Linux Security

change SSH port number

1. modify sshd_config 

vi /etc/ssh/sshd_config

a. change the port number

b. protocol must be 2

2. restart the ssh service

install ModSecurity

1. install modsecurity: yum install mod_security

2. restart httpd service: service httpd restart

install firewall 

1. download the firwall: wget http://www.configserver.com/free/csf.tgz

2. uncompress: tar -xzf csf.tgz

3. install csf:

cd csf

./csftest.pl

./install.sh

4. change configure file /etc/csf/csf.conf

TESTING ="0"

DoS Attack

1. install httpd-devel: yum install httpd-devel

2. change configure: vi /etc/httpd/conf/httpd.conf

LoadModule evasive20_module /usr/lib/httpd/modules/mod_evasive20.so

<IfModule mod_evasive20.c>
    DOSHashTableSize 3097
    DOSPageCount 6
    DOSSiteCount 100
    DOSPageInterval 2
    DOSSiteInterval 2
    DOSBlockingPeriod 600
    DOSEmailNotify <someone@somewhere.com>
</IfModule>

https://www.linode.com/docs/websites/apache-tips-and-tricks/modevasive-on-apache

3. restart httpd service: service httpd restart

Cookie Protection

1. change configuration: vi /etc/sysctl.conf

net.ipv4.tcp_syncookies = 1

2. restart service: service network restart

AntiVirus

1. install antivirus: 

yum install clamav

freshclam

2. scan home folder: clamscan -r /home

IPTABLES Setting

单个IP的命令是 
iptables -I INPUT -s 124.115.0.199 -j DROP 

封IP段的命令是 
iptables -I INPUT -s 124.115.0.0/16 -j DROP 

封整个段的命令是 
iptables -I INPUT -s 194.42.0.0/8 -j DROP 

封几个段的命令是 
iptables -I INPUT -s 61.37.80.0/24 -j DROP 
iptables -I INPUT -s 61.37.81.0/24 -j DROP 

刚才不小心搞的自己都连不上了-_-!!! 
iptables -I INPUT -p tcp –dport 80 -s 124.115.0.0/24 -j DROP 
以后用这种只封80端口就行了，不会出问题! 

iptables -I INPUT -p tcp –dport 80 -s 124.115.0.0/24 -j DROP 

iptables -I INPUT -s 61.37.81.0/24 -j DROP 

解封 
iptables -F 

Pasted from: <http://www.jb51.net/article/25252.htm>

Pasted from: <https://www.linode.com/docs/websites/apache-tips-and-tricks/modevasive-on-apache>