Welcome to Vastspace, provides Reliable Web Hosting since 2014

Welcome to Vastspace

Archive

Paid SSL certificate is a processs

I have spoken to many customers were buying SSL certificates. Most have commissioned Vastspace for the entire process. From my experience, most have the impression that the SSL certificate can be done on the same day.

Whether it is done by yourselves or Vastspace the process is the same. I will explain the entire process, so you will get a better understanding.

A Paid SSL certificate is issued by the certificate authority, not Vastspace. All SSL certificate applied for that domain must be validated and the CSR from the origin must be submitted.  The validation methods are;  domain-validation, organization validation and extended validation.  Each validation process is conducted by the CA. DV, domain validation has a shorter process. The ‘owner’ of the domain must approve that he or she has applied an SSL certificate for that domain.

Once CA has satisfied, they will issue the SSL certificate. This process is the fastest but it has lower insured value because it is domain validated. How soon? It depends on how soon the owner can approve for the DCV email sent to him or her.

I have seen DV SSL certificate took more than a month or even cancelled after the CSR was submitted. OV will validate the organization applied and buying the SSL certificate. The CA will print the organization name on the OV validated SSL certificate.

EV SSL certificate verification is the most extensive. The verification comprises the DV, OV and callback to verify the real person behind the business.  Business telephone number published on the authorised websites will be used.

The EV SSL verification is very long-winded if the organization is not prepared for the process. Handled by an inexperienced sales guy can delay the entire process. Thus, I recommend asking and check with the vendor before you are buying an SSL certificate, especially for the EV SSL certificate.

Here is the link to understand more about different types of SSL certificates.

Should you own a static IP?

Should you own a static IP?

This is a debatable question but I personally felt if you have sensitive information or data and they are hosted on the internet or accessible through the internet, you should own a static or a permanent IP.

A permanent or static IP does not have a short leasing period. It should be given on the first day of the service until the service ended.

The most common way is to get a static IP from your internet provider. If not, you can try VPN providers offer dedicated IP as an addon. You can connect with your VPN account and get the same IP address every time.

Static IP is especially for environments that have restricted access. For example, your website administrator dashboard, your shell access, your RDP access etc.

I suggest to my customers, they should own a static IP. Lockdown sensitive areas where brute force entries are possible. I have seen wp-login.php, the admin login for WordPress is extremely popular to brute-force attacks.

 

Brute-force Protection

Whether you are using Exim, Postfix or others, I personally feel that the brute-force protection is necessary. I have seen unauthorized login attempts on email accounts especially the common ones.

I supposed your service provider has been telling you ‘please use the strong password’. However, Imseeing compromised account use a weak password. So, please remind yourselves always to use strong passwords.

A strong password can be 13 characters and above, a mixture of the symbols, capital letters, small letters and numbers. You don’t and never define such as strong password ‘P@ssword123456’ Yes. it has more than 13 characters., symbols, capital, small letters and numbers.

This type of password is very guessable, they are likely in the hacker’s dictionary. Never use this kind of password. Combination of name, birthday, handphone and NRIC number should be avoided too. A password is your first defence line, hence it is important to make sure they are not guessable.

Devices have set up with email services should install with a good anti-virus capable of detecting malicious activities like for example ports scanning which is common nowadays. This is also important to an individual, even you have a strong password, there is risk your password is stolen through a backdoor on a virus-infected devive.

If you do have the above both, the brute-force protection is useful but it is not 100% you are protected or you are safe. Hackers will attempt to login to your email account with their hacking program using a guessable password.

The ideal of brute-force protection is a rule to block further failed login after X attempts in X interval and block the source for an X period. This is effective to bar authorized access. Whoever came out the mechanism is a genius. This mechanism has protected many, not only email accesses.

Like SmarterMail has such feature out of the box, actually more like internal spammer etc. However, today topic is mainly on brute-force and yes, SmarterMail has built-in with such feature. The server admin can define the number of attempts and the block interval. SmarterMail will display the IP address and its location, should you blacklist them permanently.

I personally felt this is a great feature to protect our email users. This feature reduces the workload on email server admin too. A good email system must built-in with a good security feature and SmarterMail did it.

[/vc_column_text][/vc_column][/vc_row]

Configure maldet to detect malware infected files

In the last article, we install maldet. We learn how to configure maldet today. Again, I want to mention maldet is free and only for Linux server. Let us begin the configuration, assuming you have installed maldet successfully.

For setting up maldet, the configuration file at /usr/local/maldet/conf.maldet has to make sure you be modified.

The next are some of the general options that you will just want to set.

If you will want to be notified of the existence of malware by email, set the following selections.

email_alert : If you want to get email alerts whenever a suspect file is detected, then it should be set to 1.
email_addr : The email address to which notifications should be directed. This is used in combination with the email_alert option.
email_ignore_clean : When malware notifications have been automatically cleaned out (check the next two options), ignore dispatching email notifications. This is disabled by default. Set it to 1 to allow it, if you have decide to put up an automated daily scan that picks up and cleans the hits and you do not want to be notified of these by email.
What action will need to be used on the infected files? The following alternatives can be placed to quarantine (to push the affected files to a secure and protected area where they are unable to create any damage) the files.

quarantine_hits : The default value is 0. Set this to 1 and so that the infected files will be relocated to quarantine.
quarantine_clean : The default value is 0. This is used once quarantine_hits is set to 1. Do you want the program to further clean the files? Set this to 1 if you will want the program to try to clean the malware injections. Maintain this as zero if you want to check before cleaning.
In a multi-user conditions, the following choices may become useful.

quarantine_suspend_user : By default, the following is disabled and set to 0. If you set this to 1, the accounts of users who have got hits will be suspended. For this to function, quarantine_hits should be 1.
quarantine_suspend_user_minuid : The lowest user id which can be suspended. This is set to 500 by default.
inotify_minuid : The lowest user id above which users need to be watched. The default value is 500.
inotify_docroot : The web directory relative to the home directory of users. By default, it is set to public_html. If this is set, only this web directory will be checked.
Save and close the configuration file.

A simple scan
For a simple scan, run maldet with the –scan-all option with a path as an argument. It first builds a list of files for almost all the directories and sub-directories in that path. Then it reads through all any files and gives the number of hits. It also provides a report which you can easily view to examine the files that are suspicious. Help to make sure that you provide the full path and not the relative path.

sudo maldet –scan-all /home/username/public_html/

A notice of warning, though. The setting scan_ignore_root in the configuration file is set to 1 by default. This triggers files that are owned by root to be ignored in the file list that maldet builds. The default value is more efficient, but the assumption is that your root password has not been compromised and malware are not injected into root-owned files. Change this setting to 0 if you want root-owned files also to be scanned. This might slow down the scan. So, use it judiciously.

You can view the files that are affected by opening the report file mentioned.

Quarantine affected files
When quarantine_hits is set to 1, maldet not only scans for malware, but also moves the hits to quarantine so that your users do not have access to these files. So, your malware scan may produce results as below. In this case, quarantine_clean is set to 0.

If you view the report, you can see the affected files and their quarantine location. You can inspect the files and then decide on whether you want to clean them.

If you scan with the quarantine_hits set to 0, you need not set it to 1 and redo the scan. Instead, you could quarantine all malware results from the previous scan with

sudo maldet -quarantine SCANID

Quarantine and clean affected files
When quarantine_clean is set to 1, it moves the affected files to quarantine, maldet tries to clean them.

If you did a scan with the quarantine_hits or quarantine_clean set to 0, you can do a clean with the following option.

sudo maldet -clean SCANID

Restore a file
If you want to restore a file which was false positive as a malicious and quarantined, or if you have  cleaned the file and want it back in its proper location,

sudo maldet -restore FILENAME

Alternately, give the complete path of the quarantined file.

sudo maldet -restore /usr/local/maldetect/quarantine/FILENAME

Wildcard scan
You can also make use of wildcards in your scan path. ? is the wildcard character.

sudo maldet –scan-all /home/?/public_html/

This will check all directories inside /home and if any of them had a public_html sub-directory, then that directory will be scanned completely.

Recent scan
If you want to check the same path as a previous scan, but only those files created or modified in the recent past, you have to run maldet with the –scan-recent option and the number of days n

sudo maldet –scan-recent /home/username/public_html/

A weekly incremental check will be done by doing such a recent scan for 7 days.

Automate periodic scan
You can automate daily scans using the cronjob feature. During installation, LMD installs a cronjob at /etc/cron.daily/maldet.

This cronjob will update signatures, include new malware threats in its registry and perform a daily check of all the home directories and recent changes on the server. Whenever, it detects some malware, it will notify you specified in the configuration.

Monitor mode
The inotify monitor can be used to monitor users real-time for file creation, modification or movement. Monitoring can be done with one or more of the three options available,

Monitor users
The users option will take the home directories of all users in the system who have UID greater than inotify_minuid and monitor them. If inotify_docroot is set, the users’ web directory, if it exists, will only be monitored.

sudo maldet –monitor users

Monitor paths
Alternately, you can monitor paths. Give a comma-separated path with the –monitor option.

sudo maldet –monitor PATH1,PATH2,…
For example,sudo maldet –monitor /tmp,/home,/var

Monitor files
If you have concerns about specific files, you can monitor specific files by giving a comma-separated list of files.

sudo maldet –monitor FILE1,FILE2,..

Exclude files or paths
Certain paths or files can be excluded from the scan, by using the ignore files.

Add files or paths to be excluded from daily scan in /usr/local/maldetect/ignore_paths

Add signatures to be excluded from daily scan in /usr/local/maldetect/ignore_sigs

Add files or paths to be excluded from inotify monitoring in /usr/local/maldetect/ignore_inotify.

Add the extensions of file types that you want to exclude from daily scans (one per line) in /usr/local/maldetect/ignore_file_ext. Sample entries in file could be

.png
.jpg
Check out more options like running maldet in the background and other finer settings by using the help option.

sudo maldet –help
If you run a self-hosted website, at some point or the other, it is possible for malicious hackers to inject malware into your system. Before that happens, get your system secure and install maldet to keep ahead of such attacks.[/vc_column_text][/vc_column][/vc_row]

Detect and remove malware on your Linux server

Detect and remove malware on your Linux server

Today, we learn how to remove malware in a Linux server. It is not 100% but it is the cheapest way to detect, clean or quarantine malware. I recommend this to be installed on all Linux server especially you are using open source CMS like WordPress for your website.

What is malware?

Malware is usually identified as any kind of harmful software or code that is harmful to devices.

Dangerous, invasive, and deliberately nasty, malware seeks to get into, harm, or deactivate computer systems, computer devices, networks, tablets, and mobile phone devices, often simply by taking general control over a device’s functions. Just like your flu, it disturbs with regular performance.

Malware is most about making income off you illicitly. Even though malware is not able to harm the physical equipment of devices or network system equipment it may take, encrypt, or erase your data, modify or maybe hijack main computer system capabilities, and spy on the device activity not having your knowledge or authorization.

Linux Malware Detect commonly referred to as Maldet is just an open-source malware scanner for Linux produced under the GNU GPLv2 license. The idea is built in and around the dangers experienced in shared hosted conditions. Install, configure and run this kind of free of charge software to detect and remove malware on your server.

Installation
Login as root or a user with root permissions into the server.

The source code of the current stable version of LMD or maldet is obtainable as a tarball in that link. Download it.

sudo wget http://www.rfxn.com/downloads/maldetect-current.tar.gz
Unpack that tarball.

sudo tar -xvf maldetect-current.tar.gz
After that, list its files to discover the directory in which it is set up. The directory is generally of the format maldetect-x.y.z where x.y.z is the version number. Switch to this directory.

cd maldetect-1.5
Check if perhaps the install.sh script is certainly there and installs it.

sudo ./install.sh

The next topic will teach you on how to configure maldet

How to prevent your website against hackers?

How to prevent your website against hackers?

We do not many cases but there is always a website was hacked and asked the same questions, how was my website hacked? And how to protect them?

There are a few reasons for your website was hacked. Occasionally, we can only share the possibilities until further investigation like checking the log files.

It is difficult to eliminate totally but we suggest you protect them. This will make hacking difficult or not possible.

Hackers are looking for backdoors to penetrate your website, only if you can shut it,  Here are some inexpensive ways to protect your website.

  • updated script and plugins – if you are using WordPress, Joomla or similar, always have up-to-date CMS, plugins and the PHP.
  • Limited your SQL connection or to local connection only.
  • Restrict your administration login page.
  • Use malware scanner to scan your website daily during off-peak.
  • Use WAF like Sucuri Firewall, you update less often which is useful to some.
  • Computers access to the website backend and control panel must install and scan by a good anti-virus/malware and up-to-date definition.
  • Use Strong Password for all users.
  • A penetration test. You can find a free solution online.
  • Use mod_security cPHulk brute-Force or Fail2ban – these can be found in popular cPanel or Plesk Onyx.
  • Use Firewall like CSF or APF. However, I don’t really recommend a software firewall. They can paralyse the website if you are under attacks while it takes resources from your server.

Lastly, you always have a backup copy can restore an up-to-date website.

Sucuri Firewall Pro is better?

Sucuri Firewall Pro is better?

Sucuri Firewall Pro is better? Yes, in a way. It depends on the users, and on how he or she is managing the website. However, I personally feel Sucuri is better and can be better.

In the market, Sucuri is not the only one markets website protection. There is big name like Cloudflare, Stachpath and others. But my discussion is on Sucuri today, and the Pro plan. They don’t have a free plan like Cloudflare. For their plans: You can find it here

I set up and use most, Actually, they do the job. However, I like Sucuri. The set up gives me a feeling that it is more secure for those choose to use their own DNS. The website webroot point to Sucuri proxy, not to your source. In this way, it is difficult to find your source IP and attack it.

Even your source IP is exposed, you can protect your web server only allowing sucuri proxies to access it. It is strongly recommended that you do that. When you are using a firewall proxy, your log will show the proxy IP instead. Sucuri has a tutorial on this, how The X-forward can be found here for the most web server.

Sucuri Package from us comes with monitoring too. You can check your website is status and infected by malware or not as little as 6 hours interval.

Most website proxies include CDN. With the feature, it speeds up your website. A bigger brand has more POP than Sucuri. However, never get the impression that the site responds faster. For example, my website vastspace.net scores 86 in Pingdom speed test with Sucuri and 72 only with the other firewall. Test location for both set up was the same. To confirm, I used GTmetrix, Yslow is 81 and 89 with Sucuri.

I feel too the website has loaded faster even the load time at GTmetrix has proven.  I’m not sure you have to pay more to improve loading speed (image loading speed for example) if this is the case, Sucuri is cheaper.

Sucuri is easy to understand and straight forward to most as compared to many web firewall. I found what I need, I have tried some web protection GUI. I’m either overwhelmed by the clickable icons or they have limited features. Actually, the worst feelings are having to pay for a particular feature. In my opinion, do not put them there but sell them as the addons.

Like I have mentioned, this is my opinion. Sucuri is value for money. It costs lesser than most, you will get website protection and speed. It is worth considering.

 

 

 

Modsecurity in cPanel

Another great feature in WHM/ cPanel easily neglected is the modsecurity. It is useful you have not got any web protection like Sucuri Firewall Pro. Users did not enable this feature to protect their open sourced website like WordPress, Joomla etc. This module is enabled by default but there is no rule to process. So it is as good as it is disabled.

Go to modsecurity to install vendors, I use OWSAP commonly. And remember to enable to process the rules in configuration. The rules will stop common attacks and viabilities of your website. This is important feature to those do not have ant web protection.

CSF and WHM/ cPanel

This is commonly found in a WHM / cPanel VPS or dedicated server. Actually, CSF is effective and it is free. A lot of server admin will install them as soon as they have received it. But seriously speaking, how many users know how to tweak and optimise the performance. Honestly, very few and I always see people left them in auto-pilot mode and full stop. So what is CSF? Yes, it is a firewall and it is software based. It is installed onto the server.

There is nothing wrong to install a piece of free and useful software. Wait for a second, did I just say it was useful? In certain extent, it is a Yes. But I have seen many cases, CSF is added burden to the user.

I have seen many as I have said, they simply install and turned on the firewall. If you are doing this, you might accidentally block good users or in the worst situation, you are blocked. When such a thing has happened, may have treated the service is not available and it can be frustrating especially it has happened often. There is the case, like packet loss when you are pinging the server IP or domain name. This is because of CSF. Simply turn it off and everything is back to normal.

Don’t get me wrong, CSF is useful but you need to know how to use it. Without, it can be a hassle for you. So I never buy an idea like installing a software firewall on the server. Actually, if the attacks come, the firewall will eat up the resources on the server and eventually the server performance is affected. But a web firewall like Sucuri Firewall Pro does not install onto the server, it has offloaded the server and because of many distributed points, it helps to speed up a website if you are staying further from the source of the website.