Essential web-server security

essential_server_security.txt

# ------------------------
# SSH:
# ------------------------
#http://wiki.centos.org/HowTos/Network/SecuringSSH
#https://www.linode.com/docs/security/securing-your-server/

sudo nano /etc/ssh/sshd_config
Port 20202
PermitRootLogin no
#PermitRootLogin without-password
# OR (AWS)
# Only allow root to run commands over ssh, no shell
# PermitRootLogin forced-commands-only
UseDNS no
PasswordAuthentication no 
AllowUsers avd deployer
#AWS: AllowUsers avd deployer ec2-user

sudo systemctl restart sshd
#sudo service ssh restart
#/etc/init.d/sshd restart

# ------------------------
# FW: FirewallD
# ------------------------
# @see ~/avd-conf/root/sh/srv/setup_fw.sh
firewall-cmd --zone=public --add-service=http
firewall-cmd --zone=public --add-service=https
firewall-cmd --zone=public --add-service=smtp
firewall-cmd --runtime-to-permanent
firewall-cmd --zone=public --permanent --list-service
firewall-cmd --zone=public --list-ports
firewall-cmd --reload

sudo systemctl restart firewalld

# ------------------------
# nginx:
# ------------------------
# https://weakdh.org/sysadmin.html
time openssl dhparam -out /etc/nginx/ssl/dhparams.pem 2048

# nginx.conf:
server_tokens off;
add_header X-Frame-Options SAMEORIGIN;

# ------------------------
# PHP:
# ------------------------
expose_php = Off