New Zealand Linux

Okay, so every monkey and his dog can do PHP these days, hey that what it was written for.

So if i was looking to perhaps hack a server, one of the first things i would look for is the version of php running on the server. This can be found out very easily if you enable the version to be added to the server string. You can hide this with the config option
expose_php = Off

Here are a few quick, handy php config defaults
; Who needs to download off remote sites seriously?

allow_url_fopen = Off
;this can help stop a few sql injection methods

magic_quotes_gpc = On
; By not allowing these few functions we can stop a fair bit of nasty stuff going on, not just from end users but by the users writing the code. You may wish to add mail() into this also

disable_functions = proc_open , popen, disk_free_space, diskfreespace, set_time_limit, leak, tmpfile, exec, system, shell_exec, passthru
safe_mode = On
; By default, Safe Mode does a UID compare check when

; opening files. If you want to relax this to a GID compare,

; then turn on safe_mode_gid. This stops users messing with others stuff

safe_mode_gid = Off
; This is handy if you want to be able to execute SOME binaries but not others from PHP

safe_mode_exec_dir = /some/safe/binary/folder
Okay, that covers most of the basics, now for apache PHP end.
For each website that has a VirtualHost you should add in lines similar to this
php_admin_value open_basedir /var/www/debian.co.nz:/var/www/debian.co.nz/tmp

php_admin_value doc_root /var/www/debian.co.nz:/var/www/debian.co.nz/tmp
What this does is limits users from opening anything outside of their own directories (you really dont want them being able to open stuff in /etc etc)

Last-Modified: 2007-04-05 22:00:08

First and formost, ask yourself if you really need to run ssh on an external IP. If not then in the ssh config you can bind it to your internal LAN easily enough 🙂
You can do this in the sshd_config file using something like …

ListenAddress 192.168.1.1

Another thing you probably want is to not allow root logins.

PermitRootLogin no

If you happen to want external access and have dns or something setup, it sometimes pays to run it on a different port to stop a lot of bots that go around trying default user/password combos. This can be annoying when connecting in, particularly if you have multiple users, but its worth its weight in gold in stopping automated attacks.

Port 2200

There are many more options in the ssh config that you may wish to try out, im not going to go into each and every one of them.

Here are some other ideas which may be fun to test/try

Firewall rules can help limit the amount of times they connect within a set time with something like this.

 iptables -A INPUT -i eth0 -p tcp --dport ssh -m state --state NEW \
-m recent --set --name recentssh
iptables -A INPUT -i eth0 -p tcp --dport ssh -m state --state NEW \
-m recent --name recentssh --update --seconds 120 --hitcount 4 -j DROP
iptables -A INPUT -j ACCEPT -i eth0 -p tcp --destination-port ssh

This allows them 4 counts within 120 seconds.

Ed: Some people have had issues with this due to a bug in debian/kernel/ip_recent and sent in this change

 iptable -A INPUT  -i eth0 -p tcp --dport 22 -m state --state NEW \
-m limit --limit 3/min --limit-burst 3 -j ACCEPT
iptable -A INPUT  -i eth0 -p tcp --dport 22 -m state \
--state ESTABLISHED -j ACCEPT
iptable -A OUTPUT -o eth0 -p tcp --sport 22 -m state
--state ESTABLISHED -j ACCEPT

Last-Modified: 2007-04-05 21:41:24