Access Restrictions - Revision history

Bill at 15:22, 26 May 2014

2014-05-26T15:22:01Z

Hugh at 16:28, 18 May 2014

2014-05-18T16:28:34Z

Bill: /* Dedicated/VPS Hosting */

2014-05-16T22:35:04Z

‎Dedicated/VPS Hosting

Bill: /* Dedicated/VPS Hosting */

2014-05-16T22:34:47Z

‎Dedicated/VPS Hosting

Bill: /* Dedicated/VPS Hosting */

2014-05-16T22:33:05Z

‎Dedicated/VPS Hosting

Bill: /* Shared Hosting */

2014-05-15T20:54:14Z

‎Shared Hosting

Bill at 20:45, 15 May 2014

2014-05-15T20:45:30Z

Bill at 20:26, 15 May 2014

2014-05-15T20:26:18Z

Bill at 20:17, 7 May 2014

2014-05-07T20:17:21Z

Bill at 20:16, 7 May 2014

2014-05-07T20:16:50Z

@@ Line 12: / Line 12: @@
   password required pam_cracklib.so minlen=12 lcredit=1 ucredit=1 dcredit=2 ocredit=1
-For more detail, refer to the guide [http://www.linux-faqs.info/security/force-strong-passwords| Force strong passwords]
+For more detail, refer to the guide [http://www.linux-faqs.info/security/force-strong-passwords Force strong passwords]
 <li>
-Use password aging, the chaging command on Linux servers allows checking of password age by user and setting of password aging parameters [http://linoxide.com/linux-command/password-expire-chage-command/| link].
+Use password aging, the chaging command on Linux servers allows checking of password age by user and setting of password aging parameters [http://linoxide.com/linux-command/password-expire-chage-command/ link].
 </li>
 <li>
-Failed login attempts should result in the locking of the associated user account. On Linux systems, the faillog command can be used to check failures and to set failure limits. For more details see [http://www.cyberciti.biz/tips/rhel-centos-fedora-linux-log-failed-login.html| Faillog]
+Failed login attempts should result in the locking of the associated user account. On Linux systems, the faillog command can be used to check failures and to set failure limits. For more details see [http://www.cyberciti.biz/tips/rhel-centos-fedora-linux-log-failed-login.html Faillog]
 </li>
 <li>
-Use Password Management software - a tool such as Keepass, or KeepassX for Linux and Mac, allows users to easily generate, store and mange complex difficult to crack passwords. Refer to this guide for details on [https://securityinabox.org/en/keepass_main| Keepass]
+Use Password Management software - a tool such as Keepass, or KeepassX for Linux and Mac, allows users to easily generate, store and mange complex difficult to crack passwords. Refer to this guide for details on [https://securityinabox.org/en/keepass_main Keepass]
 </li>
 </ol>
@@ Line 32: / Line 32: @@
 </li>
 <li>
-Private keys should be used for SSH login access. The following guide gives details on generating and setting up public/private keys for SSH login, [http://support.suso.com/supki/SSH_Tutorial_for_Linux| SSH tutorial]
+Private keys should be used for SSH login access. The following guide gives details on generating and setting up public/private keys for SSH login, [http://support.suso.com/supki/SSH_Tutorial_for_Linux SSH tutorial]
 </li>
 <li>
-File permissions should be restricted for critical files. User should only be allowed access to files relevant to their work. Execution as root should be restricted. Discussion of [http://www.linux.com/learn/tutorials/309527-understanding-linux-file-permissions| linux file permissions].
+File permissions should be restricted for critical files. User should only be allowed access to files relevant to their work. Execution as root should be restricted. Discussion of [http://www.linux.com/learn/tutorials/309527-understanding-linux-file-permissions linux file permissions].
 </li>
 </ol>
@@ Line 44: / Line 44: @@
 For shared hosting password managment is a core defence against attack. The administrator password should fit the criteria above for a strong password - long, variance in characters containing no dictionary words.
-As above [https://securityinabox.org/en/keepass_main| Keepass] can be used to generate and store a complex admin password. This has the secondary advantage of limiting access to the admin password to those who are trusted with the Keepass store.
+As above [https://securityinabox.org/en/keepass_main Keepass] can be used to generate and store a complex admin password. This has the secondary advantage of limiting access to the admin password to those who are trusted with the Keepass store.
 </li>
 <li>
 '''Restrict IP addresses'''
-Depending on what version of CPanel your provider offers, it is possible to lock down access via [http://docs.cpanel.net/twiki/bin/view/AllDocumentation/WHMDocs/DenyAccess| Host Access Control] option. This allows you limit access to very specific IP addresses.
+Depending on what version of CPanel your provider offers, it is possible to lock down access via [http://docs.cpanel.net/twiki/bin/view/AllDocumentation/WHMDocs/DenyAccess Host Access Control] option. This allows you limit access to very specific IP addresses.
 </li>
 <li>

@@ Line 5: / Line 5: @@
 ==Dedicated/VPS Hosting==
-'''Password Management''' is the core of any security strategy. For Dedicated and VPS hosting options, there are several modes of control that administrator can apply.
+'''Password Management''' is the core of any security strategy. For dedicated and VPS hosting options, there are several modes of control that administrator can apply.
 <ol>
 <li>
-Enforce strong password - a strong password should contain Upper and Lower case characters, Numbers and Special Characters and should be long; greater than 20 characters. It is also possible to restrict the use of previously used passwords. On Linux systems the following command can be used to force complex passwords for users:
+Enforce strong password - a strong password should contain upper and lower case characters, numbers and special characters and should be long; greater than 20 characters. It is also possible to restrict the use of previously used passwords. On Linux systems the following command can be used to force complex passwords for users:
 </li>
   password required pam_cracklib.so minlen=12 lcredit=1 ucredit=1 dcredit=2 ocredit=1

@@ Line 14: / Line 14: @@
 For more detail, refer to the guide [http://www.linux-faqs.info/security/force-strong-passwords| Force strong passwords]
 <li>
-Use password aging, the chaging command on Linux servers allows checking of password age by user and setting of password aging parameters[http://linoxide.com/linux-command/password-expire-chage-command/| link].
+Use password aging, the chaging command on Linux servers allows checking of password age by user and setting of password aging parameters [http://linoxide.com/linux-command/password-expire-chage-command/| link].
 </li>
 <li>

@@ Line 14: / Line 14: @@
 For more detail, refer to the guide [http://www.linux-faqs.info/security/force-strong-passwords| Force strong passwords]
 <li>
-Use password aging, the chaging command on Linux servers allows checking of password age by user and setting of password aging parameters[link for tutorial on chaging]
+Use password aging, the chaging command on Linux servers allows checking of password age by user and setting of password aging parameters[http://linoxide.com/linux-command/password-expire-chage-command/| link].
 </li>
 <li>

@@ Line 35: / Line 35: @@
 </li>
 <li>
-File permissions
+File permissions should be restricted for critical files. User should only be allowed access to files relevant to their work. Execution as root should be restricted. Discussion of [http://www.linux.com/learn/tutorials/309527-understanding-linux-file-permissions| linux file permissions].
 </li>
 </ol>
 ==Shared Hosting==

@@ Line 2: / Line 2: @@
 In this circumstance, access should be clearly separated into roles at different levels. When hosting a web application a separate password and user should be used for database access by the web application. The web application should never have root access to any other domain. In a similar way, real world users should be divided into roles and categories and non-should be granted full root access.
 ==Dedicated/VPS Hosting==
@@ Line 39: / Line 36: @@
 <li>
 File permissions
 </li>
 </ol>

← Older revision		Revision as of 20:26, 15 May 2014
Line 2:		Line 2:

	In this circumstance, access should be clearly separated into roles at different levels. When hosting a web application a separate password and user should be used for database access by the web application. The web application should never have root access to any other domain. In a similar way, real world users should be divided into roles and categories and non-should be granted full root access.		In this circumstance, access should be clearly separated into roles at different levels. When hosting a web application a separate password and user should be used for database access by the web application. The web application should never have root access to any other domain. In a similar way, real world users should be divided into roles and categories and non-should be granted full root access.
−
−	~~All passwords should be strong and secure - reference the section on strong passwords for further infromation [strong passwords \| strong passwords].~~

	==Shared Hosting==		==Shared Hosting==

← Older revision		Revision as of 20:16, 7 May 2014
Line 6:		Line 6:

	'''Shared Hosting'''		'''Shared Hosting'''
		+

	'''Dedicated/VPS Hosting'''		'''Dedicated/VPS Hosting'''
		+	'''Password Management''' is the core of any security strategy. For Dedicated and VPS hosting options, there are several modes of control that administrator can apply.
		+	<ol>
		+	<li>
		+	Enforce strong password - a strong password should contain Upper and Lower case characters, Numbers and Special Characters and should be long; greater than 20 characters. It is also possible to restrict the use of previously used passwords. On Linux systems the following command can be used to force complex passwords for users:
		+	</li>
		+	password required pam_cracklib.so minlen=12 lcredit=1 ucredit=1 dcredit=2 ocredit=1
		+
		+	For more detail, refer to the guide [http://www.linux-faqs.info/security/force-strong-passwords\| Force strong passwords]
		+	<li>
		+	Use password aging, the chaging command on Linux servers allows checking of password age by user and setting of password aging parameters[link for tutorial on chaging]
		+	</li>
		+	<li>
		+	Failed login attempts should result in the locking of the associated user account. On Linux systems, the faillog command can be used to check failures and to set failure limits. For more details see [http://www.cyberciti.biz/tips/rhel-centos-fedora-linux-log-failed-login.html\| Faillog]
		+	</li>
		+	<li>
		+	Use Password Management software - a tool such as Keepass, or KeepassX for Linux and Mac, allows users to easily generate, store and mange complex difficult to crack passwords. Refer to this guide for details on [https://securityinabox.org/en/keepass_main\| Keepass]
		+	</li>
		+	</ol>
		+	'''User Management''' on Dedicated or VPS systems allow administrators fine grained control of user login and access permissions.
		+	<ol>
		+	<li>
		+	Root user login should be disabled by default
		+	</li>
		+	<li>
		+	Secure Shell(SSH) login should be forced, telnet and ftp login access should be disabled by default. To upload files to the server securely user can use Secure FTP(SFTP) clients.
		+	</li>
		+	<li>
		+	Private keys should be used for SSH login access. The following guide gives details on generating and setting up public/private keys for SSH login, [http://support.suso.com/supki/SSH_Tutorial_for_Linux\| SSH tutorial]
		+	</li>
		+	<li>
		+	File permissions
		+	</li>
		+	</ol>