How to get started and host your website on CentOs VPS

This series of tutorials will guide you on how to setup your website on a RHEL / Centos 7 linux server. From apache installation to basic firewall setup to SSL certificate to wordpress installation everything is covered.

List Of Setps

1. Starting up: The first step
2. Apache HTTP server Installation
3. MySQL Database Installation
4. PHP Installation
5. Virtual Host configuration
6. Installing WordPress
7. Setting up cloudflare SSL
8. Changing the SSH port
9. iptables basic firewall setup
10. Installing and configuring fail2ban intrusion prevention software
11. Disabling root login
12. Disabling direct IP access

Disabling direct IP access prevents  anyone from accessing your website using the IP address.
If anyone tries to access your site using the IP address then a 403 Forbidden error will be shown.

To disable direct IP access you would have to edit the virtual host file

sudo vi /etc/httpd/conf.d/example.com.conf

Modify the above command based on your domain name and location of virtual host file.
conf.d directory is the default location of the virtual host file which I used in one of my earlier tutorials about virtual host.

Paste the code given below in your virtual host file. Replace 104.225.220.168 with your server’s IP address

<VirtualHost *:80>
    ServerName 104.225.220.168
    Redirect 403 /
    ErrorDocument 403 "No"
    DocumentRoot /dev/null/
    UseCanonicalName Off
    UserDir disabled
</VirtualHost>

After editing the virtual host file restart the server

sudo systemctl restart httpd

Now accessing the site via IP address would lead to 403 forbidden message being displayed

Root login should ideally be disabled due to security reasons.

To disable root login edit the sshd_config file using vi or any other editor

 sudo vi /etc/ssh/sshd_config

The above command would open up the sshd_config file

Change the line
#PermitRootLogin yes to PermitRootLogin no

After making the change restart sshd

sudo systemctl restart sshd

Fail2Ban is an intrusion prevention software framework that can protect your VPS by banning IPs that show malicious signs such as too many login failures.

To install Fail2Ban first install epel-release

sudo yum install epel-release

Now install Fail2Ban

sudo yum install fail2ban

Enable

sudo systemctl enable fail2ban

The default fail2ban configuration file is /etc/fail2ban/jail.conf.
It is not recommended to modify the original /etc/fail2ban/jail.conf directly.
Instead, we should configure the local copy called jail.local which will override the jail.conf file.

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Now open jail.local file in vi or any other editor

sudo vi /etc/fail2ban/jail.local

This is what the default fail2ban files looks like

I changed the default ban time to 36000 which is equal to 10 hours.
Monitoring ssh (sshd) logins has also been enabled.

bantime = 36000 = 10 hours
maxretry changed to 4 which is the number of failed attempts before a host is banned
findtime = 600 = 10 minutes : 4 unsuccessful login attempts within 10 minute window would lead to ban.

destmail = email where you want to receive ban messages and notifications.

Change (action_)s to (action_mwl)s if you want to receive email alerts and logs. If you want only email alerts and no logs then (action_mw)s

After you are done save and quit the file and then restart Fail2ban

sudo service fail2ban restart

Or

sudo systemctl restart fail2ban 

First install iptables with this command

sudo yum install iptables-services

Now start iptables

sudo service iptables start

Use the below command to flush any existing rules that might be there

sudo iptables -F

Now add rules one by one by executing the following commands

Block null packets

sudo iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

Reject is a syn-flood attack

sudo iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

XMAS packets

sudo iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

Allow localhost traffic

sudo iptables -A INPUT -i lo -j ACCEPT

Allow http port 80

sudo iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT

Allow https port 443

sudo iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

Allow SMTP

sudo iptables -A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
sudo iptables -A INPUT -p tcp -m tcp --dport 465 -j ACCEPT

Allow POP3

sudo iptables -A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
sudo iptables -A INPUT -p tcp -m tcp --dport 995 -j ACCEPT

Allow IMAP

sudo iptables -A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
sudo iptables -A INPUT -p tcp -m tcp --dport 993 -j ACCEPT

Allow SSH

sudo iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT

Caution: You could potentially loose ssh access to your server if you are not careful with this. If you have changed the SSH port number and are not using the default port 22 to login then replace 22 with the appropriate port number.

Allow established outgoing connections to receive incoming replies.

sudo iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Now allow all outgoing connections and block all the incoming connections except the ones we have explicitly allowed in the above rules.

sudo iptables -P OUTPUT ACCEPT
sudo iptables -P INPUT DROP

Now save the firewall rules

sudo iptables-save | sudo tee /etc/sysconfig/iptables

or

sudo iptables-save > /etc/sysconfig/iptables

Enable

sudo systemctl enable iptables

Now restart iptables

sudo service iptables restart

or

sudo systemctl restart iptables

Useful command:
List iptables firewall rules

sudo iptables -S

sudo iptables -L -n