Securing Server - Qmail

[chromedome]

We've had issues over the last year or so where we have been playing cat and mouse with php exploits and perl scripts generating massive amounts of spam, filling our quuue's, and making life generally miserable.

Steps we have taken in the past:

Upgrade php
move /tmp to it's own partition and setting up noexec
Installed and regularly run chkrootkit
Installed qmHandle to monitor and clean the queue

We have 2 servers that have gotten hit. One is FreeBSD 5.3, the other is CentOS 3.3, both are running Plesk 7.5.4

Here are my questions:
What is the best way to search out for old/exploitable php scripts?
What is the best way to "lockdown" qmail so that these scripts can not turn the box into a spam-generator
What general "lockdown" recommendations would you add to what we have already done?


Your help is appreciated

 

[eilko]

I haven't found a way to find old scripts but look at
http://www.gotroot.com/tiki-index.php?page=php+security
to make PHP more secure. Also look at
http://www.gotroot.com/tiki-index.php?page=mod_security
to make Apache more secure by denying access to certain flaws in PHP-scripts.

 

[ShadowMan@]

Originally posted by chromedome
What is the best way to "lockdown" qmail so that these scripts can not turn the box into a spam-generator

Not sure Qmail can be locked down as you are thinking. It would have no way of knowing if a message has originated from an exploited script or not.

Originally posted by chromedome
What general "lockdown" recommendations would you add to what we have already done?

ART's Atomic Secured Linux (ASL) Project

AtomicRocketTurtle's ASL

 

[chromedome]

Are you each using the systems listed above? It appears that ART's ASL project contains several of the suggestions listed by eilko.

Assuming i were to put a dev machine online with these new changes, do they play nice with Plesk, or would we be married to ART's updates? (nothing against them - just curious)

Thank you for your suggestions.

 

[ShadowMan@]

The ASL project is IMO a more complete approach. Once installed, you would do best to continue to get the updates for all related packages from ARTs yum repository. I suppose you could try mixing in updates from other sources, but it would definitely not necessarily be in your best interests.

The ASL is not really Plesk related at all, so should not pose any problems with Plesk.

You could also do your Plesk updates from ARTs repository (I do without any problems), as well as other packages (such as php, mysql, etc).

ART = atomicrocketturtle = an original founder of Plesk before the SWSoft buyout = he is astounding at what he does.