SSH into your Plesk machine as “root” and cd to the conf directory for the domain.
Create a “vhost.conf” file in “/var/www/vhosts/<domain name>/conf/”
<Directory /var/www/vhosts/<domain name>/httpdocs>
php_admin_value safe_mode on
php_admin_value open_basedir none
</Directory>
Rebuild the domain configs for the particular host via::–
[ #/usr/local/psa/admin/sbin/websrvmng -u --vhost-name=<domain name> ]
or rebuild all via :
#/usr/local/psa/admin/sbin/websrvmng -a
#service httpd reload
Sunday, 8 July 2012
phpmyadmin upload limitation
To increase the phpmyadmin upload limitation in cpanel servers you can edit the php.ini file mentioned below :
vi /usr/local/cpanel/3rdparty/etc/phpmyadmin/php.ini.
upload_max_filesize = 100M
post_max_size = 100M
Even if you edit the main php.ini file it wont work in this case.
Cpanel >> phpmyadmin may not reflect the change, if so go to
WHM >> tweak settings >> cPanel PHP max POST size >> and increase the limit.
or
Increase WHM >> Tweak Settings >> cPanel PHP max upload size
vi /usr/local/cpanel/3rdparty/etc/phpmyadmin/php.ini.
upload_max_filesize = 100M
post_max_size = 100M
Even if you edit the main php.ini file it wont work in this case.
Cpanel >> phpmyadmin may not reflect the change, if so go to
WHM >> tweak settings >> cPanel PHP max POST size >> and increase the limit.
or
Increase WHM >> Tweak Settings >> cPanel PHP max upload size
How to disable CSF IP address block alert email
vi /etc/csf/csf.conf
# Send an email alert if an IP address is blocked by one of the [*] triggersLF_EMAIL_ALERT = “1?
# Send an email alert if an IP address is blocked by one of the [*] triggers
LF_EMAIL_ALERT = “1?
# Send an email alert if an IP address is blocked by one of the [*] triggersLF_EMAIL_ALERT = “1?
Thursday, 5 July 2012
How to detect domain being Attacked or Attacking Out in cPanel
What we can do to find out which domain being attacked or attacking out from/to the server. Its no matter how this could happen, we need to stop that from happenning and turn our server stable. Its better to do this process in real-time within the time frame of server being attacked or the server others to make sure we can gather enough information, prove and logs. Its also recommended to document your process of troubleshooting for your reference. Believe me you will need it in future.
As for me, I will do basic checking as below:
1. Check overall server load summary using top command:
# top –c
2. Using the same command, we can monitor which process has taken high resource usage by sorting memory (Shift+M) or sorting CPU usage (Shift+P)
3. Check the network and analyse which connection flooding your server. Following command might be useful:
3.1 Check and sort number of network statistics connected to the server:
# netstat –anp |grep ‘tcp|udp’ | awk ‘{print $5}’ | cut –d: –f1 | sort | uniq –c | sort –n
3.2 If you have APFinstalled and using kernel older than 2.6.20, you can check the connection tracking table:
# cat /proc/net/ip_conntrack | cut –d ’ ’ –f 10 | cut –d ‘=’ –f 2 | sort | uniq –c | sort –nr | head –n 10
3.3 Do tcpdump to analyse packet that transmitted from/to your server. Following command might help to analyse any connection to eth0interface port 53 (DNS):
# tcpdump –vvxXlnni eth0 port 53 | grep A? | awk –F? ‘{print $2}’
4. Analyse Apache status page at WHM –> Server Status –> Apache Status. To do this via command line, you can run following command:
# service httpd fullstatus
5. Analyse Daily process logs at WHM –> Server Status –> Daily Process Logs. Find any top 5 users which consume most CPU percentage, memory and SQL process
After that, we should see some suspected account/process/user which occupied much resources either on CPU, memory or network connections.
Up until this part, we should shorlist any suspected account.
Then from the suspected account, we should do any step advised as below:
6. Scan the public_html directory of suspected user with anti virus. We can use clamav, but make sure the virus definition is updated before we do this:
6.1 Update clamavvirus definition:
# freshclam
6.2 Scan the public_html directory of the suspected user recursively with scan result logged to scanlog.txt:
# cd /home/user/public_html
# clamscan –i –r –l scanlog.txt &
6.3 Analyse any suspected files found by clamav and quarantine them. Make sure the file cannot be executed by chmod it to 600
7. Find any PHP files which contain suspicious characteristic like base64 encoded and store it into text file called scan_base64.txt.
Following command might help:
# cd /home/user/public_html
# grep –lir “eval(base64” *.php > scan_base64.txt
8. Scan the Apacheaccess log from raw log for any suspicious activities. Following command might help to find any scripting
activities happened in all domains via Apache:
# find /usr/local/apache/domlogs –exec egrep –iH ‘(wget|curl|lynx|gcc|perl|sh|cd|mkdir|touch)%20? {} ;
9. Analysing AWstats and bandwidth usage also get more clues. Go to cPanel > suspected domain > Logs > Awstats.
In the AWstats page, check the Hosts, Pages-URL or any related section. Example as below:
There are various way to help you in executing this task. As for me, above said steps should be enough to detect any domain/account
which attacking out or being attacked. Different administrator might using different approach in order to produce same result.
As for me, I will do basic checking as below:
1. Check overall server load summary using top command:
# top –c
2. Using the same command, we can monitor which process has taken high resource usage by sorting memory (Shift+M) or sorting CPU usage (Shift+P)
3. Check the network and analyse which connection flooding your server. Following command might be useful:
3.1 Check and sort number of network statistics connected to the server:
# netstat –anp |grep ‘tcp|udp’ | awk ‘{print $5}’ | cut –d: –f1 | sort | uniq –c | sort –n
3.2 If you have APFinstalled and using kernel older than 2.6.20, you can check the connection tracking table:
# cat /proc/net/ip_conntrack | cut –d ’ ’ –f 10 | cut –d ‘=’ –f 2 | sort | uniq –c | sort –nr | head –n 10
3.3 Do tcpdump to analyse packet that transmitted from/to your server. Following command might help to analyse any connection to eth0interface port 53 (DNS):
# tcpdump –vvxXlnni eth0 port 53 | grep A? | awk –F? ‘{print $2}’
4. Analyse Apache status page at WHM –> Server Status –> Apache Status. To do this via command line, you can run following command:
# service httpd fullstatus
5. Analyse Daily process logs at WHM –> Server Status –> Daily Process Logs. Find any top 5 users which consume most CPU percentage, memory and SQL process
After that, we should see some suspected account/process/user which occupied much resources either on CPU, memory or network connections.
Up until this part, we should shorlist any suspected account.
Then from the suspected account, we should do any step advised as below:
6. Scan the public_html directory of suspected user with anti virus. We can use clamav, but make sure the virus definition is updated before we do this:
6.1 Update clamavvirus definition:
# freshclam
6.2 Scan the public_html directory of the suspected user recursively with scan result logged to scanlog.txt:
# cd /home/user/public_html
# clamscan –i –r –l scanlog.txt &
6.3 Analyse any suspected files found by clamav and quarantine them. Make sure the file cannot be executed by chmod it to 600
7. Find any PHP files which contain suspicious characteristic like base64 encoded and store it into text file called scan_base64.txt.
Following command might help:
# cd /home/user/public_html
# grep –lir “eval(base64” *.php > scan_base64.txt
8. Scan the Apacheaccess log from raw log for any suspicious activities. Following command might help to find any scripting
activities happened in all domains via Apache:
# find /usr/local/apache/domlogs –exec egrep –iH ‘(wget|curl|lynx|gcc|perl|sh|cd|mkdir|touch)%20? {} ;
9. Analysing AWstats and bandwidth usage also get more clues. Go to cPanel > suspected domain > Logs > Awstats.
In the AWstats page, check the Hosts, Pages-URL or any related section. Example as below:
There are various way to help you in executing this task. As for me, above said steps should be enough to detect any domain/account
which attacking out or being attacked. Different administrator might using different approach in order to produce same result.
cPanel not showing FTP user accounts
This issue was due to the missing entries in the /etc/proftpd/username file.
For fixing this just issue the following command:-
# /scripts/ftpupdate.
This will sync the passwords of all the accounts in the servers
For fixing this just issue the following command:-
# /scripts/ftpupdate.
This will sync the passwords of all the accounts in the servers
Monday, 2 July 2012
Php module installation steps :iconv
Overview :
Installing a single php extension without recompiling PHP is never been a difficult job but most of the people doesn’t know it which leads to re-compile whole php.. In this article i will explain how can you add new php extension without recompiling whole php.
In our example, i will tell you how can you add iconv php extension without recompiling PHP.
root@sysadmin [~]# php -m
To list all the php modules installed in the server
root@sysadmin[~]# php -m|grep iconv
To search for the php module iconv in the module list installed in the server
=============
root@sysadmin [~]# cd /home/cpeasyapache/src/php-5.2.9/ext/
root@sysadmin [/home/cpeasyapache/src/php-5.2.9/ext]# cd iconv/
root@sysadmin [/home/cpeasyapache/src/php-5.2.9/ext/iconv]# phpize
Configuring for:
PHP Api Version: 20041225
Zend Module Api No: 20060613
Zend Extension Api No: 220060519
===============
Phpize-- with an example
------
The phpize command is used to prepare the build environment for a PHP extension. In the following sample, the sources for an extension are in a directory named extname:
$ cd extname
$ phpize
$ ./configure
$ make
# make install
----------------------
You can can see iconv php extension is installed under php extensions directory:
Enable iconv PHP extension in php.ini
Verify iconv :
Output:
iconv support => enabled
Installing a single php extension without recompiling PHP is never been a difficult job but most of the people doesn’t know it which leads to re-compile whole php.. In this article i will explain how can you add new php extension without recompiling whole php.
In our example, i will tell you how can you add iconv php extension without recompiling PHP.
root@sysadmin [~]# php -m
To list all the php modules installed in the server
root@sysadmin[~]# php -m|grep iconv
To search for the php module iconv in the module list installed in the server
=============
root@sysadmin [~]# cd /home/cpeasyapache/src/php-5.2.9/ext/
root@sysadmin [/home/cpeasyapache/src/php-5.2.9/ext]# cd iconv/
root@sysadmin [/home/cpeasyapache/src/php-5.2.9/ext/iconv]# phpize
Configuring for:
PHP Api Version: 20041225
Zend Module Api No: 20060613
Zend Extension Api No: 220060519
===============
Phpize-- with an example
------
The phpize command is used to prepare the build environment for a PHP extension. In the following sample, the sources for an extension are in a directory named extname:
$ cd extname
$ phpize
$ ./configure
$ make
# make install
----------------------
You can can see iconv php extension is installed under php extensions directory:
ls /usr/local/lib/php/extensions/no-debug-non-zts-20060613/iconv.soEnable iconv PHP extension in php.ini
echo "extension=iconv.so" >> /usr/local/lib/php.iniVerify iconv :
php -i | grep -i "iconv support"Output:
iconv support => enabled
Subscribe to:
Comments (Atom)