10 Important Steps to Secure Server

Sometimes it is possible that your server is compromised, but the actions made by attacker do not affect your server functionality, so you may never find that your machine was compromised.

So, is good from time to time to check your server security, to see if any strange activities/processes are in your system.

Following are the ways to secure your server:-

1) Use a Firewall

Make absolutely sure that your server has a firewall running all the time. A firewall is like a screen door to your porch. It blocks out flies, rodents and other pests but you can still walk out and use your BBQ. If someone ever were to get into your server, which is very very likely, the first thing they're going to try and do is upload something to start a daemon or their own service like an IRC server or use a port to launch attacks to other systems. A firewall with egress and ingress protection can stop both incoming and outgoing attacks even when you're not aware of it. We recommend using APF on Linux systems or TinyFirewall on Windows Servers. These are software firewalls so there's no extra monthly cost like a hardware firewall. For very busy systems a hardware firewall is recommended so it takes the burden off your system CPU/RAM and resources to do the work.

2) Update your kernel and OS

Make sure your server is using current, updated software. Use the stable version which has been tested more than any beta and update as soon as possible. An old kernel can lead to an easy target for your server. If you're not sure then ask your provider for the latest update.

3) Monitor Logs

Do you know what logs record which activities? How often are they updated and rotated? LogWatch is a great tool to email you the daily reports of your systems activity of anything it determines unusual, EG repeated failed logins. Besides using this you should check your logs manually to see what’s up. Tail –f /var/log/messages and view your Apache logs as well. Apache Log Files Explained

4) Backups

I still never understand why no one backs up their data yet you spend hundreds of hours working on your website or application then you absolutely must have a second hard drive for backups or use a remote back up system or a combination of these. Second Hard Drive Means Life or Death

5) Limit Access to a Minimum

Do not give users more access than the absolute minimum they require. Never give them shell access, restrict file access to a bare minimum and leave other services turned off by default until specifically requested and you determine that its safe to do so.

6) Lock down PHP and use Mod_Security with Apache

PHP is actually a large security risk but there are a few things to do to help lock it down. CGI has Suexec,which helps runs proccesess as the user and PHP has something similar called PHPSuexec but there are a few downfalls. You should also use open_base directory protection, have safe_mode on system wide, turn off register_globals, enable_dl and allow_url_open to help lock things down further.

You can use server wide protection with mod_security, a web server filter that can watch all requests to see if they match a rule and react by logging, denying the request or other programs. I highly recommend this on Apache based servers and can be extremely useful in blocking attacks and stopping hackers before they do any damage. Securing Safe Mode , Installing Mod_Security

7) Lock /tmp /var/tmp and /dev/shm partitions

On Linux each partition can have certain access restrictions. Since /tmp /var/tmp and /dev/shm are world writable directories they’re often home to uploads, sessions storage and hacker executables. Since anyone can read-write-excute anything from these directories it becomes a major security concern. With /etc/fstab however you can limit what can be done in these locations. If you see defaults beside the /tmp line remove it and replace it with noexec,nosuid this will stop any executables from being allowed to run. Do the same for /dev/shm and make /var/tmp and shortcut (symbolic link) to /tmp. Securing Your TMP Partition

8) Intrusion Detection System (IDS)

An intrusion detection system or IDS is like a burglar alarm on your server. It keeps a record of which files were changed when and alerts you of anything new or altered. This is critical because hackers usually try to replace binary applications like ps, top, netstat and others. This means when you run this new version of ps or top to see processes running they make it so it actually HIDES their hacker software, even though its running it won’t show up. Some IDS systems include TripWire, Snort and AIDE. Installing Chkrootkit

9) Review Processes Running and Remove Extra Software

You can’t protect a system if you don’t know what’s on it. If a hacker adds an extra process that you see in PS but you wouldn’t notice if you didn’t know what should be there usually. Know what runs on your system and why which user. How does Perl or Apache run, under which user? You can check your processes usually with top or ps auxfww which gives you a tree view. Check these every time you login to your server. Getting started with Shell (SSH) , Common Shell Commands

10) Keep an Eye on the Servers Performance

Know what speed your server is running at and how much bandwidth it uses on a daily basis. If an attacker compromises your system and you don’t know you’ll probably notice the system responding slowly or using a lot of bandwidth. If you don’t know what your system is usually like how will you notice something out of the ordinary.

Via: webhostgear.com/314.html

Securing Windows 2003 Server System

If your server is running Windows 2003 Server Edition, you need to make a few changes to help keep your server and client machines safe. This page is written with the assumption that you're a system administrator running an on-campus server; some of the following resources may not be available from off campus.

Essentials

• Keep your system and software up to date:
• This is one of the easiest, most effective things you can do to keep your computer secure. You can either update manually with Windows Update, or configure your systems to download updates automatically from the campus WSUS server, which provides critical Microsoft patches from an on-campus location. You can choose whether the WSUS server prompts you to confirm installations or whether patches are automatically installed.
• Install antivirus software:
• The vast majority of viruses are designed to affect Windows systems. The University of Illinois at Urbana-Champaign provides free site-licensed antivirus software that is configured to automatically update itself and protect your system.
• If you are a campus system administrator, you can also use ePolicy Orchestrator to coordinate distributing antivirus updates from your server to the client machines that you supervise. More information about ePolicy Orchestrator is available from the CITES Security Services Archive and requires Bluestem authentication to identify yourself as a campus system or network administrator. The list is maintained through Contact Manager. If you need to be added to the list of people authorized for access to the archive, but aren't listed in Contact Manager, contact securitysupport@uiuc.edu.
• Install anti-spyware software:
• Many of the nuisance-level problems afflicting Windows computers are caused by spyware rather than viruses. Spyware can cause effects ranging from a noticeable slowing of your computer to pop-ups and hijacked web browsers; spyware can also be malicious, reporting personal information from credit cards to passwords to other unauthorized websites. Fortunately, the campus has site-licensed anti-spyware software for students, faculty, and staff. For more information, see the CITES Anti-spyware pages.
• Install Service Pack 1 (SP1) and the Security Configuration Wizard (SCW):
• Microsoft's Service Pack 1 offers several security enhancements and tools for Windows 2003 Server administrators. The two most significant enhancements are the inclusion of a server firewall and the Security Configuration Wizard (which must be installed after Service Pack 1). To install SCW after installing Service Pack 1, go to Add or Remove Programs -> Add/Remove Windows Components and select the Security Configuration Wizard check box. After this, the Security Configuration Wizard will be available in the Administrative Tools section of the Control Panel.
• The Security Configuration Wizard provides a centralized way to check your server's security, to make changes as required (including managing the firewall), and to roll back changes if anything doesn't behave as expected. The graphical user interface allows you to administer one server, and a command line option (scw.exe) allows you to create group policy objects which can be used on many computers.
• Use "Manage Your Server" to enable only the services you need
• Windows 2003 Server introduces a more secure method of controlling access to your server. By default, all of the potential server services are turned off until you enable them. The "Manage Your Server" tool, found in Programs -> Administrative Tools, provides a central location to track which services are enabled. It provides roles for your server -- for example, a DNS server role, a web server role, an email server role -- and allows you to decide how many of these roles are enabled.
• Use both campus firewall and server firewall protection:
• A properly configured server firewall can be very effective in reducing the amount of network traffic that is allowed to reach your server and systems connected to it. With the release of Windows Server 2003's Service Pack 1 (described above), you can enable and administer a firewall on your server with a few clicks. You can also take advantage of campus firewall protection by joining your server to one of the available firewall groups; see Campus Firewalls for more information.
• Choose a good password:
• Any computer that will have multiple users or be attached to a network needs to have good password protection for each user. Password tips and advice can be found in the CITES Guide to Passwords.

In many versions of Windows, a user name can have a blank password, which allows anyone to log in to the computer simply by clicking. Make sure that all user accounts on the machine have passwords to protect access to your computer.

Source:cites.illinois.edu/security/by_os/win2k3srv.html

McAfee Announces Comprehensive Virtualised Server Security Suite

Virtualisation gives organizations the ability to consolidate servers to share physical resources including processors, memory, and disk space. Companies are quickly adopting virtualisation to increase infrastructure utilisation, reduce hardware cost, improve operational efficiencies and simplify deployment.

McAfee Inc. has announced McAfee Total Protection for Virtualisation, which extends security across virtual and physical environments. McAfee provides customised protection for virtual environments including online and offline virtual machines, so that enterprises can safely benefit from the full potential of virtualisation technology.

“Over the next five years, more than half of server workloads will be virtualised, but awareness of server virtualisation risks remains low,” said Gartner Fellow and Vice President, Neil MacDonald. “Security must be incorporated into virtual systems from their inception -- not addressed later as an afterthought.”

McAfee Total Protection for Virtualisation delivers:-

• Stronger Protection - comprehensive, layered protection for all virtual machines against malware, rootkits, spyware, bots, spam, zero-day threats, vulnerabilities, data loss, data exposure, and more
• Lower Costs – single management console and automatic updates reduce time and resources required for secure virtualisation management for improved operational efficiencies
• Simplified Compliance – automated compliance reports and integration with McAfee and third-party compliance tools enable better compliance for virtual environments

McAfee Total Protection for Virtualisation is a comprehensive virtualised server security suite that includes the following core components:-

• McAfee VirusScan Enterprise and McAfee VirusScan Enterprise for Linux - continuous on-access scanning for superior protection from viruses, worms, and other malicious code
• McAfee VirusScan Enterprise for Offline Virtual Images - first and only security solution to scan, clean, and update offline virtual machines without bringing them online
• McAfee AntiSpyware Enterprise - unique on-access scanning to identify, proactively block, and safely eliminate spyware and other potentially unwanted programs
• McAfee Host Intrusion Prevention for server - combines signature and behavioral IPS protection, firewall, and application control to stop known and zero-day attacks.
• McAfee ePolicy Orchestrator - centralised management console is the only integrated security and risk management platform for both physical and virtual environments.

Total Protection for Virtualisation will be available in Q4. Pricing is per physical server host, and covers all virtual machines deployed on that server.

Source:securitypark.co.uk/security_article262060.html

Google's Send Mail Server Security Certificate Expires

It appears that Google's Gmail SMTP (send mail) server might have let their secure certificate expire. I personally just got notified that the smtp.gmail.com server was not secure, due to the certificate expiring. Here is a screen capture:-

So, it seems like it just expired just minutes ago. I asked others to confirm the issue and they said they are getting the same error.

Scott Hodge did twit about a month ago about the same issue. But this is the first time I am seeing this issue and the certificate clearly shows that it expired just minutes ago.

Postscript: A Google spokesperson told for a short time this morning, some Gmail users sending mail via POP and IMAP saw a notification on their mail clients that the SMTP certificate had expired. We identified the problem and fixed it promptly. We know how important Gmail is for our users, and we apologize for any inconvenience this may have caused.

Small Business Computer Support and Microsoft Exchange Server Support will always be provided by the Microsoft Certified Techs 24x7..

Security for windows server support services

Windows Server 2008 was launched on February 27, 2008, and to some it is just the next-generation server operating system that replaces Windows 2003, but for others it is a significant improvement to a 5-year-old operating system that will drastically improve how IT will support business and organizational initiatives for the next several years. To the authors of this book, we see the similarities that Windows 2008 has in terms of usability and common graphical user interfaces (GUIs) with previous versions of Windows Server that make it easy to jump in and start implementing the new technologies.

However, after 3 1/2 years of early adopter experience with Windows 2008, when properly implemented, the new features and technologies built in to Windows 2008 really address shortcomings of previous versions of Windows Server and truly allow IT organizations to help organizations meet their business initiatives through the implementation of key technologies now included in Windows 2008.

This chapter provides an overview of what's in Windows 2008, explains how IT professionals have leveraged the technologies to improve IT services to their organization, and acts as a guide on where to find more information on these core technology solutions in the various chapters of this book.

he various server roles in Windows 2008 typically fall into three categories, as follows:

• File and print services—As a file and print server, Windows 2008 provides the basic services leveraged by users in the storage of data and the printing of information off the network. Several improvements have been made in Windows 2008 for file security (covered in Chapter 13, "Server-Level Security") and file server fault tolerance (covered in Chapter 28, "File System Management and Fault Tolerance").
• Domain services—In enterprise environments running Windows networking, typically the organization is running Active Directory to provide centralized logon authentication. Active Directory continues to be a key component in Windows 2008 with several extensions to the basic internal forest concept of an organization to expanded federated forests that allow Active Directories to interconnect with one another. There are several chapters in Part II, "Windows Server 2008 Active Directory," that address Active Directory, federated forests, lightweight directories, and so on.
• Application services—Windows 2008 provides the basis for the installation of business applications such as Microsoft Exchange, Microsoft Office SharePoint Services, SQL Server, and so on. These applications are initially made to be compatible with Windows 2008, and later are updated to leverage and take full advantage of the new technologies built in to the Windows 2008 operating system. Some of the applications that come with Windows 2008 include Windows Terminal Services for thin client computing access (covered in Chapter 25, "Terminal Services"), Windows Media Server for video and audio hosting and broadcasting (covered in Chapter 36, "Windows Media Services"), utility server services such as DNS and DHCP (covered in Chapter 11, "DHCP/WINS/Domain Controllers," and Chapter 10, "Domain Name System and IPv6"), SharePoint document sharing and collaboration technologies (covered in Chapter 35, "Windows SharePoint Services 3.0"), and virtual server hosting (covered in Chapter 37).

This focuses on the Windows 2008 operating system and the planning, migration, security, administration, and support of the operating system. Windows 2008 is also the base network operating system on top of which all future Windows Server applications will be built.

Source: informit.com

Microsoft Home Server

The Small Business Technology blog talks about Microsoft Home Server. While this server is designed for the home, it also will work for the small business that only has a couple of computers.

Home Server fills a niche that previously was not being served. Microsoft does offer Small Business Server and while it is designed for companies with under 75 employees, it is more sophisticated than most starts up need or may need for many years.

One of the nice features in Home Server is that it will monitor the health of your pc and insure that such important items as your security software is up to date. In addition you can set it up to automatically back up files for your pc's every day so that you do not lose any important data.

Another nice feature is that you can remotely access your information. For example say you are on a business trip, you can access reports, invoices, order forms or any other data you might need without having to download everything to your mobile device or laptop.

For small start ups this may be a good tool to deal with your small network until your needs become greater.

Windows Server Security Guide

The Windows Server 2003 Security Guide provides specific recommendations about how to harden computers that run Microsoft Windows Server 2003 with Service Pack 1 (SP1) in three distinct enterprise environments—one in which older operating systems such as Windows NT 4.0 and Windows 98 must be supported, one in which Windows 2000 is the earliest version of the Windows operating system in use, and one in which concern about security is so great that significant loss of client functionality and manageability is considered an acceptable trade off to achieve maximum security. These three environments are respectively referred to as the Legacy Client (LC), Enterprise Client (EC), and Specialized Security – Limited Functionality (SSLF) environments throughout this guide.

Guidance about how to harden computers in these three environments is provided for a group of distinct server roles. The countermeasures that are described and the tools that are provided assume that each server will have a single role. If you need to combine roles for some of the servers in your environment, you can customize the security templates that are included in the download able version of the guide to create the appropriate combination of services and security options. The server roles that are referenced in this guide include the following:

	Domain controllers that also provide DNS services
	Infrastructure servers that provide WINS and DHCP services
	File servers
	Print servers
	Web servers that run Microsoft Internet Information Services (IIS)
	Internet Authentication Services (IAS) servers
	Certificate Services servers
	Bastion hosts

Significant efforts were made to make this guidance well organized and easily accessible so that you can quickly find the information that you need and determine which settings are suitable for the computers in your organization. Although this guide is intended for enterprise customers, much of the information that it contains is appropriate for organizations of any size.