Bare essentials?

I am setting up a CentoS 5.2 LAMP server.

Beyond apache, php, and mysql, what are the essential services that should be enabled? What modules should only be enabled for apache and php to maximize security?

I am only interested in the bare minimum to operate a secure server.

Thank you, Jeff

2 Replies

@fos:

Beyond apache, php, and mysql, what are the essential services that should be enabled?
Well, there are basic ones like anacron/atd/crond, syslog, and network. Others like lvm2-monitor and restorecond are enabled on a CentOS Linode I deal with, though I don't know if they're strictly necessary. Of course you'll probably want iptables, sshd, and maybe one of fail2ban or denyhosts.

This is the list on my host (which also runs postfix and mailman in addition to a LAMP site):

$ /sbin/chkconfig --list | fgrep '3:on'
anacron         0:off   1:off   2:on    3:on    4:on    5:on    6:off
atd             0:off   1:off   2:off   3:on    4:on    5:on    6:off
crond           0:off   1:off   2:on    3:on    4:on    5:on    6:off
fail2ban        0:off   1:off   2:off   3:on    4:on    5:on    6:off
gpm             0:off   1:off   2:on    3:on    4:on    5:on    6:off
httpd           0:off   1:off   2:on    3:on    4:on    5:on    6:off
iptables        0:off   1:off   2:on    3:on    4:on    5:on    6:off
lvm2-monitor    0:off   1:on    2:on    3:on    4:on    5:on    6:off
mailman         0:off   1:off   2:on    3:on    4:on    5:on    6:off
mysqld          0:off   1:off   2:on    3:on    4:on    5:on    6:off
network         0:off   1:off   2:on    3:on    4:on    5:on    6:off
postfix         0:off   1:off   2:on    3:on    4:on    5:on    6:off
postgrey        0:off   1:off   2:on    3:on    4:on    5:on    6:off
restorecond     0:off   1:off   2:on    3:on    4:on    5:on    6:off
sshd            0:off   1:off   2:on    3:on    4:on    5:on    6:off
syslog          0:off   1:off   2:on    3:on    4:on    5:on    6:off
xfs             0:off   1:off   2:on    3:on    4:on    5:on    6:off

We haven't bothered to prune off things like gpm and xfs; I imagine disabling these wouldn't break anything…

Thank you Vance. That is just the kind of thing I was looking for.

Jeff

Reply

Please enter an answer
Tips:

You can mention users to notify them: @username

You can use Markdown to format your question. For more examples see the Markdown Cheatsheet.

> I’m a blockquote.

I’m a blockquote.

[I'm a link] (https://www.google.com)

I'm a link

**I am bold** I am bold

*I am italicized* I am italicized

Community Code of Conduct