Bare essentials?
Beyond apache, php, and mysql, what are the essential services that should be enabled? What modules should only be enabled for apache and php to maximize security?
I am only interested in the bare minimum to operate a secure server.
Thank you, Jeff
2 Replies
@fos:
Beyond apache, php, and mysql, what are the essential services that should be enabled?
Well, there are basic ones like anacron/atd/crond, syslog, and network. Others like lvm2-monitor and restorecond are enabled on a CentOS Linode I deal with, though I don't know if they're strictly necessary. Of course you'll probably want iptables, sshd, and maybe one of fail2ban or denyhosts.
This is the list on my host (which also runs postfix and mailman in addition to a LAMP site):
$ /sbin/chkconfig --list | fgrep '3:on'
anacron 0:off 1:off 2:on 3:on 4:on 5:on 6:off
atd 0:off 1:off 2:off 3:on 4:on 5:on 6:off
crond 0:off 1:off 2:on 3:on 4:on 5:on 6:off
fail2ban 0:off 1:off 2:off 3:on 4:on 5:on 6:off
gpm 0:off 1:off 2:on 3:on 4:on 5:on 6:off
httpd 0:off 1:off 2:on 3:on 4:on 5:on 6:off
iptables 0:off 1:off 2:on 3:on 4:on 5:on 6:off
lvm2-monitor 0:off 1:on 2:on 3:on 4:on 5:on 6:off
mailman 0:off 1:off 2:on 3:on 4:on 5:on 6:off
mysqld 0:off 1:off 2:on 3:on 4:on 5:on 6:off
network 0:off 1:off 2:on 3:on 4:on 5:on 6:off
postfix 0:off 1:off 2:on 3:on 4:on 5:on 6:off
postgrey 0:off 1:off 2:on 3:on 4:on 5:on 6:off
restorecond 0:off 1:off 2:on 3:on 4:on 5:on 6:off
sshd 0:off 1:off 2:on 3:on 4:on 5:on 6:off
syslog 0:off 1:off 2:on 3:on 4:on 5:on 6:off
xfs 0:off 1:off 2:on 3:on 4:on 5:on 6:off
We haven't bothered to prune off things like gpm and xfs; I imagine disabling these wouldn't break anything…