Server Security

We pay special attention to each server's security to provide peace of mind for our clients.

Security icon

Server security is vitally important for enterprises to avoid exposing sensitive data and protecting themselves against viruses.

HostDime’s bare metal servers undergo a rigorous check before and during deployment to give clients peace of mind.

Take a look at our ten-point security audit - a comprehensive shield that stands guard over your server and precious data, ensuring their safety around the clock.

HostDime’s Bare Metal Server Security Audit

Point 1: Check kernel version. The Linux kernel is the core system program of all Linux systems. HostDime’s talented technicians always check your kernel version to make sure there are zero exploitable vulnerabilities. If any kernel vulnerabilities are discovered, the update process will happen immediately and HostDime will contact you to schedule a reboot.

Point 2: Check PHP settings. There are several PHP settings that we advise be disabled on servers that do not require them:

  • "allow_url_fopen": This setting allows PHP to treat any URL as if it were a file. This poses a security risk for certain PHP applications that incorrectly sanitize "include" and "fopen" statements.
  • "allow_url_include": Almost no PHP applications require "allow_url_include" be enabled. Therefore it is recommended that "allow_url_include" always be disabled. Once "allow_url_include" is disabled, users can enable "allow_url_fopen" if needed.
  • "register_globals": This setting allows global PHP variables to be set at runtime through a URL. Having it enabled could allow attackers to modify arbitrary PHP variables. This can lead to SQL injections, arbitrary code execution, and other exploits for vulnerable PHP applications. Therefore the normal recommendation is that "register_globals" be disabled.

In addition to these three PHP settings, the technicians also recommend that other vulnerable PHP functions be disabled. In doing so, the effectiveness of PHP shells and other PHP-based malware is reduced. The list of functions generally recommended that users disable are the following:

dl, exec, shell_exec, system, passthru, popen, pclose, proc_open, proc_nice, proc_terminate, proc_get_status, proc_close, pfsockopen, leak, apache_child_terminate, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid.

Point 3: Check Apache mod_security ruleset. Apache mod_security is a software firewall which scans incoming HTTP requests for known exploits. HostDime maintains an internal ruleset for many known exploits and always checks to ensure that the latest ruleset is installed on a server prior to deployment. To ensure your server is always using the latest ruleset, HostDime can configure your server to update the ruleset every day.

Point 4: Check CSF/LFD configuration. CSF/LFD is a software firewall suite that supports automated brute force detection and prevention, process tracking, SYN flood protection, and a wide range of other automated security features. By default, HostDime installs and configures CSF/LFD on all standard Linux servers.

Point 5: Check system binaries. HostDime runs a full web server security audit on the binary package versions, such as BIND, apache, and udev, to ensure everything is up-to-date and not vulnerable to any known exploits.

Point 6: Configuration partition mounting options. HostDime changes configuration on partitions to lessen risk of filesystem-based attacks and to reduce I/O overhead.

Point 7: Disable typically unneeded services. HostDime disables services not commonly used to ensure the security of the server.

Point 8: Deploy initial security-focused configurations. HostDime deploys initial security-focused configurations for MySQL, Exim, cPanel, Plesk, FTP, SSH, and PHP.

Point 9: Install RKHunter. RKhunter is a program designed to scan your server for known rootkits and detected modified system binaries. We install RKHunter and initialize its state database.

Point 10: Install BusyBox. HostDime installs Unix tools file BusyBox, “The Swiss Army Knife of Embedded Linux.”