RootKit — Spyware and Junkware detection and removal tool Go to Rootkit Hunter homepage, and download the latest release. http://www.rootkit.nl/projects/rootkit_hunter.html ## Get the latest source and untar # cd /usr/src/utils # wget http://downloads.rootkit.nl/rkhunter-<version>.tar.gz # tar xfz rkhunter-*.gz # cd rkhunter # ./installer.sh ## run rkhunter # rkhunter -c Setup automatic protection on System Reboot ##… Continue reading Rootkit help
Category: Uncategorized
URL injections information
URL Injection attacks typically mean the server for which the IP address of the attacker is bound is a compromised server. Please check the server behind the IP address above for suspicious files in /tmp, /var/tmp, /dev/shm, along with checking the process tree (ps -efl or ps -auwx). You may also want to check out http://www.chkrootkit.org/… Continue reading URL injections information
Securing the TMP Partition and Tracking Hacks
Are your temp partitions putting out behind your back? Anyone who’s ever administered a Linux server would know the risk of leaving the /tmp directory unsecured, moreso on a webserver that is shared among multiple websites. The tmp directory is world-writeable and used by a majority of services on a machine — including the storage… Continue reading Securing the TMP Partition and Tracking Hacks
Installing IonCube loader with Zend Optimizer – cPanel
This is a common request we get for Ioncube to be installed. It’s generally not an issue, but when you factor in other optimization plugins like Zend and eAccelerator, a common misconception is that the three don’t get along. It’s very easy to install Ioncube into a PHP installation that already has Zend and eAccelerator.… Continue reading Installing IonCube loader with Zend Optimizer – cPanel
eAccelerator on PHP 5
Here is what I did to get eAccelerator 0.9.5 running on PHP 5 on my V-Dedicated server. I did the exact steps when I had PHP 4 running the only difference was that with PHP 4 I used the 0.9.4 install of eAccelerator instead of 0.9.5. Everything was done via SSH access. 1. cd /usr/local/src/… Continue reading eAccelerator on PHP 5
Preventing DDOS Attacks with Mod_Evasive
Denial of Service attacks are among the oldest yet most common form of attacking a server. Most system administrators have had to deal with DOS attacks taking down a server, router, or other networking device and know how difficult they can be to prevent. Mod_evasive is an Apache module that limits the number of Apache… Continue reading Preventing DDOS Attacks with Mod_Evasive
Changing the SSH Port
Sometimes you don’t want SSH running on standard port 22. Here are the steps to change it: It’s VERY important that you leave port 22 open while you are testing the new port, otherwise you may lock yourself out of the server! SSH into the server normally… cp /etc/ssh/sshd_config /etc/ssh/sshd_config.root In the /etc/ssh/sshd_config.root file that… Continue reading Changing the SSH Port
Closing Open Nameservers – DNS recursion
Open nameservers allow anyone in the world to perform queries on them, which can often lead to DOS attacks and slower performance. Some system administrators prefer to have their nameservers restricted to only trust parties. To do this kind of setup, you will need to configure your named configuration: On command line: pico /etc/named.conf Look… Continue reading Closing Open Nameservers – DNS recursion
Useful MySQL Commands
These command assume you are running a cPanel MySQL installation and logged into the server as a root user where you can do a mysql -u root without having to specify a password. Import a database: mysql -u root db_name < file.sql Dump a Database (with special characters): mysqldump -Q –add-drop-table db_name > file.sql Dump… Continue reading Useful MySQL Commands
MySQL Root Login Failure
When trying to log into the MySQL shell as root you get an access denied error. To fix: Add this line to /etc/my.cnf and restart MySQL: skip-grant-tables Follow these steps to reset the MySQL root password: mysql -u root mysql> FLUSH PRIVILEGES; mysql> GRANT ALL PRIVILEGES ON *.* TO root@localhost IDENTIFIED BY ‘password’ WITH GRANT… Continue reading MySQL Root Login Failure