven't much experience with servers so trying to get things right from the start. When I FTP ...
2
votes
1answer
236 views

Security concerns in Ubuntu and CentOS

In my company we are dealing with an interesting decision: which Operating System should we choose as the default one? This does not mean that every installation will be based on the chosen Operating ...
2
votes
1answer
126 views

Tracing root compromises [closed]

In regards to the following: http://blog.solidshellsecurity.com/2013/02/18/0day-linuxcentos-sshd-spam-exploit-libkeyutils-so-1-9/ http://www.reddit.com/r/netsec/comments/18ro3c/sshd_rootkit/ There ...
0
votes
1answer
53 views

Server goes to 100% and stays there, how can I investigate this? [duplicate]

I have a problem. I am on a Xen VPN, running CentOS 6 and Apache. I have a medium traffic Zen Cart store and a few low traffic wordpresses. I have one or two very simple PHP form submission scripts, ...
4
votes
2answers
4k views

How to solve call trace produced by security_ops_task_setrlimit() with bind

I have a machine with CentOS 5.9 and VMware installed. Currently I am using BIND 9.3.6-P1-RedHat-9.3.6-20.P1.el5_8.6 (default shipped with distribution). When I restart the machine, I can see this ...
2
votes
2answers
393 views

setting up centos to apply updates automatically

How do I set up my centos instances to automatically apply security updates? Is it as simple as setting up a cron job that does yum -y update at 1:00am ?
0
votes
1answer
2k views

iptables - Block incoming on Eth1 and Allow All from eth0

I am a bit stuck with iptables to do deal with two Ethernet ports. eth0 port for LAN use (192.168.1.50 Private IP). eth1 port is connected to the internet via cable modem (80.0.xxx.xxx public IP). ...
0
votes
2answers
89 views

How do you restrict access to a server to be from a single machine (which doesn't have a dedicated IP)?

We want to deploy a J2EE WAR file from a build server to an application server (running JBoss 7.1.1) using the JBoss management console. Each machine is located on a different network. On the build ...
0
votes
2answers
212 views

Linux - Security - Is someone trying to find a way in? [duplicate]

Possible Duplicate: Hundreds of failed ssh logins Recently I have been spending more time on my production servers in efforts to puppetize several configs and I happened to issue a find ...
2
votes
1answer
108 views

How can I implement an ip whitelist to protect my server?

I'm going to start running a gameserver soon and I want a way to reduce the the damage of a denial of service attack. I want to make it so when someone joins the game their ip adress is added to a ...
5
votes
2answers
528 views

Why chroot is considered insecure?

I've been playing around with CentOS box for couple of years now. So I'm pretty comfy with terminal. However, I read a lot of blog-post claiming that chroot is insecure and amount of those posts ...
4
votes
7answers
1k views

Preventing - Large Number of Failed Login Attempts from IP

I'm running a CentOS 6.3 server and currently receive emails entitled "Large Number of Failed Login Attempts from IP" from my server every 15 minutes or so. Surely with the below configured it should ...
3
votes
2answers
636 views

Google authenticator with Openldap or Fedora 389 Server

After a little googling I could see some references of configuring Google Authenticator with Windows Active Directory, however, I could not see how I could do it on Linux/CentOS system. What would be ...
0
votes
1answer
57 views

Getting much higher than usual brute-force attempts on cPanel

Although I have many client accounts on my cPanel based server I'm really the only one who has login information to any of the accounts. I have cPhulk setup to alert me and blocking after 4 failed ...
0
votes
2answers
187 views

USB key to pass password in Centos 6 [closed]

I had a room mate that put a livecd in my desktop and looked around on my machine. I caught him in the act and threw him out. I haven't had a room mate for a while now and so as to avoid the livecd ...
0
votes
1answer
350 views

find common string to block IPs

Currently I have all these IPs coming in. Is there a way to find a common string in the content of the packets and then block the attack via IPTables? Oct 24 16:28:52 host kernel: [ 823.255566] ...
2
votes
3answers
742 views

Which services to disable on a CentOs 5.8 web/database server?

I have just setup my CentOS 5.8 64 [final] server as a webserver. Specs: 2x E5620 Intel CPU, DDR3 RAM, Hardware Adaptec RAID 10, 4x SAS drives. I have installed myself: Nginx PHP-FPM MySQL ...
0
votes
2answers
293 views

Could it be that “chkrootkit” just doesn't like .hmac, .packlist, and .relocation-tag files?

I just cleaned up my hacked CentOS server (due to not updating since versino 5.3). But still, "chkrootkit" says this: Possible t0rn v8 \(or variation\) rootkit installed ...
0
votes
2answers
3k views

Finding latest successful logins and failed attempts to a CentOS server

I'm looking for a log file or any service to report the latest login attempts which have failed due to username/password miss match. Is there such utility available for CentOS? (built-in is preferred) ...
1
vote
2answers
774 views

security update in centos, which way is it?

Recently something have been bothered with my mind regarding my linux CentOS box.My client have been asking to set up a CentOS machine in their environment which works as server. One of their ...
5
votes
4answers
2k views

Is there a way to prevent password expiration when user has no password?

Okay, we all care about security so users should change their passwords on a regular basis (who said passwords are like underwear?). On redhat and centos (5.x and 6.x), it's possible to make every ...
-4
votes
3answers
305 views

Need Anti-Virus software for CentOS [closed]

We are using CentOS with parallel plesk server for our web application. User can upload their files to server. For security reason I need a anti-virus software scanning on all uploaded files. So ...
4
votes
4answers
249 views

Who is 1014? I have no user on my system named 1014, so why is this httpd process run as 1014?

[root@home ~]# ps au | grep httpd 1014 9701 0.0 0.2 281620 3124 pts/24 Sl+ 18:41 0:00 ./bin/httpd -X root 9742 0.0 0.0 3084 720 pts/22 R+ 18:45 0:00 grep httpd By the ...
0
votes
4answers
438 views

Disable CentOS users from everything but samba use.

I have a storage server running some samba shares. I need to create multiple users for each individual working at my company, but I only want them to be able to access samba from the client machines. ...
0
votes
1answer
513 views

PureFTPd and symlinks

I'm running Pure-FTPD on centos 5 with cPanel installed. When somebody upload a symlink file called 1.txt and it's a symlink to /partition for example, He can browse all /partition contents from this ...
3
votes
2answers
435 views

Nagios Hardening

I've been trying to look into hardening Nagios (if there is such a thing...), but haven't found anything too definitive on what to do or guidance on what to even look at. I'm wary to keep Nagios ...
0
votes
2answers
389 views

CentOS security for lazy admins

I'm running CentOS 5.5 (basic LAMP with Parallels Power Panel and Plesk) and have thus far neglected security (because it's not my full-time job, there is always something more important on my ...
6
votes
3answers
792 views

Is it secure to run older Linux distros like CentOS 4.4?

It's obviously a best practice to run an up to date distro, or at least one that is still getting security updates. If a particular piece of software requires an older distro like CentOS 4.4 (mandated ...
1
vote
4answers
4k views

Apache httpOnly Cookie Information Disclosure CVE-2012-0053

A PCI compliance scan, on a CentOS LAMP server fails with this message. The server header and ServerSignature don't expose the Apache version. Apache httpOnly Cookie Information Disclosure ...
3
votes
1answer
662 views

CentOS verify backported PHP and Apache fixes

I understand that RedHat backport CVE fixes to Apache and PHP for CentOS as updates where the version number doesn't necessarily increase, and that I can get these fixes with yum update php etc, so ...
0
votes
4answers
575 views

Is it possible to sign email with digital signature on server side?

I have nice iRedMail server (postfix, dovecot, policyd). One of my client apps sends email via this server. And client want to sign it with digital signature on server side. Is it even possible to do ...
11
votes
6answers
7k views

Automatically check for Security Updates on CentOS or Scientific Linux?

We have machines running RedHat-based distros such as CentOS or Scientific Linux. We want the systems to automatically notify us if there are any known vulnerabilities to the installed packages. ...
1
vote
1answer
595 views

Very long logging time via ssh and GSSAPIAuthentication. Can turning off GSSAPIAuthentication be a security issue?

I had a problem with very long logging via ssh to my servers (Fedora 16 and Centos 6). After testing some configuration I discovered that the problem is in enabled GSSAPIAuthentication options. After ...