ServerBuddies Support Blog

Managing System Policies in Plesk Panel

System policies define what to do with all incoming, outgoing and transit communications that do not match the explicitly defined rules. The system policies are usually displayed at the bottom of the list of rules.

To allow or deny communications of specific type:

Go to Modules > Firewall > Edit Firewall Configuration.

Click the icon to the left of the policy name you want to change. If the policy currently allows all connections, clicking this icon will prohibit all connections and vice versa.

To apply the changes, click Activate, and then click Activate again.

Source : http://parallels.com/Plesk/

Managing Access to System Services in Plesk

For each system service, you can choose whether to allow or deny all incoming communications, or allow only communications coming from specific IP/network addresses.

To allow or restrict access to a service on your Parallels Plesk Panel server:

1. Go to Modules > Firewall > Edit Firewall Configuration.
2. Click the service name.
3. Do any of the following:
* To allow all incoming connections, select the Allow option and click OK.
* To deny all incoming connections, select the Deny option and click OK.
* To deny access to a service from specific IP/network addresses, select the Allow from selected sources, deny from others option, specify the IP address or network address from which access to the selected service is allowed, and click Add. After you specify the required addresses, click OK.
4. To apply all changes to the firewall configuration, click Activate, and then click Activate again.

Source : http://parallels.com/

Protecting System Settings in Apache

To run a really tight ship, you’ll want to stop users from setting up .htaccess files which can override security features you’ve configured. Here’s one way to do it.

In the server configuration.

This prevents the use of .htaccess files in all directories apart from those specifically enabled.

Optimizing the EXT3 file system on Linux

There are some things you can do to give ext3 a boost when you just want speed.

Mount Options noatime,nodiratime

noatime
Do not update inode access times on this file system (e.g, for faster access on the news spool to speed up news servers).

nodiratime
Do not update directory inode access times on this filesystem.

This is one of the quickest and easiest performance gains. This mount option tells the system not to update inode access times. This is a good option for web servers, news servers or other uses with high access file systems

Also from the man pages.

commit=nrsec
Sync all data and metadata every nrsec seconds. The default value is 5 seconds. Zero means default.

OSSEC Open Source Host-based Intrusion Detection System.

OSSEC is an Open Source Host-based Intrusion Detection System. It performs log analysis, integrity checking, Windows registry monitoring, rootkit detection, real-time alerting and active response. It runs on most operating systems, including Linux, OpenBSD, FreeBSD, MacOS, Solaris and Windows. A list with all supported platforms is available http://www.ossec.net/main/supported-systems

If you have one system to monitor, you can install the OSSEC HIDS locally on that box and do everything from there.

However, if you are administering a few systems, you can select one to be your OSSEC server and the others to be OSSEC agents, forwarding events to the server for analysis. One of the greatest benefits of the OSSEC HIDS is its scalability, allowing you to monitor multiple systems from a central point.

The best option is to select one of your machines to be the OSSEC server and perform the “server” installation on it. Then, choose the “agent” installation for the others.

Your IDS and rootkit rules will be just in one box, making it much easier to administer and configure.

Please make sure that you understand the type of installation you are choosing (manager, agent, local, etc) and are also aware of the order (always install the manager first).

Extract the compressed package and run the “./install.sh” script (It will guide you through the installation).

Remember to open the port 1514 (UDP) if there is a firewall between the server and the agents (if you didn’t choose the local installation).

Start the OSSEC HIDS.