Category: Uncategorized

The internet as of 2000

Back when I was younger and working on gaining knowledge of such things as Linux, I used to listen to this online radio show all the time. It really gives a feel for the industry as of about the years 2000-2001 and how it was evolving at the time. The show has long since gone off the air, but they do have archives up still. ftp://ftp.dhbit.ca/DHBiT/ I also used to listen to Off The Hook, Emmanuel Goldstien’s radio show. I think it’s still on, but it’s been forever for that as well.

CSF + Passive FTP

If you running a FTP server (Pureftp/Proftp) in your linux server, it is very important to to enable passive mode, because this mode, works best for ftp clients protected by firewall since the client initiates the connection.

If you are running a CSF firewall in your linux box, along with FTP server running Pure-ftp or Proftp, just follow the below steps…

1. Add Passive Port range 30000-350000 to your Pureftp or Proftp configuration file

(i) Pureftpd

open /etc/pure-ftpd.conf, and this line

PassivePortRange    30000 35000

(ii) ProFTP

Open /etc/proftpd.conf, and add this line

PassivePorts    30000 35000

2. Open the ports from 30000 – 35000 in your CSF firewall configuration file under TCP_IN

Open /etc/csf/csf.conf

# Allow incoming TCP ports
TCP_IN = "20,21,22,25,53,80,110,30000:35000"

Then restart firewall and ftp server.

service csf restart
service pureftpd restart (or)
service proftpd restart

Once this is done, open your ftp client and try connecting to ftp server. It should be able to work in passive mode.

A common pitfall of the OpenVZ installation

A very very common error I see people make when installing OpenVZ on a 64 bit system is that they will assume the kernel used is a 64 bit kernel. By default OpenVZ does NOT install a 64 bit kernel, but rather a 32 bit one. If the wrong kernel is installed this will cause the machine to drop a kernel panic. This is mentioned in the documentation, however this is an issue I have seen clients have repeatedly.

Guidelines for system file modification

Just figure I would throw a few basic guidelines out there I use whenever I can. Not saying I always follow them as exceptions do happen and I (like many other people out there) am not perfect, but the quickest way to resolve a problem is to be able to get around it. My rules are this:

When changing a file:Always make a copy of it. Try to include something that explains its significance, such as the date or your name. Having a bunch of httpd.conf.bakN where N is the number in which they were created doesn’t really do any good to anyone

When deleting a file:Dont unless necessecary or explicitly requested. Moving a file to a new directory is a far better option. This also lets you be able to examine the files at a later date, and is quicker to perform than a raw delete in most cases I have seen.

When you’re migrating files:Don’t delete the source ones until the new ones are working properly, everything is migrated over and preferably some period of time has passed. Trust me you don’t want to be that guy who didn’t have the DNS server changed over and deleted the active site or you needed some extra files that weren’t there.

The dot:When running commands, before hitting return be sure that your commands are dotted properly. Running chown username ./* and running chown username /* are two commands that will have very different results! This is very common, there are many admins who forgot the dot! This goes for any “heavyweight” commands such as rm, chmod, chown, etc.

Remember the server is meaningless without customers who have their data on it. As a sysadmin it is ultimately YOUR responsibility to take care of ensuring data is in tact. I will cover what I believe to be “suitable” measures to safeguard your data in another blog some time down the road. Until then stay tuned.

cPanel and basic iptables

Save this to a file and run it, This will empty your iptables and set a solid set of secure rules that are compatible with cPanel servers running DNS clustering. If you run DNS locally be sure to allow 53 on TCP AND UDP!

/sbin/iptables -F
/sbin/iptables -X
/sbin/iptables -Z
/sbin/iptables -P INPUT DROP
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A INPUT -p tcp ! --syn -j REJECT --reject-with tcp-reset
/sbin/iptables -A INPUT -m state --state INVALID -j DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp ! --syn -j REJECT --reject-with tcp-reset
/sbin/iptables -A OUTPUT -m state --state INVALID -j DROP
/sbin/iptables -P FORWARD DROP
/sbin/iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp ! --syn -j REJECT --reject-with tcp-reset
/sbin/iptables -A FORWARD -m state --state INVALID -j DROP
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A OUTPUT -o lo -j ACCEPT
/sbin/iptables -A FORWARD -i lo -o lo -j ACCEPT

##Acceptable IP
/sbin/iptables -A INPUT -s x.x.x.xx -j ACCEPT #YOUR TRUSTED IP's

##General Web/File Services
/sbin/iptables -A INPUT -p tcp --dport 80  -j ACCEPT #HTTP
/sbin/iptables -A INPUT -p tcp --dport 443 -j ACCEPT #HTTPS
/sbin/iptables -A INPUT -p tcp --dport 21 -j ACCEPT #FTP
/sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT #SSH
/sbin/iptables -A INPUT -p tcp --dport 5666 -j ACCEPT #NRPE

##Email Services
/sbin/iptables -A INPUT -p tcp --dport 25 -j ACCEPT #SMTP
/sbin/iptables -A INPUT -p tcp --dport 110 -j ACCEPT #POP3
/sbin/iptables -A INPUT -p tcp --dport 143 -j ACCEPT #IMAP
/sbin/iptables -A INPUT -p tcp --dport 465 -j ACCEPT #SMTPs
/sbin/iptables -A INPUT -p tcp --dport 993 -j ACCEPT #IMAPs
/sbin/iptables -A INPUT -p tcp --dport 995 -j ACCEPT #POP3s

##cPanel Services
/sbin/iptables -A INPUT -p tcp --dport 2083 -j ACCEPT #cPanel
/sbin/iptables -A INPUT -p tcp --dport 2087 -j ACCEPT #WHM
/sbin/iptables -A INPUT -p tcp --dport 2096 -j ACCEPT #Webmail

##Allow Ping
/sbin/iptables -A INPUT -p icmp --icmp-type 8/0 -j ACCEPT

##Final Blocks
/sbin/iptables -A INPUT -j DROP
/sbin/iptables -A OUTPUT -j ACCEPT
/sbin/iptables -A FORWARD -j DROP

Guide on removing iptable rules

If you loose access to your server while using this, well that sucks.   Setup a cron job to stop the iptables service every 5 minutes just in case.

How to submit a support ticket properly

We all submit support tickets in one form or another as part of our jobs in the IT world. There just comes a point where everyone needs some help. This being said, as a person working in the industry for the lowest response times and maximum efficiency there are a few things that you should do when submitting a support ticket:

  • Root password
  • Ports of any services that have been changed
  • Any form of authentication OTHER than passwords required (eg suing up, etc.)
  • Symptoms being reported
  • If you made changes before things started happening what were they
  • Your Ip address if you are experiencing difficulties accessing the site
  • Did you ping your server/VPS and did you get a response? Was it within the typical time?

Something to keep in mind is that by including these answers you will save the technician time in trying to bring your server up as well as reducing the time it takes you to get your server brought back up. The first two are critical, it’s really bad if you have a server running out of RAM but your tech can’t access it because you changed the SSH port to 2020 instead of leaving it on 22. We are here for you the client, however if your server can’t be brought up with the information on hand you get asked some questions and your ticket gets moved aside until a response is had.

BOFH Daily Excuse Added

As system admins we felt it was necessary to show you some of our favorite BOFH excuses.   If you scroll to the bottom of the blog, near the copyright we have added “Todays BOFH Excuse:”.  However it may change more often than daily, just depends when WP Super Cache rebuilds the page index.BOFH (Bad Operator From Hell) Excuse Blurb

Tracking Network Floods

When it comes to working at a DC, attacks are a fact of life. Someone will ultimately get annoyed at a client and start throwing down with the botnet, their home system etc. These attacks can be hard to isolate at times because they can be on nearly any service, as well as using a wide variety of protocols. These attacks can do anything from making a server slow to respond to taking an entire data center out. When a system goes down due to an attack, there are a few things that must be known:

  • Who is DoSing or who is being DoSed (don’t assume your machine is the “victim” insidious PHP scripts are plentiful these days)
  • The magnitude of the attack
  • What protocol they are using

To find these out, you need proper network infrastructure set up. To this end I like Cacti on the switches for ease of usability in finding overall traffic, even though NFsen is nice for a quick check by IP however it can be flawed in picking up distributed or spoofed attacks in my experience. When attempting to isolate the problems one should have a “tiered” approach where they start checking at the most basic level which is a single server. If the attack is larger  one should try to see if it’s a single rack/switch being attacked and seeing if it can back track to a single server being the target. At this point, there are a few options. Null routes are an option if all fails, even null routing the server’s IP so that other traffic doesn’t get affected can be done as a last resort. The option that you probably have the most control over is server side mitigation. This will be the topic of my next blog. See you then!

So my friend chats me up

Saying he won $4K on a scratch off lotto ticket. What did he get with his loot? A 1TB SSD drive. It’s amazing a mere quarter century ago this would have gotten you say 10 megabytes on an MFM hard disk that was well less than fast. Amazing how technlogy moves forward. That means that you’re looking at roughly 100,000 times the storage capacity and incredibly better performance. If that happens again in 25 years we will be using drives with 1,000,000,000,000 megabytes of capacity. Provided the robots don’t kill us all first.

SolusVM New Update

Hi everyone, a long anticipated update has finally been released for SolusVM today.

New features in build SolusVM Enterprise v1.2.04

Us at Beyond Hosting have been delaying the launch of Xen Containers simply because there was no way to rate limit them.    It’s also nice to see how they build their PHP modules, everything for WHMCS is ioncube encoded and hard to modify if needed.