Server Hardware Specifications

As the base of our shared hosting services, eUKhost relies on the latest energy efficient chassis and mainboard combinations from Dell as these high performance configurations have proven to offer the reliability that we deem as necessary to meet our 99.95% uptime guarantee. The latest multi-core Intel Xeon processors provide the processing power; along with DDR3 memory, you can be assured that a stable hosting experience is guaranteed. Our client data is hosted on either SAS- or SATA-based hard drives that have been placed in RAID arrays to reduce read/write times and to improve reliability to reduce the potential for data loss to occur.

The specifications of a regular server used as part of the eUKhost shared hosting infrastructure consist of:

• Dual Intel Xeon X5660 Hexa Core CPUs
• 96GB DDR3 RAM
• 2 x SAS-based hard drives for the operating system, in RAID 1 for additional reliability
• 4 x 500GB SATA-based hard drives for client data, in RAID 10 for added performance and reliability.

eUKhost Network Design

Our network is based around two locations in the UK: a Tier 4 data centre Maidenhead hosts a majority of our client data on a 100Gbps network, with a disaster recovery site located in Milton Keynes hosting backups of all eUKhost's servers for disaster recovery and business continuity reasons.

Simply Transit provide us with a fully redundant BGP network that is redundant at hardware level as well as at network level because we utilise two different hardware vendors for this purpose. Our Level 2 network consists of two10 Gigabit networks, supplied by Extreme Networks and Foundry Networks, provide additional connectivity.

Our level two network is the base for two independent IP Transit networks (AS29550 and AS34920); these are hosted on multiple Cisco 7606-S RSP720 and 6509 SUP720 routers that are based at multiple locations in London to introduce an additional level of redundancy to the network design.

Our connections to multiple Tier 1 providers along with the London Internet Exchange (LINX) places as the only web hosting provider able to offer IP services that are inclusive of London.

Linux reseller Server Security Recommendations

1) Apache suEXEC

It is known as a more secure management for PHP and also allows us to track and monitor client usage on reseller servers so that PHP scripts are correctly identified by their true owner as opposed to "nobody" user.According to Apache HTTP Server Version 1.3, Suexec: "provides Apache users the ability to run CGI and SSI programs under user IDs different from the user ID of the calling web-server. Normally, when a CGI or SSI program executes, it runs as the same user who is running the web server. "For detailed information about Suexec, go to:
http://httpd.apache.org/docs/1.3/suexec.html

2) PHP SUPHP

Php, without PhpSuexec, runs as an Apache Module, executes as the user/group of a web server, in this case "nobody". This causes real problems when php scripts are sending mail out as nobody@servername and we are unable to track abuse or hijack issues.When PhpSuExec is enabled (running as CGI with suexec enabled) your Php scripts execute under your UID/GID level and not nobody/nobody. Files or directories that you require your Php scripts to write to no longer need to have 777 permissions. In fact, having 777 permissions on your scripts or the directories they reside in will not run and will instead cause a 500 internal server error when attempting to execute them. Your scripts and directories can have a maximum of 755 permissions (read/write/execute by you, read/execute by everyone else). That said, PhpSuExec is much more secure than Php running as a Apache module.

3) Mod Security

mod_security supplies an array of request filtering and other security features to the Apache HTTP Server.ModSecurity is an open source intrusion detection and prevention engine for web applications. Operating as an Apache Web server module, the purpose of ModSecurity is to increase web application security, protecting web applications from known and unknown attacks.

4) PHP Security - Suhosin

Suhosin is an advanced protection system for PHP installations. It was designed to protect servers and users from known and unknown flaws in PHP applications and the PHP core. Suhosin comes in two independent parts, that can be used separately or in combination. The first part is a small patch against the PHP core, that implements a few low-level protections against bufferoverflows or format string vulnerabilities and the second part is a powerful PHP extension that implements all the other protections.

5) Disable PHP Dangerous Functions

We will disable some php functions through which shell commands can be executed to manipulate server side settings. The functions are: system,passthru, exec, popen, proc_close, proc_get_status, proc_nice,proc_open, proc_terminate,shell_exec, escapeshellcmd, define_syslog_variables, posix_uname,posix_getpwuid, apache_child_terminate, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid,escapeshellarg,posix_uname,ftp_exec,ftp_connect,ftp_login,ftp_get,ftp_put,ftp_nb_fput,ftp_raw,ftp_rawlist, ini_alter,ini_restore, inject_code, syslog,openlog, define_syslog_variables ,apache_setenv, mysql_pconnect, eval, phpAds_XmlRpc, phpAds_remoteInfo, phpAds_xmlrpcEncode, phpAds_xmlrpcDecode, xmlrpc_entity_decode,fp, fput

6) Disable Ftp access for the default users:

We will disable Ftp access for all the default users of your accounts. You will have to create additional Ftp user for all the accounts from their respective cPanel >> Ftp Accounts option through which you can manage the complete account.

7) Use secure passwords!

Insecure passwords are the most common security vulnerability for most servers. If an account password is insecure and is compromised, client sites can be defaced, infected, or used to spread viruses. Having secure passwords is paramount to having a secure server. You can edit /etc/login.defs to configure many password options on your system. It is well documented.

Generally, a password utilizing at least 8 characters including alphanumeric and grammatical symbols is sufficient. Never use passwords based upon dictionary words or significant dates. If you are uncertain about the security of a password, then you can test it using JTR cracker. If a password can be broken in a few hours, then it is probably too insecure and should not be used. You can also install tools like pam_passwdqc to check the strength of passwords.

8) Secure SSH

Enable public key authentication for SSH and disable password authentication read more >>
Move SSH access to a different port. People are looking for port 22 as a possible way to access your servers. Moving SSH to a different port will add a simple way to deter those without specific knowledge of your server from easily discovering your SSH port.

You can modify the port that SSH runs on within /etc/ssh/sshd_config. Change the line that says #Port 22 to a different port such as: Port 1653. Make sure to keep your current SSH session open when testing the new port so you can change back to port 22 if the new port doesn't work.

You should always use SSHv2 only as SSHv1 is not secure. Make sure to change the line in /etc/ssh/sshd_config that says #Protocol 2,1 to Protocol 2.

You may also wish to set Shell Resource Limits for you users to prevent applications and scripts from using all up your resources and taking down your server. You can configure shell resource limits in /etc/security/limits.conf on most Linux systems.

9) Secure your /tmp partition

We recommend that you use a separate partition for /tmp that is mounted with nosetuid. Nosetuid will force a process to run with the privileges of it's executor. You may also wish to mount /tmp with noexec after installing cPanel. Check the mount man page for more information.
Also, Running /scripts/securetmp will mount your /tmp partition to a temporary file for extra security.

10) Upgrade your mail to maildir format

Maildir format adds extra security and speed to your mail system. Newer installs use maildir by default. If you're running an older copy of cPanel, you'll probably want to upgrade using /scripts/convert2maildir. Make sure to back up your current mail before converting to maildir, this can be done within /scripts/convert2maildir. If you see maildir is enabled when running /scripts/convert2maildir, you are already using maildir, and will not need to convert.

11) Lock down your system's compilers

Most users do not require the use of C and C++ compilers. You can use the Compilers Tweak within Tweak Security in WebHost Manager to turn off use of the compilers for all unprivileged users, or to disable them for specific users only. Many pre-packaged exploits require working compilers. Disabling compilers will help protect against many exploits.

12) Turn off unused services and daemons

Any service or daemon that allows a connection to be established to your server is away for hackers to gain access. To reduce security risks, you should disable all services and daemons that are not being used.

For Daemons on Linux:

Check /etc/xinetd.conf for services you are not using. For example, cupsd (printing daemon) and nfs/statd (network file system daemons) are not used on many systems.

For Services:

Go to the Service Manager in the Service Configuration section of WHM and disable any services that you are not using.

13) Monitor your system

It is important to be up to date on what is going on with your system. Make sure that you know when accounts are being created, what software is being installed, when software needs updates, etc.

Check your system frequently to ensure it is functioning in the way you expect. Make sure to check things like:

netstat -anp : Look for programs attached to ports that you did not install / authorize
find / \( -perm -a+w \) ! -type l >> world_writable.txt : Look at world_writable.txt to see all world writable files and directories. This will reveal locations where an attacker can store files on your system. NOTE: Fixing permissions on some PHP/CGI scripts that are not properly coded will break them.

find / -nouser -o -nogroup >> no_owner.txt : Look at no_owner for all files that do not have a user or group associated with them. All files should be owned by a specific user or group to restrict access to them.

ls /var/log/: There are many different logs on your system which can be valuable resources. Check your system logs, apache logs, mail logs, and other logs frequently to make sure your system is functioning as expected.

There are many readily available utilities to monitor your system and to detect rootkits, backdoors, etc. Here are some commonly available utilities:

• Tripwire - Monitors checksums of files and reports changes. http://tripwire.com or http://sourceforge.net/projects/tripwire
• Chrookit - Scans for common rootkits, backdoors, etc. http://www.chkrootkit.org
• Rkhunter - Scans for common rootkits, backdoors, etc. http://www.rootkit.nl/projects/rootkit_hunter.html
• Logwatch - Monitors and reports on daily system activity. http://logwatch.org

14) Install & Configure Software Firewall (CSF)

Installing a firewall to limit access to your server is useful. Removing all unused software on your system is more useful. Before you have the chance to remove all unused services and daemons, or the chance to figure out which services / daemons are unused, you can enable a firewall to prevent unwanted access.

15) Install & Configure Malware Detect Software and ClamV Scanner

Linux Malware Detect (LMD) is a malware scanner for Linux released under the GNU GPLv2 license, that is designed around the threats faced in reseller hosted environments. It uses threat data from network edge intrusion detection systems to extract malware that is actively being used in attacks and generates signatures for detection. In addition, threat data is also derived from user submissions with the LMD checkout feature and from malware community resources. The signatures that LMD uses are MD5 file hashes and HEX pattern matches, they are also easily exported to any number of detection tools such as ClamAV.

The driving force behind LMD is that there is currently limited availability of open source/restriction free tools for Linux systems that focus on malware detection and more important that get it right. Many of the AV products that perform malware detection on Linux have a very poor track record of detecting threats, especially those targeted at reseller hosted environments.

16) Stay up to date

It is important to make sure that you are running the latest stable versions of the software on your system to ensure that it has been patched of any security issues that past versions may be susceptible to. Make sure to keep on top of updates for:

• Kernel
• cPanel and WHM*
• User Applications (bulletin boards, CMS, blog engines, etc)**
• System Software*

17) FTP Upload Scanner

Pure-FTP has an option to run a file after an upload, called the pure-uploadscript. What you do, is tie the virus scanner into this script, so that when a file gets uploaded, it will get scanned. As long as we have your virus scanner up to date, this will pick up most of the main stream virus, as well as the dreaded php shell scripts. If our scanner detects a user uploading malicious files, it automatically move the file in trash folder

18) Web Upload Scanner

ModSecurity is capable of intercepting files uploaded through POST requests and multipart/form-data encoding or through PUT requests. Whenever the file upload using php/cgi/perl script , ModSecurity does send scan request to malware detection script, malware detection scan it and send result back to mod security. If it found virus or malicious script it doesn't allow to upload the file.

Addons (paid)

Our web hosting plans come with a wide array of optional add-ons that you can purchase to complement your hosting account. Simply sign up for a hosting plan and choose an addon of your choice at the time of order or get in touch with our Sales Department to order one for you.