Securing HiTechCloud

This section describes the best practices and settings that can increase the security of your HiTechCloud server and, thus, protect it from various types of attacks and loss of sensitive data:

Ports and firewall

A new server has ConfigServer Firewall (CSF) installed but switched off, so that a rule cannot lock you out during the install. Turn it on as soon as you can reach the server:

hitechcloudcli firewall on

It opens what the server serves on: 80 and 443 (websites), 2083 (panel), 2087 (admin), 2096 (webmail), 8888 (phpMyAdmin), 53 (DNS), 25, 465 and 587 (mail), 110, 143, 993 and 995 (mailbox access), 20, 21 and the FTP passive range, the SSH port from sshd_config, and 2091 to 2093 for the customer portals that are on. It allow-lists the address you run it from. Database and cache ports (3306, 5432, 6379, 27017 and others) are never opened by it. See hitechcloudcli firewall.

Services that only the server itself uses stay on loopback: the web servers behind the front end, the portal API (2094) and the Redis and Valkey instances (every update re-checks that the cache instances listen on loopback only: hitechcloudcli objectcache loopback).

Fail2ban

The installer sets up fail2ban with these jails in /etc/fail2ban/jail.d/hitechcloud.conf: sshd, hitechcloud-panel (failed sign-ins to 2083 and 2087, from /var/log/hitechcloud/user/failed_login.log; 3 attempts, banned for 2 hours), postfix, dovecot and pure-ftpd. The default is 5 attempts within 10 minutes, banned for 1 hour.

The address the server was installed from is added to ignoreip, so the person installing it is not locked out. An install that was not run over SSH has no such address: add yours to ignoreip in that file if you administer the server remotely, then systemctl reload fail2ban.