After just rebuilding a BlueQuartz box I thought I would copy my install notes. This is an entirely personal list of things that I do to a vanilla install of CentOS/BlueQuartz.  I thought it may be useful to other people. 

Contents

• Change root passwords
• Secure SSH
• Apache Obscurity
• Install ImageMagick
• PHP upload settings
• Add Mime Types
• yum checker
• Setup floppy drive
• Majordomo logfile

Change root password

BQ is initially set with no root MySQL password and the systems root password is set the same as the admin user. These should be changed to something different!

• Change MySQL password wth `/usr/bin/mysqladmin --user=root password NEW_PASSWORD`
• Change root password with `passwd`

Secure SSH

SSH is obviously better than telnet but did you know that the SSH protocol v1 has been cracked for quite some time now. I lock all my boxes down to only use protocol v2 and haven't had any come back on compatability issues.

• Modify `/etc/ssh/sshd_config` to set `Protocol 2`
• Run `/etc/rc.d/init.d/sshd reload`

Apache Obscurity

Yes, this is security through obscurity but everything helps. The following will remove the "signature" at the bottom of pages generated by Apache and will also only report the webserver as "Apache" instaed of the full version number and OS

• Modify (and add if necessary) the following lines in `/etc/httpd/conf/httpd.conf` & `/etc/admserv/conf/httpd.conf`

ServerSignature Off

ServerTokens Prod

• Run `/etc/rc.d/init.d/httpd reload`
• Run `/etc/rc.d/init.d/admserv reload`

Install ImageMagick

A must for most hosting nowadays.  Simply run `yum install ImageMagick ImageMagick-perl` as root.

PHP upload settings

In this new broadband age people are uploading pictures and such to their sites so I change the PHP upload defaults.  Change lines in /etc/php.ini (or your own php.ini) and run `/etc/rc.d/init.d/httpd reload`

post_max_size = 20M

upload_max_filesize = 10M

Add Mime Types

There seem to be some common mime types missing from the default install.  Add the following to `/etc/mime.types` and run `/etc/rc.d/init.d/httpd reload`

application/x-ms-wmz wmz

application/x-ms-wmd wmd

audio/x-ms-wax wax

audio/x-ms-wma wma

image/x-icon ico

text/csv csv

video/x-ms-asf asf asx

video/x-ms-wm wm

video/x-ms-wmv wmv

video/x-ms-wmx wmx

video/x-ms-wvx wvx

yum checker

Now I love the Nuonce/Solarspeed automatic yum installer however I like to install patches on systems when I am there, that way if there are any problems I can fix them straight away.  I have this little script that mails me when there are packages to install.

• touch /etc/cron.daily/yum-check
• chmod 755 /etc/cron.daily/yum-check
• vi /etc/cron.daily/yum-check

#!/bin/sh 

SERVER=`hostname`

OUTPUT=`/usr/bin/yum check-update`

EXITCODE=$?

if [ ${EXITCODE} != 0 ]

then

echo "${OUTPUT}" | /bin/mail -s "${SERVER}: Yum Updater" root

fi

Setup floppy drive

If your system has a floppy disc drive you won't be able to use it until you run `floppy --createrc > /etc/floppy`

Majordomo logfile

I know it's silly but I like all my log files to be in one place....

• cd /var/log/mail
• ln -s /usr/local/majordomo/log majordomo

I hope this is of use to people