WHM Help

Warning: Visiting this site may harm your computer!

admin — Mon, 26 Apr 2010 21:58:32 +0000

Does any of your sites opening in browser(firefox/chrome) give you this security alert ?

Warning: Visiting this site may harm your computer!

The website at yourwebsite.com contains elements from the site freecarzone.at, which appears to host malware – software that can hurt your computer or otherwise operate without your consent. Just visiting a site that contains malware can infect your computer.

For detailed information about the problems with these elements, visit the Google Safe Browsing diagnostic page for freecarzone.at.

Learn more about how to protect yourself from harmful software online.

You have got news.. your site is compromised.. What would be the first thing you would do as a system administrator or a server owner or a site owner ? You would search for your codes for freecarzone.at or simply ignore it ? what would you do ?

Unfortunately none of these options work, freecarzone.at string wont be found in any of your files. This kind of malware infected few of my sites a couple of weeks back. I opened a site file which i beleived to have been infected. At the end of the file after the assumed last line of code i saw a new set of javascript, ones which i couldnt understand.. It was encoded. It looked like the one below

This script is completely encoded and so you shall not understand the strings inside it which leads to freecarzone.at or realshoponline.info

To know it better, i went to http://jsunpack.jeek.org/dec/go? and decoded the script and i got this response there

//jsunpack.called CreateElement script //jsunpack.element http://freecarzone.at:8080/google.com/auto.ru/buzznet.com.php

Now why this happens and how to prevent it?

You will answer yourself if you have a thorough lookout in your /var/log/messages. I checked for pure-ftpd log of the infected user in /var/log/messages. I found many log entries of download and a sequential continuous upload of same file. That is someone was downloading and modifying and uploading it back to the server. This happened from different ips geographically diversified. That confirms an attack. It happened due to a poor ftp password.

First thing to do is to change your ftp passwords to a mix of letters and numbers and secure you account. Then configure your firewall (CSF firewal preferred) to have block diversified attacks. There is an option in csf to block all ips attacking a single account in a predefined time. It means if many ips get authentication failed for a single username, all the ips will get blocked suspecting that as an attack.

Similar Posts:

None Found

suPHP and open_basedir

admin — Fri, 19 Mar 2010 03:03:29 +0000

suPHP doesn’t support open_basedir but you can still add the following to your php.ini in order to get most things out of view.


open_basedir = /home/:/usr/lib/php:/usr/local/lib/php:/tmp

After placing this in your php.ini you wll need to restart Apache. If you decide to use a different handler like you can with cPanel remember to comment the added line out.Similar Posts:

Exim – Delete messages more than 24 hours old

admin — Fri, 19 Mar 2010 03:02:28 +0000

If you need to clean up your exim queue and delete emails queued and older than 24 hours run this command.

/usr/sbin/exiqgrep -o 86400 -i | xargs exim -Mrm

Similar Posts:

WHM Quota Setup

admin — Mon, 15 Mar 2010 14:16:03 +0000

You can activate quota from WHM > Initial Quota Setup.

Quotas enable you to easy set specific users disk space limits. If you wish to specify user limits, such as web space limits for specific users. This should be done. In short this is kinda mandatory.

Once done you can check if quotas are reporting correctly be querying this command on shell. You get a similar output as shown below

quota -u abcuser
Disk quotas for user abcuser (uid 507):
Filesystem blocks quota limit grace files quota limit grace
/dev/sda5 458080 1536000 1536000 15102 0 0

Similar Posts:

None Found

netstat to track connections in server | help identify ddos attacks

admin — Fri, 26 Feb 2010 19:15:26 +0000

Use either of these commands to track ddos in your server. This will give you an idea of number of connections and the network activity in server. Any unethically high number of connections can conclude that you are a victim.

netstat -tan | grep ‘:80 ‘ | awk ‘{print $6}’ | sort | uniq -c

netstat -anp |grep ‘tcp\|udp’ | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -nSimilar Posts:

None Found

WHM – Setup private nameservers

admin — Sat, 31 Oct 2009 20:25:09 +0000

This guide will show you the ropes in how to setup cpanel nameservers and configure them properly so you can run ns1 and ns2.yoursite.com. Once your nameservers are setup clients can then use your own private nameservers for their domains.

1. Regiser your domain
Register the domain name you would like to use, you can register a domain here if you need one.This domain will be used as your nameservers – eg ns1.yourdomain.com and ns2.yourdomain.com

2. Additional IPs
Have 2 available IP addresses for your server that aren’t in use.You will need to contact you provider to obtain these IP addreses.

3. Registering the Nameservers
Now login to your domain management page for the domain you registered and register ns1.newdomain.com and ns2.newdomain.com as nameservers (registries normally have a special facility for doing that). The registry may also have a facility to propogate these nameservers around the foreign registries – if so, you should use this facility.

These registrations may take a few days to propagate (often as many as 3 days).

Article provided by WebHostGear.com

4. Reverse DNS
You may also need to get your data centre to enter a reverse DNS pointer for your nameservers. You’ll need to let them know each nameserver and its IP address. Sometimes you can suffer non-delivery of mail if you don’t so this. Reverse DNS pointers can take a while to propagate.
Setup a reverse on the IP address for your domain

5. Broken NDC/BIND
My version of WHM/CPanel came with a broken NDC. To fix this:

SSH into your box as root.

(a) Type: cd /scripts
(b) Type: ./updatenow
(c) Type: ./fixndc

Go back into WHM, go to the Restart Services section in the left menu and click DNS/Nameserver (BIND).

You will need to do this if you start getting ‘ndc’ errors when you are doing anything DNS related in WHM.

6. Setup Nameservers In WHM
Go into WHM (Web Host Manager) and select Edit Setup from the Server Setup menu on the left. Enter ns1.newdomain.com in the Primary Nameserver field. Hit ‘Assign IP Address’, then hit ‘Add an A Entry for this nameserver’.
Repeat this process for the Secondary Nameserver field.

7. Tidy Up Junk Nameservers
Go into WHM (Web Host Manager) and select Manage Nameserver IPs from the Server Setup menu on the left. Remove any nameservers you don’t recognise. This is just a tidy up exercise in case anyone’s set anything up on the box before you.

8. Initial Nameserver Setup
Go into WHM (Web Host Manager) and select Initial NameServer Setup from the Server Setup menu on the left. Run this.

9. Restart BIND
Restart BIND (step 7 restarts BIND, but we’ve known it to need a proper stop and start for it to work) from SSH with:

service named stop
service named start

10. Manual Checks
I don’t know what it is about this process, but it doesn’t always work, so there are some things you can check manually via SSH.

/etc/wwwacct.conf
Check that the nameservers are correctly specified on NS, NS2 etc.
EG: scroll to the name servers section…..
NS ns1.yournameserver.com
NS2 ns2.yournameserver.com

/etc/resolv.conf
Check that there are nameserver entries for each IP. There may also be one for 127.0.0.1 – this is okay. I’m led to believe (by the ‘man’ entry for resolv.conf) that this isn’t a particularly important file, but I changed mine to read:

domain mybox.com
search mybox.com
nameserver 127.0.0.1
nameserver 111.111.111.111
nameserver 222.222.222.222

Where ‘mybox.com’ is the main domain of my server, and ’111.111.111.111′ and ’222.222.222.222′ are the IP addresses of my primary and secondary nameservers.

resolv.conf is used to lookup names that are not in FQDN format.

/etc/nameserverips
Check that there are entries for each IP acting as a nameserver.
EG:
IPHERE=ns1.yournameserver.com
IPHERE=ns2.yournameserver.com

Source: webhosttgear.comSimilar Posts:

Fix your open DNS name servers

admin — Fri, 16 Oct 2009 19:01:23 +0000

I just noticed www.dnsreport.com seems to have new check: it checks for open DNS server. This is how you check:

1) Go to http://www.dnsreport.com/tools/dnsreport.ch?domain=mydomain.com
2) Check for BIG RED “FAIL” (7th box, going down from up) saying “Open DNS servers”.

If you see the message, you can correct it the following way:

1) login to your server as root
2) nano -w /etc/named.conf (if you are running Bind)
3) Look for // query-source address * port 53; and right below write the following line:

recursion no;

4) Save and exit, restart Bind by typing service named restart
5) Check DNSReport.com to make sure it went right. You should not see the error message anymore.

If you run something else than Bind then please check http://www.dnsreport.com/info/opendns.htm for instructions.

Source: eth0.usSimilar Posts:

None Found

Configure DNS recursive

admin — Fri, 16 Oct 2009 19:00:18 +0000

For who have recently notice that now DNSreport do verify if your DNS is recursive lookup or not, here is the tip on how to set it up.

open you named.conf and add before options { the follow lines:

acl “trusted” {
xxx.xxx.xxx.xxx;
yyy.yyy.yyy.yyy;
};

where xxx.xxx.xxx.xxx is your ip address same for yyy.yyy.yyy.yyy.
for cpanel users, you can find yours ips in the follow file: /etc/nameserverips

after that, inside the options add after the line “// query-source address * port 53;” the follow:
allow-recursion { trusted; };
allow-notify { trusted; };
allow-transfer { trusted; };

also uncomment the line “// query-source address * port 53;” “to query-source address * port 53;” with out the ” (double-quotes).

restart your service.

Verify again your status with DNSreport.

Observation: you can also set up a version line it should be like:
version “Oh come on why do you want to know witch version my DNS server is ?”;

this line can be add iside your named.conf right after the line query-source address * port 53; or inside options.

Source: eth0.usSimilar Posts:

Setup MySQL Replication

admin — Fri, 16 Oct 2009 18:56:58 +0000

MySQL Replication

This guide is designed to help do the initial setup on a MySQL cluster in which multiple MySQL servers all serve the same content through the use of the replication function. We have successfully deployed this solution for multiple clients and it is a very good option for those needing a more powerful mysql solution. Carlos (theuruguayan) actually created this document so please direct any questions to carlos@totalserversolutions.com .

Be sure your mysql servers are running the same version before starting this guide, yes, is possible to have a few combinations of master-slave versions, for more information about this you can check:

http://dev.mysql.com/doc/refman/4.1/en/replication-compatibility.html

1 – Write down which is the setup you are going to do, which server is master and which server/s will be slave.

2 – Select your username/password for replications accounts. You can have one per server if you want, or one for all the mysql network.

3 – mysql> GRANT REPLICATION SLAVE ON *.*

TO ‘USERNAME’@'IPFROMTHESLAVE’ IDENTIFIED BY ‘PASSWORD’;

Username: mysql username
IPfromtheslave: ip from the mysql server that will be the one replicating the master db.
PASSWORD: the password for the replicator account.

Just a few side notes.

a) None of the passwords need to be root passwords.
b) Is not recomend to use only 1 user for replication in all the network.

4) In the master server you need to Flush all the tables, this will prevent clients from writing the db so it will keep without change while we copy over.

mysql> FLUSH TABLES WITH READ LOCK;

5) Make sure that the [mysqld] section of the my.cnf file on the master host includes a log-bin option. The section should also have a server-id=master_id option, where master_id must be a positive integer value from 1 to 232 – 1. For example:

[mysqld]

log-bin=mysql-bin

server-id=1

6) Login using another ssh client to the master server and lets create a snapshot.

mkdir /home/slave_db
rsync -vrplogDtH /var/lib/mysql /home/slave_db

You may not want to replicate the mysql database if the slave server has a different set of user accounts from those that exist on the master. In this case, you should exclude it from the archive. When the rsync is finish, just login inside mysql and type:

SHOW MASTER STATUS;

Save this info in a txt file inside the slave_db folder that we will use them laster. After you finish doing this, you can reenable the activity on the master: UNLOCK TABLES;

7) Stop the server that is to be used as a slave server and add the following to its my.cnf file:

[mysqld]

server-id=slave_id

The slave_id value, like the master_id value, must be a positive integer value from 1 to 232 – 1. In addition, it is very important that the ID of the slave be different from the ID of the master. For example:

[mysqld]

server-id=2

Remember that server-id must be unique in all the mysql network.

Copy the files over from the slave_db folder to the remote location. You can do this doing the following command:

rsync -e ssh -avz /home/slave_db/ root@REMOTESERVER:/var/lib/mysql

Check that all the permitions and correctly in the /var/lib/mysql folder.Remember files must be own by mysql:mysql

9) Start Mysql and enter to it, write the following changing the values that are needed:

mysql> CHANGE MASTER TO

-> MASTER_HOST=’master_host_name’,

-> MASTER_USER=’replication_user_name’,

-> MASTER_PASSWORD=’replication_password’,

-> MASTER_LOG_FILE=’recorded_log_file_name’,

-> MASTER_LOG_POS=recorded_log_position;

10) type: START SLAVE;Similar Posts:

None Found

WHM – Reset MySQL db password

admin — Fri, 16 Oct 2009 13:43:14 +0000

WHM – Reset MySQL db password — How to reset mysql db password via WHM ?

To reset the MySQL password via WHM, simply log into WHM and select either:

1) “MySQL Root Password” (and change it) or
2) “Change a User or Database Password” (to change a specific password)Similar Posts: