QuickFix

cPanel Installation

2011-05-19T11:35:00.000-07:00

CPanel installation is quite easy:

1) Login to the server with root access

2) wget http://layer1.cpanel.net/latest

3)sh latest

After this slow down your back on chair comfortably as the installation will take 30-45 min. You can watach the installation if any error occured.

CSF Installlation on cPanel Server

2011-05-19T10:37:00.000-07:00

Installation is quite straightforward:

Login as the root user to SSH and run the following commands.
rm -fv csf.tgz
wget http://www.configserver.com/free/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh

If you would like to disable APF+BFD (which you will need to do if you have
them installed otherwise they will conflict horribly):
sh disable_apf_bfd.sh
That's it. You can then configure csf and lfd in WHM, or edit the files
directly in /etc/csf/*

Installation Completed
Don't forget to:
1. Configure the TCP_IN, TCP_OUT, UDP_IN and UDP_OUT options in the csf configuration to suite your server
2. Restart csf and lfd
3. Set TESTING to 0 once you're happy with the firewall
csf is preconfigured to work on a cPanel server with all the standard cPanel
ports open. It also auto-configures your SSH port if it's non-standard on
installation.
You should ensure that kernel logging daemon (klogd) is enabled. Typically, VPS
servers have this disabled and you should check /etc/init.d/syslog and make
sure that any klogd lines are not commented out. If you change the file,
remember to restart syslog.
Now - login to your cPanel server's WHM as root and go to the bottom left menu. If already logged in then reload the page. In Plugins - you will see: ConfigServer Security&Firewall
The firewall is STOPPED by default - it is not running. We need to configured it, and then take it out of Test Mode.

Click on Firewall Configuration

ETH_DEVICE =: Set this to eth+

TCP_IN/TCP_OUT/UDP_IN/UDP_OUT = : These are the ports you want to leave open for your server to operate. If you change the default SSH port make sure to add it here. Also add any other services you might have running such as Shoutcast or game servers. By default most of the ports used should already be configured.

MONOLITHIC_KERNEL = : 0 Only change this to 1 if your firewall will not start - otherwise leave it as it.

LF_DSHIELD = 0: Change this option to 86400. This is an automatic updated list of known attacking IPs. Enabling this will stop them from being able to connect to your server.

Spam Protection AlertsIf you want to add some spam protection, CSF can help. Look in the configuraiton for the following:

LF_SCRIPT_ALERT = 0 change this to 1. This will send an email alert to the system administrator when the limit configured below is reached within an hour.

LF_SCRIPT_LIMIT = 100 change this to 250. This will alert you when any scripts sends out 250 email messages in an hour.

Configuration Complete - AlmostScroll down to the bottom and click on Change to save the settings. Then click Restart csf+lfd

You should see a big page of ACCEPT and near the bottom you should see:

csf: TESTING mode is enabled - don't forget to disable it in the configuration
Starting lfd:[ OK ]
Click on Return

Now TEST all your services to make sure everything is working - SSH, FTP, http. After you do a few quick tests go back into the Firewall Configuration page.
TESTING = 1 change this to 0 and click Change at the bottom. Then Restart csf+lfd

That's it, the firewall is successfully installed and running!!
Firewall Status: Running - you should see this on the main CSF page in WHM.

Track Top memory and CPU consuming process

2011-05-08T06:48:00.000-07:00

Use below mentioned command to get top memory consuming processes"

ps aux | head -1;ps aux --no-headers| sort -rn +3 | head

Use below command to get top cpu consuming processes:

ps aux | head -1;ps aux --no-headers | sort -rn +2 |more

Catching spammer on cpanel server

2011-05-08T06:43:00.000-07:00

If mass mailing or spamming is going on cPanel server then you can trace the spammer with follwoing commands:

1 ) pidof exim

2) Belwo command will show you the no of emails sent by perticular domain:

exim -bp | exiqsumm | more
3)

exim -bpr | grep "<*@*>" | awk '{print $4}'|grep -v "<>" | sort | uniq -c | sort -n

That will show you the maximum no of email currently in the mail queue have from or to the email address in the mail queue with exact figure.

4)

exim -bpr | grep "<*@*>" | awk '{print $4}'|grep -v "<>" |awk -F "@" '{ print $2}' | sort | uniq -c | sort -n

That will show you the maximum no of email currently in the mail queue have for the domain or from the domain with number.

5)

Check if any php script is causing the mass mailing with

cd /var/spool/exim/input

egrep "X-PHP-Script" * -R

Just cat the ID that you get and you will be able to check which script is here causing problem for you.

Exim Server Commands

2011-05-08T06:36:00.000-07:00

How to check emails in mail queue?

exim -bpc

How to check full status of exim server?

eximstats -nr -ne /var/log/exim_mainlog

How to check exim pids running?

pidof exim

Your license could not be activated : License File Expired

2011-05-03T07:05:00.000-07:00

I had a issue with cPanel license as I was getting the error "Your license could not be activated"

Solution >>

I tried

/usr/local/cpanel/cpkeyclt

but the issue didn't get resolve. then I cheked the date on the sever and found that very old date was set on the server. Simply I sync the date with the command :

rdate -s rdate.cpanel.net

The issue got resolved.

What is Cron

2011-04-30T05:56:00.000-07:00

Cron is a unix, solaris utility that allows tasks to be automatically run in the background at regular intervals by the cron daemon

Crontab Commands :

crontab -e    Edit your crontab file, or create one if it doesn’t already exist.
crontab -l      Display your crontab file.
crontab -r      Remove your crontab file.

Security Logs

2011-03-20T23:23:00.000-07:00

Authentication attempts:

Location : /var/log/secure

Description : Logs all daemons which requires PAM Authentication.

Tracking all Bad Logins and Logouts:

Location : /var/log/btmp

Description : Log of all attempted bad logins to the system. Accessed via the lastb command..

Tracking all Logins and Logouts:

Location : /var/log/wtmp

Description : The wtmp file records all logins and logouts.

Last Logins:

Location : /var/log/lastlog

Description : Database times of previous user logins. The lastlog file is a database which contains info on the last login of each user.

WebDav or WebDisk Log :

Location : /usr/local/cpanel/logs/cpdavd_error_log

Description : The cpdavd daemon is "WebDav" (better known as "WebDisk") which was introduced in cPanel 11 to allow users to mount their home directory on their personal computer, always having access to the files and content...

Cphulkd Logs:

Location : /usr/local/cpanel/logs/cphulkd_errors.log

Description : cPHulk Brute Force Protection prevents malicious forces from trying to access your server's services by guessing the login password for that service....
It blacklists IPs that it thinks are trying to run a brute force attack.

Failure Logging:

Location : /var/log/faillog

Description : Faillog formats the contents of the failure log from /var/log/faillog database. It also can be used for maintains failure counters and limits. Run faillog without arguments display only list of user faillog records who have ever had a login failure.

Startup/Boot, Kernel & Hardware error messages :

Location : /var/log/dmesg

Description : dmesg is a "window" into the kernels ring-buffer. It's a message buffer of the kernel. The content of this file is referred to by the dmesg command. It shows bootlog and the hardware errors..

Mysql Logs

2011-03-20T23:17:00.000-07:00

MySQL General Information and Errors :

Location : /var/lib/mysql/$(hostname).err

Description : This path could vary, but is generally located in /var/lib/mysql. Could also be located at /var/log/mysqld.log

Mysql Slow Queries:

Location : /var/log/mysql-slow.log

Description : These logs are only available if slow logs queries are enabled in my.cnf as well this path cold vary but generally located in /var/log/

FTP Logs

2011-03-20T23:12:00.000-07:00

FTP Logins and General Errors:

Location : /var/log/messages

Description : General information and login attempts are logged here..

FTP Transactions logging:

Location : /var/log/xferlog or /var/log/messages

Description : Is a symbolic link in most cases to /usr/local/apache/domlogs/ftpxferlog, which contains a history of the transactions made by FTP users...

Exim Logs

2011-03-20T23:09:00.000-07:00

Message Reception and Delivery:

Location : /var/log/exim_mainlog or /var/log/exim/mainlog

Description : Receives an entry every time a message is received or delivered.

Exim ACLs/Policies based RejectLog :

Location : /var/log/exim_rejectlog

Description : An entry is written to this log every time a message is rejected based on either ACLs or other policies eg: aliases configured to :fail

Unexpected or Fatal Errors:

Location : /var/log/exim_paniclog

Description : Logs any entries exim doesn’t know how to handle. It's generally a really bad thing when log entries are being written here, and they should be properly investigated..

IMAP/POP/SpamAssassin General Logging and Errors:

Location : /var/log/maillog & /var/log/messages

Description : The IMAP, POP, and SpamAssassin services all log here. This includes all general logging information (login attempts, transactions, spam scoring), along with fatal errors.

Apache Logs

2011-03-20T23:06:00.000-07:00

General Error and Auditing Logs:

Location : /usr/local/apache/logs/error_log

Description : All exceptions caught by httpd along with standard error output from CGI applications are logged here..
The first place you should look when httpd crashes or you incur errors when accessing website.

Apache SuExec Logs:

Location : /usr/local/apache/logs/suexec_log

Description : Auditing information reported by suexec each time a CGI application is executed. Useful for debugging internal server errors, with no relevant information being reported to the Apache error_log, check here for potential suexec policy violations...

Domain Access Logs:

Location : /usr/local/apache/domlogs/domain.com

Description : General access log file for each domain configured with cPanel.

Apache Access Logs:

Location : /usr/local/apache/logs/access_log

Description : Complete web server access log records all requests processed by the server.

cPanel-WHM Logs

2011-03-20T23:01:00.000-07:00

cPanel/WHM Initial Installation Errors:
Location : /var/log/cpanel*install*
Description : These log files contain cPanel installation logs & should be referenced first for any issues resulting from new cPanel installations..

Cpanel/WHM Service Status Logs:
Location : /var/log/chkservd.log
Description :The service monitoring demon (chkservd) logs all service checks here. Failed service are represented with a [-] and active services are represented by [+].

Cpanel/WHM Accounting Logs:
Location : /var/cpanel/accounting.log
Description : Contains a list of accounting functions performed through WHM, including account removal and creation..

cPanel error logs:
Location : /usr/local/cpanel/logs/error_log
Description : cPanel logs any error it incurs here. This should be checked when you encounter errors or strange behavior in cPanel/WHM...

cPanel License Error Logs:
Location : /usr/local/cpanel/logs/license_log
Description : All license update attempts are logged here. If you run into any errors related to license when logging in, check here.

Stats Daemon Logs:
Location : /usr/local/cpanel/logs/stats_log
Description : The stats daemon (cpanellogd) logs the output from all stats generators (Awstats, Webalizer, Analog) here.

Client Information, Requested URL Logs:
Location : /usr/local/cpanel/logs/access_log
Description : General information related to access cPanel requests is logged here.

cPanel/WHM Update Logs:
Location : /var/cpanel/updatelogs/update-[TIMESTAMP].log
Description : Contains all output from each cPanel update [upcp]. It's named with the timestamp at which the upcp process was initiated..

Bandwidth Logs:
Location : /var/cpanel/bandwidth
Description : Files contain a list of the bandwidth history for each account. Each named after their respective user.

Tailwatchd [New]:
Location : /usr/local/cpanel/logs/tailwatchd_log
Description : Logs for daemon configuired under tailwatchd ie. cPBandwd, Eximstats, Antirelayd.

How to Change SSH port on cPanel Server

2011-03-06T21:58:00.000-08:00

As far as security concern its a good deal to change the SSH port of your server, simply you need to follow the steps:

1) SSH to the server with root login

2) You need to make sure that the port you are going to assgin is opened at firwall (in case of CSF, APF):

CSF :
#pico /etc/csf/csf.conf

search for the line : TCP_IN

add the port

APF:
#pico /etc/apf/apf.conf

search for the line : TCP_IN

add the port

3) Now save the changes .

4) You need to change the ssh port in sshd_config File

# pico /etc/ssh/sshd_config

search for Port 22

Uncommnet the line and replace the port and save the file

5) Now it needs to restart ssh service

#/etc/init.d/sshd restart

Note : Dont close your current ssh seesion until you confirm that you are able to login to the server wtih new port in another ssh session.

Thast's

How to configure remoe backup through WHM

2011-03-06T21:46:00.000-08:00

You can specify how often backups occur and where backups are placed - either on the same server or on a separate backup drive. You can also specify the specific parts of the backup process that are enabled.

The following describes backup interval options available to you through WHM:

Daily - cPanel and WHM performs separate daily, weekly, and monthly backups.
Weekly - cPanel and WHM performs separate weekly and monthly backups.
Monthly - cPanel and WHM performs only monthly backups.

1. When the page loads, set the following:

Backup Status - Turns the automatic backup function on or off. You have the following options available to you:

Enabled
Disabled
Restore Only - Allows site restoration from old backups to occur, but does not create new backups.

Backup Interval - Specify the interval used by the backup process. (Note: Selecting Daily Backup with give you monthly and weekly as well unless you choose not to retain them in the "Backup Retention" setting below. Selecting Weekly backup will give you monthly as well unless you choose not to retain them in the "Backup Retention" setting below.) You have the following options available to you:

Daily
Weekly
Monthly

Backup Retention - See "Note:" in the "Backup Interval" setting above.
Days to run backup - Click on the check boxes associated with the days of the week you want to run backups. You can choose all seven days or select only the days specific to your needs.
Remount/Unmount backup drive - Mounts and unmounts the backup drive when a backup is created. This requires a separate drive mount to operate. (Note: requires a separate drive/coda/nfs mount.) Your choices include:

Enabled
Disabled

Bail out if the backup drive cannot be mounted - Stops the backup if the drive can not be mounted. Recommended if the Remount/Unmount backup drive option is enabled. Your choices include:

Enabled
Disabled

Incremental Backup - Backup process only copies what has changed since the last backup. This creates a much smaller backup file, but changes are gradual and the backup files are not compressed. Not compatible w/ftp backups. Your choices include:

Enabled
Disabled

Backup Accounts - Backup process copies all account information for your customers. Your choices include:

Enabled
Disabled

Backup Config Files - Includes config files in the backup process. Your choices include:

Enabled
Disabled

SQL Databases - Includes MySQL databases in the backup process. You can choose to backup up databases in separate accounts, the master MySQL directory, or both. Your choices include:

Per Accounts Only
Per Accounts and Entire
Mysql Dir
Mysql Dir Only

Backup Raw Access Logs - Includes the Apache raw access logs in the backup. Your choices include:

Enabled
Disabled

Backup Type - Select what type of backup you need. Your choices include:

Remote Ftp Server (Accounts Only)
Standard

FTP Backup Host (Remote Ftp Backup Only) - Enter the domain name of the FTP backup host in the text box provided (only required if Remote FTP Server is enabled). (If the FTP port is different on remoteFTP server, then you need to metnion it EX : 192.168.1.2 : 2021 where 2021 is the ftp port)
FTP Backup User (Remote Ftp Backup Only) - Enter the user name to use on the FTP backup host in the text box provided (only required if Remote FTP Server is enabled).
FTP Backup Pass(Remote Ftp Backup Only) - Enter the password to use on the FTP backup host in the text box provided (only required if Remote FTP Server is enabled).
Ftp Backup Directory/Path - [optional, a directory called cpbackup in the ftp account's directory root will be used if none specified examples: /home/fred/cpbackup,/backup/cpbackup,/files/cpbackup] (Remote Ftp Backup Only)
Use Passive mode for Ftp transfers - (required if you are behind a firewall or ftp backups fail) Your choices include:

Enabled
Disabled

Backup Destination - Enter the location of backups in the text box provided. This should be a dir/NFS/coda mount with at least twice the space of all your /home* partitions.

WARNING: Do not set this to your /home directory.
Select Specific Users - Click on the "Select >>" button to select user accounts you want these configuration settings to apply. A new window will open listing two columns containing the following:

Backup User - The username of the account.
Domain - The domain of the account.

By default, all check boxes are checked. If you do not want these backup configuration settings to apply to a particular user or account, click on the associated check box.

When you have finished selecting the users you want the backup configuration settings to apply, click on the "Save" button at the bottom of the new pop-up window.

2. When you are finished configuring the settings above, click on the "Save" button.

3. You should a confirmation statement similar to the following:

"Backup Configuration Saved!"

How to disable root login on cPanel server

2011-03-05T20:20:00.000-08:00

For security purpose you may disable direct root login and create another ssh user with the privileges, simply you need to follow the steps:

Note : Don't close your current session until you confirm that the with the changes you have made, the server is accessible in another ssh session

1) Create a user say : webadmin

# useradd webadmin

2 ) Set password for webadmin

# passwd webadmin

3) In case of cPanel, you need to add this user to 'wheel group'

WHM >> Security Center >> “Manage Wheel Group Users”

Now the user has been granted su previlages, you need to disable the root login for that you will need to login to the server at shell (command prompt)

1) Edit the SSHD configuration file ‘sshd_config’:

pico /etc/ssh/sshd_config

2) Search the line

PermitRootLogin yes
and change it to
PermitRootLogin no

Once you are complete with the above changes, save the file and exit. You will have to restart the sshd service for the changes to take effect.

# /etc/init.d/sshd restart

Now, you will have to SSH to your server as user ‘webadmin’ and then su to root as follows:

login as: webadmin
webadmin@xx.xx.xx.xx’s password: <webadmin pass here>
[admin@server ~]$ su -
password: <root password here>
[root@server ~]#

Thats't

Where are the cpbackup logs are stored

2011-03-05T20:03:00.001-08:00

You may get the cpbackup logs at the path :

/usr/local/cpanel/logs/cpbackup/

How To Resolve : Updating cPanel license...Done. Update Failed!

2011-03-02T22:32:00.000-08:00

If you are getting this error while updating cPanel license then you need to open a support ticket to cPanel.

-----------------------------------------------------
root@server [~]# /usr/local/cpanel/cpkeyclt
Updating cPanel license...Done. Update Failed!
Building global cache for cpanel...Done
root@server[~]#
-----------------------------------------------------

Can not access phpmyadmin

2011-03-02T22:28:00.000-08:00

Sometimes you may face the issue to access phpmyadmin through cpanel, it asks for user name and password:

Reason : It might be possible while changing cpanel password "Allow MySQL password change" option was not checked.

Resolution : You need to reset cPanel password by enabling this option.(It can be done through cPanel as well WHM)

/home disk space audit on cpanel server

2011-02-24T14:56:00.000-08:00

If /home is getting full then you can check for few things:

1) Check if there are suspended accounts if so then check your suspension policy and terminate the accounts by sending notification to the clients.

2) You may also check the users who are using disk space in GB's. List out those users and check exact what data they are storing? sometimes there are core files which takes more space, you may delete those core files.

3) Check if there are backup (archive) files under users home directory, notify the users to download such archive files.

I hope these tricks will be helpful to clear /home

What is EPP Code

2011-02-18T00:13:00.000-08:00

The EPP key or code is nothing but the Authorization code, which is one of the safeguards against unauthorized transfers of domain name registrations and it protects your rights as a domain owner. The EPP key is required when transferring .com, .net, .org, .biz, .info and .us domain names. It is not possible to initiate a domain name transfer for these domains without an EPP code.

How to backup Mysql Databases in Cpanel?

2011-02-12T15:24:00.000-08:00

Mysql databases can be backed up by following steps

1. Login to cPanel interface >>> Files >>> Backups >>>
2. Underneath where it says "Download a SQL DB Backup", click on the database name that you wish to backup
3. Select a place and filename for you to save on to your local computer
4. Do NOT attempt to open this file with Winzip.

You have now successfully backed up your Mysql database with Cpanel.
There are other ways to accomplish this task, such as doing a dump from
PhpMyadmin, or doing a dump from the command line, but the cpanel
method is quick and easy.

How to optimize a MySQL database using phpMyAdmin?

2011-02-12T08:43:00.001-08:00

It is always a good idea to keep your databases' tables optimized.

Fortunately, making this optimization is quite easy when using the phpMyAdmin tool available in cPanel.

To perform the optimization, log in to your phpMyAdmin and select the database whose tables you wish to optimize.

A list with all the database's tables will appear. Tick the tables you wish to optimize, or simply click [Check All] to select all tables.

From the [With selected:] drop-down menu choose Optimize table. This will execute the OPTIMIZE TABLE SQL query on the selected tables and they will be updated and optimized.

How can I retrieve the raw Apache access logs for my site?

2011-02-12T08:42:00.000-08:00

You can retrieve the Raw Access Logs for your site(s) by logging in your cPanel and following the link "Raw Access Logs".

The Error log for your site is kept separately from the Access logs. It can be found by logging in Cpanel and following the link "Error Log"

Vzctl Commands

2011-02-12T08:27:00.000-08:00

Following are some important commands which are normally used while working on a Hardware Node.

1) vzlist -a : Shows list of all the VPS’s hosted on the Node.
2) vzctl start VPS_ID: To start the VPS.
3) vzctl stop VPS_ID : To stop (Shut Down) the VPS
4) vzctl status VPS_ID : To view the status of the particular VPS
5) vzctl stop VPS_ID –fast : to stop the VPS quickly and forcefully
6) vzctl enter VPS_ID : To enter in a particular VPS

Configuration Commands

1) vzctl set VPS_ID –hostname vps.domain.com –save: To set the Hostname of a VPS.
2) vzctl set VPS_ID –ipadd 1.2.3.4 –save : To add a new IP to the hosting VPS.
3) vzctl set VPS_ID –ipdel 1.2.3.4 –save : To delete the IP from VPS.
4) vzctl set VPS_ID –userpasswd root:new_password –save : to reset root password of a VPS.
5) vzctl set VPS_ID –nameserver 1.2.3.4 –save : To add the nameserver IP’s to the VPS.
6) vzctl exec VPS_ID command : To run any command on a VPS from Node.
6) vzyum VPS_ID install package_name : To install any package/Software on a VPS from Node.

Here VPS_ID refers to the ID of the Particular VPS.