Command Center

This has worked for me numerous times without anything breaking or failing to operate. Obviously, I’m not responsible for whether you try this or not. A healthy and current backup is always a good idea before diving into the world of re-compiling software packages.

What is MCrypt?

MCrypt is a replacement for the old crypt() package and crypt(1) command, with extensions. It allows developers to use a wide range of encryption functions, without making drastic changes to their code. It allows users to encrypt files or data streams without having to be cryptographers. Above all, it allows you to have some really neat code on your machine.

Site Source: http://mcrypt.sourceforge.net/

Mcrypt is a powerful encryption library containing 22 block algorithms. Specifically, the following algorithms are supported:

Simple steps: follow these steps to compile Mcrypt and build the extension into your PHP distribution:

However, complex and complete steps are given below:

FYI – My machine stats are:

Cent OS 5.0

Apache 2.0

PHP 5.0

Ready? Here’s how you do it.

As root:

1) Install libmcrypt (2.5.x or better) http://mcrypt.hellug.gr/lib/index.html

-download and uncompress: tar z -xvf xxx.tar.gz

-cd into libmcrypt dir and type: ./configure

-when configure is done type: make

-when make is done type: make install

2) Add the library dir to /etc/ld.so.conf

-edit /etc/ld.so.conf and add: /usr/local/lib

-save file and then type the command: ldconfig

3) Update/Install Mhash (0.8.15 or newer) http://mhash.sourceforge.net/

-download and uncompress: tar z -xvf xxx.tar.gz

-cd into libmcrypt dir and type: ./configure

-when configure is done type: make

-when make is done type: make install

-when make install is done type: ldconfig

4) Install latest version of mcrypt (2.6.x or better) http://mcrypt.hellug.gr/mcrypt/index.html

-download and uncompress: tar z -xvf xxx.tar.gz

-cd into mcrypt dir and type: ./configure

-when configure is done type: make

-when make is done type: make install

-when make install is done type: ldconfig

5) Take note of your current php info

-create a file somewhere on your webserver called phpinfo.php

-edit the file and add the single line:

-make sure a normal user owns the file (not root – ie: chown user.user phpinfo.php)

-issue the command: chmod 755 phpinfo.php

-open the file in a web browser ie: www.yourserver.com/phpinfo.php

-copy the contents of “Configure Command” to a text file somewhere.

-It will look something like this (probably all on 1 line – leave it on 1 line):

‘./configure’ ‘–with-apxs=/usr/local/apache/bin/apxs’ ‘–with-xml’ ‘–enable-bcmath’

‘–enable-calendar’ ‘–enable-ftp’ ‘–enable-magic-quotes’ ‘–with-mysql’ ‘–with-pear’

‘–enable-sockets’ ‘–enable-track-vars’ ‘–enable-versioning’ ‘–with-zlib’

-edit the command to remove all the ‘ ‘ marks so it looks like this:

./configure –with-apxs=/usr/local/apache/bin/apxs –with-xml –enable-bcmath –enable-calendar

–enable-ftp –enable-magic-quotes –with-mysql –with-pear –enable-sockets –enable-track-vars

–enable-versioning –with-zlib

-at the end, add the following (assuming mcrypt is actually found in /usr/local/bin/mcrypt):

–with-mcrypt=/usr/local/bin/mcrypt

-save the text file.

6) Go into your php source directory: /home/cpapachebuild/buildapache/php-4.3.1/

-type: make clean

-type: rm config.cache (yes, remove that file)

-issue your command you saved in the text file. Something like this:

./configure –with-apxs=/usr/local/apache/bin/apxs –with-xml –enable-bcmath –enable-calendar

–enable-ftp –enable-magic-quotes –with-mysql –with-pear –enable-sockets –enable-track-vars

–enable-versioning –with-zlib –with-mcrypt=/usr/local/bin/mcrypt

-when that is done, type: make

-when that is done, type: make test (most tests will fail… about 50%-60% or so)

-when that is done, type make install

or

enable support for php. requires php-mcrypt and php-mhash packages:

7) Restart Apache

-issue the command: service httpd restart

-go back to your phpinfo.php page and check to see that –with-mcrypt now shows up in the “Configure Command”

Question:

I am trying to have mcrypt support in php. I installed libmcrypt and mhash using yum. They installed okay, but they weren’t added to phpinfo(), so they do not work.

Reading mcrypt info it says I need to recompile php.

Answer: It is working!

While I was requiring to recompile php according to the information on the mcrypt package to enable mcrypt support. I found an alternative.

There are 2 solutions to this problem:

A) This is the painless way to do it.

After a lot of research, as I couldn’t find answers on forums and other places. I found on sourceforge.net they released some rpm packages to integrate mcrypt and mhash with php.

First we need to install mcrypt and mhash as follows:

1) Install mcrypt & mhash

answer y to the question if matched your system (it should).

If it comes out

Manually install from the source after compiling as indicated from the start or the post.

2) enable support for php. requires php-mcrypt and php-mhash packages:

If you get an error saying packages not signed (unsigned packages), do the following:

edit /etc/yum.conf

change:

gpgcheck=1 to gpgcheck=0

This is my post about the steps which I used to update the versions of PHP and MySQL on RHEL 5.3. As of this writing the latest versions of PHP is 5.2.9 and that of MySQL server is 5.1.32-1. The installation of RHEL5 (after making updates) had versions of PHP/MySQL which were as much as 2.5 years old. You obviously don’t want so old versions of the software for security reasons. So I decided to upgrade versions of PHP/MySQL on the system. Obviously the default repository of RHEL does not have the updated versions of PHP and MySQL (and many other softwares I believe).

I searched online for making the upgrades and after a long search, I came across links on the web which helped me perform the upgrades. So, I decided to write a detailed post about my upgrade process so it could be helpful to others.

The packet management tool which I’m using is yum. So its a good idea to know few basic yum commands:

yum list available

yum list installed

yum list updates

yum install [package]

yum remove [package]

I guess all of above commands are self explanatory.

Since the repositories which are used by RHEL are not up to date, so we need to use and setup some other repository. One of the most popular and the one which I used is Remi’s repository which has latest packages for most of the software:

http://rpms.famillecollet.com/index.html

This repository is not there in the repository directory

/etc/yum.repos.d

yet so we need to enable it in order to use it. To do that we need to download some additional RPMs and install them first. The 2 RPMs which we need are:

epel-release and remi-release

My architecture is i386 so if yours is x86_64 then get the RPMs for it accordingly.

We can get the first one from here:

http://download.fedora.redhat.com/pub/epel/5/i386/epel-release-5-3.noarch.rpm

using:

wget http://download.fedora.redhat.com/pub/epel/5/i386/epel-release-5-3.noarch.rpm

rpm -Uvh epel-release-5-3.noarch.rpm

Download the 2nd one from Remi’s site:

http://rpms.famillecollet.com/enterprise/remi-release-5.rpm

using:

wget http://rpms.famillecollet.com/enterprise/remi-release-5.rpm

rpm -Uvh remi-release-5.rpm

2nd package is dependent on first one so we need to install 1st before the 2nd.

Now, I removed the older packages first (not sure if this was needed though) by using:

yum list installed

and looking for those packages which started with php or mysql. That also included php packages dependent on mysql and vice-versa. Remove them using:

yum remove [package]

IMPORTANT: I didn’t mention it here but if you have any data present (especially MySQL database) then please make sure that you back them up first before removing packages as that may result in loss of data also. I didn’t have any data when I started so I didn’t mention it before.

The steps will now create corresponding information for Remi’s repository in:

/etc/yum.repos.d/

So, now we have the older packages removed and need to install the new ones. Before that we need to enable Remi’s repository. For that goto file called remi.repo in the repo directory and under the section [remi] there, change enabled = 0 to enabled = 1.

After doing this, run the following command:

yum install php

Now, run:

php -v

and you should get something like this:

PHP 5.2.9 (cli) (built: Feb 27 2009 14:42:58)

Copyright (c) 1997-2009 The PHP Group

Zend Engine v2.2.0, Copyright (c) 1998-2009 Zend Technologies



as the output.

Now, run the following commands:

yum install mysql-server

yum install php-mysql

yum install mysql-devel

and it should install MySQL server and PHP-MySQL module along with necessary dependencies.

Now, you can check your working of PHP and MySQL server by starting httpd and mysql services and may be writing a phpinfo() file:

/sbin/service httpd start

/sbin/service mysqld start

So the PHP and MySQL should be working now. I have not yet done any configuration of any of those and its likely that I’ll run into some problems there and so may be I’ll make another post about it.

Some of the links which were useful to me and from where I used information for the installation process:

https://forums.misdivision.com/showthread.php?t=1285

http://timt881.wordpress.com/2009/02/17/installing-phpmyadmin-and-php-52-on-a-centos-52-server/

http://forum.parallels.com/showthread.php?t=86086

Since this thing worked for me for RHEL 5.3 so I believe it should work for CentOS as well.

REFERENCE

http://binit933x.wordpress.com/2009/03/05/how-i-updated-php-mysql-on-redhat-enterprise-linux-rhel-53/

This guide assumes you have a minimal CentOS installation and are not planning on running a control panel such as cPanel, which install the webserver for you. Some of the software versions listed below may need to be changed as they are updated. As of the writing of this article, Apache 2.2.14 and PHP 5.2.11 are the latest versions.

# yum install bison flex gcc db4 db4-devel libxml2-devel libpng-devel mysql-devel make
# wget http://www.apache.org/dist/httpd/httpd-2.2.14.tar.gz
# wget http://us3.php.net/get/php-5.2.11.tar.gz/from/us2.php.net/mirror
# tar zxvf httpd-2.2.14.tar.gz
# tar zxvf php-5.2.11.tar.gz
# cd httpd-2.2.14
# ./configure --enable-so --enable-rewrite=shared
# make
# make install
# cd ../php-5.2.11
# ./configure --with-apxs2=/usr/local/apache2/bin/apxs --with-mysql --enable-bcmath --enable-ftp --enable-magic-quotes --with-pear --enable-sockets --enable-track-vars --with-zlib --with-gd --with-freetype
# make
# make install
# cp php.ini-dist /usr/local/lib/php.ini

You can change the values passed to the configure lines of Apache and PHP to add/remove software from the build. Apache in this guide is built with DSO support and mod_rewrite as a shared module. PHP is built as an Apache DSO with MySQL, FTP, BCMath, magic quotes, PEAR, sockets, Zlib, and GD with TTF.

Finally, edit your Apache config:

# vi /usr/local/apache2/conf/httpd.conf

Add AddHandler application/x-httpd-php .php .phtml .php4 to a blank like. Now start Apache using /usr/local/apache2/bin/apachectl start.

Thats it, you're good to go! You may want to tweak your Apach configuration to suit your specific needs including adding Virtualhosts, however that is outside the scope of this article. Please refer to the Apache Docs for that information.

REFERENCE

http://www.networkdatacenterhost.com/wiki/server-administration/install-apache-php-on-centos

This is not causing the webserver slowness, or any crashes. Nor is it a kernel bug! What happens is that a client tries to shrink the TCP window. This would not be catastrophic anyway, BUT your kernel ignores/prevents this, so it should have absolutely no effect. That's why it says "Repaired." at the end.

It could be a broken router or broken/old OS on a hacked machine that is used for portscanning. It's not an attack because it does nothing, even if the kernel didn't prevent this all it would do is slow down the speed at which the server sends out data on that particular connection. Slow send can cause more overall Apache processes, but if you only see this a couple of times it's probably not an attack. Anyways, in 2007 nobody should use the preforking Apache MPM.

===============================================

Well, unfortunately we have recently had much experience related to DDOS attacks. However, DeveloWare LLC can now offer DoS and DDoS security prevention along with our hosting services. So here is a summary of what we have learned through the process…

What is a DDoS attack?

DoS and DDoS attacks flood a Web server with false requests for information, overwhelming the system and ultimately crashing it. The following graphics explain how such attacks work and how companies can possibly prevent them. In effect the server can not handle all the requests, no matter how big and bad your server is. The nature of the attack is quite simple but has complex results on the machine being affected.

How a "denial of service" attack works

In a typical connection, the user sends a message asking the server to authenticate it. The server returns the authentication approval to the user. The user acknowledges this approval and then is allowed onto the server.

In a denial of service attack, the user sends several authentication requests to the server, filling it up. All requests have false return addresses, so the server can't find the user when it tries to send the authentication approval. The server waits, sometimes more than a minute, before closing the connection. When it does close the connection, the attacker sends a new batch of forged requests, and the process begins again–tying up the service indefinitely.

Typical connection



 

DoS & DDoS attacks



 

How to block a "denial of service" attack

One of the more common methods of blocking a "denial of service" attack is to set up a filter, or "sniffer," on a network upstream. This means before a stream of information even reaches a site's Web servers. The filter can look for attacks by noticing patterns or identifiers contained in the information. It requires hardware for filtering. If a pattern comes in frequently, the filter can be instructed to block messages containing that pattern, protecting the Web servers from having their lines tied up.

DDoS attacks can happen to anybody!

As a webmaster or admin for any site, never ever think you are exempt from being attacked.  It can happen to anybody. Last month alone there was over 50,000 reported attacks. The attacks were directed towards major sites and small ones without regard. Twitter was taken down from such attacks just a couple weeks ago. Then the same malicious group targeted Google and Facebook.  Less than two years ago the department of defense was attacked and completely taken down. If they can take down Google, Twitter, and the US Gov they can most likely take down your site also.

Protect Your Website

To protect your site you must have hardware that can defend your servers. The problem is that it is expensive. If you find your site is being attacked and you host with one of those $5/month accounts at some cheap hosting company you will find that they will just shut down your site in the interest of protecting the other sites on there servers. You will be just flat out of luck. Make sure your hosting has the routers and firewalls in place to handle these vicious attacks.  Ask specifically about DDoS prevention before you purchase hosting if you want protection. Normal firewalls and routers WONT STOP THE ATTACKS.

Take if from me. We had a virtual server completely upgraded and screaming fast with the highest security you can imagine. But the nature of a DDoS attack does not even send up a red flag to most security prevention systems. You will most likely only notice when your site goes down or your hosting provider cuts you off. Not good at all because it is too late then!

The nature of an attack

What makes these kind of attacks almost impossible to handle without the proper hardware is that you can not just start blocking IP addresses. Because of a couple reasons. First, most of the time the IP doing the request is a real IP but most likely an IP that is not malicious. Usually the IP has been spoofed. Therefore, if you add an offending IP to your block list you may be blocking a true source of visitors. Second, the request is not what actually kills your http server. What kills the server is an incomplete "handshake". 

To explain the 3 way server handshake lets elaborate a little…

To establish a connection, TCP uses a three-way handshake. Before a client attempts to connect with a server, the server must first bind to a port to open it up for connections: this is called a passive open. Once the passive open is established, a client may initiate an active open. To establish a connection, the three-way (or 3-step) handshake occurs:

1. The active open is performed by sending a SYN to the server.

2. In response, the server replies with a SYN-ACK.

3. Finally the client sends an ACK (usually called SYN-ACK-ACK) back to the server.

In a DDoS attack its more like a 2 way handshake. This leaves your server hanging and waiting for the third response. What this does is flood your http server with incomplete requests. Most servers have a 30 second time out and a maxim number of connections around 300 or so. Hence, your server is doomed without protection.

DDoS attack symptoms and info

DDoS attacks generally WILL NOT eat up your bandwidth because the handshake never got completed. It just increases server load to the point of being rendered useless. Nothing ever gets sent to the requesting host so there is not usually a bandwidth issue.

DDoS attacks are basically impossible to track unless you have tons of resources. Like on a government level. One of the difficulties in tracking is because the offending IP's are usually spoofed and do not exist or are valid IP's that are non offending.

Blocking IP's wont help with a DDoS attack. You must have the proper hardware to defend against DDoS attacks. If somebody know software to hand attacks please let me and the world know about it.

Who is doing such malicious attacking?

To put it bluntly there are many groups of attackers out there. Some are religious based and some are politically based. But the most notorious ones are simply groups of hackers that get paid to take down sites. They get paid between $100 and $500 per 1000 http requests. There are actually bots for hire out there… SHeeesh! I think they should be hung upside down and have there toe nails pulled out.

Conclusions about DDoS attacks

Get a hosting company that has the hardware to handle these attacks. Firewalls and fast servers just wont help. As a result of the recent attacks on DeveloWare.com and the companies that host through us we have upgraded our equipment to handle this. We can now provide protection against DDoS attacks.

REFERENCE

http://www.develoware.com/newsposts/ddos-attacks-and-how-to-handle-them/351.php

$cfg['LoginCookieValidity'] = 3600 * 9; // 9 hours

<code>/* Authentication type */
$cfg['Servers'][$i]['auth_type'] = 'config';
$cfg['Servers'][$i]['host'] = 'localhost';
$cfg['Servers'][$i]['user'] = 'root'; 
$cfg['Servers'][$i]['password'] = 'your-root-pwd';
</code>

There are various methods of find the path of the
current file in PHP. But the problem is to find one that is consistent
across all servers. The following is a list of the most commonly used
methods to find the location of the current file. The definitions are
taken from the PHP manual(Predefined
Variables) and are modified slightly.

$_SERVER['PHP_SELF']

The filename of the
currently executing script, relative to the document root. For
instance, $_SERVER['PHP_SELF'] in a script at the address
http://example.com/test.php/foo.bar would be /test.php/foo.bar. The __FILE__
constant contains the full path and filename of the current (i.e.
included) file.

If PHP is running as a command-line processor this variable contains
the script name since PHP 4.3.0. Previously it was not available.

$_SERVER['QUERY_STRING']

The
query string, if any, via which the page was accessed.

$_SERVER['SCRIPT_FILENAME']

The
absolute pathname of the currently executing script.

Note: If a script is executed with the CLI, as a relative path, such
as file.php or ../file.php, $_SERVER['SCRIPT_FILENAME']
will contain the relative path specified by the user.

$_SERVER['PATH_TRANSLATED']

Filesystem-
(not document root-) based path to the current script, after
the server has done any virtual-to-real mapping.

Note: As of PHP 4.3.2, PATH_TRANSLATED is no longer set implicitly
under the Apache 2 SAPI in contrast to the situation in Apache 1, where
it's set to the same value as the SCRIPT_FILENAME server
variable when it's not populated by Apache. This change was made to
comply with the CGI specification that PATH_TRANSLATED
should only exist if PATH_INFO is defined.

Apache 2 users may use AcceptPathInfo = On inside httpd.conf to
define PATH_INFO.

$_SERVER['SCRIPT_NAME']

Contains
the current script's path. This is useful for pages which need to point
to themselves. The __FILE__ constant contains the full path and
filename of the current (i.e. included) file.

$_SERVER['REQUEST_URI']

The
URI used to access this page; for instance,
'/index.html'. Includes the query string.

__FILE__

The
full path and filename of the file. If used inside an
include, the name of the included file is returned. Since PHP 4.0.2, __FILE__
always contains an absolute path whereas in older versions it contained
relative path under some circumstances.

If you have access to a server that is not in the above list, please
the below code to generate the results and send the result to me - I
will include it here.

<code>
<b>REFERENCE</b>
<a href="http://www.bin-co.com/php/articles/current_file_path.php">http://www.bin-co.com/php/articles/current_file_path.php</a>
</code>