After login into phpMyAdmin panel I get this error message[1]
Everything work fine I can manage everything, but if security is important for you, you should look at the solution. Continue reading ‘phpMyAdmin blowfish_secret’
Tag Archive for 'security'
SSH is by default very strong, and since a long time without critical bugs. It has strong protection against various hacks and known vulnerabilities. For instance SSH has a password retry wait time of (default) five seconds. This makes the time for brute force attacking an SSH-server very long and not effective. However, sometimes script-kiddies will fork their hacking program making multiple processes of the brute force attack. Sometimes they are able to fork it off upwards of 1000 attempts every 5 seconds. This drastically minimizes the time to crack short passwords.
I think SSH is secure enough, but there is always a way to make it more secure.
Install knock daemon:
1 | aptitude install knockd |
In order to do this, you need to do some sysdmin job:). I am going to specifically focus on Apache and PHP because I’m more of a LAMP user. If you use ASP on Microsofts IIS, I can’t help you (but hey!, Google is there to save your sunny day! :P)
Find your php.ini file in my case,
1 | vim /etc/php5/apache2/php.ini |
Look for the line that says: “expose_php On“
Change it to:
1 | expose_php Off |
Now our PHP is very silent
Note by PHP developer:
; Decides whether PHP may expose the fact that it is installed on the server
; (e.g. by adding its signature to the Web server header). It is no security
; threat in any way, but it makes it possible to determine whether you use PHP
; on your server or not.
By default apache shows on each directory listing, error or non existing page etc. apache version, OS Version and some apache modules in the bottom of your site.
Attackers can use this information to their advantage when performing an attack.
I describe a little bit how to secure apache2, to prevent the showing of apache version and server strings.
1 | vim /etc/apache2/conf.d/security |
Configuration should be:
2 3 4 | ServerTokens Prod ServerSignature Off TraceEnable Off |
Restart apache:
1 | /etc/init.d/apache2 restart |