Performance and Security Latest Topics

Let's Encrypt for Apache - CentOS 7/AlmaLinux 8

Thu, 23 May 2024 09:48:01 +0000

Let's Encrypt is a certificate authority that provides free certificates in a fully automated process.
In this guide, you will learn how to set up a TLS/SSL certificate from Let’s Encrypt on an Centos 7 / AlmaLinux 8 servers running Apache as a web server.

Preparation

Before enabling the Let's Encrypt certificate, make sure you have Apache Web Server installed on your server. If not, you can check out our Apache web server installation guide.

You also need to create a virtual host configuration file by typing this command (if you didn't do it during Apache installation):

vi /etc/httpd/conf.d/yourdomain.ltd.conf

Add these lines to the configuration file:


  ServerAdmin admin@yourdomain.ltd
  DocumentRoot "/var/www/html"
  DirectoryIndex index.html
  ServerName yourdomain.ltd
  ErrorLog "/var/log/httpd/yourdomain.ltd.error_log"
  CustomLog "/var/log/httpd/yourdomain.ltd.access_log" common

Please note. Make sure to change the "yourdomain.ltd" to your actual domain.

After editing, you can save changes and exit.

1. Creating An Index.Html File For Testing

To create an index.html file for testing, run this command:

vi /var/www/html/index.html

Enter the text for testing in the file:

  
   Page for testing purposes

After that, you can save the file and exit.

Now you need to change the owner of the ‘/var/www/html/index.html’ file to Apache by entering this command:

chown -R apache:apache /var/www/html/index.html

This means that Apache can now read this file.

2. Install Certbot

On Centos 7 follow these steps to install Cerbot:

We need to add the EPEL repository before installing Certbot. Run this command:
yum install epel-release
Install the Certbot:
yum install certbot python2-certbot-apache mod_ssl

On AlmaLinux 8 follow these steps to install Cerbot:

Run this command to add the EPEL repository before installing Certbot:
dnf install epel-release
Install the Certbot:
dnf install certbot python3-certbot-apache

3.Set Up The SSL Certificate

To set up the SSL for domain, run this command:

certbot --apache -d yourdomain.ltd

You can install certificate for multiple domains and subdomains by following this command:

certbot --apache -d yourdomain.ltd -d www.yourdomain.ltd -d yourdomain2.ltd -d subdomain.yourdomain2.ltd

When issuing a certificate, you will need to provide an email, that you specified previously in virtual host configuration file (admin@yourdomain.ltd).
You will also need to agree to the Terms of Service (mandatory) and agree or disagree to share your email address with Electronic Frontier Foundation (optional)

Please note.

When issuing a certificate, you may receive the following error message:

Cancel the certificate issue process (enter 'c') and restart Apache service with the following command:

systemctl restart httpd

After that, try to issue the certificate again.

4.Check SSL Certificate

Enter this command to check if SSL issued successfully:

ls /etc/letsencrypt/live/yourdomain.ltd/

You should see the following output:

cert.pem chain.pem fullchain.pem privkey.pem

You can also check SSL in your browser. Open your website and click on the padlock icon in the address bar to see information about certificate.

5.Manual And Automatic Renewal

Let’s Encrypt certificates are valid for 90 days.

You can manually renew certificate with this command:

certbot renew --dry-run

If the certificate is less than 30 days away from expiration, this command will renew it.

If you want to specify auto-renewal, you can edit the crontab and create cronjob to run the above command twice a day automatically:

crontab -e

Add this line to the crontab:

 * */12 * * * root /usr/bin/certbot renew >/dev/null 2>&1

You're all set. When necessary, certbot will renew your certificates and reload Apache to pick up the changes.

Please note.

If, after activating the certificate, your site is still not available and you receive "Secure Connection Failed" error, make sure to allow traffic via HTTPS (port 443), which could be blocked in firewalld by default.

You can check if HTTPS enabled, using this command:

firewall-cmd --list-all

The output will provide you information about enabled services. In this screenshot, you can see that port 443 is enabled:

If 443 port disabled, you can enable it with firewalld or iptables.

To enable https service in firewalld, use this command:

firewall-cmd --permanent --add-service=https

Then reload the firewall:

firewall-cmd --reload

To enable https in iptables, use this command:

iptables -I INPUT -p tcp -m tcp --dport 443 -j ACCEPT

Then save the changes:

iptables-save

How to modify SWAP memory

Fri, 21 Apr 2023 08:28:29 +0000

SWAP memory is used to help RAM, once it cannot store any more data. The data which cannot be stored in RAM is then stored to SWAP memory in the hard disk. In this article, we will provide the basic steps on how to modify and increase SWAP memory in our KVM virtualization Linux VPS packages.

In general, there are different opinions on how much SWAP memory your server should have. It could be half of your RAM, the same amount or even more than RAM. In our article, we will assign 6 GB of SWAP to the server.

Allocating SWAP Memory

First thing you should do is to check if there is no SWAP memory in use on your server with the following command:

free -h

Your results will be printed in two lines: "Mem", "Swap", which will indicate, what the exact amount of RAM and SWAP memory is on the KVM server. The "Swap" line should only contain zeros.

With the following command, we will allocate 6 GB of disk space for our SWAP memory:

fallocate -l 6G /swapfile

You can check if your SWAP memory was assigned with this command:

ls -lh /swapfile

At first, your SWAP may not be allocated due to permission issue and you might be seeing this message:

-rw-r--r-- 1 root root 6.0G Dec 5 14:32 /swapfile

This would suggest we have to make additional changes, first of which should be changing the permission of the swapfile:

chmod 600 /swapfile

After the change you can check the file permissions again:

ls -lh /swapfile

The results should change as well, comparing to the previous above:

-rw------- 1 root root 6.0G Dec  5 14:36 /swapfile

Now set the swapfile as Linux swap area:

mkswap /swapfile

Finally, enable SWAP usage:

swapon /swapfile

We can now check if the SWAP memory was allocated correctly:

free -h

Your results will print two lines again, just this time, you will see a line "Swap" having a variable of 6 GB.

Additional Options

In general, your SWAP memory allocation may stop working after you reboot the KVM server, so in order to save these changes permanently, we have to edit /etc/fstab. But first, we would recommend making a backup of this file:

cp /etc/fstab /etc/fstab.old

Once the backup is done, we have to make the changes to the actual file:

echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

There are few extra options for SWAP memory, which we would like to address as well:

Option - swappiness, is used to describe when the system will move data to the SWAP file. The option may have a value from 0 to 100. Closer to 0, means that your data will be moved to SWAP only when it will be necessary. Closer to 100 means that, data will be moved to SWAP more often, therefore leaving RAM memory more free. We would recommend keeping this option closer to 0, for example, 10.

You can check the current value with the following command:

cat /proc/sys/vm/swappiness

Option - vfs_cache_pressure, this option sets how often the information about the file system is updated. By default, it should be 100, but we would recommend using a lower value, for example, 50.

The current value can be checked with this command:

cat /proc/sys/vm/vfs_cache_pressure

Both of the additional options can be edited at the file /etc/sysctl.conf
by adding the following line at the bottom of the file:

vm.swappiness=10
vm.vfs_cache_pressure=50

If any questions remain, please contact our customer support, we will be glad to help.

Tips in how to secured your VPS

Fri, 21 Apr 2023 08:22:50 +0000

Here is a simple, straightforward guide to improving VPS security.

Change the SSH port

One of the most common points of attack is port 22. Changing this discourages many of them as well as scripts set to check for that port. In order to change the port do the following:

nano /etc/ssh/sshd_config

You should locate a line that looks like:

#Port 22

Un-comment this line and change the port number. A port number above 1024 is recommended.
This section of your sshd_conf should now look like:

Port 2222
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

You can now save and exit nano (Ctrl x) and restart the SSHD service by issuing the following command:

service sshd restart

IMPORTANT: Make sure you can connect to SSH using the new port. Leave your current SSH session open and open a new session using the new port you set above. If you can connect to the new SSH session on the new port than everything is good. If you cannot, then you need to figure out why. This is why you left the original SSH session open, otherwise, you would be locked out of your server.

You may need to add the new port in your IPTables.

First, open your IPtables rules:

nano /etc/sysconfig/iptables

Next, locate the COMMIT line and add the following above it making sure to change #### to the port you set for SSH:

iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport #### -j ACCEPT

You can now save and exit nano (Ctrl x) and restart the IPtables service:

service iptables restart

You should now try to connect to SSH again. If you still cannot connect to it, it would be best to set your SSH port back to 22 and contact your service provider for help.

Use strong passwords for everything

One of the most common causes of system breach is weak passwords. For a strong password, follow a few simple guidelines:

• Minimum password length should be 10 characters
• Always use a mix of numbers, letters, uppercase, lowercase, and symbols (when allowed)
• Strong Password Example- T=ep@Uy*ST

If you need to change your root password, issue the following command and follow the prompts:

passwd

Disable Root User

It is a security risk to keep the root user enabled. Most operations and installs should not be done using root. Instead, create a regular user and if you need root privileges, use the su command.

To add a user, do the following replacing “namehere” with your desired username:

useradd namehere
passwd namehere

Now, disable root login to SSH by editing your sshd_config file:

nano /etc/ssh/sshd_config PermitRootLogin no (make sure you remove the #)

Now save and exit Nano (Ctrl x) and restart SSHd:

service sshd restart

For your next connection, use the previously created “namehere” user and if needed to perform root commands, simply use the “su” command followed with the root password.

Restrict SSH access by IP using IPtables

This adds a great amount of security but make sure you have a static IP.

First, open your IPtables rules:

nano /etc/sysconfig/iptables

Locate the line containing rule with "--dport 22" fragment and add the following above it making sure to change #### to the port you set for SSH and 192.168.0.1 to your IP address:

-A INPUT -p tcp -s 192.168.0.1 --dport #### -j ACCEPT

You can now save and exit nano (Ctrl x) and restart the iptables service:

service iptables restart

Install RkHunter

Every server needs something checking for rootkits, backdoors, md5 hashes (file changes), hidden files, etc.. etc.. and RKHunter is great at this.

To install RKHunter, issue the following commands:

yum install rkhunter -y

You need to set up a daily cron so that rkhunter will check its version and update it if needed as well as run a scan. We will also be setting it so it will e-mail you the daily report.

Create and open in nano a new cron task/shell script by issuing the command below:

nano -w /etc/cron.daily/rkhunter.sh

Now add the following making sure to replace “PutYourServerNameHere” with your server's hostname and “your@email.here” with your email address:

#!/bin/sh(/usr/local/bin/rkhunter --versioncheck/usr/local/bin/rkhunter --update/usr/local/bin/rkhunter --cronjob --report-warnings-only)
/bin/mail -s 'rkhunter Daily Run (PutYourServerNameHere)' your@email.here

If you don’t know your server’s hostname, you can find it by typing hostname in your ssh window. You will need to exit (Ctrl x) nano first or open another session.

You also need to secure the script making it usable only by root. To do this, issue the following command:

chmod 700 /etc/cron.daily/rkhunter.sh

Now test it and make sure it runs ok. To run rkhunter manually, issue the following command:

rkhunter -c -sk

That’s it. You're done and your server just became much safer!

Install CSF (Config Server Firewall)

CSF includes many different types of protection and is much more user-friendly than using IPTables directly.

If you are not sure whether you have Perl installed issue the following command:

perl -v

If perl is installed, it will return which version. If it is not installed, issue the following command to install it:

yum install perl-libwww-perl.noarch perl-LWP-Protocol-https.noarch perl-GDGraphyum install perl perl-libwww-perl perl-Time-HiRes -y

Now you can install CSF with the command below:

cd /usr/src
rm -fv csf.tgz
wget https://download.configserver.com/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh

Make sure that you have the required iptable modules by issuing the following command:

perl /etc/csf/csftest.pl

It is possible that you will be missing some modules, but as long as the test does not return a fatal error, you should be fine. You may lose some functionality of CSF with missing modules but it will work.

When you install CSF, it automatically whitelists your IP. It also starts in test mode which means it clears the rules every 5 minutes. Make sure you leave it in test mode until you are sure your configuration is working properly. If you do lock yourself out, just wait for 5 minutes and you will be able to log in again. The stock configuration is fine for most servers though some changes should be made.

If you changed your SSH port above, you need to make sure to add it to your CSF config. To edit the csf configuration, issue the following command:

nano /etc/csf/csf.conf

The first thing to edit is the TCP ports. You can delete port 22 on inbound and outbound since SSH uses your new port which should already have been added to the end of the inbound line, if not then add it. You will also need to add it to the outbound TCP:

# Allow incoming TCP portsTCP_IN = "20,21,25,53,80,110,143,443,465,587,993,995,####"
# Allow outgoing TCP portsTCP_OUT = "20,21,22,25,53,80,110,113,443,####"

Next, locate CONNLIMIT = “”
You should limit the number of concurrent connections per IP on the most commonly attacked ports which are 21 (FTP), 80 (HTTP), and your new SSH port. This setting is only for TCP.

CONNLIMIT = "21;5,####;5,80;20"

Next, configure port flood protection located directly under CONNLIMIT. Again, you should add the most commonly attacked ports. This setting limits the number of connections allowed at one time on a specified port.

PORTFLOOD = "21;tcp;5;300,80;tcp;20;5,####;tcp;5;300"

To set the e-mail that CSF will send reports to, find X_ARF_TO = “” and add your email address:

X_ARF_TO = "your@email.here"

That’s all the configuration changes we are going to cover in this guide.

Save and exit your editor (Ctrl x) and start CSF by issuing the following command:

csf -h (shows a list of csf commands) or csf -s (starts csf)

You need to open another SSH session and try to connect to your server. If you can connect without error your configuration is good!

Now we can disable testing mode so the lfd (login failure daemon) will be able to start.

To do this, go back into your csf.conf /etc/csf/csf.conf and find TESTING = “1″ and change it to “0″ then save and exit (Ctrl x). Restart CSF with the following command:

csf -r

Now you should remove the install archive by issuing the following command:

cd ../rm -fv csf.tgz

That's it! Now your server is more secure.

Tools to Encrypt/Decrypt and Password Protect Files

Fri, 21 Apr 2023 08:21:00 +0000

Introduction

Encryption is the process of encoding files in such a way that only those who are authorized can access it. Encryption does not of itself prevent interception but denies the file content to the interceptor. In an encryption scheme, the intended files, referred to as plaintext, is encrypted using an encryption algorithm, generating ciphertext that can only be read if decrypted.

Linux distribution provides a few standard encryption/decryption tools that can prove to be handy at times. Here in this article, we have covered 3 such tools with proper standard examples, which will help you to encrypt, decrypt and password-protect your files.

1. GnuPG

GnuPG (GNU Privacy Guard, often called GPG) package in most of today’s Linux distributions comes by default, if in-case it’s not installed you may apt or yum it from the repository.

Ubuntu/Debian:
sudo apt-get install gnupg

CentOS/Fedora:
yum install gnupg

Encrypting

Now you can encrypt a file using GPG. As soon as you run the gpg command with option -c (encryption only with symmetric cipher) it will create a file testfile.txt.gpg.
gpg -c /path_to_the_file/testfile.txt

Note: Enter Paraphrase twice to encrypt the given file. The above encryption was done with CAST5 encryption algorithm automatically. You may specify a different algorithm optionally. To see all the encryption algorithm present you may execute:
gpg --version

Decrypting

Now, if you want to decrypt the above encrypted file, you may use the following command:
gpg /path_to_the_file/testfile.txt.gpg

Note: You need to provide the same password you gave at encryption to decrypt when prompted.

More information about GNU Privacy Guard on official site:
https://www.gnupg.org

2. Zip

It is one of the most famous archive formats and it is so much famous that we generally call archive files as zip files in day-to-day communication. It uses pkzip stream cipher algorithm.

If you have not installed zip you can do it with apt or yum.

Ubuntu/Debian:
sudo apt-get install zip

CentOS/Fedora:
yum install zip

Encrypting

Create an encrypted zip file using zip:
zip --password mypassword testarchive.zip testfile.txt

Or if you want to add more files into zip archive:
zip --password mypassword testarchive.zip testfile.txt testfile1.txt testfile2.txt

Note: Here mypassword is the password used to encrypt it.

Decrypting

To decrypt the file, you will need to install unzip:

Ubuntu/Debian:
sudo apt-get install unzip

CentOS/Fedora:
yum install unzip

Decrypt the password-protected zipped file using unzip:

unzip testarchive.zip

You need to provide the same password you provided at encryption.

3. OpenSSL

By default OpenSSL is installed in all our templates, however, if you have removed it you can install it with apt-get or yum.

Ubuntu/Debian:
sudo apt-get install openssl

CentOS/Fedora:
yum install openssl

Encrypting
openssl enc -aes-256-cbc -in /path_to_the_file/testfile.txt -out /path_to_the_file/testfile.dat

Explanation of each option used in the above command.

enc encryption
-aes-256-cbc the algorithm to be used.
-in full path of a file to be encrypted.
-out the full path where it will be decrypted.

Decrypting

Decrypt a file using OpenSSL:
openssl enc -aes-256-cbc -d -in /path_to_the_file/testfile.dat > /path_to_the_file/testfile2.txt

Setting up SPF and DKIM on your Ubuntu and Debian OS

Fri, 21 Apr 2023 08:19:48 +0000

Introduction

SPF (Sender Policy Framework) is a DNS text entry which shows a list of servers that should be considered allowed to send mail for a specific domain. Incidentally, the fact that SPF is a DNS entry can also considered a way to enforce the fact that the list is authoritative for the domain, since the owners/administrators are the only people allowed to add/change that main domain zone.

upon receipt, the HELO message and the sender address are fetched by the receiving mail server
the receiving mail server runs a TXT DNS query against the claimed domain SPF entry
the SPF entry data is then used to verify the sender server
in case the check fails a rejection message is given to the sender server

DKIM (DomainKeys Identified Mail) should be instead considered a method to verify that the messages' content are trustworthy, meaning that they weren't changed from the moment the a message left the initial mail server. This additional layer of trustability is achieved by an implementation of the standard public/private key signing process. Once again the owners of the domain add a DNS entry with the public DKIM key which will be used by receivers to verify that the message DKIM signature is correct, while on the sender side the server will sign the entitled mail messages with the corresponding private key.

when sending an outgoing message, the last server within the domain infrastructure checks against its internal settings if the domain used in the "From:" header is included in its "signing table". If not the process stops here
a new header, called "DKIM-Signature", is added to the mail message by using the private part of the key on the message content
from here on the message *main* content cannot be modified otherwise the DKIM header won't match anymore
upon reception, the receiving server will make a TXT DNS query to retrieve the key used in the DKIM-Signature field
the DKIM header check result can be then used when deciding if a message is fraudulent or trustworthy

Setting Up SPF

SPF requires only that you add a TXT record to your DNS zone for the domain. How that happens depends on the tools provided by your domain registrar, or the tools you set up yourself should you manage your own nameservers. If using a registrar's web interface to make DNS changes, you may or may not have the option to enter a subdomain for the record. If you do, then leave that field blank.

This generic SPF TXT record authorizes mail originating from mail servers for your domain that is identified by MX records and all other servers associated with your domain that have A records:

"v=spf1 a mx -all"

Note that the double quotes are a necessary part of the SPF TXT record. Much more complicated records than this are possible, as outlined in the SPF documentation.

Setting Up DKIM

Setting up DKIM is a little more involved than SPF, but still not too challenging if you are already running a Postfix mail server on Ubuntu. First, install the necessary packages:

apt-get install opendkim opendkim-tools -y

Open /etc/opendkim.conf:

nano /etc/opendkim.conf

Add the following:

Domain    your_domain
KeyFile   /etc/postfix/dkim.key
Selector  dkim
SOCKET    inet:8891@localhost

Open /etc/default/opendkim:

nano /etc/default/opendkim

Add the following:

SOCKET="inet:8891@localhost"

Configure postfix to use this milter:

nano /etc/postfix/main.cf

Make sure that these two lines are present in the Postfix config file and are not commented out:

milter_protocol = 2
milter_default_action = accept

It is likely that a filter (SpamAssasin, Clamav etc.) is already used by Postfix; if the following parameters are present, just append the opendkim milter to them (milters are separated by a comma), the port number should be the same as in opendkim.conf:

smtpd_milters = unix:/spamass/spamass.sock, inet:localhost:8891
non_smtpd_milters = unix:/spamass/spamass.sock, inet:localhost:8891

If the parameters are missing, define them as follows:

smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891

Generating the Public and Private Keys

Now you can generate a private key for signing outgoing mail. Note that in the following command, "dkim" is the value given to Selector in /etc/opendkim.conf. This can be any simple string, provided you are consistent about replacing "dkim" with your desired value everywhere in this recipe. Run the following command to generate the key and associated materials in the form of two files, dkim.private, and dkim.txt. The former is the RSA private key, while the latter contains the entry you will have to place into your DNS records.

opendkim-genkey -t -s dkim -d your_domain

Move the key into place, but don't forget to take a copy and keep that copy backed up somewhere safe:

mv dkim.private /etc/postfix/dkim.key

You'll need to restart Postfix and OpenDKIM services to pick up the configuration changes so that outgoing mail is signed using DKIM:

service opendkim start
service postfix restart

Adding the Public Key to The Domain's DNS Records

Next up is the DNS record setup. How you do this is again completely dependent on how you manage DNS or how it is managed for you - everyone's tools are different. Note that some registrars do not let you create raw TXT records with specific subdomains, which will prevent you from creating DKIM TXT records. If this is the case, then you will have to transfer your domain to a real registrar that lets you play with all the toys. Or you can simply use our DNS management system!

You can find information about your public key in dkim.txt file:

cat dkim.txt

Here is how it looks on our DNS management system:

Sharing a DKIM Key for Multiple Domains

If you are serving multiple domains from the same mail server, then the contents of /etc/opendkim.conf:

nano /etc/opendkim.conf

Instead of:

Domain    your_domain
KeyFile   /etc/postfix/dkim.key
Selector  dkim
SOCKET    inet:8891@localhost

Should be:

Domain    *
KeyFile   /etc/postfix/dkim.key
Selector  dkim
SOCKET    inet:8891@localhost

Testing

First of all, give the DNS changes a chance to propagate before using it. Decent testing service is Mail Tester.

How to install Lynis and ClamAV

Fri, 21 Apr 2023 08:15:28 +0000

Lynis is an open-source security auditing tool. Used by system administrators, security professionals, and auditors, to evaluate the security defenses of their Linux and UNIX-based systems. It runs on the host itself, so it performs more extensive security scans than vulnerability scanners.

ClamAV is an open-source (GPL) anti-virus engine used in a variety of situations including email scanning, web scanning, and endpoint security. It provides a number of utilities including a flexible and scalable multi-threaded daemon, a command-line scanner and an advanced tool for automatic database updates.

0. Preliminary requirements:

"CentOS 7" template installed on the server;
"nano" text editor installed (yum install nano -y).

1. Installation of Lynis

mkdir /usr/local/lynis

cd /usr/local/lynis

wget https://downloads.cisofy.com/lynis/lynis-2.7.5.tar.gz

	

	tar -xvf lynis-2.7.5.tar.gz

The newest version can be found at: https://cisofy.com/download/lynis/

2. Using Lynis

To execute Lynis we first have to move to its folder:

cd /usr/local/lynis/lynis

In order to see Lynis tutorial execute:

./lynis

To check entire VPS execute:

./lynis --check-all

1. Installation of ClamAV

yum install epel-release

yum update

yum install clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd

2. Enabling Freshclam

Freshclam will keep ClamAV up-to-date. In this tutorial, it is set to check 4 times a day for new files.

cp /etc/freshclam.conf /etc/freshclam.conf.bak

sed -i '/Example/d' /etc/freshclam.conf

Edit "clam-freshclam.service" file:

nano /usr/lib/systemd/system/clam-freshclam.service

And paste the content:

# Run the freshclam as daemon
[Unit]
Description = freshclam scanner
After = network.target

[Service]
Type = forking
ExecStart = /usr/bin/freshclam -d -c 4
Restart = on-failure
PrivateTmp = true

[Install]
WantedBy=multi-user.target

Enabling freshclam to start automatically:

systemctl enable clam-freshclam.service

systemctl start clam-freshclam.service

To manually update ClamAV virus database use the following command:

freshclam

3. Configuring ClamAV deamon

cp /usr/share/clamav/template/clamd.conf /etc/clamd.d/clamd.conf

sed -i '/Example/d' /etc/clamd.d/clamd.conf

mv /usr/lib/systemd/system/clamd@.service /usr/lib/systemd/system/clamd.service

Now we have to change the clamd service file:

nano /usr/lib/systemd/system/clamd.service

[Unit]
Description = clamd scanner daemon
After = syslog.target nss-lookup.target network.target

[Service]
Type = simple
ExecStart = /usr/sbin/clamd -c /etc/clamd.d/clamd.conf --nofork=yes
Restart = on-failure
PrivateTmp = true

[Install]
WantedBy=multi-user.target

Now move to "system" directory:

cd /usr/lib/systemd/system

And enable clamd to start automatically:

systemctl enable clamd.service

systemctl start clamd.service

4. Manual scan options
To scan all files on the VPS and show name of each file:

clamscan -r /

To scan all files on the VPS, but only show names of infected files when found:

clamscan -r -i /

To scan all files on the VPS, but only show names of infected files, while scan running in the background (while in progress, you can check the scan with "jobs" command):

clamscan -r -i / &

To scan all files in all users home directories:

clamscan -r /home

To scan all files in the USER directory and move infected files to different Quarantine directory:

clamscan -r --move=/home/USER/Quarantine /home/USER

To scan all files in the USER directory and delete the infected files:

clamscan -r --remove /home/USER

Installation Of ConfigServer (CSF) Security & Firewall

Fri, 21 Apr 2023 08:11:42 +0000

ConfigServer Security & Firewall is a popular Linux firewall security suite. It is easy to install, flexible to configure and secure with extra checks. CSF helps to control exactly what traffic is allowed in and out of the server and to protect the server from malicious attacks.

Preliminary Requirements:

CentOS 7, Fedora 23, Ubuntu 16.04 or Debian 8 OS installed.

Installation Of ConfigServer Security & Firewall

For CentOS / Fedora firstly you need to install required for CSF Perl packages:

yum install perl-libwww-perl.noarch perl-Time-HiRes perl-core zip unzip bind-utils -y

For Ubuntu and Debian install the following packages:

apt-get install e2fsprogs dnsutils libwww-perl -y

Then, download a CSF source archive:

wget http://download.configserver.com/csf.tgz

tar xzf csf.tgz

Then we need to run CSF installation script:

cd csf

sh install.sh

After installation run the test in order to make sure that all required iptables modules are installed on your VPS:

perl /usr/local/csf/bin/csftest.pl

If all required iptables modules are installed you will receive such result:

Testing ip_tables/iptable_filter...OK
Testing ipt_LOG...OK
Testing ipt_multiport/xt_multiport...OK
Testing ipt_REJECT...OK
Testing ipt_state/xt_state...OK
Testing ipt_limit/xt_limit...OK
Testing ipt_recent...OK
Testing xt_connlimit...OK
Testing ipt_owner/xt_owner...OK
Testing iptable_nat/ipt_REDIRECT...OK
Testing iptable_nat/ipt_DNAT...OK

RESULT: csf should function on this server

After checking iptables modules we need to enable CSF. For this reason, you may open and edit configuration file:

vi /etc/csf/csf.conf

You need to change "TESTING" value to the zero:

TESTING = "0"

Also, change the "RESTRICT_SYSLOG" value to 3:

RESTRICT_SYSLOG = "3"

Save the configuration file and execute the following command to restart CSF and reload new changes:

csf -r

If after the restart, you would receive a warning that starts with "*WARNING* Binary location for [SENDMAIL]", run the following commands:

echo '#!/bin/sh' > /usr/sbin/sendmail
chmod +x /usr/sbin/sendmail

Then, to check if everything is fine, run the restart again:

csf -r

This is it, now ConfigServer Security & Firewall is successfully installed to your server.

Enable ConfigServer Security & Firewall Web UI

ConfigServer Security & Firewall provides in-built Web UI for the managing firewall via a browser. After enabling Web UI you will be able to access the firewall via a specified port and manage it at the graphical interface. Firstly install Perl modules, required for Web UI:

For CentOS / Fedora execute:

yum install perl-IO-Socket-INET6 perl-Socket6 -y

For Debian / Ubuntu execute:

apt-get install libio-socket-ssl-perl libcrypt-ssleay-perl libnet-libidn-perl libio-socket-inet6-perl libsocket6-perl libwww-perl -y

In order to enable Web UI you need to edit the configuration file:

vi /etc/csf/csf.conf

You need to modify following values:

# 1 to enable, 0 to disable
UI = "1"

# Set this to the port that want to bind this service to. You should configure
# this port to be >1023 and different from any other port already being used
#
# Do NOT enable access to this port in TCP_IN, instead only allow trusted IP's
# to the port using Advanced Allow Filters (see readme.txt)
UI_PORT = "7777"

# Optionally set the IP address to bind to. Normally this should be left blank
# to bind to all IP addresses on the server.
#
# If the server is configured for IPv6 but the IP to bind to is IPv4, then the
# IP address MUST use the IPv6 representation. For example 1.2.3.4 must use
# ::ffff:1.2.3.4
#
# Leave blank to bind to all IP addresses on the server
UI_IP = "111.111.111.111"

# This should be a secure, hard to guess username
# 
# This must be changed from the default
UI_USER = "username"

# This should be a secure, hard to guess password. That is, at least 8
# characters long with a mixture of upper and lowercase characters plus 
# numbers and non-alphanumeric characters
#
# This must be changed from the default
UI_PASS = "password"

, where:

UI - should be "1" for enabled Web UI;
UI_PORT - port for accessing CSF firewall via the browser;
UI_IP - your server's IP address. Leave it blank to bind to all IP addresses on the server (e.g. if you have additional IPs);
UI_USER - username for accessing CSF firewall via the browser;
UI_PASS - password for accessing CSF firewall via the browser.

After it add your public IP to the /etc/csf/ui/ui.allow file in order to allow access to CSF Web UI:

echo "your_public_ip_address" >>  /etc/csf/ui/ui.allow

Finally restart lfd (Login Failure Daemon) daemon, which uses CSF Web UI:

service lfd restart

Now you could access ConfigServer Security & Firewall Web UI via your server's IP address and specified earlier port: https://server_ip_address:port

Note: use HTTPS to access Web UI.

DoS / DDoS Attacks Prevention With ConfigServer Security & Firewall

It is possible to configure ConfigServer Security & Firewall to prevent VPS from small and limited DDoS attacks. In order to enable it, you need to edit /etc/csf/csf.conf file. If you have enabled Web UI, you could edit configuration file via it - just go to the "ConfigServer Firewall" and select "Firewall Configuration". In another case you need to edit /etc/csf/csf.conf via SSH:

vi /etc/csf/csf.conf

First of all you need to set up total number of connections allowed from single host:

CT_LIMIT = "20"

Set connection tracking interval (in seconds):

CT_INTERVAL = "30"

Enable email alerts sending for each blocked IP address:

CT_EMAIL_ALERT =1

Enable permanent IP addresses blocking ("1" to enabled, "0" for disabled):

CT_PERMANENT = 1

If you did not enable permanent IP addresses blocking, you could set interval (in seconds) within which IP will remained blocked:

CT_BLOCK_TIME = 1800

If you would like to enable it only for specific ports, you need to provide it in CT_PORTS. If you keep it empty, all ports would be checking:

CT_PORTS = "22,23,80,443"

After it, you need to restart CSF service and lfd daemon. If you have performed changes via Web UI, just press the button "Restart csf+lfd'. Else execute the following command via SSH:

csf -r && service lfd restart

More information about ConfigServer Security & Firewall could be found here:

https://www.configserver.com/cp/csf.html

How to install and setup in SpamAssassin.

Fri, 21 Apr 2023 08:09:00 +0000

SpamAssassin is a computer program used for e-mail spam filtering. SpamAssassin uses a variety of spam-detection techniques, including DNS-based and fuzzy-checksum-based spam detection, Bayesian filtering, external programs, blacklists, and online databases. It will save your mailbox from many unwanted spam emails.

For this tutorial we are using Ubuntu 16.04 distribution, however, you should be able to use it for all Debian and Ubuntu distributions we offer on Time4VPS.

Update System

First things first. Like always, first of all, we recommend updating your server. It can be done by simply executing:

apt-get update

Installation

After our server is up to date we can start the installation. Use apt-get to install Spamassassin and spamc:

apt-get install spamassassin spamc -y

While installing you can get a message about the kernel, we are using stable kernel version 2.6.32 for OpenVZ, so you do not need to worry about that, just click OK.

Adding User

There are a few steps that has to be taken to make it fully functional. To run SpamAssassin you need to create a new user on your VPS. First, add the group spamd:

groupadd spamd

Then add the user spamd with the home directory /var/log/spamassassin:

useradd -g spamd -s /bin/false -d /var/log/spamassassin spamd

Then create the directory /var/log/spamassassin:

mkdir /var/log/spamassassin

And change the ownership of the directory to spamd:

chown spamd:spamd /var/log/spamassassin

Setting Up

Open the SpamAssassin config file:

nano /etc/default/spamassassin

Note: If you do not have nano installed on your server, you can do it simply with the command:

apt-get install nano

To enable Spamassassin and automatic rule updates in order to get the latest spam filtering rules to find the CRON and ENABLED variables and change then to:

ENABLED=1
CRON=1

Now create a variable named SAHOME with the Spamassassin home directory:

SAHOME="/var/log/spamassassin/"

Find and change the OPTIONS variable to:

OPTIONS="--create-prefs --max-children 2 --username spamd \
-H ${SAHOME} -s ${SAHOME}spamd.log"

After setting up is complete we can start the Spamassassin daemon by using the following code:

service spamassassin start

Configuring Postfix
SpamAssassin is set up, however, emails are still not going through it. To enabling that, open Postfix config file:

nano /etc/postfix/master.cf

Find the line:

smtp inet n - - - - smtpd

And add the following to the end of the line:

-o content_filter=spamassassin

Now, Postfix will pipe the mail through SpamAssassin.

To setup after-queue content filter add the following line to the end of the file

spamassassin unix -     n       n       -       -       pipe
        user=spamd argv=/usr/bin/spamc -f -e  
        /usr/sbin/sendmail -oi -f ${sender} ${recipient}

For the changes to take effect restart postfix:

service postfix restart

Configuration

To get the maximum use of SpamAssassin you have to create rules. Open the SpamAssassin default rules file using:

nano /etc/spamassassin/local.cf

To activate a rules uncomment line by removing the # symbol in the beginning of the line. Some line we recommend to uncomment:

rewrite_header Subject *****SPAM***** - To add a spam header to spam mail.

required_score 5.0 - Spamassassin gives a score to each mail after running different tests on it. This line marks the mail as spam if the score is more than the value specified in the rule.

use_bayes 1 - To use Bayes theorem to check mails.

bayes_auto_learn 1 - To enable Bayes auto-learning.

After adding the above details, save the file and restart spam assassin.

service spamassassin restart

Testing

To see if SpamAssassin is working, you can check the SpamAssassin log file using:

nano /var/log/spamassassin/spamd.log

or send the email from an external server and check the mail headers.

Conclusion

Using SpamAssassin, it is very easy to protect your mailbox from spammers. The best thing about SpamAssassin is that we can create rules by ourselves and manage it.

How to Make Minimal OS Image

Sat, 04 Feb 2023 12:35:57 +0000

In order to make a standard OpenVZ OS image minimal you need to follow these instructions:

1. Install the standard OS from the client area
2. Login to the VPS SSH and execute one of the following commands (depending on your OS):

CentOS 6 64-Bit

yum remove acl apr apr-util apr-util-ldap aspell attr authconfig avahi-libs bind bind-libs bzip2 centos-indexhtml cronie cronie-noanacron crontabs cups-libs cvs cyrus-sasl dhclient dhcp-common elfutils fetchmail finger finger-server ftp gettext gnutls gpg-pubkey-c105b9de gpm-libs hesiod httpd httpd-tools iptables-ipv6 jwhois libcap-ng libgomp libgssglue libjpeg-turbo libpcap libpng libtalloc libtdb libtevent libtiff libtirpc lm_sensors-libs lsof lynx m4 mailcap mailx man man-pages mlocate ncompress net-snmp net-snmp-libs net-snmp-utils newt newt-python nscd ntsysv perl perl-Module-Pluggable perl-Pod-Escapes perl-Pod-Simple perl-libs perl-version portreserve procmail rpcbind rsync samba-client samba-common samba-winbind samba-winbind-clients screen sendmail sendmail-cf setuptool slang stunnel sudo talk talk-server tcpdump tcsh telnet time traceroute unzip usermode vim-common vim-enhanced which xinetd xz xz-lzma-compat -y; yum clean all

CentOS 7 64-Bit

For CentOS 7 64-bit, login to the VPS SSH and execute the following command:

yum remove tcpdump mailx stunnel vim-enhanced vim-filesystem elfutils ntsysv bzip2 lsof traceroute telnet ethtool man-pages libtevent httpd bind-libs-lite apr hunspell apr-util libldb slang libss make libselinux-utils procmail gpm-libs libpcap json-c dhcp-common pytalloc policycoreutils usermode centos-logos cups-libs samba-libs cronie-noanacron libsmbclient cyrus-sasl libpipeline libaio rsyslog sendmail-cf samba-client rpcbind nscd talk-server setuptool screen sudo tcsh fetchmail mailcap hunspell-en ftp attr unzip time talk ncompress bind-license bind-libs libtalloc httpd-tools libtdb bind hunspell-en-US hesiod newt hunspell-en-GB avahi-libs which m4 vim-common finger dhcp-libs newt-python logrotate openssl libwbclient libtirpc samba-common crontabs cronie sendmail libestr man-db xinetd dhclient iptables-services mlocate finger-server rsync authconfig e2fsprogs -y; yum clean all

Debian 7 64-Bit

If you are using Debian 7 64-bit, login to your VPS SSH and type in the following command:

DEBIAN_FRONTEND=noninteractive apt-get remove --purge -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" apache2 apache2-doc apache2-mpm-prefork apache2-utils apache2.2-bin apache2.2-common apt-utils bind9 bind9-host bind9utils binutils bsd-mailx bsdmainutils bzip2 ca-certificates console-common console-data cracklib-runtime cron db-util db5.1-util debconf-utils debian-keyring dialog expat fetchmail file finger fontconfig fontconfig-config fonts-freefont-ttf ftp gettext groff-base info install-info iputils-arping iputils-tracepath isc-dhcp-client isc-dhcp-common kbd ldap-utils less libapr1 libaprutil1 libaprutil1-dbd-sqlite3 libaprutil1-ldap libapt-inst1.5:amd64 libavahi-client3:amd64 libavahi-common-data:amd64 libavahi-common3:amd64 libbind9-80 libcap2:amd64 libcrack2 libcroco3:amd64 libcups2:amd64 libdns88 libfile-copy-recursive-perl libfontconfig1:amd64 libfreetype6:amd64 libgeoip1 libgettextpo0:amd64 libgomp1:amd64 libgssglue1:amd64 libisc84 libisccc80 libisccfg82 liblockfile-bin liblockfile1:amd64 libltdl7:amd64 liblwres80 libmagic1:amd64 libodbc1:amd64 libpaper1:amd64 libpcap0.8:amd64 libperl5.14 libpipeline1:amd64 libpopt0:amd64 libsensors4:amd64 libsnmp-base libsnmp15 libsysfs2:amd64 libtalloc2:amd64 libtdb1:amd64 libtirpc1:amd64 libunistring0:amd64 libwbclient0:amd64 libxml2:amd64 locales-all logrotate lynx lynx-cur m4 make man-db manpages memtester mlocate mtools ncurses-term odbcinst odbcinst1debian2:amd64 openssl openssl-blacklist procmail psutils pwgen rmail rpcbind rsync sasl2-bin screen sendmail sendmail-base sendmail-bin sendmail-cf sendmail-doc sensible-mda sharutils snmp ssl-cert sudo syslinux syslinux-common tcpdump tcsh telnet tofrodos traceroute ttf-dejavu ttf-dejavu-core ttf-dejavu-extra ttf-freefont unixodbc unzip update-inetd uuid-runtime whois wide-dhcpv6-client xinetd; apt-get clean; apt-get remove --purge -y sendmail-base

Debian 8 64-Bit

Debian 8 64-bit users need to login to their VPS SSH and type in this command:

DEBIAN_FRONTEND=noninteractive apt-get remove --purge -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" apache2 apache2-bin apache2-data apache2-doc apache2-mpm-prefork apache2-utils apt-utils bind9 bind9-host bind9utils binutils bsd-mailx bsdmainutils bzip2 ca-certificates cifs-utils console-common console-data cracklib-runtime cron db-util db5.3-util debconf-utils dh-python dialog expat fetchmail file finger fontconfig fontconfig-config fonts-dejavu fonts-dejavu-core fonts-dejavu-extra fonts-freefont-ttf ftp gettext groff-base info iputils-arping iputils-tracepath isc-dhcp-client isc-dhcp-common kbd ldap-utils less libapr1:amd64 libaprutil1:amd64 libaprutil1-dbd-sqlite3:amd64 libaprutil1-ldap:amd64 libapt-inst1.5:amd64 libasn1-8-heimdal:amd64 libavahi-client3:amd64 libavahi-common-data:amd64 libavahi-common3:amd64 libbind9-90 libcap-ng0:amd64 libcrack2:amd64 libcroco3:amd64 libcups2:amd64 libdns-export100 libdns100 libfile-copy-recursive-perl libfontconfig1:amd64 libfreetype6:amd64 libgeoip1:amd64 libglib2.0-0:amd64 libgomp1:amd64 libgssapi3-heimdal:amd64 libhcrypto4-heimdal:amd64 libhdb9-heimdal:amd64 libheimbase1-heimdal:amd64 libheimntlm0-heimdal:amd64 libhx509-5-heimdal:amd64 libirs-export91 libisc-export95 libisc95 libisccc90 libisccfg-export90 libisccfg90 libkdc2-heimdal:amd64 libkrb5-26-heimdal:amd64 libldb1:amd64 liblockfile-bin liblockfile1:amd64 libltdl7:amd64 liblua5.1-0:amd64 liblwres90 libmagic1:amd64 libmpdec2:amd64 libntdb1:amd64 libodbc1:amd64 libpaper1:amd64 libpcap0.8:amd64 libpci3:amd64 libperl5.20 libpipeline1:amd64 libpng12-0:amd64 libpopt0:amd64 libpython2.7:amd64 libpython3-stdlib:amd64 libpython3.4-stdlib:amd64 libroken18-heimdal:amd64 libsensors4:amd64 libsnmp-base libsnmp30:amd64 libtalloc2:amd64 libtdb1:amd64 libtevent0:amd64 libunistring0:amd64 libwbclient0:amd64 libwind0-heimdal:amd64 libxml2:amd64 logrotate lynx lynx-cur m4 make man-db manpages memtester mlocate mtools ncurses-term odbcinst odbcinst1debian2:amd64 openssl openssl-blacklist patch postfix procmail psutils pwgen python-crypto python-dnspython python-ldb python-ntdb python-samba python-talloc python-tdb python3 python3-minimal python3.4 rpcbind rsync samba-common samba-common-bin samba-dsdb-modules samba-libs:amd64 sasl2-bin screen sharutils snmp ssl-cert sudo syslinux tcpdump tcsh tdb-tools telnet tofrodos traceroute ttf-dejavu ttf-dejavu-core ttf-dejavu-extra ttf-freefont unixodbc unzip update-inetd uuid-runtime whois wide-dhcpv6-client xinetd

Ubuntu 12.04 64-Bit

Those that use Ubuntu 12.04 64-bit, need to login to their VPS SSH and execute the following:

DEBIAN_FRONTEND=noninteractive apt-get remove --purge -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" apache2 apache2-doc apache2-mpm-prefork apache2-utils apache2.2-bin apache2.2-common apt-utils bind9 bind9-host bind9utils binutils bsd-mailx bsdmainutils bzip2 ca-certificates console-common console-data console-tools console-tools-dev cracklib-runtime cron db-util db5.1-util debconf-utils defoma expat fetchmail file finger fontconfig fontconfig-config ftp gettext groff-base info install-info iputils-arping iputils-tracepath isc-dhcp-client isc-dhcp-common klogd ldap-utils less libapr1 libaprutil1 libaprutil1-dbd-sqlite3 libaprutil1-ldap libapt-inst1.4 libavahi-client3 libavahi-common-data libavahi-common3 libbind9-80 libcap2 libclass-isa-perl libconsole libcrack2 libcroco3 libcups2 libdb4.8 libdns81 libfile-copy-recursive-perl libfontconfig1 libfreetype6 libgdbm3 libgeoip1 libgettextpo0 libgomp1 libgssglue1 libisc83 libisccc80 libisccfg82 liblockfile-bin liblockfile1 libltdl7 liblwres80 libmagic1 libnewt0.52 libodbc1 libpaper1 libpcap0.8 libperl5.14 libpipeline1 libpopt0 libsensors4 libsnmp-base libsnmp15 libswitch-perl libsysfs2 libtalloc2 libtdb1 libtirpc1 libunistring0 libwbclient0 libxml2 logrotate lynx lynx-cur m4 make man-db manpages memtester mlocate mtools ncurses-term odbcinst odbcinst1debian2 openssl openssl-blacklist perl perl-modules procmail psutils pwgen rmail rpcbind rsync sasl2-bin screen sendmail sendmail-base sendmail-bin sendmail-cf sendmail-doc sensible-mda sharutils snmp ssl-cert sudo sysklogd syslinux syslinux-common tcpdump tcsh telnet tofrodos traceroute ttf-dejavu ttf-dejavu-core ttf-dejavu-extra ttf-freefont unixodbc unzip update-inetd uuid-runtime whiptail whois wide-dhcpv6-client xinetd; apt-get clean

Ubuntu 14.04 64-Bit

On Ubuntu 14.04 64-bit, login to the VPS SSH and write in this command:

DEBIAN_FRONTEND=noninteractive apt-get remove --purge -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" apache2 apache2-bin apache2-data apache2-doc apache2-mpm-prefork apache2-utils apt-utils bind9 bind9-host bind9utils binutils bsd-mailx bsdmainutils bzip2 ca-certificates console-common console-data console-setup cracklib-runtime cron db-util db5.3-util debconf-utils dialog expat fetchmail file finger fontconfig fontconfig-config fonts-dejavu fonts-dejavu-core fonts-dejavu-extra fonts-freefont-ttf ftp gettext groff-base info iputils-arping iputils-tracepath isc-dhcp-client isc-dhcp-common kbd keyboard-configuration ldap-utils less libapr1:amd64 libaprutil1:amd64 libaprutil1-dbd-sqlite3:amd64 libaprutil1-ldap:amd64 libapt-inst1.5:amd64 libavahi-client3:amd64 libavahi-common-data:amd64 libavahi-common3:amd64 libbind9-90 libbsd0:amd64 libcrack2:amd64 libcroco3:amd64 libcups2:amd64 libdns100 libfile-copy-recursive-perl libfontconfig1:amd64 libfreetype6:amd64 libgeoip1:amd64 libglib2.0-0:amd64 libgmp10:amd64 libgomp1:amd64 libgssglue1:amd64 libhdb9-heimdal:amd64 libisc95 libisccc90 libisccfg90 libkdc2-heimdal:amd64 libldb1:amd64 liblockfile-bin liblockfile1:amd64 libltdl7:amd64 liblwres90 libmagic1:amd64 libntdb1:amd64 libodbc1:amd64 libpaper1:amd64 libpcap0.8:amd64 libperl5.18 libpipeline1:amd64 libpopt0:amd64 libpython-stdlib:amd64 libsensors4:amd64 libsnmp-base libsnmp30:amd64 libtalloc2:amd64 libtdb1:amd64 libtevent0:amd64 libtirpc1:amd64 libunistring0:amd64 libwbclient0:amd64 libxml2:amd64 logrotate lynx lynx-cur m4 make man-db manpages memtester mlocate mtools ncurses-term odbcinst odbcinst1debian2:amd64 openssl openssl-blacklist postfix procmail psutils pwgen python python-crypto python-dnspython python-ldb python-minimal python-ntdb python-talloc python-tdb python2.7 python2.7-minimal rpcbind rsync sasl2-bin screen sharutils snmp ssl-cert sudo syslinux syslinux-common tcpdump tcsh tdb-tools telnet tofrodos traceroute ttf-dejavu ttf-dejavu-core ttf-dejavu-extra ttf-freefont unixodbc unzip update-inetd uuid-runtime whois wide-dhcpv6-client xinetd xkb-data; apt-get clean

Ubuntu 15.04 64-Bit

If you use Ubuntu 15.04 64-bit, login to your VPS SSH and use:

DEBIAN_FRONTEND=noninteractive apt-get remove --purge -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" apache2 apache2-bin apache2-data apache2-doc apache2-mpm-prefork apache2-utils apt-utils bind9 bind9-host bind9utils binutils bsd-mailx bsdmainutils bsdutils bzip2 ca-certificates cifs-utils console-common console-data console-setup console-setup-linux cracklib-runtime cron db-util db5.3-util debconf-utils dialog expat fetchmail file finger fontconfig fontconfig-config fonts-dejavu fonts-dejavu-core fonts-dejavu-extra fonts-freefont-ttf ftp gettext groff-base info iputils-arping iputils-tracepath isc-dhcp-client isc-dhcp-common kbd keyboard-configuration ldap-utils less libapr1:amd64 libaprutil1:amd64 libaprutil1-dbd-sqlite3:amd64 libaprutil1-ldap:amd64 libapt-inst1.5:amd64 libavahi-client3:amd64 libavahi-common-data:amd64 libavahi-common3:amd64 libbind9-90 libbsd0:amd64 libcrack2:amd64 libcroco3:amd64 libcups2:amd64 libdns-export100 libdns100 libfile-copy-recursive-perl libfontconfig1:amd64 libfreetype6:amd64 libgeoip1:amd64 libglib2.0-0:amd64 libgomp1:amd64 libhdb9-heimdal:amd64 libicu52:amd64 libirs-export91 libisc-export95 libisc95 libisccc90 libisccfg-export90 libisccfg90 libkdc2-heimdal:amd64 libldb1:amd64 liblockfile-bin liblockfile1:amd64 libltdl7:amd64 liblua5.1-0:amd64 liblwres90 libmagic1:amd64 libntdb1:amd64 libodbc1:amd64 libpaper1:amd64 libpcap0.8:amd64 libperl5.20 libpipeline1:amd64 libpopt0:amd64 libpython-stdlib:amd64 libsensors4:amd64 libsnmp-base libsnmp30:amd64 libtalloc2:amd64 libtdb1:amd64 libtevent0:amd64 libtirpc1:amd64 libunistring0:amd64 libwbclient0:amd64 libxml2:amd64 logrotate lynx lynx-cur m4 make man-db manpages memtester mlocate mtools ncurses-term odbcinst odbcinst1debian2:amd64 openssl openssl-blacklist patch postfix procmail psutils pwgen python python-crypto python-dnspython python-ldb python-minimal python-ntdb python-samba python-talloc python-tdb python2.7 python2.7-minimal rpcbind rsync samba-common samba-common-bin samba-dsdb-modules samba-libs:amd64 sasl2-bin screen sharutils snmp ssl-cert sudo syslinux tcpdump tcsh tdb-tools telnet tofrodos traceroute ttf-dejavu ttf-dejavu-core ttf-dejavu-extra ttf-freefont unixodbc unzip update-inetd uuid-runtime whois wide-dhcpv6-client xinetd xkb-data

Ubuntu 16.04 64-Bit

For Ubuntu 16.04 64-bit operating system, login to your VPS SSH and complete as follows:

DEBIAN_FRONTEND=noninteractive apt-get remove --purge -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" apache2 apache2-bin apache2-data apache2-doc apache2-utils bind9 bind9-host bind9utils libbind9-140 bind9-host bind9utils binutils bsd-mailx bsdmainutils bzip2 ca-certificates console-data cracklib-runtime cron db-util db5.3-util debconf-utils dialog expat libexpat1 fetchmail file libfile-copy-recursive-perl liblockfile-bin liblockfile1 finger fontconfig fontconfig-config libfontconfig1 fontconfig-config fonts-dejavu fonts-dejavu-core fonts-dejavu-extra fonts-dejavu-core fonts-dejavu-extra fonts-freefont-ttf ftp gettext gettext-base liblocale-gettext-perl groff-base distro-info-data info install-info procinfo iputils-arping iputils-tracepath isc-dhcp-client isc-dhcp-common ldap-utils less libfile-copy-recursive-perl liblockfile-bin libsnmp-base logrotate lynx lynx-common m4 make makedev man-db manpages memtester mlocate mtools odbcinst odbcinst1debian2 libgnutls-openssl27 openssl openssl-blacklist openssl-blacklist postfix procmail psutils pwgen dh-python libpython-stdlib libpython2.7 libpython2.7-minimal libpython2.7-stdlib libpython3-stdlib libpython3.5 libpython3.5-minimal libpython3.5-stdlib python python-crypto python-dnspython python-ldb python-minimal python-samba python-talloc python-tdb python2.7 python2.7-minimal python3 python3-minimal python3.5 python3.5-minimal python-crypto python-dnspython python-ldb python-minimal python-talloc python-tdb libpython2.7 libpython2.7-minimal libpython2.7-stdlib python2.7 python2.7-minimal libpython2.7-minimal python2.7-minimal rpcbind rsync sasl2-bin screen sharutils libsnmp-base libsnmp30 snmp ssl-cert sudo syslinux tcpdump tcsh tdb-tools telnet tofrodos traceroute ttf-dejavu ttf-dejavu-core ttf-dejavu-extra ttf-dejavu-core ttf-dejavu-extra ttf-freefont unixodbc unzip update-inetd uuid-runtime whois wide-dhcpv6-client xinetd; apt-get clean

OpenSuse 13.1 64-Bit

If you own an openSuse 13.1 64-bit operating system, login to your VPS SSH and execute:

for i in SuSEfirewall2* aaa_base* adjtimex* apache2* aspell* autoyast2* bind* binutils* branding* bundle* ca* cantarell* checkmedia* cifs* command* cryptsetup* cups* curl* dconf* dhcp* dmraid* fetchmail* finger* fontconfig* gd* ghostscript* gio* glib* glib2* groff* gsettings* hwinfo* initviocons* keyutils* kpartx* less* libICE6* libSM6* libX11* libXau6* libXext6* libXmuu1* libXpm4* libXt6* libaio1* libapr* libapr1* libarchive13* libaspell15* libavahi* libdcerpc* libdcerpc0* libdconf1* libelf0* libenca0* libevent* libfam0* libffi4* libfreetype6* libgdbm4* libgensec0* libgio* libglib* libgmodule* libgnutls28* libgobject* libguess1-1.1-2.1.2.x86_64* libhogweed2* libicu51_2* libjasper1* libjavascriptcoregtk* libjbig2* libjpeg8* libldapcpp1* libldb1* liblua5_2* libmowgli2* libmysqlclient18* libndr* libndr0* libnetapi0* libnetpbm11* libnettle4* libp11* libparted0* libpcap1* libpci3* libpdb0* libpipeline1* libpng16* libpython2_7* librcc0* librcd0* libregistry0* libreiserfs* libsamba* libsamdb0* libsensors4* libsmbclient* libsmbclient0* libsmbconf0* libsmbldap0* libsmi* libsmi2* libsnmp30* libsoup* libsqlite3* libstorage* libstorage4* libtalloc2* libtasn1* libtdb1* libtevent* libtevent0* libtiff5* libtirpc1* libtranslate0* libwbclient0* libx86emu1* libxcb1* libyaml* libyui* libyui5* lsscsi* lvm2* lynx* m4* mailx* make* man* mdadm* mlocate* module* mtools* multipath* ncftp* ncurses* netcfg* netpbm* nfs* nfsidmap* openSUSE* openslp* p11* parted* pciutils* pkg* procmail* psmisc* psutils* pytalloc* python* rcc* release* rpcbind* rsync* ruby* ruby20* rubygem* samba* scout* screen* sendmail* shared* sharutils* snmp* sudo* syslinux* tcpdump* tcsh* telnet* time* timezone* traceroute* unzip* vim* wallpaper* which* words* xauth* xdg* xinetd* xli* yast2*; do zypper --non-interactive remove -n $i; done; zypper cc --all

3. Restart VPS

Note: Some operating systems (openSuse 13.01 and CentOS 7) will require you to wait for upgrade process finish in order to execute OS minimalization command.

Have any difficulties following these instructions? Got additional questions about making standard OpenVZ OS image minimal? Let us know! Our customer support team is ready to help 24/7.

Working with a Compromised VPS

Sat, 04 Feb 2023 11:49:00 +0000

An exploited or hacked VPS is one that is no longer fully under your control. Someone else is now partially controlling your VPS and using it for their own purposes. Here are some common reasons to exploit a VPS:

• To send out spam email;
• To launch attacks against other servers (thus, consuming your CPU, memory, and bandwidth resources);
• To install a phishing website on your VPS to gain access to sensitive information.

Background

There are two primary ways a VPS may be compromised:

A. If the hacker has guessed a password of a user on the VPS. This may be an email, FTP, or SSH use;
B. If the hacker has gained access through a security hole in a web application (or its addons/plugins) such as WordPress, Joomla, Drupal, etc.

1. How do I know if my service has been exploited?

Many times, customers may not notice that they have been compromised until they are contacted by the Time4VPS Abuse Department. To prevent any delays in learning about a breach, you must periodically check your VPS log files.

2. What steps can I take to prevent my service from being hacked?

A. Use Strong Passwords:

Be sure to use strong passwords. This would include passwords for the Client Area, VPS, any of your control panels, etc. The stronger the password the better protected your service will be. GRC (Gibson Research Corporation) provides a free tool that will generate strong passwords for you that are a mixture of lowercase, uppercase, numerical, and symbols..

B. Use Secure Protocols:

When connecting to your services, it is best to use secure connections whenever possible. This would include SSL connections for email and using sFTP instead of the more common FTP protocol.

C. Maintain Regular Backups:

Be sure to backup your data on a regular basis. If a domain, or your entire service, becomes compromised, it may go unnoticed for a while. You would not want to restore a compromised backup. You always want to restore from the last known clean backup.

D. Harden Your PHP Settings:

Just making a few changes to your php.ini file can greatly increase the security of your service. Here are a few settings we recommend:

• Enable Safe Mode;
• Disable allow_url_fopen;
• Increase PHP security with PHPSecInfo.

E. Working with Third-Party Applications:

When you are working with third-party software such as Wordpress, Drupal, or Joomla, please consider these points. This is also very important with applications that rely on plug-ins for extended functionality:

• Be careful with what third-party tools you choose to use. Pick software that is known to have a reliable reputation for security. Consider using software packages that have frequent updates to patch security holes;
• Be sure to update your software regularly. Subscribe to the RSS feeds of any applications you use. This is a fantastic, effortless way to stay aware of any new updates that you may need to stay secure.

I've been hacked. What can I do?

Backup your domains and service, but please remember that this backup will probably contain compromised scripts. You do not want to restore directly from this backup.

How can you backup and restore a MySQL database:

• Take your website offline temporarily, or until you know you have resolved the issue. Alternatively, consider displaying an "Under Construction" page. This should be done to prevent any hacked pages from being served to your customers;
• Start performing a damage assessment. What is the scope of the problem? Is only one domain affected? Are other domains on your service affected also?
• Start the recovery process. The best thing you can do is to reinstall your environment from a known clean source;
• Finally, take the steps to restore your websites.

Useful Links

Join and contribute to online communities that are dedicated to helping fight badware/phishing. Here are a few examples:

• http://www.stopbadware.org;
• http://www.antiphishing.org;
• http://www.phishtank.com.

--

Artice source: mediatemple (MT)

Basic and most common iptables rules

Sat, 04 Feb 2023 11:45:51 +0000

Iptables is basically a powerful firewall, which can allow a user to set specific rules to control incoming and outgoing traffic. You can use it to block the specific port, IP addresses and much more. In this article, we present the most common uses of iptables.

The iptables rules can be specified with 3 blocks, which are used for a specific purpose (called Chains😞

INPUT - All packets destined for the host computer.
OUTPUT - All packets originating from the host computer.
FORWARD - All packets neither destined for nor originating from the host computer, but passing through (routed by) the host computer. This chain is used if you are using your computer as a router.

The first command we present is used to flush the existing iptables rules, this can be useful if we want to start with new rules or if we have accidentally blocked ourselves (Our Clients Area has a button for this case specifically - "Flush iptables"):

iptables -F

Note. If you want to flush a single Chain, specific rules. You can use this:

sudo iptables -F INPUT

Next commands are used to check current rules that are active within your server:

iptables -L

iptables -S

Note. You can add specific words, like INPUT, FORWARD OR OUTPUT. For example:

iptables -L INPUT

This will let you specify the rules by their purpose (Chains).

Note. You can also add "-v" to your command (iptables -L -v), this will let you check the packets and their size matched with each rule.

Now we can continue with more specific rules to make some simple rules. Usually, a Firewall is used to block something first, and only then to allow something. So here are some rules which help you to block the connections.

In order to block a connection from the specific IP address you can use this:

iptables -A INPUT -s 1.1.1.1 -j DROP

iptables -A OUTPUT -s 1.1.1.1 -j DROP

iptables -A INPUT -s 1.1.1.1 -j REJECT

Note. REJECT is used to give a response that the connection is not blocked and sends a message "connection refused".

If you want to block a specific port, for example, SMTP port 25, you can use this:

iptables -A INPUT -p tcp --dport 25 -j DROP
iptables -I OUTPUT -p tcp --dport 25 -j DROP

Allow Incoming SSH connection only from a specific IP:

iptables -A INPUT -i venet0 -p tcp -s 1.1.1.1 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o venet0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

This actually allows only specific IP to connect to the server using 22 port. Also, every time it happens, it establishes a status, which will be used in the second rule to allow the same IP the outgoing traffic.

Following sets of rules are for HTTP and HTTPS connections:

iptables -A INPUT -i venet0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o venet0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

iptables -A INPUT -i venet0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o venet0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT

The first set of rules allows HTTP and the second set of rules allows HTTPS connection using the default ports 80 and 443

Next rules allow outside users to ping to your server:

iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT

The same applies to block it:

iptables -A INPUT -p icmp --icmp-type echo-request -j DROP

iptables -A OUTPUT -p icmp --icmp-type echo-reply -j DROP

To allow loopback access to your server, for example using localhost:

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

Allowing MySQL connection from specific IP address:

iptables -A INPUT -i venet0 -p tcp -s 1.1.1.1 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o venet0 -p tcp --sport 3306 -m state --state ESTABLISHED -j ACCEPT

Allowing POP3 or IMAP traffic:

iptables -A INPUT -i venet0 -p tcp --dport 143 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o venet0 -p tcp --sport 143 -m state --state ESTABLISHED -j ACCEPT

iptables -A INPUT -i venet0 -p tcp --dport 110 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o venet0 -p tcp --sport 110 -m state --state ESTABLISHED -j ACCEPT

Also, this can be applied for POP3/IMAP using a secure connection:

iptables -A INPUT -i venet0 -p tcp --dport 993 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o venet0 -p tcp --sport 993 -m state --state ESTABLISHED -j ACCEPT

iptables -A INPUT -i venet0 -p tcp --dport 995 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o venet0 -p tcp --sport 995 -m state --state ESTABLISHED -j ACCEPT

Note. When you describe network interface in the rules, for example, venet0, do not forget to change it, if your server uses different network interfaces, for example, eth0 or other.

One last use of iptables is that it can be used to prevent the DDoS as well, by limiting the connections per minute:

iptables -A INPUT -p tcp --dport 80 -m limit --limit 10/minute --limit-burst 100 -j ACCEPT

More details about this one:

-m limit: This uses the limit iptables extension
–limit 25/minute: This limits only a maximum of 10 connections per minute.
–limit-burst 100: This value indicates that the limit/minute will be enforced only after the total number of connection have reached the limit-burst level.

You can change the details based on your requirements, to prevent some attacks.

Quickly Allowing/Denying IP’s Using Iptables

Sat, 04 Feb 2023 11:44:54 +0000

How do you block an IP using iptables?

iptables -A INPUT -s xx.xx.xx.xx -j DROP

How do you block an IP from a specific port?

iptables -A INPUT -p tcp -s xx.xx.xx.xx --dport PORT -j DROP

(xx.xx.xx.xx is the remote IP address and PORT is the port number you wish to allow/deny access to.)

How do you allow access to an IP?

iptables -A INPUT -s xx.xx.xx.xx -j ACCEPT

How do you allow access to an IP to a specific port using iptables?

iptables -A INPUT -p tcp -s xx.xx.xx.xx --dport PORT -j ACCEPT

(Again, xx.xx.xx.xx is the remote IP address and PORT is the port number you wish to allow/deny access to.)

How do you block a scanner on a server for example "blablabla.at.ISC.SANS" using iptables?

iptables -I INPUT -p tcp --dport 80 -m string --algo bm \
--string 'GET /blablabla.at.ISC.SANS.' -j DROP

More information can be found in our article about the most common iptables rules:
https://www.lcwhost.org/topic/21-basic-and-most-common-iptables-rules/

How to a Identify a DoS/DDoS Attack

Sat, 04 Feb 2023 11:42:22 +0000

If your server appears pretty slow, there could be many things wrong such as poorly written scripts - but sometimes it could be because someone is flooding your server with traffic known as DoS (Denial of Service) or DDoS (Distributed Denial of Service). It could also be that your server itself is part of a botnet and is being used to attack other networks. In this case, it is always a good idea to run scans with software such as ClamAV and RootKit Hunter as a precaution.

Furthermore, whenever a client connects to a server via a network, a connection is established and opened on the system. On a busy high-load server, the number of connections connected to the server can be hundreds if not thousands. Find out and get a list of connections on the server.
Take a look at these handy netstat commands below that will surely help you determine whether your under attack or are part of an attack.

netstat -na

Displays all active Internet connections to the server and only established connections are included.

netstat -an | grep :80 | sort

Shows only active Internet connections to the server on port 80 and sorts the results. This is useful in detecting a single flood by allowing you to recognize many connections coming from one IP.

netstat -n -p|grep SYN_RECV | wc -l

This command is useful to determine how many active SYN_RECV are occurring on the server. The number should be pretty low, preferably less than 5. On DoS attack incidents or mail bombs, the number can jump pretty high. However, the value always depends on the system, so a high value may be average on another server.

netstat -n -p | grep SYN_RECV | sort -u

Lists all IP addresses involved.

netstat -n -p | grep SYN_RECV | awk '{print $5}' | awk -F: '{print $1}'

Lists all the unique IP addresses that are sending SYN_RECV connection statuses.

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

Uses the netstat command to calculate and count the number of connections each IP address makes to the server.

netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

Lists the number of connections the IP's are making to the server using the TCP or UDP protocol.

netstat -ntu | grep ESTAB | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr

Checks on ESTABLISHED connections instead of all connections, and displays the number of connections for each IP.

netstat -plan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -nk 1

Shows a list of IP addresses and the number of connections that are connecting to port 80 on the server. Port 80 is used mainly by the HTTP protocol.

Optimize Apache server

Sat, 04 Feb 2023 11:40:51 +0000

LCwHost Ltd support department receives a lot of questions about how to optimize the Apache service. This article introduces basic, simple and yet effective ways to optimize Apache service according to VPS resources. By default, Apache "prefork" module is used. When this module is in use, one process serves one query. Those processes must be defined in strict numerical values to avoid VPS resource allocation to Apache only.

For traditional Apache optimization, there are four variables used by Apache:

• StartServers: number of child server processes created at startup;
• MinSpareServers: minimum number of idle child server processes;
• MaxSpareServers: maximum number of idle child server processes;
• MaxClients: maximum number of connections that will be processed simultaneously.

We can calculate optimal values for those variables:

• StartServers: RAM/128;
• MinSpareServers: RAM/256;
• MaxSpareServers: RAM/64;
• MaxClients: RAM/32.
• RAM: your server total Random Access Memory value;

Practical example in VPS plan with 4 GHz CPU | 4 GB RAM | 50 GB storage | 4 TB bandwidth:

• StartServers: 4096/128=32
• MinSpareServers: 4096/256=16
• MaxSpareServers: 4096/64=64
• MaxClients: 4096/32=128

Variables must be set in the Apache server configuration file. To edit this file, execute the following command:

nano /etc/httpd/conf/httpd.conf

Find the variables described above and change them according to the formula. If you can not find the variables, at the end of the file, add the following lines with your optimized limits being set:


KeepAlive Off

   StartServers        32
   MinSpareServers     16
   MaxSpareServers     64
   MaxClients         128

After modification, do not forget to restart apache server:

service httpd restart

Secure Mail Server Checklist

Sat, 04 Feb 2023 11:38:57 +0000

Setup of email server in Linux is simple, but your job does not end there. Customer had experiences where mail gateway has been misconfigured and has caused open relay for a spammer attack. Always pay extra careful attention when you deal with related internet services such as web and email.

1. MX record

The Mail Exchanger (MX) is critical to email related information in your DNS. The MX record tells the internet email servers how to handle the your email routing. If you host your own DNS server, please remember to add a MX record. You can perform a simple MX record test. Please change your internal dns server to an external dns server.

2. IP address

Use the mail security tool below to check your IP status:

http://www.mxtoolbox.com/SuperTool.aspx

3. Secure Mail Test tool

http://www.checktls.com/index.html

4. Reverse DNS

Usually anti-spam applications check if you have a valid reverse DNS IP. If you are sending mail from a non reverse DNS IP mail server, your 'mail reputation' will be lower than those who have a valid reserve IP. You might not see the impact instantly, however, since it might have a consequence in the long run such as sending valid bulk emails that might get your IP blacklisted or dropped.

5. SPF DNS Record

Most anti-spam application / gateway applies a Sender Policy Framework (SPF) checking. This is an additonal layer of spam filtering, where it checks if the mail is genuinely from a domain. It is advised to include SPF record in your DNS.