It is a process of enhancing the security of the server through variety of means. It is done so that one can optimize and enhance the security of their server. It is probably one of the most important task to be taken once a server is deploy especially on production environment because there is so much risk when the server is vulnerable.
Here are several tips and checklist to harden your server.
- Encrypt all communication data.
- Avoid sending critical information as plain text.
- Avoid using insecure protocol.
- Keep the server operating system up to date.
- Always use a strong combination of password especially on user accounts.
- Use non-standards port especially on production server.
- Disable direct root user login.
- For PHP scripting, update the php.ini configuration as follow;
- Do not allow fopen wrapper to open remote URLs.
- allow_url_fopen = 0
- allow_url_include = 0
- Do not allow runtime execution to be more then 30 seconds. A well script should not take more than 30 seconds to be executed.
- max_input_time = 30
- max_execution_time = 30
- Always make sure that the script does not consume more than 8MB of memory. In case script is compromised, this setting effectively limit the amount of memory that the script can use.
- memory_limit = 8M
- Disable the register global.
- register_globals = off
- Disable error message for end user. This is because the end user should only the layman term of error not the cause and why does the error appear as it may be a benefits for hacker if the error message is displayed.
- display_errors = 0
- display_startup_errors = 0
- PHP error should be log into one file that is secured.
- log_errors = 1
- error_log = /home/developer/log/php_error_log
- Do not allow fopen wrapper to open remote URLs.
- Configure the system firewall (Iptables) properly or get a software installed like CSF or APF.