Skip to content

Security

CpHulk

DOS attack methods

Firewalls such as CSF with LFD; Apache’s mod_evasive or mod_qos modules for Apache-specific attacks. cPHulk does not provide protection against these types of attacks.

  • BruteForce attack (Authentication-based)

Tools to use:

cPHulk Brute Force Protection provides an effective layer of protection against these types of attacks, by monitoring incoming authentication attempts and applying rules as necessary.

Cphulk applies to the following services

  • SSH, FTP, IMAP , POP3, SMTP
  • And Any 3rd-party services that authenticate using PAM.
Mod Security CONFIGURATION FILES /etc/apache2/conf.d/modsec_vendor_configs/

Mod Security Phases

  • 5 Phases of Http traffic filtration
  • Request Header
  • Request Body
  • Response Header
  • Response Body
  • Logging

Source HTTP

Full list of Headers

request-header = Accept
- Accept-Charset
- Accept-Encoding
- Accept-Language
- Authorization
- Expect
- From
- Host
- If-Match

  • If-Modified-Since
  • If-None-Match
  • If-Range
  • If-Unmodified-Sinc
  • Max-Forwards
  • Proxy-Authorizatio
  • Range
  • Referer
  • TE
  • User-Agent

Request Body

Method "OPTIONS"
- "GET"
- "HEAD"
- "POST"
- "PUT"
- "DELETE"
- "TRACE"
- "CONNECT" - extension-method - extension-method = token

Response Header

  • Accept-Ranges
  • Age
  • ETag
  • Location
  • Proxy-Authenticate
  • Retry-After
  • Server
  • Vary
  • WWW-Authenticate

Response Body

  • Status Codes 200,400,404,500,504,502 etc

Logging

ModSecurity Rules Documentation

DOCS

Syntax of ModSecurity

SecRule Variables Operator [Action]

Mod Security actions

  1. Disruptive The ModSecurity engine acts on the item, whether that be to allow, refuse, or otherwise alter a transaction.

  2. Non-Disruptive An action is taken, however, it is prevented from interrupting or affecting the processing of rules. This might be something like modifying the value of a variable or creating a new variable.

  3. Flow A change in the progression of rule processing - an example of this might be a rule that instructs ModSecurity to skip to another rule.

  4. Meta-Data Analyzes specifically the meta-data values of the item (id, msg, URI, and data), which provides a data fragment for analysis. Find more information in the official ModSecurity documentation Docs

  5. Data Primarily used to hold notes or additional details of some kind and does not interfere or act on the connection being processed

Types of attacks ModSec can protection

  1. Code/SQL injection
  2. DoS via HTTP POST
  3. Common Exploits
  4. Common Trojans

Security Models

  1. POSITIVE Model ModSecurity rejects everything except confirmed / whitelisted traffic.

  2. NEGATIVE Model ModSecurity seeks out malicious traffic to filter from the entirety of incoming requests.

  3. Virtual Patching

  4. Extrusion Detection

CSF And Host Access Control

  • Works with file : /etc/hosts.allow Those services include:

  • cPanel (cpaneld)

  • WHM (whostmgrd)

  • Webmail (webmaild)

  • Web Disk (cpdavd)

  • FTP (ftpd)

  • SSH (sshd)

  • SMTP (smtp)

  • POP3 (pop3)

  • IMAP (imap)

FTP Enabloing FTP port range passive ports in iptables

https://www.cyberciti.biz/faq/linux-iptables-multiport-range/ cPanel docs

iptables -I INPUT -p tcp --match multiport --dports 10000:20000 -j ACCEPT
- Using NFT Tables 
nft add rule filter INPUT tcp dport 49152-65534 accept
nft -s list ruleset | tee /etc/sysconfig/nftables.conf # to save the ruleset post reboot
  • FirewallCMD
firewall-cmd --permanent --zone=public --add-service=ftp
firewall-cmd --permanent --add-port=49152-65534/tcp
firewall-cmd --reload
  • Your IP address is then automatically added as the first IP address on the verified IP address list, stored here:
/var/cpanel/userhomes/cpanel/.cpanel/securitypolicy/iplist/root
  • The question/answer information is stored here (with the answers encrypted):
/var/cpanel/userhomes/cpanel/.cpanel/securitypolicy/questions/root.json
  • As you might guess, the file you'll find this information in may be different for resellers that have these policies configured - hence the specification of "root" as the filename here (leaving room for other user-named files as well).