Best Practices for DirectAdmin Security

1. BestPracticesfor DirectAdminHosting Security

2. 1) Mount /tmpPartitionwithnoexec andnosuidOptions i) Configuration of the /tmp partition is defined in the /etc/fstab file. To configure the partition with noexec and nosuid, follow these steps: ii)Edit the /etc/fstab file by typing: # vi /etc/fstab Find the following line in the file: UUID=0aef28b9-xxxxxxx /tmp ext4 defaults 1 2 iii)Edit this line with the options so that it reads like this: UUID=0aef28b9-xxxxxxx /tmp ext4 defaults,nosuid,noexec 1 2 iv) Save and close the file. In a virtual environment, you don’t have access to the /tmp partition. Instead, you can create a new directory and create a symbolic link to it. First, create a new directory where you want to store temporary files. Then, run the following command: ln -s <old_tmp_directory> <new_tmp_directory>

3. 2) DisableDangerousPHPFunctions Usingthedisable_functionsList i) To disable dangerous PHP functions, follow these steps: Switch to the custombuild directory by typing: $ cd /usr/local/DirectAdmin/custombuild ii) Update the disable_functions configuration by typing the following: ./build set secure_php yes ./build secure_php

4. 3) RegularlyUpdateSystemServicesand Libraries Update DirectAdmin services and scripts, run the following commands: cd /usr/local/DirectAdmin/custom build ./build update ./build all d

5. 4)Configuresafe_modeand open_basedirinPHPCLIMode To configure PHP to run in safe mode, you must edit the php.ini file. Open the file and find the line with the safe mode configuration: safe_mode = Off Change this line to the following: safe_mode = On Also read:https://www.hostingseekers.com/blog/plesk-vs-cpanel-vs- directadmin-comparison/

6. 5) Install suPHP 6) Bind MySQLd to 127.0.0.1 (Localhost) In the /etc/my.cnf file, change the MySQL section to the following: [mysqld] bind-address = 127.0.0.1

7. 7) AddApachemod_security 8) ForceDirectAdmintoUseNewerSSL/TLSVersions 9) BlockApacheUsersfromExecutingPerlScripts 10) DisableDirectAccesstoSSHfortherootUser 11) TurnOnBrute-ForceDetection 12) UseSecureEmailConnections

8. 13) Disable UserDir Access Use the following command to disable the user directory: cd /usr/local/directadmin/custombuild ./build set userdir_access no ./build rewrite_confs I 14) Install Anti-Malware Extensions