Additional Security Software

Overview

This document lists third-party software and modifications that you can install to help secure your server.

APF Firewall

APF Firewall offers an advanced firewall for Linux systems. For more information about APF Firewall, visit the APF Firewall website at r-Fx Networks.

Atomicorp

Atomicop offers a hardened and secure shell for Linux servers. For more information about Atomicorp, visit the Atomicorp website.

BitNinja

BitNinja offers a security suite that provides protection against multiple forms of attack. For more information about BitNinja, visit the BitNinja website.

chkrootkit

The chkrootkit shell script examines your system’s binaries for rootkit installations. Rootkits allow a malicious user to gain undetected administrative access to the server.

To install the chkrootkit script, perform the following steps:

1. Log in to your server as the root user via SSH.

2. Run the cd /root command to change to the root directory.

3. Run the following command to download chkrootkit:

   wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz

4. Run the tar -xvzf chkrootkit.tar.gz command to decompress the downloaded file.

5. Run the cd chkrootkit-0.53 command to change directories.

6. To begin the chkrootkit installation, run the make sense command. The system will install the chkrootkit script on your server.

To run the chkrootkit script, run the following command:

/root/chkrootkit-0.53/chkrootkit

For more information about the chkrootkit script, visit the chkrootkit website.

CloudLinux

CloudLinux offers a secure version of Linux that provides advanced functionality for shared hosting environments. CloudLinux integrates with cPanel & WHM, and it provides detailed resource management tools and other improvements to system management and stability.

You can purchase CloudLinux from the cPanel store. For more information about CloudLinux, visit the CloudLinux website.

ConfigServer software

Many of our Technical Support Analysts recommend that you use CSF (ConfigServer Firewall), a free product that ConfigServer provides. CSF contains a stateful packet inspection (SPI) firewall, a login and intrusion detection mechanism, and a general security application for Linux servers.

To install CSF, perform the following steps:

1. Log in to your server as the root user via SSH.

2. Run the cd /root command to change to the root directory.

3. Run the following command to download CSF:

   wget https://download.configserver.com/csf.tgz

4. Run the tar -xzf csf.tgz command to decompress the downloaded file.

5. Run the cd csf command to change directories.

6. To begin the CSF installation, run the ./install.cpanel.sh command.

To configure CSF, use WHM’s ConfigServer Security & Firewall interface (WHM >> Home >> Plugins >> ConfigServer Security & Firewall). The installation script should enable the correct ports in CSF, but we recommend that you confirm this on your server.

After you configure CSF, you must disable testing mode. To take CSF out of testing mode, perform the following steps:

1. Click Firewall.

2. Change the value of Testing from 1 to 0.

3. Click Change.

For more information about how to use CSF, visit the CSF website.

ConfigServer eXploit Scanner

ConfigServer eXploit Scanner (CXS) scans all uploads to a server for malware, and it quarantines any suspicious files. It integrates with cPanel & WHM. For more information about CXS, visit the CXS website at ConfigServer Services.

ImunifyAV

ImunifyAV is free antivirus software that protects your server from malicious code. For more information about ImunifyAV, visit the ImunifyAV website.

ImunifyAV+ builds on ImunifyAV’s antivirus protection. ImunifyAV+ not only detects threats but automatically cleans up infected files. It also includes email notifications.

You can purchase ImunifyAV+ from the cPanel store. For more information about ImunifyAV+, read the cPanel blog.

Imunify360

Imunify360 offers a security suite that protects servers against a wide range of attacks. It integrates with cPanel & WHM, and it provides reports to the system administrator on the server’s status.

You can purchase Imunify360 from the cPanel store. For more information about Imunify360, visit the Imunify360 website.

KernelCare

KernelCare automatically updates your system’s Linux kernel without the need for a reboot. It also provides patches that secure vulnerabilities, such as the symlink race condition.

You can purchase KernelCare from the cPanel store. For more information about KernelCare, visit the KernelCare website.

Linux Malware Detect

Linux Malware Detect (LMD) offers a shareware malware protection scanner. For more information about LMD, visit the LMD website at r-Fx Networks.

Modify the Logwatch configuration file

The Logwatch customizable log analysis system parses your system’s log files for a given period of time. In addition, it creates a report that analyzes specified data. If your server does not include Logwatch, run the yum -y install logwatch command to install it and any dependences that Logwatch requires. The Logwatch configuration file exists in the /usr/share/logwatch/default.conf/logwatch.conf location.

We recommend that you use a text editor to change the following parameters:

• MailTo = user@example.com — Change the user@example.com address to the email address that you wish to receive Logwatch notifications.

• Detail = 5 or Detail = 10 — Change this parameter to set the detail in the log files.

  • 5 represents a medium level of detail.
  • 10 represents a high level of detail.

Patchman

Patchman detects vulnerabilities in software and sends notices to customers to teach them how to resolve the issue. If the customer does not resolve the vulnerability, Patchman can fix it automatically. Patchman integrates with cPanel & WHM, and it provides reports to the system administrator on the server’s status.

For more information about Patchman, visit the Patchman website.

RootKit Hunter

The rkhunter script scans for rootkits and other exploits.

To install the rkhunter script, perform the following steps:

1. Log in to your server as the root user via SSH.

2. Run the cd /root command to change to the root directory.

3. Run the following command to download the rkhunter script:

   wget https://sourceforge.net/projects/rkhunter/files/rkhunter/version/rkhunter-version.tar.gz.asc/download

4. Run the tar -xvzf rkhunter-version.tar.gz command to decompress the downloaded file.

5. Run the cd rkhunter-1version command to change directories.

6. To begin the rkhunter script installation, run the ./installer.sh --layout default --install command. The system will install the rkhunter script on your server.

To run the rkhunter script, run the following command:

/root/rkhunter-version/files/rkhunter -c

For information about how to configure the rkhunter script, read the rkhunter FAQ.