Greetings!
We ran into a problem with the dreaded “Too many open files” error message in Apache which caused it to crash and left it in a non-startable state.
We fixed the problem by editing the /etc/security/limits.conf on a RHEL box, saving and restarting apache.
Code:
nano -w /etc/security/limits.conf
Change (or add) the last two lines
Code:
* soft nofile 32768
* hard nofile 32768
Code:
/sbin/service httpd restart
Greetings,
Check following files for it. If thats under users home directory then remove it from there.
locate irc
locate eggdrop
locate bnc
locate BNC
locate ptlink
locate BitchX
locate guardservices
locate psyBNC
locate .rhosts
Thank you
Darsh
Greetings,
Make sure that phpsuexec is not insalled on your server. If its installed then you can try following steps.
PHP is a feature-rich programming language that includes simple HTTP authentication. Unfortunately, if PHP is running under CGI then PHP scripts cannot use HTTP authentication. The workaround for this problem is to use mod_rewrite to pass HTTP authentication info to scripts as a GET parameter.
The following are step-by-step instructions on how to get HTTP authentication working when PHP is running as a CGI/PHPSuExec.
Step 1:
Create a plain text file using a text editor such as Windows Notepad.
Step 2:
Add the following text…
Code:
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]
</IfModule>
Step 3:
Save the file as a plain text file. Name the file “.htaccess”
Step 4:
Upload the .htaccess file in ASCII mode to your web space using an FTP application.
Step 5:
Add the following in your PHP script right before your user/pass check routine.
Code:
list($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) = explode(':', base64_decode(substr($_SERVER['HTTP_AUTHORIZATION'], 6)));
Example:
Code:
<?php
// split user/pass parts
list($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) = explode(':', base64_decode(substr($_SERVER['HTTP_AUTHORIZATION'], 6)));
// open user/pass prompt
if (!isset($_SERVER['PHP_AUTH_USER'])) {
header('WWW-Authenticate: Basic realm="Your Realm"');
header('HTTP/1.0 401 Unauthorized');
echo 'Text to send if Cancel button is used';
exit;
} else {
echo "<p>Greetings: </p>".$_SERVER['PHP_AUTH_USER'];
echo "<p>Password you entered: </p>".$_SERVER['PHP_AUTH_PW'];
}
?>
Greetings,
If you want to block any site on your computer then you can do that by following these steps.
Step 1:
Go to
C:\WINDOWS\system32\drivers\etc
Step 2:
Open a “host” file in notepad. At the bottom of the line, you can see as follows
127.0.0.1 localhost
Add the following line at the end
Ex: 127.0.0.1 www.abcxyz.com localhost
The above code is written to block www.abcxyz.com website on my pc.
Cheers..!!
Greetings,
Mod_secuirty that allows your server to be hacked from some of the dabgerous php function. That prevents your server from the hack in many way. So here is the instllation guidance for it.
Installation:
Download the source and unpack (Check the newest version at http://www.modsecurity.org/download/)
# wget http://www.modsecurity.org/download/…e_1.9.4.tar.gz
# tar -zvxf modsecurity-apache_1.9.4.tar.gz
From here, you will need to descend into the correct apache version directory
Either apache1.3 (cPanel uses Apache 1.3)
# cd modsecurity-apache-1.9.4/apache1
or, for apache2.x (Plesk uses Apache 2.0)
# cd modsecurity-apache-1.9.4/apache2
Use apxs to compile the module
# /etc/httpd/bin/apxs -cia mod_security.c
If /etc/httpd/bin/apxs does not exist, you are missing the httpd-devel package. To install on Redhat, use:
# up2date httpd-devel
Mod_security will automatically install the module in the apache modules directory and add the corresponding lines in httpd.conf
Installation is done, now we just need to add the rules.
Mod_security rules: The following rules have been continually tested to verify safety and effectiveness against the most commonly exploited web applcations. It currently provides protection against common exploits in phpBB, PHP-Nuke, Post-nuke, vbulletin, Mambo, Invision Power Board, phpMyAdmin, Coppermine, WordPress, OSCommerce, Awstats, OSticket, ModernBill, Cubecart, phpAdsNew, Xoops, Drupal, Serendipity, and Comdev eCommerce. It also provides an effective arbitrary command detection list, for use against general attacks.
You should copy this ruleset and save this file to..
on apache 1.3 (or cpanel machines):
/etc/httpd/conf/modsec.conf
on apache 2.0 (or plesk machines):
/etc/httpd/conf.d/modsec.conf
For apache 1.3, you will need to include the following line after the “LoadModule” section:
Include conf/modsec.conf
Restart apache and you’re done. If you want to know how to make sure mod_security is installed and running, check to see if /etc/httpd/logs/audit_log exists. If it does, you’re good to go. If not, go back over the steps above or see the modsecurity.org installation documentation:
http://www.modsecurity.org/documentation/index.html
Please remember that this rule set is just an extended set of rules to get you started. There are many things that can be done with Mod_Security that are not covered here. You will need to do some research and tweak these rules accordingly.
Cheerss..!!
Requirements:
cPanel, Plesk or DirectAdmin
Nobody Check has been tested on:
CentOS
Fedora
Red Hat and Red Hat Enterprise systems
What is Nobody Check?
Free Nobody Check security tool for cPanel/Pkesk and DirectAdmin based servers that will greatly enhance server security. Developed exclusively by WebHostGear.com
The Nobody Check tool is a new and unique security tool that can detect malicious processes that are running on your Linux server and report them to you in real time or by email. The tool can be configured to run at selected times and doesn’t eat up resources or interfere with server operations.
Download
Nobody Check is available for download free here: nobody_check.tar.gz
Installation Script: NEW
Install Nobody Check has never been easier.
1) Login to your server as the root user through shell
2) wget http://www.webhostgear.com/projects/nobodycheck/install.sh
3) chmod +x install.sh
4) ./install.sh
Wait for the installer to finish
5) rm -f install.sh
6) Open the /usr/local/nobody_check/nc.conf and put in your email address and select your options
Demo Nobody Check now!
While we can’t run an actual demo of the script we can provide you with the output it produces so you get the idea of how it works.
- Email Detection Result
- Shell Scan Result
Documentation
- readme which answers many questions
- changelog
Licensing
Nobody Check is Copyright of Wave Point Media Inc. and WebHostGear. All rights reserved. We express no warranty or liability if you use this tool. This script may not be copied, altered or redistributed unless you have explicit written permission from Wave Point Media Inc.
Greetings,
Follow these steps in order to get that done.
First off we need to create a special log file for these filters do this:
touch /var/log/filter.log
chmod 0644 /var/log/filter.log
Now open up the configuration file
vi /etc/antivirus.exim
It should have a whole whack of comments at the top.
Here’s the webhostgear.com antivirus.exim configuration. Simple add this to your existing file, save the changes and they take effect instantly.
### CUSTOM WEBHOSTGEAR.COM FILTERS by Steven Leggett info@webhostgear.com ###################################################### # START # Filters all incoming an outgoing mail
logfile /var/log/filter.log 0644 ## Common Spam if
# Header Spam $header_subject: contains "Pharmaceutical" or $header_subject: contains "Viagra" or $header_subject: contains "Cialis" or $header_subject: is "The Ultimate Online Pharmaceutical" or $header_subject: contains "***SPAM***" or $header_subject: contains "[SPAM]"
# Body Spam or $message_body: contains "Cialis" or $message_body: contains "Viagra" or $message_body: contains "Leavitra" or $message_body: contains "St0ck" or $message_body: contains "Viaagrra" or $message_body: contains "Cia1iis" or $message_body: contains "URGENT BUSINESS PROPOSAL" or $message_body matches "angka[^s]+[net|com|org|biz|info|us|name]+?" or $message_body matches "v(i|1)agra|vag(i|1)n(a|4)|pen( i|1)s|asu|seks|l(o|0)l(i|1)ta|dewacolok"
then # Log Message - SENDS RESPONSE BACK TO SENDER # SUGGESTED TO LEAVE OFF to prevent fail loops # and more work for the mail system #fail text "Message has been rejected because it hasn # triggered our central filter." logwrite "$tod_log $message_id from $sender_address contained spam keywords"
seen finish endif
# END # Filters all incoming an outgoing mail
# START # All outgoing mail on the server only - what is sent out
#Check forwarders so it doesn't get blocked #Forwarders still work =)
## FINANCIAL FAKE SENDERS
## Log all outgoing mail from server that matches rules
logfile /var/log/filter.log 0644
if (
$received_protocol is "local" or
$received_protocol is "esmtpa"
) and (
$header_from contains "@citibank.com" or
$header_from contains "@bankofamerica.com" or
$header_from contains "@wamu.com" or
$header_from contains "@ebay.com" or
$header_from contains "@chase.com" or
$header_from contains "@paypal.com" or
$header_from contains "@wellsfargo.com" or
$header_from contains "@bankunited.com" or
$header_from contains "@bankerstrust.com" or
$header_from contains "@bankfirst.com" or
$header_from contains "@capitalone.com" or
$header_from contains "@citizensbank.com" or
$header_from contains "@jpmorgan.com" or
$header_from contains "@wachovia.com" or
$header_from contains "@bankone.com" or
$header_from contains "@suntrust.com" or
$header_from contains "@amazon.com" or
$header_from contains "@banksecurity.com" or
$header_from contains "@visa.com" or
$header_from contains "@mastercard.com" or
$header_from contains "@mbna.com"
)
then
logwrite "$tod_log $message_id from $sender_address is fraud"
seen finish
endif
## OTHER FAKE SENDERS SPAM
## Enable this to prevent users using @domain from addresses
## Not recommended since users do use from addresses not on the server
## Log all outgoing mail from server that matches rules
logfile /var/log/filter.log 0644
if (
$received_protocol is "local" or
$received_protocol is "esmtpa"
) and (
$header_from contains "@hotmail.com" or
$header_from contains "@yahoo.com" or
$header_from contains "@aol.com"
)
then
logwrite "$tod_log $message_id from $sender_address is forged fake"
seen finish
endif
## KNOWN FAKE PHISHING
### Log all outgoing mail from server that matches rules
logfile /var/log/filter.log 0644
if (
$received_protocol is "local" or
$received_protocol is "esmtpa"
) and (
#Paypal
$message_body: contains "Dear valued PayPal member" or
$message_body: contains "Dear valued PayPal customer" or
$message_body: contains "Dear Paypal" or
$message_body: contains "The PayPal Team" or
$message_body: contains "Dear Paypal Customer" or
$message_body: contains "Paypal Account Review Department" or
#Ebay
$message_body: contains "Dear eBay member" or
$message_body: contains "Dear eBay User" or
$message_body: contains "The eBay team" or
$message_body: contains "Dear eBay Community Member" or
#Banks
$message_body: contains "Dear Charter One Customer" or
$message_body: contains "Dear wamu.com customer" or
$message_body: contains "Dear valued Citizens Bank member" or
$message_body: contains "Dear Visa" or
$message_body: contains "Dear Citibank" or
$message_body: contains "Citibank Email" or
$message_body: contains "Dear customer of Chase Bank" or
$message_body: contains "Dear Bank of America customer" or
#ISPs
$message_body: contains "Dear AOL Member" or
$message_body: contains "Dear AOL Customer"
)
then
logwrite "$tod_log $message_id from $sender_address is phishing"
seen finish
endif
# END # All outgoing mail on the server only - what is sent out
The log file will have the logging format like this:
2006-04-27 16:37:40 1FZEB9-0002KQ-VP from nobody@ocean.wavepointmedia.com is phishing
Date and time, the Exim message ID, the sender and the section of the filter, like phishing, fraud or spam. You can check the mail message by grepping the exim_mainlog for it like this
grep 3GFEB5-87592KG-VL /var/log/exim_mainlog
If you haven’t already you should enable a higher level of logging in your mail server which will be in our next tutorial.
Cheers..!!