Enhance Security Options

illuzant

Hello! Just wondering what everyone has setup for security? Looking for something that will scan files and email. Malware scanner type. Hoping for something that is really close to being similar to a native integration.

Thanks in advance!

Oldschool

I'm currently testing cpguard and it looks promising, would love to hear about others as well.

mendozal

I also tested cpguard, it worked very well.

I didn't test it in the email role though, only on the app server.

twest

Bitninja looks promising. I haven't tried them, but a lot of other people here have. I'd be interested to see some results of their supposed "load reduction" too.

Oldschool

twest
Started testing bitninja and they've told me they are still working on supporting OLS but it's not currently supported.

twest

Oldschool did you notice any decrease in load throughout the day? So they're supporting Apache/LS? Hmm... I might need to give them a tester.

ordinary

Oldschool I also ran into problems with BN.

Specifically, the SSL mapping was failing. BN support manually fixed it twice before a senior support person took over the ticket and told me LS wasn't currently supported.

OPS Shield has been great for me so far in production. I'm using LS rather than OLS (as currently the security configuration options are missing in Enhance to allow me to to use the WAF).

Hopefully that gets sorted soon and I'll switch back to OLS.

Oldschool

twest I tried them on a smaller 4.5GB VPS running NGINX and one site on enhance. CPU was minimal but memory utilization went from 25% to between 80% and 95%. I moved the site back off that vps and restarted the server and memory utilization went down to 70% with no sites, no roles on that VPS and has since climbed back up to 83%.

I never ran out of memory and I know unused memory is wasted memory but I'm not sure what it's doing to consume all the memory, didn't notice any real difference on cpguard for resources.

SharedGrid

We tested Bitninja, but at this time they only support HTTP/1.1 with Enhance.

Other than that - they were flawless, support was great and we would have stuck with them if it wasn't for the HTTP/1.1 thing.

8Dweb

We are using cpGuard and it has been working fine. Our app servers are very lightly loaded, so at this point measurements of load impact show negligible difference with or without it in place.

illuzant

Oldschool Do you know if the user count for the license only counts for hosting and email scanning is free? How does that work out? Specially if you have hosting and email separated on different servers. Interested in hearing how the billing works for bitninja and cpguard.

Oldschool

illuzant I've not seen the per user pricing they've previously discussed but a bitninja employee jumped in another thread and said it was counted as a single user.

Bitninja does have a free tier for VPS under 2GB 2Cores and they have discounted pricing for more than 5 servers and for other VPS but I don't know if they have their per user pricing for enhance out yet.

Oldschool

ordinary
I'm running OLS and testing cpguard on enhance, my WAF is enabled, and working (although I don't know how thorough) I'm getting waf logs from some of my sites and the captcha thing is working on log in pages.

ordinary

Oldschool I might need to spin up a new server and in the estate and have another go with OLS.

From memory, using OLS I wasn't seeing anything in WAF logs and OPSS was just saying there was an error. I was under the impression you need to configure OLS and those settings aren't possible to access / persistent yet with Enhance?

I followed the instructions here to get OPSS working with LS: https://opsshield.com/help/cpguard/cpguard-waf-required-settings-and-depencies/

Machiel92

As I am a lover of opensource alternatives, I'm searching around to find one. If I find a suitable one I will mention it here 😉
And no, clamav isn't my lovely software.

Oldschool

ordinary I don't know if it's full featured and completely working but I just did the default install and WAF shows some logs and events and the captcha for login pages is working.

I have the default cpguard install, enhance with OLS and actually have wordfence on the sites too (with PHP directive for wordfence).

Your mileage my vary but that's what I'm getting, I should probably ask their support about full OLS compatibility. Ipdb is blocking a ton.

twest

ordinary that's right, ols doesn't have a persistent config yet, so you can't tweak the ols config (it has a web based GUI config for all options, like adding more workers, etc)... The defaults should be pretty decent for small servers/small VPS, but I probably wouldn't use it on anything bigger than 10cpu, or you might hit config bottlenecks.

MarkNLD

Is anyone using ImunifyAV with enhance?