How would you block an IP which is acting malicious on internal private VSFTP network?

Block IP using host.deny file

Open ‘/etc/hosts.deny’ file.

# vi /etc/hosts.deny

Append the following line at the bottom of the file with the IP address that you want to block access to FTP.

#
# hosts.deny    This file contains access rules which are used to
#               deny connections to network services that either use
#               the tcp_wrappers library or that have been
#               started through a tcp_wrappers-enabled xinetd.
#
#               The rules in this file can also be set up in
#               /etc/hosts.allow with a 'deny' option instead.
#
#               See 'man 5 hosts_options' and 'man 5 hosts_access'
#               for information on rule syntax.
#               See 'man tcpd' for information on tcp_wrappers
#
vsftpd:198.28.0.0

Block IP using iptables rule

To block FTP access to particular IP address, add the following drop rule to iptables INPUT chain.

iptables -A RH-Firewall-1-INPUT -p tcp -s 172.16.16.1 -m state --state NEW -m tcp --dport 21 -j DROP

Scripts location on linux cpanel server through command line

• addns – add a dns zone


• addfpmail – Add frontpage mail extensions to all domains without them


• addfpmail2 -Add frontpage mail extensions to all domains without them


• addnetmaskips – Add the netmask 255.255.255.0 to all IPs that have no netmask


• addnobodygrp – Adds the gorup nobody and activates security


• addpop – add a pop account


• addservlets – Add JSP support to an account (requires tomcat)


• addstatus – (Internal use never called by user)


• adduser – Add a user to the system


• bandwidth – (OLD)


• betaexim – Installs the latest version of exim


• biglogcheck – looks for logs nearing 2 gigabytes in size


• bsdcryptoinstall – Installs crypto on FreeBSD


• bsdldconfig – Configures the proper lib directories in FreeBSD


• bsdpkgpingtest – Tests the connection speed for downloading FreeBSD packages


• buildbsdexpect – Install expect on FreeBSD


• builddomainaddr – (OLD)


• buildeximconf – Rebuilds exim.conf


• buildpostgrebsd-dev – Installs postgresql on FreeBSD.


• chcpass – change cpanel passwords


• easyapache – recompile/upgrade apache and/or php


• exim4 – reinstall exim and fix permissions


• fixcommonproblems – fixes most common problems


• fixfrontpageperm – fixes permission issues with Front Page


• fixmailman – fixes common mailman issues


• fixnamed – fixes common named issues


• fixndc – fixes rndc errors with named


• fixquotas – fixes quota problems


• fullhordereset – resets horde database to a fresh one – all previous user data are lost


• initquotas – initializes quotas


• installzendopt – installs zend optimizer


• killacct – terminate an account – make sure you take a backup of the account first


• mailperm – fixes permission problems with inboxes


• park – to park a domain


• pkgacct – used to backup an account


• restartsrv – restart script for services


• restorepkg – restores an account from a backup file ( pkgacct file)


• runlogsnow – update logs of all users


• runweblogs – update stats for a particular user


• securetmp – secures /tmp partition with options nosuexec and nosuid


• suspendacct – suspends an account


• unsuspendacct – unsuspends a suspended account


• upcp – updates cpanel to the latest version


• updatenow – updates the cpanel scripts


• updateuserdomains – updates userdomain entries

How to disable mod_sec for domain from linux command line ?

If mod_sec is causing problem in proper functioning of web site then we will need to disable it by placing few statements into your .htaccesss . Statement vary depending on your Apache version.

First we need to check apache version installed on your server by running below command:

root@linux [~]# httpd -v
OR
root@linux [~]# /usr/local/apache/bin/httpd -v

If you have Apache 1.x then create .htaccess file into your document root and place following statements.

SecFilterEngine Off
SecFilterScanPOST Off

If you have Apache 2.x then place following statements.

SecRuleEngine Off
SecAuditEngine Off

Note : False Or Spam reviews will be deleted, all reviews are cross checked.

Server Migration Bluck Migration Reseller Migration Migration Script

Want to migrate more than one account / s from one server to another server then you need to create packages for each accounts . You can easily create packages by using this script.

1) Create one text file username-migration.txt file and add the the user name , which you want to create packages.

2) Create Migration directory for to move all the cpmove files from /home directory to Migration directory.

then use the following command to create cpmove packages and moved to “Migration” directory.

root@delinux # for i in `cat /home/username-migration.txt`;do /scripts/pkgacct $i; mv /home/cpmove-$i.tar.gz /home/Migration/;done

For migrating Reseller and/or Bulk accounts between cpanel servers:

For Reseller Accounts:-

root@delinux # cat /etc/trueuserowners  | grep username | awk '{print "/scripts/pkgacct "$1}'

root@delinux # cat /etc/trueuserowners  | awk '{print $1}' > 1.txt

then remove the sign “:” from 1.txt

root@delinux # for i in `cat 1.txt`;do /scripts/pkgacct $i; mv /home/cpmove-$i.tar.gz /home/Migration/;done

Then move the “Migration" folder and 1.txt file to remote server and by using following command restore all the accounts.

root@delinux # for i in `cat 1.txt`;do /scripts/restorepkg $i;done

 

Importing Big mysqldump + Progress Bar

I have been facing hard time to import a big dump file (27 GB in size to be exact). It could take hours to load data in so it could be worth to watch the progress of this import. Fortunately, Linux has always had a convenient way to do this. I just need to install pv,  which can monitor the progress of piping data.

Enough with talking, let’s start installing!

CentOS 6.4 box, so it requires me to install EPEL repo at the first place:

$ rpm -Uhv http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm

Install pv using yum:

$ yum install -y pv

Installation done. Let the importing begin!

$ pv /home/user/my_big_dump.sql | mysql -uroot -p
928MB 0:07:41 [ 2.3MB/s] [==>                                                      ]  4% ETA 2:35:52

So now I can sit back and relax while watching up the import progress. If no error occurred, the import could finish within two and a half hours. Cheers!

Disable Direct Root Login in cpanel server

Another security measure you can take to lock down a Linux server is to disable the root user login in the SSH server.

First you need to add new admin user

root@server1 [~]# adduser admin
root@server1 [~]# passwd admin

Please keep admin password

root@server1 [~]# vi /etc/group
Make sure admin user wheel settings

wheel:x:10:root,admin

Modifying The sshd_conf File

Remember, backing up any important system file before you modify it is always a good idea!

 

root@server1 [~]# cp /etc/ssh/sshd_config /etc/ssh/sshd_config_backup

1. Copy and paste this line to edit the file for SSH logins

root@server1 [~]# vi /etc/ssh/sshd_config

2. Find the line
Protocol 2, 1

3. Uncomment it and change it to look like
Protocol 2

4. Next, find the line
PermitRootLogin yes

1. Uncomment it and make it look like PermitRootLogin no




2. Save the file Ctrl+X then Y then enter

7. Now you can restart SSH
root@server1 [~]# /etc/rc.d/init.d/sshd restart


SSH into your server as 'admin' and gain root access by su

Configure e-mail authentication in cPanel

E-mail authentication in cPanel is based upon two complementary technologies, DKIM and SPF, that help reduce the amount of spam.

DomainKeys Identified Mail (DKIM)

You can use DKIM to verify that an incoming e-mail message is actually from the stated sender, and that the message has not been altered during transit. When DKIM is enabled, the sender digitally signs a message using a private key. The recipient uses DNS to retrieve the sender's public key and verify the message's signature. If the signature is invalid, then the message is assumed to be forged and therefore spam.

Enabling DKIM - To enable DKIM, follow these steps:
In the Mail section of the cPanel home screen, click Email Authentication. Under DKIM, click Enable.

Disabling DKIM - To disable DKIM, follow these steps:
In the Mail section of the cPanel home screen, click Email Authentication. Under DKIM, click Disable.

Sender Policy Framework (SPF)
SPF helps prevent spammers from forging messages that implicate your domain as the sender. As a result, SPF can also reduce the amount of bounce messages that you receive (also known as backscatter spam). SPF uses DNS records that specify the mail servers and IP addresses that are authorized to send e-mail messages from a domain.

Enabling SPF - To enable SPF, follow these steps:
In the Mail section of the cPanel home screen, click Email Authentication. Under SPF, click Enable.

Changing SPF advanced settings:
After you have enabled SPF, you can modify its configuration. You can add additional IP addresses or mail servers that are authorized to send e-mail for your domain. For example, you may want to do this if you use a third-party mail server.