Take the 2-minute tour ×

This is a CentOS 6.2 system.

For my login with the hosting company website, I set a 20-character mixed case, letters, numbers, symbols password and enabled two-factor authentication.

In /etc/ssh/sshd_config I turned off remote root login and turned of password-based login.

I'm running sshd, Apache, SSL, and MySQL on standard ports (although MySQL should only be accessed from within the same host).

I plan to run yum update -y as a daily cron job. (should I make it hourly?)

I ran this script to configure my firewall...


-A INPUT -i lo -j ACCEPT









Are there any changes that anyone would recommend?

(I realize that any apps I deploy may have their own security issues such as SQL injection or cross site scripting). For now, I'm just talking about the bare setup so far.)

share|improve this question
Define "reasonable" secure? This is so context dependent that it can't be reasonably discussed here. Also, why do you care about firewalls and stuff it you don't even keep your server updated to the newest version of the base OS, which is 6.4? –  SvW Aug 24 '13 at 15:21
I think he pretty much described the context. –  platforms Aug 24 '13 at 15:50
@SvW Sure, no prob. By "reasonably secure" I mean that if I posted the I.P. then you, personally, would be unable to break in. I went with 6.2 because that's what my the hosting company offers and they spend all day, every day evaluating O.S. versions and have a huge financial stake in choosing the right ones (whereas you, in contrast, appear to have spare time to make snarky, obstructive, unhelpful, time-wasting comments on ServerFault). –  Agvorth Aug 24 '13 at 15:50
@Agvorth: IF they spend all day evaluating OS releases why are they 2 behind ? –  Iain Aug 24 '13 at 16:30
add comment

closed as primarily opinion-based by SvW, mdpc, Ward, Falcon Momot, faker Aug 25 '13 at 6:52


1 Answer

up vote 3 down vote accepted

No, it is not secure. It is CentOS 6.2, which is rather old. You should update to the latest released CentOS 6.x and keep doing so. I would also not automatically run yum update, but get nagios to alert you when there are security updates, so you can update manually.

Your firewall is reasonably safe, but I'd replace the trailing -j REJECT rules with a simple REJECT policy on the input and forward chains.

Your SSH config is ok, but if you want to improve it, you could use two-factor authentication with e.g. duo security.

Some more things I would add:

  • ossec for anomaly detection
  • fail2ban for automatic blocking of ssh attacks
share|improve this answer
Yes, having automatic updates through yum might sound like a good idea but it can make your system very troublesome to troubleshoot, because how to you make sure what version reproduced a bug or the like. It being a CentOS System, I'd really invest some time getting it working with SELinux too because it sounds like you are running only stuff which should run well with it on. –  Petter H Aug 24 '13 at 18:46
Thanks, I appreciate you taking the time to answer my question and provide specific advice. It's a help. –  Agvorth Sep 4 '13 at 0:34
add comment
