How to Increase Your Bare Metal Server Security

Server security is vitally important for businesses to avoid exposing sensitive data and protecting themselves against viruses. HostDime’s bare metal servers undergo a rigorous security check before and during deployment to give clients peace of mind. You can check out our extensive security audit in detail below.

But first, there are additional ways to beef up your server’s security, whether you are a HostDime client or not. Perform these steps to reduce your server’s risk of attack:

 

How to Increase Your Bare Metal Server Security

1. Change the SSH (Secure Shell) Listen Port on the server to a port different than 22. This prevents automated brute-force attacks from even beginning to guess usernames and passwords on the server.

2. Use only TLS (Transport Layer Security) protected interfaces for server administration. TLS encrypts the traffic between your server and your computer. This prevents hackers from capturing login information so they can execute an attack. Our servers offer TLS-protected access, but it may not be on by default.

3. Use only trusted networks and computers to administer your server.

4. Ensure all systems used to administer the server are free from malware, as malware gives attackers access information for your server’s admin interfaces as it is used, even if it’s sent encrypted over the network.

5. Always keep an eye out for the latest fixes and releases for all active scripts. Monitor the developers whose scripts you are running to be aware of patches and other tweaked releases.

And now, on to HostDime’s own server security audit.

 

HostDime’s Bare Metal Server Security Audit

Point 1: Check kernel version. The Linux kernel is the core system program of all Linux systems. HostDime’s talented technicians always check your kernel version to make sure there are zero exploitable vulnerabilities. If any kernel vulnerabilities are discovered, the update process will happen immediately and HostDime will contact you to schedule a reboot.

 

Point 2: Check PHP settings. There are several PHP settings that we advise be disabled on servers that do not require them:

“allow_url_fopen”: This setting allows PHP to treat any URL as if it were a file. This poses a security risk for certain PHP applications that incorrectly sanitize “include” and “fopen” statements.

“allow_url_include”: Almost no PHP applications require “allow_url_include” be enabled. Therefore it is recommended that “allow_url_include” always be disabled. Once “allow_url_include” is disabled, users can enable “allow_url_fopen” if needed.

“register_globals”: This setting allows global PHP variables to be set at runtime through a URL. Having it enabled could allow attackers to modify arbitrary PHP variables. This can lead to SQL injections, arbitrary code execution, and other exploits for vulnerable PHP applications. Therefore the normal recommendation is that “register_globals” be disabled.

In addition to these three PHP settings, the technicians also recommend that other vulnerable PHP functions be disabled. In doing so, the effectiveness of PHP shells and other PHP-based malware is reduced. The list of functions generally recommended that users disable are the following:

dl, exec, shell_exec, system, passthru, popen, pclose, proc_open, proc_nice, proc_terminate, proc_get_status, proc_close, pfsockopen, leak, apache_child_terminate, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid

 

Point 3: Check Apache mod_security ruleset. Apache mod_security is a software firewall which scans incoming HTTP requests for known exploits. HostDime maintains an internal ruleset for many known exploits and always checks to ensure that the latest ruleset is installed on a server prior to deployment. To ensure your server is always using the latest ruleset, HostDime can configure your server to update the ruleset every day.

 

Point 4: Check CSF/LFD configuration. CSF/LFD is a software firewall suite that supports automated brute force detection and prevention, process tracking, SYN flood protection, and a wide range of other automated security features. By default, HostDime installs and configures CSF/LFD on all standard Linux servers.

 

Point 5: Check system binaries. HostDime runs a full web server security audit on the binary package versions, such as BIND, apache, and udev, to ensure everything is up-to-date and not vulnerable to any known exploits.

 

Point 6: Configuration partition mounting options. HostDime changes configuration on partitions to lessen risk of filesystem-based attacks and to reduce I/O overhead.

 

Point 7: Disable typically unneeded services. HostDime disables services not commonly used to ensure the security of the server.

 

Point 8: Deploy initial security-focused configurations. HostDime deploys initial security-focused configurations for MySQL, Exim, cPanel, Plesk, FTP, SSH, and PHP.

 

Point 9: Install RKHunter. RKhunter is a program designed to scan your server for known rootkits and detected modified system binaries. We install RKHunter and initialize its state database.

 

Point 10: Install BusyBox. HostDime installs Unix tools file BusyBox, “The Swiss Army Knife of Embedded Linux”.

 

Good luck out there. As always, for any questions you may have, hit us up on chat.