

CLICK HERE TO SHOP
Photography by Jenn Hoffman, Makeup by Leslie Rodriguez |
OpenSSH
and Mail Server
when installing Ubuntu Server 12.04 LTS
.sudo apt-get update
sudo apt-get upgrade
sudo apt-get dist-upgrade
sudo apt-get install php5-cgi php5 php5-cli php5-mysql php5-curl php5-gd php5-intl php-pear php5-imagick php5-imap php5-mcrypt php5-memcache php5-ming php5-ps php5-pspell php5-recode php5-snmp php5-sqlite php5-tidy php5-xmlrpc php5-xsl php5-xcache php5-suhosin php5-ffmpeg apache2-utils php5-fpm
gpg --keyserver hkp://keys.gnupg.net --recv-keys 1C4CBDCDCD2EFD2A
gpg -a --export CD2EFD2A | sudo apt-key add -
sudo nano /etc/apt/source.list.d/percona.list
deb http://repo.percona.com/apt precise main
deb-src http://repo.percona.com/apt precise main
sudo apt-get update
sudo apt-get install percona-server-server-5.5 percona-server-client-5.5
sudo apt-get install libc6-dev libssl-dev dpkg-dev debhelper fakeroot libxml2-dev libxslt1-dev
wget http://www.cmake.org/files/v2.8/cmake-2.8.10.2.tar.gz
tar -xvzf cmake-2.8.10.2.tar.gz
cd cmake-2.8.10.2
./configure
make
sudo make install
wget http://www.hiawatha-webserver.org/files/hiawatha-8.8.tar.gz
tar -xzvf hiawatha-8.8.tar.gz
cd hiawatha-8.8/extra
./make_debian_package
cd ..
sudo dpkg -i hiawatha_8.8_amd64.deb
sudo dpkg -i hiawatha_8.8_i386.deb
sudo nano /etc/php5/cgi/php.ini
cgi.rfc2616_headers = 1
zlib.output_compression = On
zlib.output_compression_level = 6
display_errors = Off
log_errors = On
allow_url_fopen = Off
safe_mode = On
expose_php = Off
enable_dl = Off
session.cookie_httponly = 1
disable_functions = system, show_source, symlink, exec, dl, shell_exec, passthru, phpinfo, escapeshellarg, escapeshellcmd
cgi.fix_pathinfo = 0
safe_mode = off
sudo nano /etc/php5/fpm/php-fpm.conf
[www]
user = www-data
group = www-data
listen = 127.0.0.1:9000
pm = static
pm.max_children = 100
chroot = /var/www/
chdir = /
sudo nano /etc/hiawatha/hiawatha.conf
ServerId
at GENERAL SETTINGS
.ServerId = www-data
BINDING SETTINGS
.Binding {
Port = 80
# Interface = 127.0.0.1
MaxKeepAlive = 30
TimeForRequest = 3,20
}
GENERAL SETTINGS
. ConnectionsTotal = 1000
ConnectionsPerIP = 30
SystemLogfile = /var/log/hiawatha/system.log
GarbageLogfile = /var/log/hiawatha/garbage.log
ExploitLogfile = /var/log/hiawatha/exploit.log
LogFormat = extended
ServerString = Apache
CGIwrapper = /usr/sbin/cgi-wrapper
BANNING SETTINGS
. BanOnGarbage = 300
BanOnMaxPerIP = 300
BanOnMaxReqSize = 300
BanOnTimeout = 300
KickOnBan = yes
RebanDuringBan = yes
BanOnDeniedBody = 300
BanOnSQLi = 300
BanOnFlooding = 30/1:300
BanlistMask = deny 192.168.0.0/24, deny 127.0.0.1
BanOnInvalidURL = 300
ReconnectDelay = 3
#Reverse Proxy
HideProxy = 127.0.0.1
MaxServerLoad = 0.8
COMMON GATEWAY INTERFACE (CGI) SETTINGS
should be looking like this.CGIhandler = /usr/bin/perl:pl
CGIhandler = /usr/bin/php5-cgi:php
CGIhandler = /usr/bin/python:py
CGIhandler = /usr/bin/ruby:rb
CGIhandler = /usr/bin/ssi-cgi:shtml
CGIextension = cgi
FastCGIserver {
FastCGIid = PHP5
ConnectTo = 127.0.0.1:9000
Extension = php, php5
SessionTimeout = 30
}
VIRTUAL HOSTS
.Include /etc/hiawatha/enable-sites/
enable-sites
and disable-sites
under /etc/hiawatha
.sudo mkdir /etc/hiawatha/enable-sites
sudo mkdir /etc/hiawatha/disable-sites
mysite.com
and place it under /etc/hiawatha/enable-sites/mysite.com
.DenyBot
" entries when you want the search engines to find your site easily.PreventSQLi
" is set to "yes
" when your web application is vulnerable to SQL Injection and you cannot fix it at the moment.mysite.com
" to /etc/hiawatha/disable-sites/
and then restart hiawatha server.sudo mv /etc/hiawatha/enable-sites/mysite.com /etc/hiawatha/disable-sites/
sudo /etc/init.d/hiawatha restart
sudo nano /etc/hiawatha/cgi-wrapper.conf
CGIhandler = /usr/bin/perl
CGIhandler = /usr/bin/php5-cgi
CGIhandler = /usr/bin/python
CGIhandler = /usr/bin/ruby
CGIhandler = /usr/bin/ssi-cgi
Wrap = jail_mysite ; /var/www/mysite ; www-data:www-data
sudo apt-get install apparmor-profiles apparmor-utils
sudo aa-genprof hiawatha
sudo aa-logprof
sudo nano /etc/apparmor.d/usr.sbin.hiawatha
usr.sbin.hiawatha
should look like this or make it look like this.sudo aa-enforce hiawatha
sudo apparmor_parser -r < /etc/apparmor.d/usr.sbin.hiawatha
sudo ln -s /etc/apparmor.d/usr.sbin.hiawatha /etc/apparmor.d/disable/
sudo apparmor_parser -R < /etc/apparmor.d/usr.sbin.hiawatha
sudo rm /etc/apparmor.d/disable/usr.sbin.hiawatha
sudo apparmor_parser -r < /etc/apparmor.d/usr.sbin.hiawatha
sudo apt-get install libcap2-bin
sudo chmod u-s /usr/sbin/cgi-wrapper
sudo setcap cap_setgid,cap_setuid+ep /usr/sbin/cgi-wrapper
sudo getcap /usr/sbin/cgi-wrapper
/usr/sbin/cgi-wrapper = cap_setgid,cap_setuid+ep
cd /var/log/hiawatha
sudo chown www-data:www-data access.log
sudo chown www-data:www-data error.log
sudo chown www-data:www-data exploit.log
sudo chown www-data:www-data garbage.log
sudo chown root:root system.log
php-fcgi.log
" and "system.log
" leave them untouched (root:root).cd /var/www/mysite
sudo chown -R root:root *
sudo /etc/init.d/hiawatha start
sudo /etc/init.d/hiawatha stop
suod /etc/init.d/hiawatha restart
500 Internal Server Error
", you may consider to make the Apparmor to "Complain mode
".sudo aa-complain hiawatha
Enforce mode
".sudo aa-logprof
sudo aa-enforce hiawatha
usr.sbin.hiawatha
may not 100% work for you.sudo apt-get install knockd
sudo apt-get install ufw
sudo apt-get update
sudo apt-get install apache2-utils libapache-mod-security libapache2-mod-evasive
sudo cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf
sudo nano /etc/apache2/conf.d/security
ServerTokens
" to "Full
".sudo cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf
sudo nano /etc/modsecurity/modsecurity.conf
SecServerSignature SamiuxHTTP
sudo mkdir /var/log/mod_evasive
sudo chown www-data:www-data /var/log/mod_evasive/
sudo nano /etc/apache2/sites-enabled/000-default
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]
DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 60
DOSLogDir /var/log/mod_evasive
DOSEmailNotify samiux@gmail.com
DOSWhitelist 127.0.0.1
sudo nano /etc/modsecurity/modsecurity.conf
SecRuleEngine DetectionOnly
SecRuleEngine On
cd /etc/modsecurity
sudo mkdir activated_rules
sudo wget http://downloads.sourceforge.net/project/mod-security/modsecurity-crs/0-CURRENT/modsecurity-crs_2.2.5.tar.gz
sudo tar -zxvf modsecurity-crs_2.2.5.tar.gz
cd modsecurity-crs_2.2.5
sudo cp modsecurity_crs_10_setup.conf.example /etc/modsecurity/modsecurity_crs_10_setup.conf
cd /etc/modsecurity/modsecurity-crs_2.2.5/base_rules
for f in * ; do sudo ln -s /etc/modsecurity/modsecurity-crs_2.2.5/base_rules/$f /etc/modsecurity/activated_rules/$f ; done
cd /etc/modsecurity/modsecurity-crs_2.2.5/optional_rules
for f in * ; do sudo ln -s /etc/modsecurity/modsecurity-crs_2.2.5/optional_rules/$f /etc/modsecurity/activated_rules/$f ; done
sudo nano /etc/apache2/mods-available/mod-security.conf
Include "/etc/modsecurity/activated_rules/*.conf"
sudo a2enmod mod-security
sudo a2enmod mod-evasive
sudo a2enmod headers
sudo /etc/init.d/apache2 restart