I know XOOPS site has closed a few times to do some server hardening. Can XOOPS post their guidlines? Can anyone point me to a reliable guide to secure the following:

Apache
Mysql
PHP
Linux

Thanks.

well it varies from distro to distro, and with what other software you have installed, and what you are using the server for etc..

ie.. if you don't need something or don't use it at all, then don't install it or disable it..

if you use ssh, then it's best to disable root login.. and add your main user or whatever to the admin group or whatever you call it.. then SU if you need to access with root privs. change the default ssh listening port to something random (that isn't actually a normal used port, by this i mean don't set it to port 80, or 21, or 443 etc)

try not to make usernames called 'admin' or administrator, or manager, or owner etc.. make long passwords containing uppercase/lowercase/numeric & other characters like +-£$ etc..

if you don't use ssh at all, disable it.. likewise with telnet..

google around for more info, there's plenty of sites outthere that will give you info..

http://security.linux.com/article.pl?sid=04/08/20/1546229&tid=90

http://security.linux.com/article.pl?sid=04/08/19/1422204&tid=2&tid=74

http://www.seifried.org/lasg/

http://howtos.linux.com/guides/linux-admin-made-easy/

keep your system current and up2date (try to use stable releases tho)

Quote:

...right into my Google Notebook. Thanks m0nty.

Here are a few others:

Installing Rootkit Hunter (rkhunter)

Protecting Linux from Automated Attackers

Server Security Tutorials at Webhostgear

Cosmetic change:
You might as well consider to rename your 'mainfile.php' to 'yoursecretname.php ' ((and make the change wherever it is being included)).
And that is only cosmetic.. breaking down the pattern!!
Maybe the future version could consider to giving the user the option to name or rename their mainfile to whatever they wish.

Quote:

Yum yum. Google Notebook gobbled these up as well

Thanks everyone for all the replies. It is definately a place to start. When I posted, I thought I had put the Linux will be Fedora 5.

The box will just be for hosting XOOPS and other sites, only running apache, php, mysql, phpmyadmin, ssh.