Disabling Dangerous PHP Functions in a Shared Environment
PHP is an incredibly versatile language and if used in the wrong way, either maliciously or by accident has the potential to mess up an entire webserver. This can be a major problem if you are offering a shared hosting environment.
There is an often overlooked php.ini setting called disable_functions at hand.
tcptrack
tcptrack is a sniffer which displays information about TCP connections it sees on a network interface. It passively watches for connections on the network interface, keeps track of their state and displays a list of connections in a manner similar to the unix 'top' command. It displays source and destination addresses and ports, connection state, idle time and superbly impressive - bandwidth usage.
A server admin must have.
cPanel Apache Tuning
One of the first things I do is run /scripts/easyapache and rebuild my PHP / Apache configuration.
I usually select Apache 2.2 and PHP 5.2.9. At the time of writing I stay away from the 5.3 versions as they aren't supported by programs and programmers enough yet.
Although this guide was originally inspired from a cPanel install, its Apache specific and doesn't require cPanel.
SSH Authentication with Pageant for extra laziness
So you've read Key-Based SSH Logins With PuTTY but can't be bothered typing in your private key passphrase each time? No problem, pageant can solve that - it can remember stuff so you don't have to
Key-Based SSH Logins With PuTTY
Following on from the previous SSH security ramblings, one of the most secure methods of security is public/private key-based authentication.
g up key based SSH logins for two reasons;
- They are more secure. You aren't prompted for a password which could be brute forced or sniffed via man in the middle attacks for example
- We're lazy. We don't want to type username/password combinations into each server.
SSH Security Ramblings
SSH - Secure Shell isn't that secure. If you're not using it behind a Layer 7 firewall or an enhanced security daemon like cPanel's cPHulk or even just the default config isn't secure.
What can you do?
About Kieran
