artaman

Just a little config cuts from production node served for web-related services, client ftp & cerebro, etc. It’s about CentOS based system and assume that you know what you do.

vsftpd. Regarding to this service I highly hope that in some future all customers and their managers should be able to press F1 and read how to setup local clients for TLS/SSL connection. Unfortunately, now we need to use plain authentication paying maximum attention to secure such transactions. Please notice, that chroot’ing users to their home directories would be more useful if you move that to separate partition early.

anonymous_enable=NO
local_enable=YES
check_shell=NO
write_enable=YES
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_file=/var/log/vsftpd.log
idle_session_timeout=600
data_connection_timeout=120
ftpd_banner=Ftp ready
listen=YES
chroot_local_user=YES
# Create userlist and add there ONLY users who can use ftp.
userlist_enable=YES
userlist_deny=NO
userlist_file=/etc/vsftpd/user_list
# Don't forget to create him and switch shell to /sbin/nologin && home to /dev/null
nopriv_user=ftps
# Critical to use in basic centos distribution.
pam_service_name=vsftpd

sshd_conf. Disallow root login and try to keep reasonable number of users who allow to login via ssh. Also disable v1 protocol and misc. noted below.

Port XXXX
Protocol 2
PermitRootLogin no
UsePrivilegeSeparation yes
AllowTcpForwarding no
X11Forwarding no
StrictModes yes
IgnoreRhosts yes
HostbasedAuthentication no
RhostsRSAAuthentication no
PermitEmptyPasswords no
Banner /etc/motd
AllowUsers xxxxx

firehol. Allow nothing except ssh and anything_you_need™ (don’t forget to change it to supported service).

version 5
server_ssh_ports="tcp/XXXX"

# Accept all client traffic on any interface
interface any world
        protection strong
        policy drop
        server "ssh and_anything_you_need" accept
        client all accept

nginx. Of course you have intranet, website or both. Nginx is my favourite and he is blazing fast. If you need php (or perl/python, etc…) you can spawn them by fcgi, there is no problem. Notice gzip_static setting. It allow you to serve previously gzipped content instead of regular one, so you can write a one-line bash script to compress specific type of files and save some bandwidth.

user  nginx;
worker_processes  1;
worker_rlimit_nofile 100000;
timer_resolution 100ms;
worker_priority -2;

error_log   /var/log/nginx/error.log;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
    use epoll;
       }

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;
    server_tokens   off;
    gzip            off;
    gzip_static     on;
    keepalive_timeout  3;
    }

# There is nothing interesting below this line.

If you interested in details or want to ask something — feel free to comment this post.