Cpanel Hardening

You should configure the following in your WHM (CPanel):

Main >> Server Configuration >> Tweak Settings

[x] Prevent the user ‘nobody’ from sending out mail to remote addresses (php and cgi scripts generally run as nobody if you are not using phpsuexec and suexec respectively.)

[x] Track the origin of messages sent though the mail server by adding the X-Source headers (exim 4.34+ required)

Main >> Security >> Fix Insecure Permissions (Scripts)

Main >> Security >> Tweak Security

“Compilers are disabled for unpriviledge users”

Main >> Service Configuration >> Enable/Disable SuExec

suexec Status “enabled”

Main >> Account Functions >> Disable or Enable Demo Mode

Select from “Users” the “demo” account and click “Modify” then click “Disable” if it exists :)

Access Awstats from outside of cpanel

Step 1.
Download awstats from http://awstats.sourceforge.net

Step 2.
Uncompress awstats-5.6.tgz

Step 3.
Copy the contents of the uncompressed cgi-bin folder from your hard drive to the user cgi-bin directory (this includes awstats.pl, awstats.model.conf, and the lang, lib and plugins sub-directories).

Step 4.
If necessary (should not be needed with most setups), edit the first (top-most) line of awstats.pl file that is #!/usr/bin/perl to reflect the path were your Perl interpreter is installed. Default value works for most of Unix OS, but it also might be #!/usr/local/bin/perl

Step 5.
Move AWStats icon sub-directories and its content into a directory readable by your web server, for example /home/users/public_html/icons

Step 6.
Copy awstats.model.conf file into a new file named awstats.myvirtualhostname.conf. This new file must be stored in /home/user/public_html/cgi-bin.

Step 7.

Edit this new config file with your own setup :
- Change LogFile value with full path of your web server log file
(The path is:
LogFile="/usr/local/apache/domlogs/domain.com").

- Check if LogFormat has the value "1" (it means "NCSA apache combined/ELF/XLF log format").

- Change DirIcons parameter to reflect relative path of icon directory.
(DirIcons="/icons")

- Edit SiteDomain parameter with the main domain name or the intranet web server name used to reach the web site to analyze (Example: www.mydomain.com).

IMPORTANT! - Change DirData to use the same Statics file than Cpanel Awstats and do not loose any entry.
(DirData="/home/user/tmp/awstats/")

Step 8.

Access AwStats by the URL:
www.domain.com/cgi-bin/awstats.pl?config=domain.com