Logging server load to /var/log/messages

There can be issues when the server goes offline and you can’t find any related log entries in the server. One of the issue that can cause is high load in the server. But we wont be able to conclude whether the load was the exact issue after the server reboot.

The better solution to find the load is set a cronjob to enter the load in the server to /var/log/messages for a particular amount of time. A sample cron is shown below which will log the server load every 10 minutes to /var/log/messages.

*/10 * * * * uptime | logger -t “SERVER LOAD”

Now you will be able to get the load from /var/log/messages

Now you will be able to get the load from /var/log/messages

Disable/Enable Ping On Linux Server

Command to disable ping on the server…

You can use following command to disable PING:

echo “1? >> /proc/sys/net/ipv4/icmp_echo_ignore_all

The following command will enable PING for you:

echo “0? >> /proc/sys/net/ipv4/icmp_echo_ignore_all

Disk usage on cPanel server

On a Linux system for a system administrator it is necessary to check disk usage on the server and make sure that the disk space does not get 100% and cause problem for the users, so as a routine you should always check for disk space.

The command to check disk space on the complete server is:

root@server# df –h

If a particular partition is consuming too much disk space and you need to find which folder under that partition is using it, for example the partition is /var you can use the command:

root@server# cd /var

root@server# du –sh *

This will display the size of each directory under the /var partition.

So, be proactive and keep your server always healthy.

Backing Up/Restoring Mysql Databases using SSH/Shell

This is really the most handy tool for mysql databases. A built in mysqldump can be used via shell to dump mysql databases within a few minutes. Sometimes dumping backups using phpmyadmin is too hazardous. So it’s really a necessary tool and fast too. I have listed this commands and i believe this should be useful to lots of system admins

Taking Database Backup

mysqldump -uuser -pmysqluserpassword database_name > database_name.sql

Restoring a Database

mysql -uuser -pmysqluserpassword database_name < database_name.sql

Here, you need to replace the user with the proper database user who has access to that specific database and the mysqluserpassword directs the password of that specific user. Here, one important thing is database_name.sql file can be replaced with the location of the sql file, suppose if you want to save it or retrieve from /home/backup then you can put /home/backup/database_name.sql to do that.

Roundcube installation on cPanel server

1-Login to the server as root and run the following:

cd /usr/local/cpanel/base
wget http://dfn.dl.sourceforge.net/sourceforge/roundcubemail/roundcubemail-0.1.1.tar.gz
tar -zxvf roundcubemail-0.1.1.tar.gz
rm -rf roundcubemail-0.1.1.tar.gz
mv -f roundcubemail-0.1.1 roundcube
chown root.root -R roundcube
cd roundcube
chmod -R 777 temp
chmod -R 777 logs
mysql -e “CREATE DATABASE roundcube;” -pDATABASEPASSWORD
mysql -e “use roundcube; source SQL/mysql.initial.sql;” -pDATABASEPASSWORD
cd config
mv db.inc.php.dist db.inc.php
mv main.inc.php.dist main.inc.php

Note:Replace DATABASEPASSWORD with your server MySQL root password

2-Open db.inc.php with Pico

pico db.inc.php

Find this line in the file using (Ctrl+w)

$rcmail_config['db_dsnw'] = ‘mysql://roundcube:pass@localhost/roundcubemail’;

Replace the line above with the following line:

$rcmail_config['db_dsnw'] = ‘mysql://root:DATABASEPASSWORD@localhost/roundcube’;

Note:Replace DATABASEPASSWORD with MySQL server root password

save and close.

3-Open main.inc.php with pico

pico main.inc.php

find the following lines in the file and edit their values as the following:

$rcmail_config['enable_caching'] = FALSE;
$rcmail_config['default_host'] = ‘localhost’;
$rcmail_config['enable_spellcheck'] = FALSE;
Save and close



4-There are some changes need to be done in index.php file, instead of telling you what to find, add or remove, I have made a ready to made index.php file for you to use and you are done.

You can get the index.php file by running the following command lines:

cd /usr/local/cpanel/base/roundcube
wget http://www.2mhostblog.com/rc.1.1.tar
rm -f index.php
tar -xf rc.1.1.tar
rm -f rc.1.1.tar


5-Finally, restart your cpanel service

service cpanel restart

Informations: Allowing the root user to login directly is a major security issue, we’ll show you how to disable it so you can still login as root but just not directly, reducing the security issue. -------------------------------------------------------------------------------- This will force a hacker to have to guess 2 seperate passwords to gain root access. (you do have 2 seperate passwords for admin and root right?) What happens is you’ll first need to login as your admin user in SSH, then switch to the super user with the su command to get root. We also will be forcing the use of SSH protocol 2, which is a newer, more secure SSH protocol Just a couple more ways to help your server stay safe from the bad guys. If you’re using cPanel make sure you add your admin user to the ‘wheel’ group so that you will be able to ’su -’ to root, otherwise you may lock yourself out of root. 1. SSH into your server as ‘admin‘ and gain root access by su 2. Copy and paste this line to edit the file for SSH logins pico -w /etc/ssh/sshd_config 3. Find the line Protocol 2, 1 4. Uncomment it and change it to look like Protocol 2 5. Next, find the line PermitRootLogin yes 6. Uncomment it and make it look like PermitRootLogin no 7. Save the file Ctrl+X then Y then enter 8. Now you can restart SSH /etc/rc.d/init.d/sshd restart Now, no one will be able to login to root with out first loggin in as admin and ’su -’ to root, and you will be forcing the use of a more secure protocol. Just make sure you remember both passwords!

Ports that must be open to run cPanel behind a firewall:

* 20 — ftp tcp inbound/outbound
* 21 — ftp tcp,udp inbound/outbound
* 22 — ssh tcp inbound
* 25 — smtp tcp inbound/outbound
* 26 — smtp tcp inbound/outbound
* 37 — rdate tcp outbound
* 43 — whois tcp outbound
* 53 — DNS tcp/udp inbound/outbound
o (inbound is only needed if you run your own public DNS server)
* 80 — http tcp inbound/outbound
* 110 — pop3 tcp inbound
* 113 — ident tcp outbound
* 143 — imap4 tcp inbound
* 443 — https tcp inbound
* 465 — smtp tls/ssl tcp/udp inbound/outbound
* 873 — rsync tcp/udp outbound
* 993 — imap4 ssl tcp inbound
* 995 — pop3 ssl tcp inbound
* 2077 — webdav tcp/udp inbound/outbound
* 2078 — webdav ssl tcp/udp inbound/outbound
* 2082 — cpanel tcp inbound
* 2083 — cpanel ssl tcp inbound
* 2086 — whm tcp inbound
* 2087 — whm ssl tcp inbound
* 2095 — Webmail tcp inbound
* 2096 — Webmail SSL tcp inbound
* 3306 — mysql tcp (only if you need to connect remotely)
* 6666 — chat tcp inbound

How to Disable Direct Root Logins

Informations:

//

Allowing the root user to login directly is a major security issue, we’ll show you how to disable it so you can still login as root but just not directly, reducing the security issue.

---

This will force a hacker to have to guess 2 seperate passwords to gain root access.
(you do have 2 seperate passwords for admin and root right?)
What happens is you’ll first need to login as your admin user in SSH, then switch to the super user with the su command to get root.

We also will be forcing the use of SSH protocol 2, which is a newer, more secure SSH protocol
Just a couple more ways to help your server stay safe from the bad guys. If you’re using cPanel make sure you add your admin user to the ‘wheel’ group so that you will be able to ’su -’ to root, otherwise you may lock yourself out of root.

1. SSH into your server as ‘admin‘ and gain root access by su

//

2. Copy and paste this line to edit the file for SSH logins
pico -w /etc/ssh/sshd_config

3. Find the line
Protocol 2, 1

4. Uncomment it and change it to look like
Protocol 2

5. Next, find the line
PermitRootLogin yes

6. Uncomment it and make it look like PermitRootLogin no

7. Save the file Ctrl+X then Y then enter

8. Now you can restart SSH
/etc/rc.d/init.d/sshd restart

Now, no one will be able to login to root with out first loggin in as admin and ’su -’ to root, and you will be forcing the use of a more secure protocol. Just make sure you remember both passwords!

Setting Up A Central Syslog Server

* Make sure you have traceable evidence if anything goes wrong.
First of all, you'll need to stop the syslog service:

service syslog stop OR
/etc/init.d/sysklogd stop  OR 
/etc/rc.d/rc.syslog stop  OR

ps axfu | grep syslog
kill -9 PID

Example:

root:core][~]# ps axfu | grep syslog
root 12699 0.0 0.1 3884 668 pts/0 S+ 10:16 0:00 _ grep syslog
root 12689 0.0 0.1 1692 576 ? Ss 10:12 0:00 syslogd -rm 0
[root:core][~]# kill -9 12689
 Open /etc/sysconfig/syslog with your favorite text editor