Wednesday, November 18, 2015

Starting up mlog2waffle in "batch" mode, using config file /etc/mlog2waffle.conf Error in HTTP connection: 403 Forbidden


The problem is authentication.
Probably  sensor name has white spaces.
2015-07-09 16_32_26-WAF-FLE

Reduce TIME_WAIT socket connections


Some time in your life you’ll run across an Apache server that always has tons of TIME_WAIT connections just seeming to hang out. While these don’t take up as many resources as an ESTABLISHED connection, why keep them around so long? This short article will show you how to identify how many you have, and how to tell your server to reduce them, reuse and recycle them (see, recycling IS a good thing).
First, SSH into your server and become root.
Next, let’s see how many TIME_WAITs you have hanging out:
You should see something like:
So – let’s get that number smaller.
See what your current values are in these files by catting them to the screen:
If you have default settings, you’ll probably see values of 60, 0 and 0. Let’s change those values to 30, 1, 1.
Now, let’s make the change persistent by adding them to the sysctl.conf file. First however, let’s make sure there aren’t any entries in there yet for these settings.. cat the file and grep for the changes we’re about to make:
Make notes of what your settings are if you had any results..
Now, edit the /etc/sysctl.conf with your favorite editor and add these lines to the end of it (or edit the values you have in yours if they exist already):
Now, let’s rerun that command from before and see where your TIME_WAITs are at:
You may need to wait at least a minute or so (depending on what your old values were) to see a change here.

Fixperms script for cPanel servers running suPHP or FastCGI

#! /bin/bash
#
# Date: Jan 26th 2012
# Author: Colin R.
# Revisions: Jacob "Boom Shadow" Tirey (boomshadow.net)
# Revisions: Will Ashworth (williamashworth.com || ashworthconsulting.com)
# Fixperms script for ServInt
#
# https://github.com/PeachFlame/cPanel-fixperms</code>

#
# Fixperms script for cPanel servers running suPHP or FastCGI.
# Written for ServInt.net
# Copyright (C) 2012 Colin R.
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details. http://www.gnu.org/licenses/

# Set verbose to null
verbose=""

#Print the help text
helptext () {
tput bold
tput setaf 2
echo "Fix perms script help:"
echo "Sets file/directory permissions to match suPHP and FastCGI schemes"
echo "USAGE: fixperms [options] -a account_name"
echo "-------"
echo "Options:"
echo "-h or --help: print this screen and exit"
echo "-v: verbose output"
echo "-all: run on all cPanel accounts"
echo "--account or -a: specify a cPanel account"
tput sgr0
exit 0
}

# Main workhorse, fix perms per account passed to it
fixperms () {

#Get account from what is passed to the function
account=$1

#Check account against cPanel users file
if ! grep $account /var/cpanel/users/*
then
tput bold
tput setaf 1
echo "Invalid cPanel account"
tput sgr0
exit 0
fi

#Make sure account isn't blank
if [ -z $account ]
then
tput bold
tput setaf 1
echo "Need an account name!"
tput sgr0
helptext
#Else, start doing work
else

#Get the account's homedir
HOMEDIR=$(egrep "^${account}:" /etc/passwd | cut -d: -f6)

tput bold
tput setaf 4
echo "Fixing perms for $account:"
tput setaf 3
echo "------------------------"
tput setaf 4
echo "Fixing website files...."
tput sgr0

#Fix individual files in public_html
find $HOMEDIR/public_html -type d -exec chmod $verbose 755 {} \;
find $HOMEDIR/public_html -type f | xargs -d$'\n' -r chmod $verbose 644
find $HOMEDIR/public_html -name '*.cgi' -o -name '*.pl' | xargs -r chmod $verbose 755
chown $verbose -R $account:$account $HOMEDIR/public_html/*
find $HOMEDIR/* -name .htaccess -exec chown $verbose $account.$account {} \;

tput bold
tput setaf 4
echo "Fixing public_html...."
tput sgr0
#Fix perms of public_html itself
chown $verbose $account:nobody $HOMEDIR/public_html
chmod $verbose 750 $HOMEDIR/public_html

#Fix subdomains that lie outside of public_html
tput setaf 3
tput bold
echo "------------------------"
tput setaf 4
echo "Fixing any domains with a document root outside of public_html...."
for SUBDOMAIN in $(grep -i document /var/cpanel/userdata/$account/* | awk '{print $2}' | grep home | grep -v public_html)
do
tput bold
tput setaf 4
echo "Fixing sub/addon domain document root $SUBDOMAIN...."
tput sgr0
find $SUBDOMAIN -type d -exec chmod $verbose 755 {} \;
find $SUBDOMAIN -type f | xargs -d$'\n' -r chmod $verbose 644
find $SUBDOMAIN -name '*.cgi' -o -name '*.pl' | xargs -r chmod $verbose 755
chown $verbose -R $account:$account $SUBDOMAIN
find $SUBDOMAIN -name .htaccess -exec chown $verbose $account.$account {} \;
done

#Finished
tput bold
tput setaf 3
echo "Finished!"
echo "------------------------"
printf "\n\n"
tput sgr0
fi

return 0
}

#Parses all users through cPanel's users file
all () {
cd /var/cpanel/users
for user in *
do
fixperms $user
done
}

#Main function, switches options passed to it
case "$1" in

-h) helptext
;;
--help) helptext
;;
-v) verbose="-v"

case "$2" in

-all) all
;;
--account) fixperms "$3"
;;
-a) fixperms "$3"
;;
*) tput bold
tput setaf 1
echo "Invalid Option!"
helptext
;;
esac
;;

-all) all
;;
--account) fixperms "$2"
;;
-a) fixperms "$2"
;;
*)
tput bold
tput setaf 1
echo "Invalid Option!"
helptext
;;
esac


Source: <a href="https://github.com/PeachFlame/cPanel-fixperms" target="_blank">https://github.com/PeachFlame/cPanel-fixperms</a>

Fix EasyApache Error : localhost did not have any working

One of the reason for Cpanel EasyApache  failed when the Cpanel update not going smoothly.
So the solution is to run the update in force mode then re build easy apache.
#/scripts/upcp --force
#/scripts/easyapache --build

Friday, September 25, 2015

How to check package version Ubuntu

apt-get install libmemcached-dev
apt-get install pkg-config
apt-cache policy php5-memcached
apt-cache show memcached | grep Version
apt-cache showpkg memcached 

HOW TO MODSECURITY-2.9.0 ON OLD CENTOS 5 SERVERS

Must install libxml2 before starting
# wget http://xmlsoft.org/sources/libxml2-2.9.2.tar.gz
# tar xzvf libxml2-2.9.2.tar.gz
# cd libxml2-2.9.2
# ./configure
# make
# make install
# yum install automake && pcre-devel && apr-devel && curl-devel && libxml2-devel
# wget https://www.modsecurity.org/tarball/2.9.0/modsecurity-2.9.0.tar.gz
# tar zxvf modsecurity-2.9.0.tar.gz
# cd modsecurity-2.9.0/
#./configure --with-apxs=/hsphere/shared/apache2/bin/apxs --with-apr=/hsphere/shared/apache2/bin/apr-1-config --with-apu=/hsphere/shared/apache2/bin/apu-1-config
# make
# make install
# mv /hsphere/shared/apache2/modules/mod_security2.so /hsphere/shared/apache2/modules/mod_security2.so.back
# cp /usr/local/modsecurity/lib/mod_security2.so /hsphere/shared/apache2/modules/
# nano /hsphere/local/config/httpd2/httpd.conf
add
# LoadFile /root/libxml2-2.9.2/.libs/libxml2.so
# cp /hsphere/local/config/httpd2/httpd.conf.tmpl.custom
Now download the last rules:
https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project
# tar zxvf SpiderLabs-owasp-modsecurity-crs-2.2.9-17-g60c8bc9.tar.gz
# mv SpiderLabs-owasp-modsecurity-crs-2.2.9-17-g60c8bc9 /hsphere/local/config/httpd2/
Now we configure hsphere apache work with new rules
# nano /hsphere/local/config/httpd2/httpd.conf.tmpl.custom
make it look like:

#Include /hsphere/local/config/httpd2/modsecurity-core-rules/*.conf
Include /hsphere/local/config/httpd2/SpiderLabs-owasp-modsecurity-crs-g60c8bc9/base_rules/*.conf
Include /hsphere/local/config/httpd2/extra/httpd-security2.conf
Include /hsphere/local/config/httpd2/gotrootrules2/*.conf
Include /hsphere/local/config/httpd2/extra/httpd-exclude-secrules2.conf
# /etc/init.d/httpd restart
Now we done :)
================Troubleshooting=====================
if error
configure: *** pcre library not found.
# yum install pcre-devel
if error
configure: *** apr library not found.
yum install apr-devel
if error
configure: *** curl library not found.
# yum install curl-devel
if error
configure: *** apu library not found.
# yum install apr-util-devel
if error
configure: *** xml library not found
# yum install libxml2-devel
# yum install automake

How to use percona toolkit to fix broken mysql replication

How to use percona toolkit to fix broken mysql replication
host1=my slave server (name or ip)
host2=my master server (name or ip)
Following will syncronizing missed data from master to slave
Thefore we need to take the last binlog file and key position on the master:
# mysql
mysql> show master status\G;
*************************** 1. row ***************************
File: mysql-bin.000022
Position: 474336476
Binlog_Do_DB:
Binlog_Ignore_DB:
1 row in set (0.00 sec)
On the slave:
mysql> slave stop;
mysql>CHANGE MASTER TO master_log_file='mysql-bin.000022',master_log_pos=474336476;
mysql> slave start;

Next , we going to synchronize all missed data from master
# pt-table-sync --verbose --print --execute h=host2 --database test h=host1
Sample out is:
DELETE REPLACE INSERT UPDATE ALGORITHM START END EXIT DATABASE.TABLE
UPDATE `test`.`demo_test` SET `c2`=’core|a:3:{s:23:”_session_validator_data”;a:4:{s:11:”remote_addr”;s:13:”5.255.253.127″;s:8:”http_via”;s:0:””;s:20:”http_x_forwarded_for”;s:0:””;s:15:”http_user_agent”;s:64:”Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)”;}s:12:”visitor_data”;a:16:{s:0:””;N;s:11:”server_addr”;i:1054544702;s:11:”remote_addr”;i:100662655;s:11:”http_secure”;b:0;s:9:”http_host”;s:15:”musicgate.co.il”;s:15:”http_user_agent”;s:64:”Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)”;s:20:”http_accept_language”;s:42:”ru, uk;q=0.8, be;q=0.8, en;q=0.7, *;q=0.01″;s:19:”http_accept_charset”;s:0:””;s:11:”request_uri”;s:58:”/wishlist/index/add/product/942/form_key/jgjZFa9Idi12wjim/”;s:10:”session_id”;s:26:”00013fgiur7cecou15b8iu7j62″;s:12:”http_referer”;s:0:””;s:14:”first_visit_at”;s:19:”2015-05-12 18:36:27″;s:14:”is_new_visitor”;b:0;s:13:”last_visit_at”;s:19:”2015-05-12 18:36:27″;s:10:”visitor_id”;s:7:”2835829″;s:11:”last_url_id”;s:7:”2881777″;}s:8:”last_url”;s:82:”http://musicgate.co.il/core/index/noCookies/’, `c3`=’0′, `c4`=’8288′, `c5`=’101′ WHERE `c1`=’00013fgiur7cecou15b8iu7j62′ LIMIT 1 /*percona-toolkit src_db:test src_tbl:demo_test src_dsn:h=xx.xxx.xx.xx dst_db:test dst_tbl:demo_test dst_dsn:h=xx.xxx.xx.xx lock:0 transaction:1 changing_src:0 replicate:0 bidirectional:0 pid:19564 user:user host:myhost*/;
# 0 0 0 1 Chunk 17:04:11 17:04:26 2 test.demo_test
We need to stop/strt the slave
mysql> slave stop;
mysql> slave start;

To be sure all going well:
mysql> show slave status\G;
If:
Slave_IO_Running: Yes
Slave_SQL_Running: Yes
All work as expected.
The advantage of this method is not complex mysqldump and restore needed. No downtime.No table locks.

Wednesday, July 15, 2015

MYSQLDUMP MYSQL MASTER SERVER

Dump with binary and log position
# mysqldump –single-transaction –master-data=2 DATABASE NAME| gzip > /root/DATABASE.sql.gz
restore
# gunzip < /root/DATABASE.sql.gz | mysql DATABASE

PHP FPM – HOW TO SEPARATE VHOST(WEB SITE) AND EXTEND LIMITS PER VHOST ON NGINX.

php fpm – How to separate vhost(web site) and extend limits per vhost on nginx.
I’m done it for phpmyadmin to allow import large files (this can be used to separate vhosts with limitations or extend as well)
# cp /etc/php5/fpm/pool.d/www.conf /etc/php5/fpm/pool.d/phpmyadmin.conf
# nano /etc/php5/fpm/pool.d/phpmyadmin.conf
change
; pool name (‘www’ here)
[www]
to
[phpmyadmin]
change
; Note: This value is mandatory.
listen = /var/run/php5-fpm.sock
to
; Note: This value is mandatory.
listen = /var/run/php5-fpm-phpmyadmin.sock
# nano /etc/nginx/sites-enabled/phpmyadmin
chnge
fastcgi_pass unix:/var/run/php5-fpm.sock;
to
fastcgi_pass unix:/var/run/php5-fpm-phpmyadmin.sock;
# nano /home/phpmyadmin/.user.ini
add
upload_max_filesize = 20M
memory_limit = 256M
max_execution_time = 300
max_input_time = 240
# sudo service php5-fpm restart
# sudo service nginx reload

LINUX SENDMAIL WORK SLOW (FQDN)

Sendmail work slow , up to 60 sec when send mail.
This is because sendmail can’t resolve the right FQDN.
How to resolve:
1) We check what is our hostname
# hostname -f
# newdev

2) The fix is:
# nano /etc/hosts
and make the first line loock like”
# 127.0.0.1 localhost localhost.newdev newdev
Now , the sendmail send mails without delay.

CLAMD HAS FAILED. CONTACT YOUR SYSTEM ADMINISTRATOR IF THE SERVICE DOES NOT AUTOMAGICALLY RECOVER

clamd has failed. Contact your system administrator if the service does not automagically recover.
Home »cPanel »Manage Plugins
Uninstall clamavconnector
Install and keep updated
cpanel_clam