首页 > 安全 > 系统安全 >

PHP服务器安全怎么配置?这是最好的PHP服务器安全配置

2017-03-31

PHP服务器安全怎么配置?这是最好的PHP服务器安全配置。

PHP服务器安全怎么配置?这是最好的PHP服务器安全配置。

1) Upgrade Apache/PHP, MySQL, OpenSSH, OpenSSL cP/WHM etc

Quote:

Update your Apache/PHP, MySQL, OpenSSH, OpenSSL, cP/WHM... and be sure that you running the latest secured version.

2) cP/WHM Configuration

Quote:

WHM - Server setup - Tweak Security:

-------------------------------------

Enable php open_basedir protection

Enable mod_userdir protection

Disable Compilers for all accounts(except root)

Enable Shell Bomb/memory Protection

WHM - Account Functions:

-------------------------

Disable cPanel Demo Mode

Disable shell access for all accounts(except root)

WHM - Service Configuration - FTP Configuration:

-------------------------------------------------

Disable anonymous FTP access

WHM - MySQL:

-------------

Set some MySQL password(Don't set the same password like for the root access)

-If you don't set MySQL password and if someone upload shell(E.G c99) on some site on server he will be able to login into db with username "root" without password

and delete/edit/download any db on that server

WHM - Server Setup:

--------------------

Go to Server Setup and enable suEXEC and PHPsuEXEC

When PHP runs as an Apache Module it executes as the user/group of the webserver which is usually "nobody" or "apache".

PHPsuEXEC changes this so scripts are run as a CGI. Than means scripts are executed as the user that created them.

With PHPsuEXEC script permissions can't be set to 777(read/write/execute at user/group/world level)

3) SSH Access

Quote:

Change SSH port(set something like 1334)

You can change it in /etc/ssh/sshd_conf

There is a lot of script kiddiez with brute forcers and they will try to crack our ssh pass because they know username is root, port is 22

But we are smarter, we changed SSH port :)

Also, their "brute forcing" can reduce server load, that means our sites(hosted on that server) will be slower

SSH Legal Message

edit /etc/motd, write in motd something like that:

"ALERT! That is a secured area. Your IP is logged. Administrator has been notified"

When someone login into SSH he will see that message:

ALERT! That is a secured area. Your IP is logged. Administrator has been notified

And at the end restart SSH, type "service sshd restart" into SSH

4) Mod_Security

Quote:

Mod_Security is a web application firewall and he can help us to secure our sites against RFI, LFI, XSS, SQL Injection etc

If you use cP/WHM you can easly enable Mod_security in WHM - Plugins - Enable Mod_Security and save

Now I will explain how to install Mod_security from source.

You can't install Mod_Security if you don't have libxml2 and http-devel libraries.

Also, you need to enable mod_unique_id in apache modules, but don't worry, I will explain how to do it :)

Login into SSH and type...

----------------------------------------------------

yum install libxml2 libxml2-devel httpd-devel

----------------------------------------------------

libxml2 libxml2-devel httpd-devel should be installed now

then you need to edit httpd.conf file, you can find it here:

/etc/httpd/conf/httpd.conf

You need to add this in your httpd.conf file

LoadModule unique_id_module modules/mod_unique_id.so

Now download the latest version of mod_security for apache2 from http://www.modsecurity.org

login into SSH and type...

-----------------------------------------------------------------------------

cd /root/downloads

wget http://www.modsecurity.org/download/...e_2.1.7.tar.gz

tar zxf modsecurity-apache_2.1.7.tar.gz

cd modsecurity-apache_2.1.7

cd apache2

------------------------------------------------------------------------------

Now we need to edit Makefile, file is located here:

/root/download/modsecurity-apache_2.1.7/apache2/

change "top_dir =" with "top_dir = /usr/lib/httpd"

then type:

-------------------

make

make install

-------------------

---------------------------------------------------------

# /etc/httpd/conf/httpd.conf

LoadModule unique_id_module modules/mod_unique_id.so

LoadFile /usr/lib/libxml2.so

LoadModule security2_module modules/mod_security2.so

Include /etc/httpd/conf/modsecurity.conf

---------------------------------------------------------

go at the end of httpd.conf and place an include for our config/rules file...

Include /etc/httpd/conf/modsecurity.conf

Content of /etc/httpd/conf/modsecurity.conf

------------------------------------------------------------------------------------------------------------------------

# Only inspect dynamic requests

# (YOU MUST TEST TO MAKE SURE IT WORKS AS EXPECTED)

SecFilterEngine DynamicOnly

# Reject requests with status 403

SecFilterDefaultAction "deny,log,status:403"

# Some sane defaults

SecFilterScanPOST On

SecFilterCheckURLEncoding On

SecFilterCheckCookieFormat On

SecFilterCheckUnicodeEncoding Off

# Accept almost all byte values

SecFilterForceByteRange 1 255

# Server masking is optional

# SecServerSignature "Microsoft-IIS/5.0"

SecUploadDir /tmp

SecUploadKeepFiles Off

# Only record the interesting stuff

SecAuditEngine RelevantOnly

SecAuditLog logs/audit_log

# You normally won't need debug logging

SecFilterDebugLevel 0

SecFilterDebugLog logs/modsec_debug_log

# Only accept request encodings we know how to handle

# we exclude GET requests from this because some (automated)

# clients supply "text/html" as Content-Type

SecFilterSelective REQUEST_METHOD "!^GET$" chain

SecFilterSelective HTTP_Content-Type "!(^$|^application/x-www-form-urlencoded$|^multipart/form-data)"

# Require Content-Length to be provided with

# every POST request

SecFilterSelective REQUEST_METHOD "^POST$" chain

SecFilterSelective HTTP_Content-Length "^$"

# Don't accept transfer encodings we know we don't handle

# (and you don't need it anyway)

SecFilterSelective HTTP_Transfer-Encoding "!^$"

# WEB-ATTACKS /bin/sh command attempt

SecFilter "/bin/sh"

# WEB-ATTACKS ps command attempt

SecFilterSelective THE_REQUEST "/bin/ps"

# WEB-ATTACKS /bin/ps command attempt

相关文章
最新文章
热点推荐