Hardening the linux server or cenos 5/6.2

nano -w /etc/fstab 

At the very bottom add 
/usr/tmpMnt /tmp ext3 loop,noexec,nosuid,rw 0 0

nano -w /etc/fstab
change “defaults” to loop,noexec,nosuid,rw
mount /tmp

rm -rf /var/tmp
ln -s /tmp /var/tmp

If a symlink is not possible, then /var/tmp is most likely also a partition. In this case, /var/tmp must be hardened with loop,noexec,nosuid,rw in fstab as well.

IF /tmp is hardened by cpanel’s /scripts/securetmp. Remove the line from /etc/rc.d/rc.local and then reboot. It will come back without a /tmp partition and then you can follow the instructions above

SSH Server Hardening
———————
nano -w /etc/ssh/sshd_config
Uncomment #Protocol 2, 1
Change to Protocol 2

Append these lines to the bottom:
LoginGraceTime 120 
IgnoreRhosts yes 
X11Forwarding no 

nano -w /etc/group
Search for wheel, then append “anyuserxxx” 
So it should be “root,anyuserXXX”

nano -w /etc/ssh/sshd_config

PermitRootLogin no (and uncomment)

At the bottom add
AllowUsers anyuserXXX

ChkRootKit
————–
cd /root/
wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz
mv chkrootkit.tar.gz /usr/local/src/
cd /usr/local/src/
tar -zxf chkrootkit.tar.gz
cd /usr/local/src/chkrootkit*
make sense
cd /root
mv /usr/local/src/chkrootkit* /usr/local/chkrootkit

cd /etc/cron.weekly

Code: Select all

#!/bin/bash
EMAIL=your@domain.com
/usr/local/chkrootkit/chkrootkit -q | mail -s “ChrootKit Scan Report – $(hostname)” $EMAIL
chmod 755 /etc/cron.weekly/chkrootkit.sh

RkHunter
————
cd /root
wget http://space.dl.sourceforge.net/project/rkhunter/rkhunter/1.3.8/rkhunter-1.3.8.tar.gz
wget http://space.dl.sourceforge.net/project/rkhunter/rkhunter/1.3.8/rkhunter-1.3.8.tar.gz
tar -zxf rkhunter-1.3.4.tar.gz
cd rkhunter*
./installer.sh –layout default –install

cd /etc/cron.weekly

Code: Select all
#!/bin/bash
EMAIL=your@domain.com
rkhunter  -c –sk –summary -q |  mail -s “Rkhunter Scan Report – $(hostname)” $EMAIL