Is it possible to change TTL SOA records in all domain zone files?

Yes, it is possible to change the

- TTL
- Refresh
- Retry
- Expire
- Minimum

records by updating the `dns_recs` table in the psa database:

If these parameters are absent, the default settings are be used.

Example:

UPDATE dns_recs SET val=”900? WHERE type=”SOA” AND host=”TTL”;

After updating the records you will need to rebuild all of the domain zone files by running the following command:

“%plesk_bin%dnsmng” update *
Keywords: SOA TTL DNS records change

DNSmng.exe fails during domain creation

DNSmng.exe fails during domain creation.

DNSmng.exe fails during domain creation

[FIX] DNSmng.exe fails during domain creation
SYMPTOMS
When creating a new domain Plesk returns the following error:

dnsmng::update() failed: dnsmng failed: Empty error message from utility.
CAUSE
Most probably configuration files of DNS server are corrupted.
RESOLUTION
You can try fixing it using Plesk command line tool:

“%plesk_bin%defpackagemng.exe” –fix –type=dnsserver

“%plesk_bin%DNSMng.exe” update *

Note: One more possible reason is the memory shortage, so please check server resources as well.

Speed up your site with Caching and cache-control

Caching with .htaccess and Apache will take your website and your web skills to the next level. This is some technical and advanced methods condensed to simple htaccess code examples for you. But you must take the time to understand caching with cache-control and other headers and HTTP options before you implement on a production server.

NOTE: Stay tuned I'm working on the update!

Caching with both mod_expires + mod_headers

# Turn on Expires and set default to 0
ExpiresActive On
ExpiresDefault A0

# Set up caching on media files for 1 year (forever?)
<FilesMatch ".(flv|ico|pdf|avi|mov|ppt|doc|mp3|wmv|wav)$">
ExpiresDefault A29030400
Header append Cache-Control "public"
</FilesMatch>

# Set up caching on media files for 1 week
<FilesMatch ".(gif|jpg|jpeg|png|swf)$">
ExpiresDefault A604800
Header append Cache-Control "public"
</FilesMatch>

# Set up 2 Hour caching on commonly updated files
<FilesMatch ".(xml|txt|html|js|css)$">
ExpiresDefault A7200
Header append Cache-Control "proxy-revalidate"
</FilesMatch>

# Force no caching for dynamic files
<FilesMatch ".(php|cgi|pl|htm)$">
ExpiresActive Off
Header set Cache-Control "private, no-cache, no-store, proxy-revalidate, no-transform"
Header set Pragma "no-cache"
</FilesMatch>

Caching with mod_headers

# 1 YEAR
<FilesMatch ".(flv|ico|pdf|avi|mov|ppt|doc|mp3|wmv|wav)$">
Header set Cache-Control "max-age=29030400, public"
</FilesMatch>

# 1 WEEK
<FilesMatch ".(jpg|jpeg|png|gif|swf)$">
Header set Cache-Control "max-age=604800, public"
</FilesMatch>

# 3 HOUR
<FilesMatch ".(txt|xml|js|css)$">
Header set Cache-Control "max-age=10800"
</FilesMatch>

# NEVER CACHE
<FilesMatch ".(html|htm|php|cgi|pl)$">
Header set Cache-Control "max-age=0, private, no-store, no-cache, must-revalidate"
</FilesMatch>

Caching with mod_expires

ExpiresActive On
ExpiresDefault A0

# 1 YEAR
<FilesMatch ".(flv|ico|pdf|avi|mov|ppt|doc|mp3|wmv|wav)$">
ExpiresDefault A29030400
</FilesMatch>

# 1 WEEK
<FilesMatch ".(jpg|jpeg|png|gif|swf)$">
ExpiresDefault A604800
</FilesMatch>

# 3 HOUR
<FilesMatch ".(txt|xml|js|css)$">
ExpiresDefault A10800"
</FilesMatch>

Display Number of Processors on Linux

Display Number of Processors on Linux.

Display Number of Processors on Linux

If you’ve just upgraded your Linux box, or you are wondering how many processors a remote server has, there’s a quick and dirty command you can use to display the number of processors.

On Linux, /proc/cpuinfo contains all of the processor information for all current processors in your computer. This will include the speed, the amount of on-chip cache, processor type, and how many cores.

Here’s the command:

cat /proc/cpuinfo | grep processor | wc -l

The command just looks in the /proc/cpuinfo file, pulls out the number of lines containing the word “processor” and passes them into wc (word count), which returns a count of the CPUs in the system.

Here’s what it returned on my remote server:

[root@root]# cat /proc/cpuinfo | grep processor | wc -l

16

Note that if you have a dual-core processor, it will return each core as a separate processor. You can look at the full output of cat /proc/cpuinfo to see if the chips are dual-core.

OR

You can get a lot of information by typing “cat /proc/cpuinfo”.
[root@root ~]# cat /proc/cpuinfo
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 44
model name : Intel(R) Xeon(R) CPU E5620 @ 2.40GHzstepping : 2
cpu MHz : 2394.063
cache size : 12288 KB
physical id : 1
siblings : 8
core id : 0
cpu cores : 4
apicid : 32
fpu : yes
fpu_exception : yes
cpuid level : 11
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx pdpe1gb rdtscp lm constant_tsc ida nonstop_tsc arat pni monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr sse4_1 sse4_2 popcnt lahf_lm
bogomips : 4788.12
clflush size : 64
cache_alignment : 64
address sizes : 40 bits physical, 48 bits virtual
power management: [8]

If that’s the entire output then you only have a single processor/core. With multiple processors/cores you should see something like (4 processor/core box):

processor : 0
vendor_id : GenuineIntel
<—SNIP—>
processor : 1
vendor_id : GenuineIntel
<—SNIP—>
processor : 2
vendor_id : GenuineIntel
<—SNIP—>
processor : 3
<—SNIP—>

OR

[root@root~]# cat /proc/cpuinfo | grep ‘model name’ | cut -d: -f2
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz

how to Secure Linux server

This article contains configuration information and tips on how to protect your machine. The article is applicable to all popular Linux distributions.

General

Configure and Enable Firewall

The firewall is the front-line defense against remote attacks. It's highly recommended that you enable and configure it. Linux firewall infrastructure is called netfilter/iptables. To configure it, check this Iptables howto, or use a configuration frontend such asm0n0wall (CLI), shorewall (CLI), or FireStarter (GUI).

I suggest that you drop all incoming connections, and then open the ports you need, like SSH or BitTorrent.

Avoid Easy-to-compromise User Accounts

Your machine must not have user accounts with easy-to-guess passwords, especially accounts like test/test or guest/guest. Many Linux worms try to exploit such accounts over SSH. open/etc/passwd and make sure there are no such accounts, if you do have an account like this, delete it:

$ sudo userdel <username>

If you really need such an account for some odd reason, change its shell to /bin/false, so that an attacker cannot login using it:

$ sudo chsh -s /bin/false <username>

Mount /tmp as noexec

Many script kiddies rely on downloading scripts to /tmp and executing them. By mounting /tmp as noexec, scripts located in/tmp will not be executable. This effectively disables exploits that rely on /tmp. Here is the /tmp config line from my /etc/fstab:

/dev/hda5               /tmp            ext2            noatime,noexec 0 0

Protect against Fork Bombs

Fork bombs are programs that keep creating child processes until system resources are all used. They actually aren't remote exploits because they require a local user to execute the bomb; however, users may be tricked into running a fork bomb. For example, the following example may look innocent, but running it on an unprotected system may take the whole system down:

:(){ :|:& }; :

Do not run the above code on an unprotected system!

The above shell script will actually keep forking at an exponential rate until system resources are exhausted.

To protect a system against such attacks, there is a file for limiting the number of processes per user. It is/etc/security/limits.conf. Add the following two lines to it:

@users          soft    nproc  100
@users          hard    nproc  150

These lines prevent anyone in the users group from having more than 150 processes, and issue a warning at 100 processes.

Your system may not have a users group, so you may want to edit the lines to match your needs.

Limit Usage of su/sudo

su lets normal users switch to the root account, and sudo enables granting more privileges to users. It's always better to grant only the absolutely necessary privileges to specific users, and limit the usage of su to a specific group.

When the usage of su/sudo is limited, even if the system is compromised through a dummy account (like test as username and password), the attacker will have less options to play with.

Linux Daemons

OpenSSH

Users of machines with broadband connections usually need to remotely connect to their machines through SSH. So even if the workstation is protected by a firewall, the port of SSH needs to be open for inbound connections. Therefore, SSH is a common target for remote attacks.

Here is a list of OpenSSH configuration settings that make it more secure against attacks. SSH settings are usually located in/etc/ssh/sshd_config:

SSH default port is 22, change it through the line below. This will stop many automated attacks.

Port 22

(change the port number)

Notice that when remotely connecting to your machine, the new port number needs to be specified to the SSH client, for example:

$ ssh -p <new-port> <username>@<host>

Make sure the protocol is set to 2. Version 1 is not secure.

Protocol 2

The following config lines protect against brute force attacks.

LoginGraceTime 2m
MaxAuthTries 6

Random attackers will usually try random usernames when trying to break through SSH, and since the root account exists on every machine, it will be on the attack list. The following config line disables root login over SSH and stops such attackers. If root access to a remote machine is needed, login using your regular account and use sudo:

PermitRootLogin no

A username with blank password may be added accidentally. The following config line disables SSH for such accounts.

PermitEmptyPasswords no

In addition to the configuration lines I listed, and in case you login to your machine from the same IP address or range, limit IP addresses that can connect to SSH using /etc/hosts.allow. Use the following format:

sshd : 127.0.0.1 : allow
sshd : IP address here : allow
sshd : IP address here : allow
sshd : ALL : deny

MySQL

if you use MySQL for local development, then it's safer to limit its connections to localhost (among the other things). To do so, run the mysql_secure_installation script, and it will take care of things for you.

Samba

Many need Samba for sharing files over the local network. Here is a list of config lines to secure it. The configuration file is usually located at /etc/samba/smb.conf or /etc/smb.conf:

hosts allow = 127.0.0.1 192.168.0.0/24
hosts deny = 0.0.0.0/0

These config lines limit the hosts that can connect to Samba to localhost and local IP ranges; modify to suit your needs.

security = user

Set security to user. In this case, users connecting to Samba will need to login before continuing. To add Samba user accounts, use the following command:

$ sudo smbpasswd -a <username>

You will be asked to provide a password for the new account.

If you login to your Samba share from a MS Windows machine, you may set your Samba username/password to match those on Windows, and avoid having to enter them every time you connect to the share.

As a final Samba tip, do not share your home directory. If you do so, you are just asking for trouble. Create a directory for sharing, and drop files there when necessary.

General Tips

• Keep your system up-to-date, especially when security vulnerabilities appear in packages you use. All major Linux distros have security mailing lists, subscribe to your distro's.


• Disable services you don't need. Every open service makes your system more open to attacks.


• Regularly monitor the output of the following command for odd entries:
  
  
  

  $ sudo less /var/log/messages  # System log.
  $ sudo ps aux  # Running processes.
  $ sudo netstat -anp  # Active connections.