Restricting access to data based on roles, rights and responsibilities is an integral part of any security policy. It is equally true in the framing of secure hosting.
In this circumstance, access should be clearly separated into roles at different levels. When hosting a web application a separate password and user should be used for database access by the web application. The web application should never have root access to any other domain. In a similar way, real world users should be divided into roles and categories and non-should be granted full root access.
Dedicated/VPS Hosting
Password Management is the core of any security strategy. For Dedicated and VPS hosting options, there are several modes of control that administrator can apply.
- Enforce strong password - a strong password should contain Upper and Lower case characters, Numbers and Special Characters and should be long; greater than 20 characters. It is also possible to restrict the use of previously used passwords. On Linux systems the following command can be used to force complex passwords for users:
- Use password aging, the chaging command on Linux servers allows checking of password age by user and setting of password aging parameters[link for tutorial on chaging]
- Failed login attempts should result in the locking of the associated user account. On Linux systems, the faillog command can be used to check failures and to set failure limits. For more details see Faillog
- Use Password Management software - a tool such as Keepass, or KeepassX for Linux and Mac, allows users to easily generate, store and mange complex difficult to crack passwords. Refer to this guide for details on Keepass
password required pam_cracklib.so minlen=12 lcredit=1 ucredit=1 dcredit=2 ocredit=1
For more detail, refer to the guide Force strong passwords
User Management on Dedicated or VPS systems allow administrators fine grained control of user login and access permissions.
- Root user login should be disabled by default
- Secure Shell(SSH) login should be forced, telnet and ftp login access should be disabled by default. To upload files to the server securely user can use Secure FTP(SFTP) clients.
- Private keys should be used for SSH login access. The following guide gives details on generating and setting up public/private keys for SSH login, SSH tutorial
- File permissions
- Password Management For shared hosting password managment is a core defence against attack. The administrator password should fit the criteria above for a strong password - long, variance in characters containing no dictionary words. As above Keepass can be used to generate and store a complex admin password. This has the secondary advantage of limiting access to the admin password to those who are trusted with the Keepass store.
- Restrict IP addresses Depending on what version of CPanel your provider offers, it is possible to lock down access via Host Access Control option. This allows you limit access to very specific IP addresses.