I'm running a server using OpenVZ for a few websites. Nothing in HN except for sshd. A VM for Varnish, a VM for MySQL and a few VMs each for one website (running Apache/PHP). Now I'd like to secure this server, mostly from network attack (I think).

What I should do? I see that I should not install Selinux in HN. Installation of CSF seems complicated (needs a few iptables rule fine-tunes).



Configuring firewall in the HW node is tricky as you have to consider all the traffic going through the node from/to your VPSs before enabling the firewall in HW node. You may need to do an audit and configure the firewall accordingly, if you are going to use one in the main node. Normally, DCs will use hardware firewall to protect the nodes from attacks to reduce the overhead of the node from managing all the traffic through its firewall (as you can assume, the node firewall has to manage all the traffic from/to the VPSs, which is really going to affect the performance if it hosts a number of busy VPSs) Disabling any unnecessary service in the main node (mail service, printer service..etc)and disabling direct root access will be sufficient in most cases.

  • I abandonned the OpenVZ solution to install all services one physical server because I got a performance problem with OpenVZ. So I really don't need the answer for this question. However I give the bounty to SparX for the word "tricky". It's not only difficult for security but also for dimensionning. – jcisio Jan 31 '12 at 20:24

Keeping your HN's system up to date and correctly configuring its firewalling rules should suffice. I recommend using Shorewall instead of bare iptables because it's so much easier to read (and hence easier to keep well configured). There's specific documentation for configuring Shorewall when OpenVZ is present.

Also remember to configure sshd in order to authenticate only through private keys and not with passwords. If you must use passwords, it'd better be good. If you have iLO or similar, tighten it up too.


If using the standard venet automatic ip assigment of OpenVZ distributions (as proxmox) you need separate CSF / firewalls on host and virtual machines. This is, depending on your hosting or network config your venet IPs assigned to VMs are not necesarilly be protected. We use Proxmox PVE and install separate CSF on host and each VM with a public IP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.