Quick PHP Secure - Disabling System Functions
A quick way of securing PHP against ner-do-wells wanting to execute binary programs from an exploited script is to disabled a series of system calls that exploits try to use. This is a quick and easy way to get around them, but it might break some normal programs in the process.
Firstly you need to find out where you php.ini file is stored. Login as root on your server and run
<br /> root@shared1 [~]# php -i | grep ini<br /> Configuration File (php.ini) Path => /usr/local/Zend/etc/php.ini<br />
This shows that /usr/local/Zend/etc/php.ini is the ini file so open this in your favourite editor e.g. nano and search for the string “disable_functions”. Change the line to read
<br /> disable_functions = dl,passthru,proc_open,proc_close,shell_exec,system<br />
Save the file and quit the editor. Restart Apache service httpd restart for Linux system
To check its working you can just run “php -i | grep disable_functions” and you should see
disable_functions => dl,passthru,proc_open,proc_close,shell_exec,system => dl,passthru,proc_open,proc_close,shell_exec,system
This means you now have on bit of security against exploits
Finding your forgotten wordpress admin email
Today I needed to reset the main admin password for a wordpress blog however realised that the admin email address wasn’t any of the normal. So a quick dig and I came up with this simple approach;
Login via shell and run just run
<br /> echo "select user_email from wp_users where id=1;" | mysql database_for_wordpress<br />
and it will just pop out the email. Simple eh?
Quick MySQL tip
A real quick tip to restore mysql from a sql backup
<br /> # cd /var/lib/mysql<br /> # cp -rp dname dbname.old<br /> # mysql
At the mysql prompt
mysql> drop database dbname;
mysql> create database dname;
mysql> exit;
# mysql dname < /path/to/filename/sql<br />
Quick and effective
Differnet types of hosting
This is a little article to help to explain to people what differnet types of hosting there are and the advtanges/disadvantages to each. It should be able to help you to find out what best suits your needs.
Hosting is split up into 4 basic catagories which will cover 99% of internet users. The remaining 1% will already know what they need as they will be enterprise customers. You will normally find mentioned 4 differnet types of hosting and these are generally classified as
- Shared - Basic single website hosting
- Reseller - The ability to sell shared hosting packages from you own control panel
- VPS / VDS - Virtual private server. A cross between reseller and dedicated
- Dedicated - A physical machine just allocated to you only
Shared Hosting
Shared hosting is generally the first step people take when wanting to setup a website for themesleves. Most shared hosting comes with minimal amounts of disk space and bandwith but these are normally enough for single websites. When you sign up for a shared hosting package (also sometimes called virtual hosting) you will normally be allowed a low number of domain names that you can host on one account (say less than 5) and you may also get a free domain name registered.
The shared hosting is ideal for people starting out as they don’t have to worry about looking after hardware or anything based on the software and just have to upload their websites. Email and databases are normally configured from a web-based interface that the hosting company provides and they will also provide support should you need help in setting up the site or anything related to it.
The downside of shared hosting is that you don’t get any control over the version of software installed and for some people this cna be an issue if they have a program that requires certain versions. Also on shared hosting you have to be considerate of how much CPU power, disk space and bandwidth you are using as hosts don’t generally allow you to use more than a small percentage of the overall system power as it can effect other users and slow down their websites.
If they do find that your site is taking more than its fair share of power or disk space then they might ask you to upgrade to a higher package. Also its advisable to avoid hosts that offer unlimited disk space and bandwidth as they will normally overcommit / oversell the space they offer.
As a side not overselling means that if they have 100 units of storage and they each sell each customers 50 units of storage that if they have 3 customers they will have sold 150 units of storage but only have 100 units on the server. They can do this however as most users will only use 1-2 units of storage and not the full amount they have been given. If they do find that a user is using a large amount of this and they are doing large amounts of overselling they may delete the site. This is something to watch out for.
Reseller Hosting
Reseller hosting is a step up from shared webhosting and its useful if you want to start you own basic webhosting company or if you want to have multiple sites with multiple logins for security reasons. With reseller hosting you get a control panel which is similar to your normal shared hosting package but it has the ability to create accounts to you own choosing.
With reseller hosting some hosts allow you to oversell the space you are given which can help you get the most profit out of the webspace you sell but if not done carefully you can cause issues by not having enough space and being foreced to buy more at a higher cost than your profits allow.
Reseller hosting is good in that it generaly allows you to use a bit more system resoucres than shared hosting does as there are less resellers per box but like shared hosting you are locked into the version of software that the host provides to you.
With reseller hosting you are also resonsible for the content of websites that you sell so it can be that if one of your clients sends out a large amount of spam or hosts an offesnive website they might shut down all your customers until its resolved. You should keep an eye out for abuse reports from your host so that the chances of this are minimal. You should also do research on any hosts tha you use to see what their support and response is like.
Overall reseller hosting can be a good way to get into the hosting business without spending to much on a monthly basis. You might also find some hosts that offer free billing software like ClientEXEC that means you can offeset some further costs and bill your clients using the “free” software.
VPS
VPS is a step between reseller and dedicated hosting. A relativly new idea VPS (virtual private server) hosting gives you full adminstrator (or root) access to a partition of a physical machine so you can install which ever programs you want on your section of the server. This gives you large amounts of cuntionality and you can customise your offerings to suit your client base. Also you get a higer share of hardware which means that you can run websites that require more processing power
Like a reseller account you can also sell space off but as you have full adminstrator access you can also create reseller accounts of your own and sell these off to end customers. Some VPS software also allows you to do backup and restores of the entire server or reinstall it form scratch if needed. This can be helpful if you are devloping software and want a clean test bed.
However with great power comes great responsibility in that you are normally responsible for the security of the server so you have to make sure that all the programs and scripts users have installed are secure and the latest versions. This can take time and unless you are very comfertable on the operating system you are running it would be advisable to get a managed server when the host will help look after the verison installed however you would still have some responsibiltiy to act upon any complaints
Dedicated
A dedicated server is an upgrade to a VPS where you get all the hardware dedicated to you and can install whichever operating system you want. Again like a VPs however you ahve a lot of responsibility of looking after what users have installed. Also you have to monitor hardware as if a disk should fail you will have to rely on you rown backups.
C-Panel/WHM - Basic cPanel/WHM Setup - Explanations
Sometimes C-Panel/WHM can be a bit cryptic in what settings actually do what. Below I’ve attempted to make things a bit simpler to understand for people who are new to WHM. All the following settings are found in WHM Under “Basic cPanel/WHM Setup”
Main Shared Virtual Host IP - This is the main IP all your website will point to. Normally you can use the main IP of your server that has been issued to you by your host. By default it should be set to this already. You can of course change it if you wish to.
Server Contact E-Mail Address - An email address that reports and warning about the server are sent to. It can make sence to have this as an offsite email address such as something @gmail.com so you can access it even if the server goes down.
Server Contact Pager Address - Another email address that can be used to send short messages to. This is for warnings only and not the full report the main admin email address gets.
Default cPanel Theme - The theme (skin) that people will get by default when you setup account. x2 is a good choice here.
Alternate Main Ethernet Device - Most users can ignore this. If however the IP which is licensed is not eth0 you can override it hear and put the correct interface.
Default Home Directory - The location on the disk under which users home directories will be created. Normally /home and this is safe to leave. Also should you ever add another disk and mount it under /home2 then C-Panel will automatically start using it for storing new user data.
Home Directory Prefix - Set this similar to the previous entry but most users will leave it as home
Hostname - The name of your servre and is normally set to somethign like server.domain.com
Apache Access Log Style - Do you want to log all the info such as the refer and type of browser (combined) or just the IP’s and parts of the website visited (access). This effects the level of reports in the webstats.
Minimum UID - Within UNIX each user is given a numeric ID that relates to their username. Leave it blank unless you know what you are doing.
Primary Nameserver - This is the first DNS server that will be used when creating new accounts. This is normally ns1.yourdomain.com
Secondary Nameserver - This the second DNS server that will be used when creating accounts. This is normally similar to ns2.yourdomain.com
Tertiary Nameserver - This the third DNS server that will be used when creating accounts. This is normally similar to ns3.yourdomain.com
CGI Script Alias - This is to automatically create a link to cgi-bin. Best to set it to yes
ns4 - This is the 4th DNs serve ryou might use when setting up new accounts. Leave blank if there isn’t one.
AIM Password - If you want the server to send you a emssage via AIM put in the password for the AIM accounts here
AIM Username - For the messages from the server put in the username of the AIM nickname you want the server to have
The username that this server should use for login to AIM when sending alerts. You can register a new aim name: here.
Server Contact AIM - This is your AIM name that you want the server to message if there is something going on
Server Contact ICQ - If you want the server to contact you via ICQ this will be the number it contacts. This should be your nick name ICQ Password - The password the the account the server will be issued. Not the password for your account
ICQ ID - The ICQ number you will give to the server.
Master Nameserver - If you are using old style DNS clustering put the IP address of the main DNS cluster server here. If you aren’t using DNS clustering (and you will know if you are) then you can ignore this
Master Cluster Server - If you are using the new style clustering put the main IP here otherwise leave it blank.
Really handy guide: Ways to speed up XP
Collection of really handy guide for optimisng XP
10 Simple Ways To Speed Up Windows XP 10 Intermediate Way to Speed UP XP More ways to speed
Google Pack fails to impress - ZDNet UK News - or does it?
Google Pack fails to impress - ZDNet UK News
People are saying that Google Pack is a 1/2 hearted attempt and bundelign some software with an installer around it and in its current state I would tend to agree. You get some good and not so good software with an automatic updater that checks the versions that is installed.
Now for me I think its this automatic update that is important and this is a testing of something bigger to come. Imagine what would happen if Google extended the updater to include more software that you could download and install at the click of the button, basically a sentralised software house similar to apt-get on Debian.
Now Microsoft’s Windows Update looks after the installed core system so that when an update is available it will tell you and go off and get it. However if you look at your desktop how many programs are installed that don’t have automatic updaters. You package might be say 3-4 version behind and some people always want the latest (and maybe greatest installed) and there isn’t anything like this for 3rd party apps.
I can really see Google taking the idea of the auto-update and pushing it as a companion to Windows update so they can start to get a foot hold on the actual desktop. By giving a centralised place for one click software installation and automatic security updates you get yourself in a very powerful position.
Prehaps this is again one of those things that Google is good at. Something simple but very very effective
Renewing your control panel license
If you find that you are getting a “license expiered” messages from your control panel it could be that you need to manually renew it. So here is a quick howto on checking and renewing your license for some popular web hosting control panels.
C-Panel | DirectAdmin | Plesk
C-Panel (website)
To check if your license is valid find your main IP on the server ( the one your host should of given you when you signup ) and goto verify.cpanel.net. Place your IP in box and click “Check”. This will tell you if your license is valid.
If so then open a root ssh session to your machine and run /usr/local/cpanel/cpkeyclt
You should get something similar to <br /> [/]# /usr/local/cpanel/cpkeyclt<br /> Updating Internal cPanel Information.....Done<br /> You should now be able to login without issue
DirectAdmin (website)
If you are having trouble logging into DirectAdmin check /var/log/directadmin/error.log to see if there are logged messaages about your license being expiered. If so you can renew it via the following commands <br /> cd /usr/local/directadmin/scripts<br /> source setup.txt # Ignore any errors here<br /> ./getLicense.sh $uid $lid<br /> /etc/init.d/directadmin restart<br /> The download from should be 1,298 bytes which is the correct license size. If its 46 bytes then contact your host for further support as they might need to tell you your UID (user ID) and LID (license ID)
Plesk (website)
By default should there be a license problem on Plesk it will still allow you to login as it has a default setting of allow 1 Domain and 1 Email address. To force a license reload however you need to login to Plesk at with the admin user.
Click Server / License Managment / Retrieve Keys.
This will force a reload of the license and you should be able to use Plesk again
Mounting remote UNIX servers over SSH into Windows
Firstly a bit of background. If you are running a Windows box sometime you want to connect to a remote UNIX box and access files on it. Traditionally you would setup laptop batteries which allows you to access a remote UNIX server as a filesystem.
Whilst this in itself is good there are a few things to bear in mind when using this
Pros
- Quick and Easy to setup.
- All traffic is encrypted point to point via SSH
- Fast as your internet connection is
Cons
- No user level authentication. You access everything on nother
- Everything is done client side. Its not possible for a server admin to monitor as easily
- It costs money. Its not free but it is worth it
So with that in mind if you want to install and use SFTPDrive this is what you have to do.
Goto the website to get your trial license key. Once you have that select “Download SFTPDrive Now”. You will get your normal download box so save the file and execute it.
The setup program is a simple affair and you can just select the defaults as needed.
Once installed click on Start / SFTPDrive / SFTPDrive.
You will see a small magnet icon appear in the system tray. If you select that you get the “SFTPDrive Manager”. Click on New session and fill out the defailts
Session Name : How you want to refer to this session Server : The Full DNS name or IP of the remote Server Port : The port SSH runs on (normally 22) Username : Your normal ssh username Password : Your normal SSH password
If you want it to remeber the password and not prompt you then just click save.
Leave the Autentication as “Use password to login”. Set Directory to whatever you want to use as appropiate. Drive Letter: This is your local mapping.
If you want to keep these settings make sure “Save Session” is set.
Once done click “Connect”
If you now open “My Computer” you should see the new drive mapping. You can now access this like any normal disk drive, albit a bit slower than normal depending on your network connection
Installing C-Panel on a new box
Should you ever need to reinstall C-Panel here is a quick guide of how to install on a brand new servers (taking in some cavates that might crop up)
In the ideal world you should be able to run
laptop battery
However if you find that doesn’t work then the following “fix all” recipe might help. You can ignore things after the # but if you do copy and paste it will still work
<br /> /sbin/iptables -F # Remove all your firewall rules<br /> /etc/init.d/xinetd stop # Xinetd can sometimes listen on port 2087 stopping WHM https working<br /> echo nameserver 127.0.0.1 > /etc/resolv.conf # Fix your DNS server if its not resolving<br /> chmod a+r /etc/rndc.key # Make sure named will start<br /> /etc/init.d/named restart # Start up named (the DNS Server)<br /> cd /root<br /> wget http://layer1.cpanel.net/latest<br /> sh latest<br />
If you now wait about an hour you should see C-Panel fully install itself and then you are ready to login and configure WHM at Login with your root username/password