Securing Your Server?

In the past week or so we've had countless attempts at people trying to hack into our sever, most noteably when somebody tried to get FTP access to corrupt files, but made sure to spoof an admin IP so it would go unnoticed. So, as you can imagine, we're starting to get a bit paranoid. Aside from install most of the 3.5.2-4 security hacks on this board (which was already somewhat planned), what else can be done in terms of server configuration, software, firewall settings, ect to help better secure our box?

[Trigunflame]

Originally Posted by AdminNation

In the past week or so we've had countless attempts at people trying to hack into our sever, most noteably when somebody tried to get FTP access to corrupt files, but made sure to spoof an admin IP so it would go unnoticed. So, as you can imagine, we're starting to get a bit paranoid. Aside from install most of the 3.5.2-4 security hacks on this board (which was already somewhat planned), what else can be done in terms of server configuration, software, firewall settings, ect to help better secure our box?

Lockdown php with open_basedir for PHP stuff.
Server side, compile a monolithic kernel with grsec, preferably a 2.6.x build.
As for FTP server, it depends which you are using and if its chrooted or not.
Chroot your nameserver, webserver, and FTP if its not already along with any other public services.
Firewall settings are going to be geared mainly towards deflecting illegitimate traffic, that being udp floods, tcp connections, concurrent request etc..
Prevent direct root login, make sure you have to login as a system user first then su- to root; also change SSH to a higher level port thats not currently in use, possibly change ftp to another port as well.

[turkforum]

I do Close all unnecessary ports. Update the server every day. Check the Logs. let my mods change their pass every month or week (admins). And still looking for a nice firewall for a windows machine.

[Paul M]

Originally Posted by turkforum

And still looking for a nice firewall for a windows machine.

Have you tried Winroute Pro ?

[cirisme]

I use DenyHosts to help in the security fight.

[who is chris c]

also you can move ftpd to a secureftpd (data encryption)

[Erwin]

Don't use ftp - close that port, and use only ssh2.

[GrCh_Jeff]

Originally Posted by Erwin

Don't use ftp - close that port, and use only ssh2.

is that like ftp?

[who is chris c]

ssh is an encrypted telnet protocol:

Ssh2 (Secure Shell) is a program for logging in on a remote machine and
executing commands on a remote machine. It is intended to replace rlogin
and rsh, and provide secure, encrypted communication channels between two
hosts over an insecure network. X11 connections and arbitrary TCP/IP ports
can also be forwarded over such secure channels.

[mikeylikesitz]

and for those of you who dont know about winscp, it is a great windows based ssh transfer program.

http://winscp.net/eng/docs/introduction

i dont use ftp at all on my server, only ssh on a higher port and this program.