Security Suggestions - How to make your server more secure

Question

Server Security is critical to keep your server, websites, and other data secure. New methods of attacks and hacks are popping up almost every day, so it is critically important to keep your servers safe and updated. Keeping your server up to date will make the servers more resistant to attacks, hacks, and other threats.

Answer

While there is no way to protect your server from all security issues 100% of the time, we have the following links that should help minimize your risk:

• Tips To Make Your Server More Secure
• Recommended Security Settings
• Basic Security Concepts
• Additional Security Software
• How To Prevent Email Abuse
• How To Secure SSH

Some basics (these are all mentioned in the links above as well):

1. Strong Passwords: Keep strong and lengthy alphanumeric passwords with multiple characters.
2. Keep SSH Secure: It is essential to keep SSH secure to prevent attacks through it.
   • Always update the SSH packages to the latest stable version provided by your operating system vendor.
   • Another means to secure SSH is to set up a Wheel User, which will only allow you to log in to the server as the desired user. Direct root login should not be permitted.
3. Enable cPHulk Brute Force Protection - cPHulk is a commonly used tool to protect the server from Brute Force attacks.
4. Disable compiler access to users other than root.
5. Harden /tmp and /var/tmp by running the securetmp script
   • How to secure your /tmp partition
6. Enable the system firewall - Setting up a firewall is very important in security because it denies all the unwanted connections to the server.
   • A third-party tool to manage firewall rules is available from ConfigServer, "ConfigServer Security & Firewall" (CSF)
7. Upgrade from ImunifyAV to an anti-virus with active protection.
   • Imunify360 offers proactive anti-virus protection and web access filtering.
   • ClamAV is an alternative anti-virus plugin available for cPanel.
8. Disable Recursion in PowerDNS (or BIND)
9. Keep FTP disabled, or at least disable Anonymous FTP & Logins with root
10. Last but not least, keep your server operating system packages, kernel, and all 3rd party software updated regularly.
    • Ensure automatic updates are enabled.
    • Ensure automatic updates are being installed.
    • Regularly ensure all packages are up to date by manually running "dnf update", "yum update", or "apt update && apt upgrade" depending on your operating system. 
    • Do not disable updates, and don't forget to update all software--including your websites and their plugins!