Tips and Tutorial for cPanel Server Security
Overview
This tutorial provides several tips to enhance the security of your cPanel & WHM installation.
Warning!!
Exercise extreme caution when following these tips. the author or blendhosting.com takes no responsibility to individual servers or the security practices mentioned in this guide. Each server is a collection of compromises which means that any server that allows connections could be insecure.Employ Strong Passwords
Insecure passwords represent a common security vulnerability. Compromised account passwords can lead to defacement, hacking, and the theft of valuable data from client sites.
It is imperative to change your password regularly. Here are additional tips for creating a secure password:
- Passwords should be alphanumeric and grammatical.
- Passwords should consist of 10 or more characters.
- Avoid using the same password for multiple sites.
- Refrain from allowing your browser to store your passwords.
- Avoid incorporating names of family members, birthdates, or personally significant numbers.
- Avoid using any dictionary words in your password.
- Consider generating a random password; some password generator sites, such as passwordsgenerator.net[1], provide options to generate passwords with special characters.
Employ safe SSH keys
Transfer SSH to an Other Port
Attempt to move your SSH to a different port to deter individuals without specific knowledge of your server from easily discovering your SSH port. Most visitors typically search on port 22, which is the default SSH port.
Always use ports below 1024, as these are privileged ports accessible only to root. Any port above 1024 can be used by anyone.
To move your SSH to a different port, log in to your server command line as root and open ‘sshd_config‘.
nano /etc/ssh/sshd_config
Discard and adapt:
Port 22
to
Port 102
then restart sshd:
service sshd restart
For instance, we have set port 102 as the default SSH port instead of 22.
Note: It is crucial to allow the new port in the server firewall. Ensure not to close the current SSH connection while testing the new port to avoid any unintended disruptions.
Activate the CPHulk Brute Force Defence
cPHulk is a service designed to safeguard your server from brute force attacks, a hacking method that employs an automated system to guess passwords for your web server or services.
When cPHulk blocks an attack, it displays ‘login is invalid‘ on the login page. To prevent being locked out of your own server, add your IP address to the whitelist.
You can access cPHulk through WHM > Security Center section > cPHulk Brute Force Protection.
Disable any unused daemons and services
Any service or daemon that permits connections to your server may pose a security risk by providing potential entry points for hackers. To mitigate these risks, disable all services and daemons that are not essential.
You can disable unused services in WHM’s Service Manager interface(Home >> Service Configuration >> Service Manager).
Protect your Apache
The most accessible means of accessing a web server is through the web server application itself. Securing your Apache installation is paramount.
One of the most effective tools to prevent malicious use of Apache is ModSecurity™.
In cPanel & WHM version 11.46 and later, you can utilize the following interfaces to manage ModSecurity:
- WHM’s ModSecurity™ Tools interface (Home >> Security Center >> ModSecurity™ Tools).
- WHM’s ModSecurity™ Configuration interface (Home >> Security Center >> ModSecurity™ Configuration).
CSF Installation Guide
cd /usr/src
rm -fv csf.tgz
wget https://download.configserver.com/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh
Next, confirm that you have the necessary iptables modules:
perl /usr/local/csf/bin/csftest.pl
Login to your WHM, and you will now find a CSF configuration page in the Plugins section. To configure CSF, you can follow the steps outlined in the tutorial “Installing and Configuring CSF on CentOS 7[2].”
Fortify the /tmp partition
We recommend using a separate /tmp partition mounted with the nosuid option. This option compels a process to run with the privileges of its executor. After installing cPanel & WHM, you may also choose to mount the /tmp directory with noexec for additional security.
You must perform the following in order to mount your /tmp partition to a temporary file for added security:
/scripts/securetmp
Note: Ensure that there is sufficient disk space for the partitions. It is recommended to have a minimum of 8GB for /usr and 16GB for /var. Anything below the recommended disk space may lead to issues later on. You can refer to the cPanel Advanced Partitioning Guide[3] for more information.
Turn off the system compilers
Many users do not require the use of C and C++ compilers. It is strongly recommended to disable compilers for all users who are not in the compilers group in the /etc/group file. Many pre-packaged exploits rely on functional compilers.
To disable compilers from the WHM interface, use WHM’s Compiler Access interface (Home >> Security Center >> Compiler Access).
Use the following command as the root user to stop compilers from the command line:
/scripts/compilers off
[1]: https://passwordsgenerator.net/
[2]: https://www.blendhosting.com/kb/install-and-set-up-the-centos-7-64-bit-csf-configserver-firewall/
[3]: https://confluence2.cpanel.net/display/1142Docs/Installation+Guide+-+Advanced+Partitions