PHP服务器安全怎么配置？这是最好的PHP服务器安全配置
PHP服务器安全怎么配置？这是最好的PHP服务器安全配置。
1) Upgrade Apache/PHP, MySQL, OpenSSH, OpenSSL cP/WHM etc
Quote:
Update your Apache/PHP, MySQL, OpenSSH, OpenSSL, cP/WHM... and be sure that you running the latest secured version.
2) cP/WHM Configuration
Quote:
WHM - Server setup - Tweak Security:
-------------------------------------
Enable php open_basedir protection
Enable mod_userdir protection
Disable Compilers for all accounts(except root)
Enable Shell Bomb/memory Protection
WHM - Account Functions:
-------------------------
Disable cPanel Demo Mode
Disable shell access for all accounts(except root)
WHM - Service Configuration - FTP Configuration:
-------------------------------------------------
Disable anonymous FTP access
WHM - MySQL:
-------------
Set some MySQL password(Don't set the same password like for the root access)
-If you don't set MySQL password and if someone upload shell(E.G c99) on some site on server he will be able to login into db with username "root" without password
and delete/edit/download any db on that server
WHM - Server Setup:
--------------------
Go to Server Setup and enable suEXEC and PHPsuEXEC
When PHP runs as an Apache Module it executes as the user/group of the webserver which is usually "nobody" or "apache".
PHPsuEXEC changes this so scripts are run as a CGI. Than means scripts are executed as the user that created them.
With PHPsuEXEC script permissions can't be set to 777(read/write/execute at user/group/world level)
3) SSH Access
Quote:
Change SSH port(set something like 1334)
You can change it in /etc/ssh/sshd_conf
There is a lot of script kiddiez with brute forcers and they will try to crack our ssh pass because they know username is root, port is 22
But we are smarter, we changed SSH port :)
Also, their "brute forcing" can reduce server load, that means our sites(hosted on that server) will be slower
SSH Legal Message
edit /etc/motd, write in motd something like that:
"ALERT! That is a secured area. Your IP is logged. Administrator has been notified"
When someone login into SSH he will see that message:
ALERT! That is a secured area. Your IP is logged. Administrator has been notified
And at the end restart SSH, type "service sshd restart" into SSH
4) Mod_Security
Quote:
Mod_Security is a web application firewall and he can help us to secure our sites against RFI, LFI, XSS, SQL Injection etc
If you use cP/WHM you can easly enable Mod_security in WHM - Plugins - Enable Mod_Security and save
Now I will explain how to install Mod_security from source.
You can't install Mod_Security if you don't have libxml2 and http-devel libraries.
Also, you need to enable mod_unique_id in apache modules, but don't worry, I will explain how to do it :)
Login into SSH and type...
----------------------------------------------------
yum install libxml2 libxml2-devel httpd-devel
----------------------------------------------------
libxml2 libxml2-devel httpd-devel should be installed now
then you need to edit httpd.conf file, you can find it here:
/etc/httpd/conf/httpd.conf
You need to add this in your httpd.conf file
LoadModule unique_id_module modules/mod_unique_id.so
Now download the latest version of mod_security for apache2 from http://www.modsecurity.org
login into SSH and type...
-----------------------------------------------------------------------------
cd /root/downloads
wget http://www.modsecurity.org/download/...e_2.1.7.tar.gz
tar zxf modsecurity-apache_2.1.7.tar.gz
cd modsecurity-apache_2.1.7
cd apache2
------------------------------------------------------------------------------
Now we need to edit Makefile, file is located here:
/root/download/modsecurity-apache_2.1.7/apache2/
change "top_dir =" with "top_dir = /usr/lib/httpd"
then type:
-------------------
make
make install
-------------------
---------------------------------------------------------
# /etc/httpd/conf/httpd.conf
LoadModule unique_id_module modules/mod_unique_id.so
LoadFile /usr/lib/libxml2.so
LoadModule security2_module modules/mod_security2.so
Include /etc/httpd/conf/modsecurity.conf
---------------------------------------------------------
go at the end of httpd.conf and place an include for our config/rules file...
Include /etc/httpd/conf/modsecurity.conf
Content of /etc/httpd/conf/modsecurity.conf
------------------------------------------------------------------------------------------------------------------------
# Only inspect dynamic requests
# (YOU MUST TEST TO MAKE SURE IT WORKS AS EXPECTED)
SecFilterEngine DynamicOnly
# Reject requests with status 403
SecFilterDefaultAction "deny,log,status:403"
# Some sane defaults
SecFilterScanPOST On
SecFilterCheckURLEncoding On
SecFilterCheckCookieFormat On
SecFilterCheckUnicodeEncoding Off
# Accept almost all byte values
SecFilterForceByteRange 1 255
# Server masking is optional
# SecServerSignature "Microsoft-IIS/5.0"
SecUploadDir /tmp
SecUploadKeepFiles Off
# Only record the interesting stuff
SecAuditEngine RelevantOnly
SecAuditLog logs/audit_log
# You normally won't need debug logging
SecFilterDebugLevel 0
SecFilterDebugLog logs/modsec_debug_log
# Only accept request encodings we know how to handle
# we exclude GET requests from this because some (automated)
# clients supply "text/html" as Content-Type
SecFilterSelective REQUEST_METHOD "!^GET$" chain
SecFilterSelective HTTP_Content-Type "!(^$|^application/x-www-form-urlencoded$|^multipart/form-data)"
# Require Content-Length to be provided with
# every POST request
SecFilterSelective REQUEST_METHOD "^POST$" chain
SecFilterSelective HTTP_Content-Length "^$"
# Don't accept transfer encodings we know we don't handle
# (and you don't need it anyway)
SecFilterSelective HTTP_Transfer-Encoding "!^$"
# WEB-ATTACKS /bin/sh command attempt
SecFilter "/bin/sh"
# WEB-ATTACKS ps command attempt
SecFilterSelective THE_REQUEST "/bin/ps"
# WEB-ATTACKS /bin/ps command attempt
