Hardening my server, Anything else I have to do?

[jake66]

I am sure this has been addressed many times before, but I am not sure of the terms to use in a search query to get the most relevant topics to show.

I am on a "managed" VPS server, but it seems as though the responsibility to securing the server is still up to me. I was several versions behind on cpanel and I had to notify them about this in order to upgrade. I have since figured how to do this myself and began a trial & error on other security features.

Firewall
I enabled the default Virtuozzo firewall. Blocked access to everyone (except me) on:
SSH
FTP
..is this firewall good enough?

FTP
Recently I came across a post on this board about the WinSCP client. I ditched my Cuteftp and now exclusively login under my SSH port with WinSCP and using a private key.

Cpanel
Many say the only way to secure this is to dump it altogether, but I prefer it. I find it very easy to use and I disabled all non-necessary applications to lessen the chance of an attack (and to save the load on the server).
I periodically check for new versions & upgrade immediately after I find them.

I also tried to block access to the cpanel port to everyone but me (through the firewall), but I got hundreds of failure notices in my email box the next day, but the site never went down. I'm sure the best place to ask is the CP board, but am simply curious if there's another way to disallow anyone but my IPs access to it.

Apache
I am running 3 versions newer than PayPal. I've decided I won't migrate to 2.0 until they do, for fear of breaking some of my applications. (If they're secure enough to hold millions of credit card numbers.. I figure I'm safe too. And no I do not store CC#s :) )
FYI: I am on 1.3.39
PayPal: 1.3.33

Scripts
I upgrade script patches immediately once security fixes are released.

Passwords
WHM and Virtuozzo both login under: root
Does this matter?
I periodically change the passwords to stuff like 65ds4g5HUFHU89384

Blocking
Periodically I check my logs and block suspicious IP ranges (mostly those that are outside of the areas I prefer to work with) I realize this isn't fool-proof, but it's better than doing nothing.

What else can I do to heighten my VPS' security?

[jake66]

As well, I have mod_security enabled on my server with only default rules. I have yet to figure out how to add new rules. I'm a bit hesitant to trial and error on it. What's the worst that could happen if I make a mistake? Can they be easily undone without any real damage? (I realize I can look up tutorials.. but I prefer to hear about this type of stuff from people who've actually used it themselves & made a mistake or two. Most tutorials leave out the bad what-ifs.)

[lammert]

What else can I do to heighten my VPS' security?

Move to a dedicated server. A VPS is just a virtual box in a real server and your security policy will never be better than the policy applied by the hosting company to the root-access to that server.

I was several versions behind on cpanel and I had to notify them about this in order to upgrade.

If this is how your hosting company responds to security issues, it validates my first point.

[jake66]

I'm a bit hesitant to jump into a dedicated server, as my current load is acceptably fast on my VPS.

I've also only been able to locate unmanaged options. (Or, dedicated hosts offering "support" for an extra fee.. for nearly the cost of the entire server) I can't say I'm too advanced with the technical aspects of running a server. Patching applications I've been able to teach myself thus far, but I had a hard time installing the easiest of applications. so I do need the option of being able to ask somebody else to get in there and install what I need, when I need it.

[edited by: phranque at 12:57 am (utc) on Mar. 16, 2008]
[edit reason] hosting discussion [/edit]