Command Center

TIME-WAIT - represents waiting for enough time to pass to be sure the remote TCP received the acknowledgment of its connection termination request.

See the following TCP state diagram: 

/etc/init.d/networking restart

This socket option tells the kernel that even if this port is busy (in
the TIME_WAIT state), go ahead and reuse it anyway. If it is busy, but with another state, you will still get an address already in use error. It is useful if your server has been shut down, and then restarted right away while sockets are still active on its port. You should be aware that if any unexpected data comes in, it may confuse your server, but while this is possible, it is not likely.

# -------------------------------------------------------
# Some common sense basics to secure Debian Linux servers


# installing extra security packages

apt-get install denyhosts tiger rkhunter chkrootkit snort oinkmaster checksecurity logcheck logwatch fcheck logcheck-database syslog-summary tripwire

# after downloading and installing, build the tripwire database:

tripwire --init

# most of the tools send e-mail to root@localhost, make sure to redirect this to a working e-mail address:

echo "root: my.email@address.com" >> /etc/aliases
newaliases

# Download the 'sysctl.conf' provided here, place it in /etc and run:

wget -O /etc/sysctl.conf http://klaver.it/linux/sysctl.conf
sysctl -e -p /etc/sysctl.conf

# Download the 'rc.iptables' save it to /etc/init.d and edit it to only open the desired ports for your server you really need, after that do:

wget -O /etc/init.d/rc.iptables http://klaver.it/linux/rc.iptables
chmod 755 /etc/init.d/rc.iptables
update-rc.d rc.iptables defaults
/etc/init.d/rc.iptables start &

# Get automatic security updates

apt-get install cron-apt unattended-upgrades

# Do some virusscanning to make sure there are no unwanted files on your server system:

apt-get install clamav clamav-daemon clamav-freshclam
freshclam
clamscan --infected --recursive --no-summary /

# You could also do this on a daily basis and add it as cronjob:

echo "13 5 * * * clamscan --infected --recursive --no-summary /" >> /var/spool/cron/crontabs/root

# remove or take away permissions of all system tools that can be used to download files at the command-line (like lynx and wget)

chmod 700 /usr/bin/wget /usr/bin/curl /usr/bin/GET /usr/bin/ftp /usr/bin/telnet
dpkg -P lynx links

# Search for other installations of these tools and remove or disable them for normal users

whereis wget curl GET links lynx ftp telnet

# Monitor your user cron-jobs and look for suspicious commands

cat /var/spool/cron/crontabs/*

# In case you do not want your users to use cron-jobs, you can disable them all (exept for the root user) using the following commands

echo root > /etc/cron.allow
/etc/init.d/cron restart

# Let the server fix it's filesystem automatically when errors are found

echo "FSCKFIX=yes" >> /etc/defaults/rcS



# --------------------------------------------------
# Adding webserver software specific security tweaks:

# use apache mod_security (www.modsecurity.org)

# use the suexec tool to limit permissions of CGI scripts

# use SuPHP to limit permissions of PHP scripts

# For PHP edit php.ini and set the following options:

allow_url_fopen = Off
allow_url_include = Off
register_globals = Off

# PHP safe_mode will add some extra limitations, see http://www.php.net/manual/en/features.safe-mode.functions.php
# use PHP option safe_mode = On , or disable a list of common abused php functions that are rarely used by legitimate php software packages:

disable_functions = dl,system,exec,passthru,shell_exec,proc_open,proc_get_status,proc_terminate,proc_close,dir,readfile,virtual,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source

# install the php hardening patch available at www.hardened-php.net and you might also try the suhosin patch available at the same website.

# set php option open_basedir for every website limiting them to their own user home-dir to prevent php scripts get access to other users and websites at the system.



# Your server is now a bit more secure, but you still have to keep an eye at your users and make sure they do not upload and use insecure/buggy/old software packages

Apache optimization: KeepAlive On or Off?

Advantages of KeepAlive

• Improves website speed: It reduces latency associated with HTTP transfers and delivers a better user experience.
• Reduces CPU usage: On the server side enabling KeepAlive reduces CPU usage. Consider that a typical web page has dozens of different files such as images, stylesheets, javascript files etc. If KeepAlive is disabled a separate connection must be made for each of those files. Creating and closing connections has an overhead and doing it for every single file wastes CPU time.

Disadvantages of Keepalive

• Increases memory usage: Enabling KeepAlive  increases memory usage on the server. Apache processes have to keep connections open waiting for new requests from established connections. While they are waiting they are occupying RAM that could be used to service other clients. If you turn off KeepAlive fewer apache processes will remain active. This will lower memory usage and allow Apache to serve more users.

When should you enable KeepAlive?

• Server resources: How much RAM vs. how much CPU power you have? RAM is often the biggest limiting factor in a webserver. If you have little RAM you should turn off KeepAlive because having Apache processes hanging around while they wait for more requests from persistent connections is a waste of precious memory. If CPU power is limited then you want KeepAlive on because it reduces CPU load.
• Types of sites: If you have pages with a lot of images or other files linked into them, KeepAlive will improve the user experience significantly. This is because a single connection will be used to transfer multiple files.
• Traffic patterns: The type of traffic you get. If your web traffic is spread out evenly throughout a day then you should turn on KeepAlive. OTOH, if you have bursty traffic where a lot of concurrent users access your sites during a short time period KeepAlive will cause your RAM usage to skyrocket so you should turn it off.

Configure Apache KeepAlive settings

• KeepAlive: Switches KeepAlive on or off. Put in “KeepAlive on” to turn it on and “KeepAlive off” to turn it off.
• MaxKeepAliveRequests: The maximum number of requests a single persistent connection will service. A number between 50 and 75 would be plenty.
• KeepAliveTimeout: How long should the server wait for new requests from connected clients. The default is 15 seconds which is way too high. Set it to between 1 and 5 seconds to avoid having processes wasting RAM while waiting for requests.

Other settings

• MaxClients: MaxClients is the maximum number of child processes launched by Apache to service incoming requests. With KeepAlive enabled you have will have a higher number of child processes active during peak times. So your MaxClients value may have to be increased.
• MaxRequestsPerChild: The number of requests a child process will serve before it is killed and recreated. This is done to prevent memory leaks. When KeepAlive is turned on each persistent connection will count as one request. That effectively turns MaxRequestsPerChild into a maximum connections per child value. As a result you can set a lower MaxRequestsPerChild value if you allow KeepAlive. If you don’t allow KeepAlive you should increase the MaxRequestsPerChild value to prevent excessive CPU usage.

Final thoughts

• terminal = tty = text input/output environment
• console = physical terminal
• shell = command line interpreter

termcapinfo xterm*|xs|rxvt|terminal ti@:te@

set -g terminal-overrides 'xterm*:smcup@:rmcup@'

termname

termcapinfo xterm ti@:te@
termcapinfo xterm-color ti@:te@