Recommended Security Settings Checklists

This section contains 2 checklists that you can use to quickly reference whether or not you are using our recommended security settings. You can find additional information about each of these configuration options in this document set.

The Tweak Settings Checklist

This checklist pertains to the Tweak Settings interface of WHM. You can access the Tweak Settings interface at Main >> Server Configuration >> Tweak Settings.

The Security Center Checklist

You can access WHM's Security Center features at Main >> Security Center. Many of these features will help to secure your server.

Setting	Recommendation
Password Strength Configuration This feature allows you to specify a minimum password strength for accounts hosted by your server.	A value of 50 or greater.
PHP open_basedir Tweak Enabling this option requires users to manually specify the open_basdir setting in their relevant php.ini files if PHP is configured to run as a CGI, SuPHP, or FastCGI process.	Enabled
Apache mod_userdir Tweak Enabling this option prevents users from bypassing bandwidth limits by accessing their sites using a tilde (~), username, and hostname (e.g. http://example.com/~user).	Enabled
Compiler Access Disabling compiler access for unspecified users will help prevent attacks on your server.	Disabled
Manage Wheel Group Users This feature allows you to define users who can use the su command to become the root user.	Remove all users except for root and your main account.
Shell Fork Bomb Protection Enabling this option prevents users with terminal access from using all of the resources on the server. Note: Enabling this option may cause resource shortage problems as this setting heavily limits various resources.	Enabled
FTP Configuration	Disable Anonymous FTP
Manage Shell Access	Disable shell access for all other users.
cPHulk Brute Force Protection If you enable this option, you should add trusted IPs using the White/Black List Management tab. This will prevent you from being locked out if someone attempts to brute force your server.	Enabled

Disable Identification Output for Apache

1. Log into WHM and access the Apache Global Configuration feature (located at Main >> Service Configuration >> Apache Configuration >> Global Configuration).
2. Select Off (PCI Recommended) from the ServerSignature pull-down menu.
3. Click Save.

EasyApache Configuration

When you configure EasyApache, you should include the following modules:

• suPHP — This module will cause PHP scripts to run as the user who owns the script versus the system user known as nobody.
• Suhosin — This module is an advanced protection system for PHP installations. Read more at the Suhosin website.
• mod_security — This module is an open source web application firewall. Read more at modsecurity.org. You may also wish to read our forum post about mod_security.