Settings for best security

Howdy,

Well, Linux distributions, nor Virtualmin, ships settings that are considered to be insecure by default.

Outside of that, the questions "how to improve security" and "what might impair security" are topics for very large books :-)

If you had anything in particular you were hoping to try, feel free to ask and we can discuss whether it's a security problem :-)

-Eric

I couldn't have expressed it better than Eric. To "books", you might add "myriads of websites" and "highly paid firms offering security audits". ;)

For starters, to get an inherently secure system, it's recommended to use a Grade-A supported OS, installing no packages besides SSH, and using the Virtualmin installer script to get your web hosting software in place. Virtualmin configures the services, as securely as you can get without being an employee at one of the aforementioned firms. :)

Most security issues come from buggy or incorrectly configured web software, and not from the services itself.

this one is excellent guide

http://blog.pclewis.com/2010/01/the-dangers-of-shared-hosting/

They try of course. But a good example is VM 3.97 which fixed major security issues a few days ago that have existed in Virtualmin for a long time ;-)

For optimum security it is always a good idea to go through some security/hardening check lists :-)

Unless you have only one site on your system, I guess. If you need more than one site, then probably Virtualization offers the best protection (I use OpenVZ). However there is some overhead.

Hi,

A few items which rank high on my list of security measures include, "firewall hardening", "disabling FTP (and other services not used) in favour of SFTP", "disabling password authentication for root", and installing a good "intrusion detection system".

We have been using OSSEC for our primary OS-level intrusion detection system for a few years now, and it has saved us sleepless nights because of it's highly customizable ruleset, and the proactive measures it takes against hackers and other malicious activity. OSSEC also if configured will send out an email to you including all items which may be a security threat, or that you should know about including login attempts, file changes, etc.

When you consider what OSSEC and similar software does, it makes administrating lots of machines less of a headache, and increases uptime by pointing out threats, and taking proactive measures.

Hope this information helps!

-Peter

Oh right, security software. I personally use the following on my hosting systems:

CSF/LFD

Watches, among lots of other things, logs for login failures and blocks the offending IP via iptables. Also watches for modified system files, can detect port floods, use blacklists to block known hacker nets, limit connection count per source IP, and other stuff.

LOGCHECK

Scan configurable log files and reports all lines it doesn't know (configurable via regular expressions, comes with a pre-made set of rules) via email

LMD

Linux Malware Detect, a malware scanner specifically for bad web software. Uses the ClamAV engine for scanning.

Yepperz, I took a look at the OSSEC website, and it sounds quite nice. :)

Mmh, might it be possible to take a look at a live installation of OSSEC? I like to test new stuff, but before I replace my whole LFD/Logwatch setup with something new, I'd really like to see if it does anything better than what I'm using now. :) Unfortunately, OSSEC does not seem to have a demo installation, and not even screenshots.

Remote graphics access on an Internet-facing server: No go. :)

My suggestion would be: First, turn off "root login with password" in SSH. Set it to "with RSA key only". That will prevent brute force attacks on the root account, because no brute force attack in this world can work out an RSA key (of sufficient length).

In Virtualmin, you'd still use the root user and their regular password (make it securely long). Brute-force attacks on Webmin are very rare, since it's by far not as widespread as SSH.

If you want extra security, set up a VPN (OpenVPN suggested) and open port 22 and 10000 only for VPN connections.

To mitigate the brute force of Virtualmin using the root user, you could make sure you tighten the host blocking options:

Webmin > Webmin Configuration > Authentication

I would leave "Block users with more than" and "Lock users with failed logins" otherwise you might get locked out of root access as I am not aware of any white listing option. Perhaps turn up the time a host is blocked for invalid login attempts? You could also change the port that is used to access Virtualmin but that isn't really security (in my opinion, security through obscurity doesn't do much except slow down a determined attacker).

Just my opinion :)

Related documentation

• http://docs.virtualmin.com/Webmin/SSH_Server#Restricting_access_to_the_S...
• http://docs.virtualmin.com/Webmin/SSH_Server#Network_Configuration
• http://docs.virtualmin.com/Webmin/SSH_Server#Authentication_configuration

This is what I do after a clean virtualmin install on a minimal OS install:

1.Disable root login by SSH, instead I use a regular user to login and then "su" for root. I guess you could also use keys.

2.Enable the iptables firewall in webmin to only allow the hosting ports.

3.Install & configure fail2ban, enable it not only for SSH, but PAM, postfix, proftpd, dovecot, perhaps others, in more recent versions there will be a Webmin jail too so you can use that out of the box.

4. Create a Virtual Server with a domain and make sure SSL is enabled as a feature.

5. Get the Let's Crypt Certificates in "manage SSl" through virtualmin server management. This has the benefit of enabling SSL in those applications..

BUT I always change the protocols and ciphers to something along the lines of: https://cipherli.st/

So that only TLS 1.2 is used.

I think Virtualmin actually enables postfix for ssl v3. Which is insecure.

You can then add HSTS to Apache. (careful though that auto renewal works for the certs and that you are not using self-signed).

You then get the A+ rating on Qualys.

Then you can always run stuff like Nessus & Netsparker to scan for anything you might have missed of known vulnerabilities.

Netsparker can scan your webapps for problems in php and so on.