zVPS.uk

Accounts and Services

Switch from md5 to sha512 for account passwords

                            authconfig --passalgo=sha512 --update
                        

restrict cron and at

                            touch /etc/cron.allow
                            chmod 600 /etc/cron.allow
                            awk -F: '{print $1}' /etc/passwd | grep -v root > /etc/cron.deny
                            touch /etc/at.allow
                            chmod 600 /etc/at.allow
                            awk -F: '{print $1}' /etc/passwd | grep -v root > /etc/at.deny
                        

Drivers and System

disable wireless drivers

                            for i in $(find /lib/modules/`uname -r`/kernel/drivers/net/wireless -name "*.ko" -type f) ; do echo blacklist $i >> /etc/modprobe.d/blacklist-wireless ; done;
                        

kernel network improvements

                            vi /etc/sysctl.conf
                            net.ipv4.conf.all.send_redirects = 0
                            net.ipv4.conf.default.send_redirects = 0
                            net.ipv4.tcp_max_syn_backlog = 1280
                            net.ipv4.icmp_echo_ignore_broadcasts = 1
                            net.ipv4.conf.all.accept_redirects = 0
                            net.ipv4.conf.all.secure_redirects = 0
                            net.ipv4.conf.all.log_martians = 1
                            net.ipv4.conf.default.accept_source_route = 0
                            net.ipv4.conf.default.accept_redirects = 0
                            net.ipv4.conf.default.secure_redirects = 0
                            net.ipv4.icmp_echo_ignore_broadcasts = 1
                            net.ipv4.icmp_ignore_bogus_error_responses = 1
                            net.ipv4.conf.all.rp_filter = 1
                            net.ipv4.tcp_timestamps = 0
                        

Firewall Config

iptables install and setup

                            yum install system-config-firewall-tui
                            system-config-firewall-tui