{"id":55517,"date":"2020-04-24T12:24:55","date_gmt":"2020-04-24T17:24:55","guid":{"rendered":"https:\/\/blog.cpanel.com\/?p=55517"},"modified":"2020-04-24T12:24:55","modified_gmt":"2020-04-24T17:24:55","slug":"advanced-server-security","status":"publish","type":"post","link":"https:\/\/devel.www.cpanel.net\/blog\/products\/advanced-server-security\/","title":{"rendered":"Securing Your cPanel: Advanced Server Security"},"content":{"rendered":"\n
As you learned in our I<\/a>ntro to Server Security,<\/a> securing your server is one of the most important things you need to do when you’re setting up and maintaining your cPanel server. We’re building on the knowledge presented in the introduction to provide more advanced tips for server security. <\/p>\n\n\n\n In this article, you’ll learn more in-depth techniques and best practices for safeguarding your site, server, and account from hackers. We’ll cover security topics like: <\/p>\n\n\n\n Aside from the Security Advisor, there are some manual steps each sysadmin should take to keep their server safe from attacks. Some of these are settings that can be disabled once, and others require regular monitoring. One of the first places to start is our knowledge base article about Recommended Security Settings<\/a>. Pay special attention to the “Tweak Settings Checklist” as it has a lot of significant beginning steps. These additional suggestions provided below will help you set up a secure environment. <\/p>\n\n\n\n Enabling Configure Security Policy<\/a> allows you to limit who can log in to only verified IP addresses. In this area, you can also add Two-factor authentication using Google Authenticator, and change the settings for Password Strength and Password Age. You can also set it up when creating a new account to disable shell access or use VirtFS Jailed Shell<\/a> by visiting the Manage Shell Access<\/a> interface.<\/p>\n\n\n\n Most users don’t require access to a C or C++ compiler. We recommend that you disable compilers for users that don’t belong to the compilers group under \/etc\/group in your server’s settings. Without a functional compiler, most pre-packaged exploits can’t run. <\/p>\n\n\n\n \/scripts\/compilers off<\/p>\n\n\n\n A computer firewall is either a hardware device or a software program that is configured to inspect all the data traffic that is received by the firewall before it enters the server or network. It uses a set of predefined rules to determine whether the data it should be allowed to pass or be blocked. <\/p>\n\n\n\n cPanel does not come with a firewall provided, but adding a firewall to your server will prohibit malicious elements from accessing your system. There are several 3rd party firewalls we recommend<\/a>, and we provide documentation about how to configure your firewall for your cPanel. <\/a> Here is a brief list of some 3rd party firewalls you might use. <\/p>\n\n\n\n It’s important to note that if a firewall is incorrectly configured, it can block desired traffic. If you set up a firewall and suddenly find that you can’t access parts of your website, you should go back and look further into your firewall configuration. <\/p>\n\n\n\n When you have daemons or services that enable connections to your server that are redundant or not being actively used, there’s a risk of attracting hackers who will abuse those connections. The more services<\/em> that are running on your server, the more opportunities there are for others to use them, break into or take control of your system through them. Examine your system to see what programs are redundant or unused. To improve your server’s security, deactivate all daemons and services that you don’t require. You can do this in the Service Manager<\/a> interface. (WHM >> Home >> Service Configuration). <\/p>\n\n\n\n One of the most important ways to protect your server is to keep an eye on it yourself. Track the number of user accounts created. Subscribe to the cPanel Mailing List <\/a>to be notified of critical updates and keep your server updated. Stay aware of what software is installed so you can keep 3rd party applications updated, too. In our documentation, we’ve compiled a list of additional security software<\/a> that we recommend for helping you to monitor your system. <\/p>\n\n\n\n cPanel offers some other tips to make your server more secure.<\/a> These include Logwatch<\/a>, which is a customizable log analysis system that parses through your system’s logs and creates a report analyzing areas that you specify, and chrootkit<\/a>. This tool checks locally for signs of a rootkit on your server. <\/p>\n\n\n\nSteps to Secure Your Server<\/strong><\/h2>\n\n\n\n
Restrict System Compilers<\/strong><\/h2>\n\n\n\n
Start Using a Firewall<\/strong><\/h2>\n\n\n\n
Disable Redundant Daemons and Services<\/strong><\/h2>\n\n\n\n
Actively Monitor Your System<\/strong><\/h2>\n\n\n\n
ModSecurity in WHM<\/strong><\/h2>\n\n\n\n