ConfigServer Security & Firewall

ConfigServer Security & Firewall - csf v5.40

Note: Internal WHM links will not work within the csf Integrated UI

Firewall Check	Status	Comment
Check whether csf is enabled	OK
Check csf is running	OK
Check whether csf is in TESTING mode	OK
Check csf AUTO_UPDATES option	WARNING	To keep csf up to date and secure you should enable AUTO_UPDATES. You should also monitor our blog
Check whether lfd is enabled	OK
Check incoming MySQL port	OK
Check csf SMTP_BLOCK option	OK
Check csf LF_SCRIPT_ALERT option	OK
Check csf LF_SSHD option	OK
Check csf LF_FTPD option	OK
Check csf LF_SMTPAUTH option	OK
Check csf LF_POP3D option	OK
Check csf LF_IMAPD option	OK
Check csf LF_HTACCESS option	OK
Check csf LF_MODSEC option	OK
Check csf LF_CPANEL option	OK
Check csf LF_CPANEL_ALERT option	OK
Check csf LF_DIRWATCH option	OK
Check csf LF_INTEGRITY option	OK
Check csf PT_SKIP_HTTP option	OK
Check csf PT_ALL_USERS option	OK
Check csf SAFECHAINUPDATE option	OK
RT_RELAY_LIMIT sanity check	WARNING	RT_RELAY_LIMIT = 3. Recommended range: 10-10000 (Default: 100)
RT_AUTHRELAY_LIMIT sanity check	WARNING	RT_AUTHRELAY_LIMIT = 3. Recommended range: 10-10000 (Default: 100)
RT_POPRELAY_LIMIT sanity check	WARNING	RT_POPRELAY_LIMIT = 3. Recommended range: 10-10000 (Default: 100)
RT_LOCALRELAY_LIMIT sanity check	WARNING	RT_LOCALRELAY_LIMIT = 3. Recommended range: 10-10000 (Default: 100)
RT_LOCALHOSTRELAY_LIMIT sanity check	WARNING	RT_LOCALHOSTRELAY_LIMIT = 3. Recommended range: 10-10000 (Default: 100)
DEBUG sanity check	WARNING	DEBUG = 1. Recommended range: 0 (Default: 0)
Server Check	Status	Comment
Check /tmp permissions	OK
Check /tmp ownership	OK
Check /tmp is mounted as a filesystem	OK
Check /tmp is mounted noexec,nosuid	OK
Check /etc/cron.daily/logrotate for /tmp noexec workaround	WARNING	Due to a bug in logrotate if /tmp is mounted with the noexec option, you need to have logrotate use a different temporary directory. If you don't do this syslog may not restart correctly and will write to the wrong (older) log files. See here for a way to do this
Check /var/tmp permissions	OK
Check /var/tmp ownership	OK
Check /var/tmp is mounted as a filesystem or is a symlink to /tmp	OK
Check /usr/tmp permissions	OK
Check /usr/tmp ownership	OK
Check /usr/tmp is mounted as a filesystem or is a symlink to /tmp	OK
Check /dev/shm is mounted noexec,nosuid	OK
Check for DNS recursion restrictions	OK
Check for DNS random query source port	OK
Check server runlevel	OK
Check nobody cron	OK
Check Operating System support	OK
Check perl version	OK
Check MySQL version	OK
Check MySQL LOAD DATA disallows LOCAL	OK
Check SUPERUSER accounts	OK
Check for cxs	OK
Check for IPv6	OK
Check for kernel logger	OK
SSH/Telnet Check	Status	Comment
Check SSHv1 is disabled	OK
Check SSH on non-standard port	WARNING	You should consider moving SSH to a non-standard port [currently:22] to evade basic SSH port scans. Don't forget to open the port in the firewall first!
Check SSH PasswordAuthentication	WARNING	For ultimate SSH security, you should consider disabling PasswordAuthentication and only allow access using PubkeyAuthentication
Check SSH UseDNS	OK
Check telnet port 23 is not in use	OK
Check shell limits	OK
Check Background Process Killer	OK
Mail Check	Status	Comment
Check root forwarder	OK
Check exim for extended logging (log_selector)	OK
Check exim weak SSL/TLS Ciphers (tls_require_ciphers)	OK
Check for maildir conversion	OK
Check dovecot weak SSL/TLS Ciphers (ssl_cipher_list)	OK
Apache Check	Status	Comment
Check apache version	OK
Check suPHP	OK
Check Suexec	OK
Check apache for mod_security	OK
Check apache for FrontPage	OK
Check apache for RLimitCPU	OK
Check apache for RLimitMEM	OK
Check Apache weak SSL/TLS Ciphers (SSLCipherSuite)	OK
Check apache for TraceEnable	OK
Check apache for ServerSignature	OK
Check apache for ServerTokens	OK
Check apache for FileETag	OK
Check mod_userdir protection	OK
PHP Check	Status	Comment
Check php version (/usr/local/bin/php)	OK
Check php for enable_dl or disabled dl()	OK
Check php for disable_functions	OK
Check php for ini_set disabled	WARNING	You should consider adding ini_set to the disable_functions in the PHP configuration as this setting allows PHP scripts to override global security and performance settings for PHP scripts. Adding ini_set can break PHP scripts and commenting out any use of ini_set in such scripts is advised
Check php for register_globals	OK
Check php for Suhosin	OK
Check php open_basedir protection	OK
WHM Settings Check	Status	Comment
Check cPanel login is SSL only	OK
Check boxtrapper is disabled	OK
Check max emails per hour is set	OK
Check whether users can reset passwords via email	OK
Check whether native cPanel SSL is enabled	OK
Check compilers	OK
Check Anonymous FTP Logins	OK
Check Anonymous FTP Uploads	OK
Check pure-ftpd weak SSL/TLS Ciphers (TLSCipherSuite)	OK
Check FTP Logins with Root Password	OK
Check allow remote domains	OK
Check block common domains	OK
Check allow park domains	OK
Check proxy subdomains	WARNING	This option can mask a users real IP address and hinder security. You should disable WHM > Tweak Settings > Proxy subdomains
Check proxy subdomains for new users	WARNING	This option can mask a users real IP address and hinder security. You should disable WHM > Tweak Settings > Proxy subdomain creation
Check cPAddons update email to owner	OK
Check cPAddons update email to root	OK
Check cPanel tree	WARNING	Running EDGE/BETA on a production server could lead to server instability
Check cPanel updates	WARNING	You have cPanel updating disabled, this can pose a security and stability risk. WHM > Update Config* >cPanel/WHM Updates > Daily Updates > Update cPanel & WHM daily*
Check package updates	OK
Check security updates	OK
Check melange chat server	OK
Check Accounts that can access a cPanel user account	WARNING	You should consider setting this option to "user" after use. WHM > Tweak Settings > Accounts that can access a cPanel user account
Check cPanel php for register_globals	OK
Check cPanel php.ini file for register_globals	OK
Check cPanel passwords in email	OK
Check core dumps	OK
Check Cookie IP Validation	OK
Check MD5 passwords with Apache	OK
Check Referrer Blank Security	OK
Check Referrer Security	OK
Check HTTP Authentication	OK
Check Security Tokens	OK
Check Parent Security	OK
Check Domain Lookup Security	OK
Check SMTP Tweak	OK
Check nameservers	WARNING	At least one of the configured nameservers: ns2.webumake.net ns1.webumake.net should be located in a topologically and geographically dispersed location on the Internet - See RFC 2182 (Section 3.1)
Server Services Check	Status	Comment
Check server startup for cups	OK
Check server startup for xfs	OK
Check server startup for atd	OK
Check server startup for nfslock	OK
Check server startup for canna	OK
Check server startup for FreeWnn	OK
Check server startup for cups-config-daemon	OK
Check server startup for iiim	OK
Check server startup for mDNSResponder	OK
Check server startup for nifd	OK
Check server startup for rpcidmapd	OK
Check server startup for bluetooth	OK
Check server startup for anacron	OK
Check server startup for gpm	OK
Check server startup for saslauthd	OK
Check server startup for avahi-daemon	OK
Check server startup for avahi-dnsconfd	OK
Check server startup for hidd	OK
Check server startup for pcscd	OK
Check server startup for sbadm	OK

Your Score: 124/141*

141 (max)

124 (score)

*This scoring does not necessarily reflect the security of your server or the relative merits of each check

csf: v5.40