Category: Linux

  • Invalid command Header

    On a web site running Apache, i got following error in log file

    [Fri Jan 19 06:43:41.146643 2018] [core:alert] [pid 3536:tid 139697024132864] [client 112.133.229.111:50559] /home/site.com/public_html/.htaccess: Invalid command 'Header', perhaps misspelled or defined by a module not included in the server configuration, referer: https://site.com/

    This was Ubuntu server with Apache.

    Problem is due to Apache Headers module not enabled. Fixed by running

    a2enmod headers

    Restart Apache

    systemctl restart apache2

    See Apache

  • phpmyadmin

    cd /usr/local/src
wget https://files.phpmyadmin.net/phpMyAdmin/4.8.2/phpMyAdmin-4.8.2-all-languages.zip
unzip phpMyAdmin-4.8.2-all-languages.zip
mkdir /usr/serverok
rm -rf /usr/serverok/phpmyadmin
mv phpMyAdmin-4.8.2-all-languages /usr/serverok/phpmyadmin
mkdir /usr/serverok/phpmyadmin/tmp/
chmod 777 /usr/serverok/phpmyadmin/tmp/
cp /usr/serverok/phpmyadmin/config.sample.inc.php /usr/serverok/phpmyadmin/config.inc.php

    Edit

    vi /usr/serverok/phpmyadmin/config.inc.php

    Generate 32 chars length random key and add 

    pwgen 32

    Or

    sed -i  's/$cfg\[.blowfish_secret.\] = .*$/$cfg\["blowfish_secret"\] = "ohhae8Fa6oJohrohng0ieV0to3aiThae";/g' /usr/serverok/phpmyadmin/config.inc.php

    Configure Apache

    On Ubuntu, create file

    vi /etc/apache2/conf-enabled/phpmyadmin.conf

    On CentOS

    vi /etc/httpd/conf.d/phpmyadmin.conf

    Add following content

    Alias /phpmyadmin "/usr/serverok/phpmyadmin"
  

    AllowOverride All
    Options FollowSymlinks
    Order allow,deny
    Allow from all
   
     
       Require all granted

    MySQL root can’t login to phpMyAdmin

    Password Protect phpMyAdmin in CentOS Server

    Add following config to /etc/httpd/conf.d/phpmyadmin.conf

    alias /phpmyadmin "/usr/serverok/phpmyadmin"


    AllowOverride All
    Options FollowSymlinks
    AuthType Basic
    AuthName "Restricted Content"
    AuthUserFile /usr/serverok/htpasswd/phpmyadmin
    Require valid-user

    Create password file

    mkdir /usr/serverok/htpasswd
htpasswd -c /usr/serverok/htpasswd/phpmyadmin admin

    This will create user “admin” with password you specified.

    Restart apache

    service httpd restart

    Nginx

    Add following inside any server entry

    location /phpmyadmin {
    root /usr/serverok/;
    index index.php;
    location ~ ^/phpmyadmin/(.*\.php)$ {
            include snippets/fastcgi-php.conf;
            proxy_read_timeout 180;
            fastcgi_intercept_errors on;
            fastcgi_buffers 16 16k;
            fastcgi_buffer_size 32k;
            fastcgi_pass unix:/run/php/php7.2-fpm.sock;
    }
}

    https://www.adminer.org
    phpMyAdmin allow connecting to multiple servers
    Allow phpMyAdmin remote access on xampp
    MySQL root can’t login to phpMyAdmin
    Nginx Configuration for phpMyAdmin

  • Install PHP 5.6 on Debian

    Debian 9 come with PHP 7. To install PHP 5.6, run

    apt install apt-transport-https lsb-release ca-certificates -y
wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg
sh -c 'echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list'
apt-get update

    Install PHP 5.6 with

    apt install -y php5.6 php5.6-mysql php5.6-gd php5.6-mbstring php5.6-mcrypt php5.6-zip php5.6-curl php5.6-xml

    Enable SimpleXML module

    phpenmod -v 5.6 simplexml

    Install php-fpm if required

    apt install -y php5.6-fpm

    See php

  • curl

    View Header

    To view the response header, use

    curl -I URL_HERE

    Specify Host Header

    Example

    curl http://192.99.201.92/ip.php -H "host: iptools.bizhat.com"

    Using Proxy

    To connect to a proxy using an Authenticated proxy, use

    curl -U PROXY_USER:PROXY_PW -x MY_PROXY_SERVER:PROXY_PORT http://checkip.amazonaws.com

    Proxy with IP auth example

    curl -x http://207.66.90.22:16416 -L http://checkip.amazonaws.com

    To connect using Socks5 proxy running on 127.0.0.1 port 7070, run

    curl --socks5 127.0.0.1:7070 http://checkip.amazonaws.com

    For socks proxy with authentication, use

    curl --socks5 USER_HERE:PW_HERE@PROXY_IP:1080 http://checkip.amazonaws.com

    Sent Multiple Rquests

    Following command will sent 100 requet to url specified.

    curl -s "http://serverok.in/wp-login.php?[1-100]"

    On the server, you will see requests like

    http://serverok.in/wp-login.php?1
http://serverok.in/wp-login.php?2
http://serverok.in/wp-login.php?3

  • find

    find files by size
    Find limit search depth
    Find files older than X minutes

    Find Inside File

    find ./ -type f -name '*.*' -exec grep 'STRING_TO_FIND_HERE' {} \; -print

    Or

    grep -rnw '/path/' -e "STRING_TO_FIND_HERE"

    -r = recursive
    -n = show line number
    -w = whole word only (you can omit this if you need a partial match).

    grep -irl "STRING_TO_FIND_HERE"

    Files changed in the last 1 day

    find /path -mtime -1 -ls

    -1 = changed in last 24 hours
    +1 = changed earlier than 24 hours. Useful to find older files.

    Delete files older than x days

    To delete files older than 30 days, run

    find /path/ -type f -mtime +30 -exec rm -f {} \;

    If you need to delete a particular type of file, say .log files, use

    find /path/ -type f -mtime +30 -name "*.log" -exec rm -f {} \;

    Instead of “-exec rm -f {} \;”, find support -delete option

    find /path/ -type f -mtime +30 -name "*.log" -delete

  • dd

    To test the speed of the hard disk, run

    dd if=/dev/zero of=serverok bs=64k count=16k conv=fdatasync

    Here is the test result for 2 * SSD in RAID 1

    root@india ~ # dd if=/dev/zero of=serverok bs=64k count=16k conv=fdatasync
16384+0 records in
16384+0 records out
1073741824 bytes (1.1 GB, 1.0 GiB) copied, 2.58697 s, 415 MB/s
root@india ~ #

    Write ISO into USB Drive

    dd bs=4M if=/mnt/data/archlinux-2018.06.01-x86_64.iso of=/dev/sde1 status=progress oflag=sync

  • Forum

  • Block Tor IP Addresses with CSF Firewall

    To block traffic from TOR using CSF firewall, edit

    vi /etc/csf/csf.blocklists

    Add following to end of the file

    TOR|86400|0|https://www.dan.me.uk/torlist/

    86400 = Tor IP list updated every 86400 seconds (12 hours), you can change this if required, but updating every 12 hours is fine for such a large list.

    Now restart CSF and LFD

    csf -r
systemctl restart lfd

    You can verify IPs get added to firewall by running

    iptables -L -n

    You wills see DROP lines for each of the TOR IP address.

    # iptables -L -n | grep DROP | wc -l
5955
#

    You will be able to see the downloaded TOR IP list at

    /var/lib/csf/csf.block.TOR

    csf

    Block Tor IP Addresses

  • Block Tor IP Addresses

    UPDATE: This is not efficient method. Use new method available at Block Tor IP Addresses with CSF Firewall

    Here is a PHP script that you can run as cronjob every 1 hour to block Tor traffic on your server.

    This require csf firewall installed on your server.

     /var/log/tor-block.log 2>&1


$torIPSource = "https://www.dan.me.uk/torlist/";
$torIPs = file_get_contents($torIPSource);
$torIPArray = explode("\n", $torIPs);

foreach ($torIPArray as $torIP) {
    $torIP = trim($torIP);
    if (empty($torIP)) { continue; }

    if (isValidIPv4($torIP)) {
        $blockCmd = "/usr/sbin/csf -d $torIP";
        echo $blockCmd . "\n";
        exec($blockCmd);
    }
}

function isValidIPv4($ip) {
    if (filter_var($ip, FILTER_VALIDATE_IP)) {
        return true;
    } else {
        return false;
    }
}

    Set cronjon,

    crontab -e

    Add

    5 * * * * /usr/local/bin/php /usr/serverok/block-tor.php > /var/log/tor-block.log 2>&1

  • ConfigServer Security and Firewall (CSF)

    How to use CSF Firewall

    Firewall Configuration

    Csf Requirments

    On CentOS/RHEL

    yum install -y perl perl-libwww-perl perl-Time-HiRes unzip bind-utils

    On Debian/Ubuntu

    apt -y install libwww-perl

    Install CSF firewall

    cd /usr/local/src
wget https://download.configserver.com/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh

    Configure some basic settings for CSF

    /bin/sed -i "s/RESTRICT_SYSLOG\s*=.*$/RESTRICT_SYSLOG = \"3\"/g" /etc/csf/csf.conf
/bin/sed -i "s/SYSLOG_CHECK\s*=.*$/SYSLOG_CHECK = \"3600\"/g" /etc/csf/csf.conf
/bin/sed -i "s/SMTP_BLOCK\s*=.*/SMTP_BLOCK = \"1\"/g" /etc/csf/csf.conf
/bin/sed -i "s/LF_GLOBAL\s*=.*$/LF_GLOBAL = \"1800\"/g" /etc/csf/csf.conf
/bin/sed -i "s/LF_SCRIPT_ALERT\s*=.*$/LF_SCRIPT_ALERT = \"1\"/g" /etc/csf/csf.conf
/bin/sed -i "s/PT_ALL_USERS\s*=.*$/PT_ALL_USERS = \"1\"/g" /etc/csf/csf.conf
/bin/sed -i "s/TESTING = \"1\"/TESTING = \"0\"/g" /etc/csf/csf.conf

    Restart csf

    csf -r

    Block an IP

    csf -d IP_ADD

    Whitelist an IP

    csf -a IP_ADD

  • sysctl

    nf_conntrack: table full, dropping packet
    MariaDB Change Open Files Limit
    Elasticsearch

  • nf_conntrack: table full, dropping packet

    On a CentOS server, i get following error in /var/log/messages

    Jan 17 03:40:02 ss1 kernel: nf_conntrack: table full, dropping packet
    Jan 17 03:40:03 ss1 kernel: nf_conntrack: table full, dropping packet
    Jan 17 03:40:03 ss1 kernel: nf_conntrack: table full, dropping packet
    Jan 17 03:40:03 ss1 kernel: nf_conntrack: table full, dropping packet
    Jan 17 03:40:03 ss1 kernel: nf_conntrack: table full, dropping packet
    Jan 17 03:40:03 ss1 kernel: nf_conntrack: table full, dropping packet

    This is because the server is getting too much connections. This can be due to a busy server or DDoS attack.

    if you traffic is legit, you can increase maximum connection tracking.

    To see current value, run

    cat /proc/sys/net/netfilter/nf_conntrack_max

    To set value, run

    echo 64000 > /proc/sys/net/netfilter/nf_conntrack_max

    Change 64000 with your desired value.

    You can also use sysctl, for example

    sysctl -a | grep nf_conntrack_max

    To set value, run

    sysctl -w net.netfilter.nf_conntrack_max=120000

    To make it permanent, edit 

    vi /etc/sysctl.conf

    Add 

    net.netfilter.nf_conntrack_max=120000

    Now run

    sysctl -p

    See sysctl