ServerBuddies Support Blog

Security Checks During Server Compromise

We can use some techniques and tools to investigate our server if we suspect they’ve been compromised.

Compromised as a result of various factors: weak passwords, weak iptables rules, older versions of software with known exploits, and more.

Below command helps you check for any “backdoors” which have been opened on your server.

Sniff for any connections to a particular port using tcpdump

This will capture all the packets with destination port 3128.

To list all the open IP sockets associated with your SSH server run the following command:

lsof can be used to display all his running processes for a particular user.

More example can be found in the man pages for lsof.

BIND Security

BIND supports a number of different methods to protect the updating and transfer of zones, on both master and slave nameservers:

DNSSEC — Short for DNS SECurity, this feature allows for zones to be cryptographically signed with a zone key.
In this way, the information about a specific zone can be verified as coming from a nameserver that has signed it with a particular private key, as long as the recipient has that nameserver’s public key.

BINDversion 9 also supports the SIG(0) public/private key method of message authentication.

TSIG — Short for Transaction SIGnatures, a shared secret key exists on the master and slave server, verifying that a transfer from master to slave is authorized.
This feature strengthens the standard IP address-based method of transfer authorization. An attacker would not only need to have access to the IP address to transfer the zone, but they would also need to know the secret key.

BINDversion 9 also support TKEY, which is another shared secret key method of authorizing zone transfers.

Apache Security Tips - Permissions on ServerRoot Directories

In typical operation, Apache is started by the root user, and it switches to the user defined by the User directive to serve hits. As is the case with any command that root executes, you must take care that it is protected from modification by non-root users. Not only must the files themselves be writeable only by root, but so must the directories, and parents of all directories. For example, if you choose to place ServerRoot in /usr/local/apache then it is suggested that you create that directory as root, with commands like these:

It is assumed that /, /usr, and /usr/local are only modifiable by root. When you install the httpd executable, you should ensure that it is similarly protected:

You can create an htdocs subdirectory which is modifiable by other users — since root never executes any files out of there, and shouldn’t be creating files in there.

SSH Security On cPanel Servers.

1. Change SSH port number.

Edit your ssh configuration file under /etc/ssh/sshd_config and add/replace this line:

2. Allow only the IP’s that you would like to have access to SSH through your firewall.

3. Use a utility like BFD, BlockHosts and DenyHosts

4. Use iptables to limit the rate of incoming connections to SSH.

This will limit incoming connections to port 22 to no more than 3 attempts in a minute. Any more will be dropped.

How to get info about threads and security

To get info about threads:

To get security info: