Archive for the ‘other’ Category


Linux Malware Detect (LMD) is a malware scanner for Linux released under the GNU GPLv2 license, that is designed around the threats faced in shared hosted environments. It uses threat data from network edge intrusion detection systems to extract malware that is actively being used in attacks and generates signatures for detection.

 

In addition, threat data is also derived from user submissions with the LMD checkout feature and from malware community resources. The signatures that LMD uses are MD5 file hashes and HEX pattern matches, they are also easily exported to any number of detection tools such as ClamAV.

 

Note: This guide assumes you are familiar with SSH and basic command line navigation. These instructions apply primarily to customers who have Virtual Private Servers or Dedicated servers. If you do not have root-level access you will not be able to make these changes.

 

Installation

Installation is very straightforward. Ensure to change the version number below to the one you have actually downloaded:

# cd /usr/local/src
# wget http://www.rfxn.com/downloads/maldetect-current.tar.gz
# tar -zxvf maldetect-current.tar.gz
# cd maldetect-1.4.2
# ./install.sh

 

After the installation has been completed succesfully, you will be presented with the following output.

Linux Malware Detect v1.4.2
            (C) 2002-2011, R-fx Networks 
            (C) 2011, Ryan MacDonald 
inotifywait (C) 2007, Rohan McGovern 
This program may be freely redistributed under the terms of the GNU GPL

installation completed to /usr/local/maldetect
config file: /usr/local/maldetect/conf.maldet
exec file: /usr/local/maldetect/maldet
exec link: /usr/local/sbin/maldet
exec link: /usr/local/sbin/lmd
cron.daily: /etc/cron.daily/maldet

maldet(6073): {sigup} performing signature update check...
maldet(6073): {sigup} local signature set is version 2013102428301
maldet(6073): {sigup} new signature set (2013102428301) available
maldet(6073): {sigup} downloaded http://www.rfxn.com/downloads/md5.dat
maldet(6073): {sigup} downloaded http://www.rfxn.com/downloads/hex.dat
maldet(6073): {sigup} downloaded http://www.rfxn.com/downloads/rfxn.ndb
maldet(6073): {sigup} downloaded http://www.rfxn.com/downloads/rfxn.hdb
maldet(6073): {sigup} downloaded http://www.rfxn.com/downloads/maldet-clean.tgz
maldet(6073): {sigup} signature set update completed
maldet(6073): {sigup} 10849 signatures (8981 MD5 / 1868 HEX)

 

Configuration

Maldet can be configured by editing the file below:

# vi /usr/local/maldetect/conf.maldet

The default file looks as follows:

# [ EMAIL ALERTS ]
##
# The default email alert toggle
# [0 = disabled, 1 = enabled]
email_alert=1

# The subject line for email alerts
email_subj="maldet alert from $(hostname)"

# The destination addresses for email alerts
# [ values are comma (,) spaced ]
email_addr="youremail@yourdomain.com"

# Ignore e-mail alerts for reports in which all hits have been cleaned.
# This is ideal on very busy servers where cleaned hits can drown out
# other more actionable reports.
email_ignore_clean=0

##
# [ QUARANTINE OPTIONS ]
##
# The default quarantine action for malware hits
# [0 = alert only, 1 = move to quarantine & alert]
quar_hits=1

# Try to clean string based malware injections
# [NOTE: quar_hits=1 required]
# [0 = disabled, 1 = clean]
quar_clean=1

# The default suspend action for users wih hits
# Cpanel suspend or set shell /bin/false on non-Cpanel
# [NOTE: quar_hits=1 required]
# [0 = disabled, 1 = suspend account]
quar_susp=0
# minimum userid that can be suspended
quar_susp_minuid=500

 

You may edit the following values to configure Maldet to your needs

  • email_alert : If you would like to receive email alerts, then it should be set to 1.
  • email_subj : Set your email subject here.
  • email_addr : Add your email address to receive malware alerts.
  • quar_hits : The default quarantine action for malware hits, it should be set 1.
  • quar_clean : Cleaing detected malware injections, must set to 1.
  • quar_susp : The default suspend action for users wih hits, set it as per your requirements.
  • quar_susp_minuid : Minimum userid that can be suspended.

 

Cronjob for automated scan

During installation, a daily cron job script is installed in /etc/cron.daily/maldet.

The cronjob installed by LMD is used to perform daily update of signature files, keep the session, temp and quarantine data to no more than 14 days old and it runs a daily scan of recent file system changes. If inotify-based real time monitoring is enabled, the daily cron job also scans the recently updated/created files for malware. The folder structures for the most popular control panel configurations: Ensim, Plesk, DirectAdmin, Cpanel, Interworx, have been imcluded.

You should ensure compatibility with your servers’ structure of homedirs and make sure it corresponds with this cron file. Take special note of the control panel specific sections in this cron file.

#!/bin/bash

# clear quarantine/session/tmp data every 14 days
/usr/sbin/tmpwatch 336 /usr/local/maldetect/tmp >> /dev/null 2>&1
/usr/sbin/tmpwatch 336 /usr/local/maldetect/sess >> /dev/null 2>&1
/usr/sbin/tmpwatch 336 /usr/local/maldetect/quarantine >> /dev/null 2>&1
/usr/sbin/tmpwatch 336 /usr/local/maldetect/pub/*/ >> /dev/null 2>&1

# check for new release version
/usr/local/maldetect/maldet -d >> /dev/null 2>&1

# check for new definition set
/usr/local/maldetect/maldet -u >> /dev/null 2>&1

# if were running inotify monitoring, send daily hit summary
if [ "$(ps -A --user root -o "comm" | grep inotifywait)" ]; then
        /usr/local/maldetect/maldet --alert-daily >> /dev/null 2>&1
else
        # scan the last 2 days of file changes
        if [ -d "/home/virtual" ] && [ -d "/usr/lib/opcenter" ]; then
                # ensim
                /usr/local/maldetect/maldet -b -r /home/virtual/?/fst/var/www/html 2 >> /dev/null 2>&1
                /usr/local/maldetect/maldet -b -r /home/virtual/?/fst/home/?/public_html 2 >> /dev/null 2>&1
        elif [ -d "/etc/psa" ] && [ -d "/var/lib/psa" ]; then
                # psa
                /usr/local/maldetect/maldet -b -r /var/www/vhosts/?/httpdocs 2 >> /dev/null 2>&1
                /usr/local/maldetect/maldet -b -r /var/www/vhosts/?/subdomains/?/httpdocs 2 >> /dev/null 2>&1
        elif [ -d "/usr/local/directadmin" ]; then
                # DirectAdmin
                /usr/local/maldetect/maldet -b -r /var/www/html/?/ 2 >> /dev/null 2>&1
                /usr/local/maldetect/maldet -b -r /home?/?/domains/?/public_html 2 >> /dev/null 2>&1
        else
                # cpanel, interworx and other standard home/user/public_html setups
                /usr/local/maldetect/maldet -b -r /home?/?/public_html 2 >> /dev/null 2>&1
        fi
fi

In order to activate email alerts when malware is detected, you need to open the Maldet configuration file, which is located at:
/usr/local/maldetect/conf.maldet .

email_alert=1
email_subj="Maldet alert from $(hostname)"
email_addr="email@domain.com"

 

iNotify Monitoring

The inotify monitoring feature is designed to monitor users in real-time for file creation/modify/move operations. This option requires a kernel that supports inotify_watch (CONFIG_INOTIFY) which is found in kernels 2.6.13+ and CentOS/RHEL 5 by default. If you are running CentOS 4 you should consider an inbox upgrade with: http://www.rfxn.com/upgrade-centos-4-8-to-5-3/

There are three modes that the monitor can be executed with and they relate to what will be monitored, they are USERS|PATHS|FILES.

  • e.g: maldet –monitor users
  • e.g: maldet –monitor /root/monitor_paths
  • e.g: maldet –monitor /home/mike,/home/ashton

The options break down as follows:

  • USERS – The users option will take the homedirs of all system users that are above inotify_minuid and monitor them. If inotify_webdir is set then the users webdir, if it exists, will only be monitored.
  • PATHS – A comma spaced list of paths to monitor
  • FILE – A line spaced file list of paths to monitor

you can run maldet as a daemon as follows. The example below displays the syntax for a comma spaced list of paths to monitor

maldet -m /var,/home
maldet(5330): {mon} set inotify max_user_instances to 128
maldet(5330): {mon} set inotify max_user_watches to 61440
maldet(5330): {mon} added /var to inotify monitoring array
maldet(5330): {mon} added /home/xmodulo to inotify monitoring array
maldet(5330): {mon} starting inotify process on 1 paths, this might take awhile...
maldet(5330): {mon} inotify startup successful (pid: 4154)
maldet(5330): {mon} inotify monitoring log: /usr/local/maldetect/inotify/inotify_log

 

Usage

To scan a folder, for example /home you should enter:

maldet -a /home.

you can examine the malware scan report by running the following command and appending the scan report ID.

maldet --report number-xxxx.xxxxx

To quarantine the infected files, run the following command with the scan report ID. The infected files will then be quarantined for cleaning.

# maldet -q SCAN ID
# maldet –quarantine SCANID

Clean all malware results from a previous scan

# maldet -n SCAN ID
# maldet --clean SCAN ID

Restore a file that you have already quarantined

# maldet -s FILENAME
# maldet --restore FILENAME

 

Ignore Files

There are three ignore files available in Linux Malware Detect. These can be used to exclude files from daily malware scans.

ignore_paths

This is a line spaced file for paths that are to be execluded from search results

/usr/local/maldetect/ignore_paths

 

ignore_sigs

This is a line spaced file for signatures that should be removed from file scanning

/usr/local/maldetect/ignore_sigs

 

ignore_inotify

This is a line spaced file for paths that are to be excluded from inotify monitoring

/usr/local/maldetect/ignore_inotify

There may be some situations where you have to move the location of MySQL, for example, if you’re out of disk space or perhaps looking to host it on another device to increase performance. Whatever the reason, moving MySQL is simple and has no impact  on cPanel’s functionality.

 

1.Create a backup

Please make full database backup(including system tables) before moving your data directory. This action will prevent data losing in case if something goes wrong.

# tar -cvf mysql.tar /var/lib/mysql

2.Edit the my.cnf file

# vi /etc/my.cnf

Now in the mysqld section add the following. Don’t restart MySQL after adding new entry.

datadir=/home/mysql

3.Create the new MySQL data directory

# mkdir /home/mysql

4.Now migrate the data to the new location using rsync command.

# nohup rsync -avp /var/lib/mysql/ /home/mysql

The nohup will keep rsync running even when your session with the server end, the other part “

# tail -f nohup.out

Notice that you have to do the syncing process twice because when moving large size of data can take some time to complete and the tables may have changed in between. When we run it the second time we hopefully get it so that when the switch over happens there is very little, if any, lost data. If you can afford the downtime simply shut down MySQL before running this command.If you cannot though running it twice then quickly copy/pasting the other commands is a valid substitute.

5.Typically you want to stop MySQL for syncing data completely.

# /etc/init.d/mysqld stop

6.Start the re-sync process once again to copy data’s completely.

# rsync -avp --delete /var/lib/mysql/ /home/mysql/

7. Change ownership of new created MySQL data directory to MySQL.

# chown -R mysql:mysql /home/mysql/

8. Now, re-link the socket file to /tmp:

# rm -rf /tmp/mysql.sock
# ln -sf /home/mysql/mysql.sock /tmp/mysql.sock

9. Since you already added the data directory entry to my.cnf , all you need to do is restart again and everything should be working.

# /etc/init.d/mysqld start

Check whether your MySQL logs are written at the new location (Eg: /home/mysql/hostname.err)

10. Create a sample database named “test” for checking.

# mysqladmin create test

11. Check whether the new database is created at new data directory.

# ls -d /home/mysql/test

12. After confirming everything works properly.You can remove the old data directory.

# rm -rf  /var/lib/mysql

Custom php.ini file with FastCGI

Posted: December 15, 2016 in other

  1. Login to your server via SSH.
  2. Make a backup copy of your cPanel PHP wrapper script with the following command:

    cp -frp /usr/local/cpanel/cgi-sys/php5 /usr/local/cpanel/cgi-sys/php5-BACKUP

  3. Now edit the cPanel PHP wrapper script with your favorite text editor:

    vi /usr/local/cpanel/cgi-sys/php5

    By default this script should look like:

    #!/bin/sh

    # If you customize the contents of this wrapper script, place
    # a copy at /var/cpanel/conf/apache/wrappers/php5
    # so that it will be reinstalled when Apache is updated or the
    # PHP handler configuration is changed

    exec /usr/bin/php

  4. Above the line exec /usr/bin/php add the following code:

    [[ -f ~/public_html/php.ini ]] && exec /usr/bin/php -c ~/public_html/php.ini

    Now the cPanel PHP wrapper script should look like:

    #!/bin/sh

    # If you customize the contents of this wrapper script, place
    # a copy at /var/cpanel/conf/apache/wrappers/php5
    # so that it will be reinstalled when Apache is updated or the
    # PHP handler configuration is changed

    [[ -f ~/public_html/php.ini ]] && exec /usr/bin/php -c ~/public_html/php.ini
    exec /usr/bin/php

    What this does is uses the Bash syntax for seeing if a file exists [[ -f ]] and in this case we’re looking for the file ~/public_html/php.ini. The ~ symbol would represent the current user calling the script, so this would be the same as entering in either /home/user1/public_html/php.ini or /home/user2/public_html/php.ini as the full path.

    The rest of the code simply executes the PHP binary at /usr/bin/php with the -c flag which sets the location where you’d like to load a php.ini from from. In this case we are telling the server we’d like to use the php.ini file inside the user’s /public_html/ directory if one exists, instead of /usr/local/lib/php.ini which would be the server’s default.

  5. Now you’ll want to copy the cPanel PHP wrapper script to a more permanent location, so that your settings are saved if you ever recompile Apache down the road. This can be done using the following command:

    mkdir -p /var/cpanel/conf/apache/wrappers
    cp -frp /usr/local/cpanel/cgi-sys/php5 /var/cpanel/conf/apache/wrappers/php5

  6. Now restart Apache for the settings to become active:

    service httpd restart

  7. In order to verify your settings have been applied you’ll want to create a PHP info script, the simplest way of doing this is simply copying any of your files to a file such as info.php, and then overwriting it with the phpinfo(); function:

    echo ‘<?php phpinfo(); ?>’ > ~user1/public_html/info.php

    Now when you visit your website and access the newly crated info.php script, you should see your custom php.ini being loaded next to the Loaded Configuration File section
    php-ini-loaded-configuration-file

2014 in review

Posted: December 30, 2014 in other

The WordPress.com stats helper monkeys prepared a 2014 annual report for this blog.

Here’s an excerpt:

A San Francisco cable car holds 60 people. This blog was viewed about 1,200 times in 2014. If it were a cable car, it would take about 20 trips to carry that many people.

Click here to see the complete report.

How to change date of linux to UTC/GMT?

Posted: December 3, 2013 in other

Assume that your current timezone is UTC as shown below. You would like to change this to London ie in GMT.

# date
Tue Dec 3 10:02:02 UTC 2013

On some distributions (for example, CentOS), the timezone is controlled by /etc/localtime file.

Delete or move the current localtime file under /etc/ directory

# cd /etc
# rm -rf localtime or #mv localtime localtime.bak

All Europe timezones are located under the /usr/share/zoneinfo/Europe directory as shown below:

# ls /usr/share/zoneinfo/Europe/
Amsterdam Busingen Kaliningrad Monaco San_Marino Vaduz
Andorra Chisinau Kiev Moscow Sarajevo Vatican
Athens Copenhagen Lisbon Nicosia Simferopol Vienna
Belfast Dublin Ljubljana Oslo Skopje Vilnius
Belgrade Gibraltar London Paris Sofia Volgograd
Berlin Guernsey Luxembourg Podgorica Stockholm Warsaw
Bratislava Helsinki Madrid Prague Tallinn Zagreb
Brussels Isle_of_Man Malta Riga Tirane Zaporozhye
Bucharest Istanbul Mariehamn Rome Tiraspol Zurich
Budapest Jersey Minsk Samara Uzhgorod

Note: For other country timezones, browse the /usr/share/zoneinfo directory

Link the London file from the above Europe directory to the /etc/localtime directory as shown below:

#ln -s /usr/share/zoneinfo/Europe/London localtime

Now the timezone on your Linux system is changed to Europe/London time as shown below.

#date
Tue Dec 3 10:11:43 GMT 2013

URL for different ports in the server

Posted: February 3, 2013 in other

exim -bp | awk ‘/^ *[0-9]+[mhd]/{print “exim -Mrm ” $3}’ | bash

How to redirect a WWW?

Posted: February 3, 2013 in other

Step1:
Go to the path #/home/username/public_html

Step2:
vi .htaccess

Step3:

RewriteEngine on
RewriteCond %{HTTP_HOST} ^alyaseenco.com\.com$ [NC]
RewriteRule ^(.*)$ http://www.alyaseenco.com/$1 [R=301,L]