Showing posts with label cPanel. Show all posts
Showing posts with label cPanel. Show all posts

Friday, June 17, 2011

How to protect/secure php.ini with SuPHP?

SkyHi @ Friday, June 17, 2011
When Apache is compiled as CGI/SuPHP, it allows users to create their own php.ini file under their home directory and modify the php values as per their wish. This may increase security concerns on the server and hence to protect/secure php.ini in SuPHP enabled servers, force every user to use a common php.ini file.

This can be achieved by defining the path of php.ini using suPHP_ConfigPath. To force users to use existing server side php.ini file, create suphp_configpath.conf

# pico /usr/local/apache/conf/userdata/suphp_configpath.conf

and add the following lines

#just specify the path to the php.ini file directory


suPHP_ConfigPath /usr/local/lib/



Once done, save the file and rebuild the Apache configuration so it picks up the changes.

# /usr/local/cpanel/bin/apache_conf_distiller –update –main
# /usr/local/cpanel/bin/build_apache_conf

To verify the include files, execute:

/scripts/verify_vhost_includes

It will display the path to the .conf file you created. Restart the Apache service once

/scripts/restartsrv httpd

This will ensure all the users use the server side php configuration file. If you wish to keep the php.ini elsewhere, just change the value of “suPHP_ConfigPath” and follow the above steps.

REFERENCES
http://linuxhostingsupport.net/blog/tag/what-is-suphp_configpath

Tuesday, September 7, 2010

cPanel A Beginner's Guide to Securing Your Server

SkyHi @ Tuesday, September 07, 2010
A Beginner's Guide to Securing Your Server Part 1 of 3 (Security Inside WHM/CPanel)

These are items inside of WHM/Cpanel that should be changed to secure your server.

Goto Server Setup =>> Tweak Settings

Check the following items...

Under Domains

Prevent users from parking/adding on common internet domains. (ie hotmail.com, aol.com)


Under Mail

Attempt to prevent pop3 connection floods

Default catch-all/default address behavior for new accounts - blackhole


Under System

Use jailshell as the default shell for all new accounts and modified accounts


Goto Server Setup =>> Tweak Security

Enable php open_basedir Protection

Enable mod_userdir Protection

Disabled Compilers for unprivileged users.


Goto Server Setup =>> Manage Wheel Group Users

Remove all users except for root and your main account from the wheel group.


Goto Server Setup =>> Shell Fork Bomb Protection

Enable Shell Fork Bomb/Memory Protection


When setting up Feature Limits for resellers in Resellers =>> Reseller Center, under Privileges always disable Allow Creation of Packages with Shell Access and enable Never allow creation of accounts with shell access; under Root Access disable All Features.


Goto Service Configuration =>> FTP Configuration

Disable Anonymous FTP

Goto Account Functions =>> Manage Shell Access

Disable Shell Access for all users (except yourself)


Goto Mysql =>> MySQL Root Password

Change root password for MySQL


Goto Security and run Quick Security Scan and Scan for Trojan Horses often. The following and similar items are not Trojans:

/sbin/depmod
/sbin/insmod
/sbin/insmod.static
/sbin/modinfo
/sbin/modprobe
/sbin/rmmod

These are measures that can be taken to secure your server, with SSH access.


Udate OS, Apache and CPanel to the latest stable versions.

This can be done from WHM/CPanel.



Restrict SSH Access


To restrict and secure SSH access, bind sshd to a single IP that is different than the main IP to the server, and on a different port than port 22.


SSH into server and login as root.

Note: You can download Putty by Clicking Here. It's a clean running application that will not require installation on Windows-boxes.


At command prompt type: pico /etc/ssh/sshd_config

Scroll down to the section of the file that looks like this:


Code:
#Port 22
#Protocol 2, 1
#ListenAddress 0.0.0.0
#ListenAddress ::

Uncomment and change

#Port 22

to look like

Port 5678 (choose your own 4 to 5 digit port number (49151 is the highest port number)


Uncomment and change

#Protocol 2, 1

to look like

Protocol 2


Uncomment and change

#ListenAddress 0.0.0.0

to look like

ListenAddress 123.123.123.15 (use one of your own IP Addresses that has been assigned to your server)


Note 1: If you would like to disable direct Root Login, scroll down until you find

#PermitRootLogin yes

and uncomment it and make it look like

PermitRootLogin no

Save by pressing Ctrl o on your keyboard, and then exit by pressing Ctrl x on your keyboard.


Note 2: You can also create a custome nameserver specifically for your new SSH IP address. Just create one called something like ssh.xyz.com or whatever. Be sure to add an A address to your zone file for the new nameserver.


Now restart SSH

At command prompt type: [B]/etc/rc.d/init.d/sshd restart[B]


Exit out of SSH, and then re-login to SSH using the new IP or nameserver, and the new port.


Note: If you should have any problems, just Telnet into your server, fix the problem, then SSH in again. Telnet is a very unsecure protocol, so change your root password after you use it.




Disable Telnet

To disable telnet, SSH into server and login as root.

At command prompt type: pico -w /etc/xinetd.d/telnet

change disable = no to disable = yes

Save and Exit

At command prompt type: /etc/init.d/xinetd restart




Server e-mail everytime someone logs in as root

To have the server e-mail you everytime someone logs in as root, SSH into server and login as root.

At command prompt type: pico .bash_profile

Scroll down to the end of the file and add the following line:

echo 'ALERT - Root Shell Access on:' `date` `who` | mail -s "Alert: Root Access from `who | awk '{print $6}'`" your@email.com

Save and exit.




Set an SSH Legal Message

To an SSH legal message, SSH into server and login as root.

At command prompt type: pico /etc/motd

Enter your message, save and exit.

Note: I use the following message...

Code:
ALERT! You are entering a secured area! Your IP and login information
have been recorded. System administration has been notified.

This system is restricted to authorized access only. All activities on
this system are recorded and logged. Unauthorized access will be fully
investigated and reported to the appropriate law enforcement agencies.
Now everytime someone logs in as root, they will see this message... go ahead a try it.




Disable Shell Accounts

To disable any shell accounts hosted on your server SSH into server and login as root.

At command prompt type: locate shell.php

Also check for:

locate irc
locate eggdrop
locate bnc
locate BNC
locate ptlink
locate BitchX
locate guardservices
locate psyBNC
locate .rhosts



Note: There will be several listings that will be OS/CPanel related. Examples are

/home/cpapachebuild/buildapache/php-4.3.1/ext/ircg
/usr/local/cpanel/etc/sym/eggdrop.sym
/usr/local/cpanel/etc/sym/bnc.sym
/usr/local/cpanel/etc/sym/psyBNC.sym
/usr/local/cpanel/etc/sym/ptlink.sym
/usr/lib/libncurses.so
/usr/lib/libncurses.a
etc.




Disable identification output for Apache

To disable the version output for proftp, SSH into server and login as root.

At command prompt type: pico /etc/httpd/conf/httpd.conf


Scroll (way) down and change the following line to

ServerSignature Off


Restart Apache

At command prompt type: /etc/rc.d/init.d/httpd restart

These are applications that will help to secure your server.



Install chkrootkit

To install chrootkit, SSH into server and login as root.

At command prompt type: cd /root/

At command prompt type: wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz

At command prompt type: tar xvzf chkrootkit.tar.gz

At command prompt type: cd chkrootkit-0.44

At command prompt type: make sense


To run chkrootkit

At command prompt type: /root/chkrootkit-0.44/chkrootkit

Make sure you run it on a regular basis, perhaps including it in a cron job.




Install APF Firewall

To install APF, SSH into server and login as root.

At command prompt type: cd /root/

At command prompt type: wget http://www.rfxnetworks.com/downloads/apf-current.tar.gz

At command prompt type: tar -xvzf apf-current.tar.gz

At command prompt type: rm -f apf-current.tar.gz

At command prompt type: cd apf-0.9.4-6

At command prompt type: sh ./install.sh


After APF has been installed, you need to edit the configuration file.

At command prompt type: cd /etc/apf

At command prompt type: pico -w conf.apf


Scroll down and find

USE_DS="0"

change it to

USE_DS="1"


Now scroll down and configure the Ports. The following ports are required for CPanel:


Code:
Common ingress (inbound) TCP ports
IG_TCP_CPORTS="21,22,25,53,80,110,143,465,953,993,995,2082,2083,2084,2086,2087,2095,2096,3306,6666,7786,3000_3500"
Note: If you changed the port for SSH, be sure to include that port and remove port 22.

-----
21 FTP (TCP)
22 SSH (TCP)
25 SMTP (TCP)
53 DNS - Domain Name Server (TCP)
80 HTTP (TCP)
110 POP3 (TCP)
143 IMAP (TCP)
443 HTTPS (TCP)
465 sSMTP (TCP)
953 ??BIND??
993 IMAP4 protocol over TLS/SSL (TCP)
995 POP3 protocol over TLS/SSL (was spop3) (TCP)
2082 CPANEL (http://sitename.com:2082) (TCP)
2083 CPANEL SSL (https://sitename.com:2083) (TCP)
2084 entropychat server (disable from CPANEL service manager if not used) (TCP)
2086 WHM (http://sitename.com:2086) (TCP)
2087 WHM SSL (https://sitename.com:2087) (TCP)
2095 WebMail (http://sitename.com:2095) (TCP)
2096 WebMail SSL (https://sitename.com:2096)
3306 mySQL remote access (TCP)
6666 Melange chat Server (disable from CPANEL service manager if not used) (TCP)
7786 Interchange (TCP)
3000_3500
-----
5100 for ASP,
8080 and 8443 for JSP if you use them.
-----


Code:
Common ingress (inbound) UDP ports
IG_UDP_CPORTS="53,6277
-----
53 DNS - Domain Name Server
6277 SpamAssassin / DCC (email scanning)
-----


Code:
Common ICMP (inbound) types
IG_ICMP_TYPES="3,5,11,0,30,8"
-----
0 Echo Reply
3 Destination Unreachable
5 Destination Unreachable
8 Echo
11 Time Exceeded
30 Traceroute
-----


Code:
Common egress (outbound) TCP ports
EG_TCP_CPORTS="21,25,37,53,80,110,113,#123,443,43,873,953,2089,2703,3306"
-----
21 FTP
25 SMTP
37 Required for CPANEL Licensing
53 DNS - Domain Name Server
80 HTTP
110 POP3 (if you have scripts that need to retrieve email via POP, e.g. HelpDesk)
113 Authentication Protocol (AUTH)
123 NTP (Network Time)
443 HTTPS
43 WHOIS
873 rsync (CPanel updates)
953 BIND ??
2089 Required for CPANEL Licensing
2703 Razor (email scanning)
3306 mySQL remote access
-----


Code:
Common egress (outbound) UDP ports
EG_UDP_CPORTS="20,21,53,873,953,6277"
-----
20 ftp-data
21 FTP
53 DNS - Domain Name Server
873 rsync
953 BIND ??
6277 SpamAssassin / DCC (email scanning)
-----


Code:
Common ICMP (outbound) types
EG_ICMP_TYPES="all"


Save the changes then exit.


To start APF

At command prompt type: /usr/local/sbin/apf -s

APF commands are:

-s start
-r restart
-f flush - stop
-l list
-st status
-a HOST allow HOST
-d HOST deny HOST


Log out of SSH and then login again.


After you are sure everything is working fine, change the DEV option

At command prompt type: cd /etc/apf

At command prompt type: pico -w conf.apf


Scroll down and find

DEVM="1"

change it to

DEVM="0"


Save changes, exit and then restart firewall,

At command prompt type: /usr/local/sbin/apf -r




Install BFD (Brute Force Detection)

To install BFD, SSH into server and login as root.

At command prompt type: cd /root/

At command prompt type: wget http://www.rfxnetworks.com/downloads/bfd-current.tar.gz

At command prompt type: tar -xvzf bfd-current.tar.gz

At command prompt type: cd bfd-0.4

At command prompt type: ./install.sh


After BFD has been installed, you need to edit the configuration file.

At command prompt type: pico /usr/local/bfd/conf.bfd


Under Enable brute force hack attempt alerts:

Find

ALERT_USR="0"

and change it to

ALERT_USR="1"


Find

EMAIL_USR="root"

and change it to

EMAIL_USR="your@email.com"


Save the changes then exit.


To start BFD

At command prompt type: /usr/local/sbin/bfd -s




Modify LogWatch

Logwatch is a customizable log analysis system. It parses through your system's logs for a given period of time and creates a report analyzing areas that you specify, in as much detail as you require. Logwatch is already installed on most CPanel servers.


To modify LogWatch, SSH into server and login as root.

At command prompt type: pico -w /etc/log.d/conf/logwatch.conf


Scroll down to

MailTo = root

and change to

Mailto = your@email.com

Note: Set the e-mail address to an offsite account incase you get hacked.


Now scroll down to

Detail = Low

Change that to Medium, or High...

Detail = 5 or Detail = 10

Note: High will give you more detailed logs with all actions.


Save and exit.
REFERENCES
http://forums.cpanel.net/f185/beginners-guide-securing-your-server-30159.html

Wednesday, June 30, 2010

The attack of the inodes – how to find out your number

SkyHi @ Wednesday, June 30, 2010

“Inode” is a term used in Linux/UNIX file systems. Each file, directory, symlink… is represented by an inode which has a bunch of information on the file or directory (check out Understanding UNIX / Linux filesystem Inodes for more information). Computers running Linux have a maximum number of inodes allowed, i.e. a maximum number of files and directories, independently of their sizes. This number is quite big so in general it won’t affect you. Furthermore, if you are running Windows you might be tempted to skip this post altogether. But if you have a domain in a hosting service and your web hosting package is in a Linux server, you should definitely continue reading. In my previous post Hostgator pros and cons, I explained how it has a maximum of 50,000 inodes quota and how it’s not that difficult to reach that number. Whether you are using Hostgator as your web hosting provider or any other, you should know about inodes and how their shortage can become a problem. In this post I will go through ways to find out how many inodes do you have. In the 2nd part, I am going to compile a list of the number of inodes different packages have when you install them (important if you want to run WordPress, TYPO3, Mambo, TikiWiki…).


To find out how many inodes are there in a folder or web hosting account, there are three ways. Whether one or another are possible, or all three, will depend on your web hosting provider.


Option 1. Submit a ticket


This one is easy and only takes as long as your provider’s support takes. Just ask them for an inode report on your account. Hostgator complied within 4 hours, and that was for three different accounts.


Advantage of this method: little effort and you don’t have to learn any commands.

Disadvantage of this method: if you haven’t been warned of being above the inode limit, you might be calling their attention to your account unnecessarily. Furthermore, you depend on others to know the number of inodes.


Option 2. Via ssh


If your provider allows you to ssh to your account, then once you are connected, all you have to do is type the following:


find . -printf "%i\n" | sort -u | wc -l


Advantage: quick (it can take 20 seconds to count 10,000 inodes).

Disadvantage: not all web hosting providers allow you ssh access. In Hostgator, for example, you can ask for ssh access but you need to give them a copy of your photo id.


Option 3. Via ftp


This can’t be done using FileZilla or similar. From a Linux machine you must open a terminal and:


  1. First make sure you have the curlftpfs package installed. Depending on your Linux distribution it can be as simple as running (as super-user)

    yum install curlftpfs

  2. Then you have to create the directory where you want to mount the ftp connection to your hosting account.

    mkdir ftp-domain-folder

    where ftp-domain-folder is the name of the directory you chose.

  3. After that you connect to your account.

    curlftpfs -o user=xxxx:yyyy ftp://domain-name.zzz/ ftp-domain-folder/

    where xxxx = user name and yyyy = password.

  4. And you run this command to count the inodes.

    find ftp-domain-folder/ | sort -u | wc -l

  5. Finally, unmount the folder (requires super-user priviledges):

    umount ftp-domain-folder/


Advantage: you can do it from your computer, quite easy, no need for ssh,…

Disadvantage: it takes quite a bit (over an hour to count 10,000 inodes) and you need to run the commands from a Linux computer.


To check the total number of inodes, if you don’t have ssh access, I would suggest using option 1. Once you know the total number, you can use option 3 to find out the inode count in folders within your hosting account. Each individual folder will not have as many inodes as the whole account so the command will take less time. For example:


find ftp-domain-folder/mail/ | sort -u | wc -l


where mail is the folder where all your email accounts and emails are, or:


find ftp-domain-folder/public_html/folder-name/ | sort -u | wc -l


to check the inodes inside a folder in your account. This way you can check if you have erased enough files if you were reaching the limit.


REFERENCES

http://www.olivetalks.com/2008/03/05/inodes-attack-part1/

How is measured the monthly bandwidth usage

SkyHi @ Wednesday, June 30, 2010
What is Bandwidth ?


Bandwidth is a measure of data transfer. Computer data is fundamentally measured in bits, and bytes. Understanding the units of measure is necessary before you can do anything else. A Byte is simply 8 bits. In the world of computers measurements are conveniently represented by powers of two, while in the real world powers of ten are prevalent. This caused the confusing definition of "Kilobyte" to mean 1024 bytes instead of 1000 bytes as you might expect. Compounding the confusion, a Megabyte" is 1024 Kilobytes, or 1048576 bytes. A Gigabyte is 1024 Megabytes, or 1048576 Kilobytes, or 106954752 bytes. The number of bits or bytes per unit of time is referred to as bandwidth. Thus you see numbers such as 1.5Mbps (1,500,000 bits per second) 28.8Kb/s (28.8 Thousand bits per second) or 3GB/month (Three Gigabytes per month.)



The first lesson of understanding bandwidth is not to confuse Bits and Bytes. If you do, your numbers will be off by a factor of 8, which is usually pretty significant. Many vendors quote numbers in bits, because the result is 8 times larger and makes things look more impressve. Usually a lower-case 'b' indicates bit, and an upper case 'B' indicates byte, but you can't always rely upon that.



The second lesson is to understand that 'K' technically doesn't mean 1000, but everyone usually acts like it does. Minor discrepencies in numbers can usually be accounted for by this assumption. Unless you're talking about huge amounts of data, it's unlikely to make much difference. (less than 10% for even a Terabyte)



How is measured the monthly bandwidth usage



There are different schemes for paying for bandwidth.



I Real Data transfer ( Burstable Bandwidth)



Your host will provide you a graph ( usually MRTG graph) wich shows average bandwidth incoming and outgoing traffic in real-time. On this graph you will read several data as the Monthly Average Out and the Monthly average In.



To measure the real Monthly Data transfer used you have to use use the following equation:



  • Monthly Average Out + Monthly Average In / 8 bits x 60 seconds x 60 minutes x 24 hours x 30.5 days = total bandwidth used for the month.



    Note, some host providers counts only the Monthly Average IN or OUT. With them, you can save a lot of money.



    Sample of Measure of the real Monthly data transfer



  • Mrtg Graphs shows : Monthly average IN + OUT =1024 Kbps = 1 Mbps
  • 1024 kbps/8*60*60*24*30.5= 337305600 Kilobytes /1048576= 321 GB.



    Find here some conversion:



  • 1Mbps = 320GB
  • 10Mbps= 3200GB
  • 20Mbps =6400GB
  • 50Mbps=16000GB
  • 100Mbps =32000GB




    II Capped Bandwidth ( also unlimited transfer)


    Another common system is capped bandwidth, is simply to pay for the bandwidth that's available. For example, you might get 1 Mbps of bandwidth capped, and you can use all of it or none of it and pay the same amount. The network administrator will program the router to cap your usage at that amount.



    III The 95th percentile


    95th Percentile is a method of measuring bandwidth that bases your bill on peak utilization. Your bandwidth is measured from the switch or router and recorded in a log file. At the end of the month, your usage statistics are sorted, and the top 5%, or 37 hours, of data is thrown away, and that next measurement becomes your 'utilization' for the month.



    So, if you had a great weekend promoting your site, and used 3mb/sec for two days, you would be billed for the 3mb/sec rate -- potentially much more expensive than your average bandwidth utilization or actual utilization.



    Written by Peter Lee for AskwebHosting.com

  • REFERENCES
    http://www.askwebhosting.com/article/7/How_is_measured_the_monthly_bandwidth_usage.html

    How to reduce the number of inodes my account uses?

    SkyHi @ Wednesday, June 30, 2010

    The number of inodes represents the number of files/folders you have on your web hosting account. The more inodes your account uses, the more system resources it consumes.



    Thus it is wise to keep the number of your inodes(files/folders) as small as possible.


    SiteGround customers can see the number of inodes they are using from their cPanel > Inodes Usage.



    To reduce the number of inodes your account uses, you should:


    • remove all files/folders you don't need;

    • check the number of cache files you have; applications such as Joomla can generate a lot of cache files; you should regularly check your cache folder and reduce the number of cached files you keep;

    • if you have Default Address (catch-all) enabled, make sure you check the mailbox regularly and delete all mails you don't need;

    • check  your cPanel's main email account regularly; the mails for it are kept in:

             /home/username/mail/cur

             /home/username/mail/new     


            where username is your cPanel username. You can manually delete the messages in these folders using cPanel's File Manager or your favorite FTP  client;


    • you should also check your email accounts regularly and delete any spam messages from them;

    • if you have email accounts you don't need or use, it would be best to remove them;



    If you have a large number of files/folders and reducing their number is not a suitable option for you, you may consider upgrading your account to a dedicated solution. There the number of inodes you use will not be a problem because all system resources will be dedicated to your account.


    REFERENCES

    http://kb.siteground.com/article/How_to_reduce_the_number_of_inodes_my_account_uses.html

    Saturday, June 19, 2010

    Fantastico is not installed at the default location

    SkyHi @ Saturday, June 19, 2010

    The error was


    Fantastico is not installed at the default location
    /usr/local/cpanel/3rdparty/fantastico. Either move the Fantastico directory
    from it's current location to /usr/local/cpanel/3rdparty/fantastico OR
    enable ioncube loaders in WHM -> Tweak settings.

    Enabling ioncube did not fix it for me. Maybe it will for you. After looking I found cpanel now uses /var/cpanel/3rdparty/bin/php NOT /usr/local/cpanel/3rdparty/bin/php

    After doing a php info I saw it did not have a php.ini file in the new location. The fix was:


    cp /usr/local/cpanel/3rdparty/etc/php.ini /var/cpanel/3rdparty/etc<br />

    Other Possible Fixes


    You may want to first try enabling ioncube in WHM->Tweak Settings

    Second you may want to try to update fantastico with cd /usr/local/cpanel/whostmgr/docroot/cgi/fantastico/scripts/ ; /usr/local/cpanel/3rdparty/bin/php cron.php

    Third you may want to rebuild cpanel's php with /scripts/makecpphp

    Fourth you may want to try a cpanel update with /scripts/upcp --force



    Today I found this error while trying to open Fantastico page in cPanel.


    Fantastico is not installed at the default location /usr/local/cpanel/3rdparty/fantastico. Either move the Fantastico directory from it’s current location to /usr/local/cpanel/3rdparty/fantastico OR enable ioncube loaders in WHM -> Tweak settings.





    Though I did not do this in my case, if you are facing same problem, first of all, try restarting cpanel.


    service cpanel restart



    I have made it confirm that ioncube is installed. However, I reinstalled it by following command:



    /scripts/phpextensionmgr install IonCubeLoader



    This did not solve the problem. Then somewhere in forum/blog I have read it that rebuilding cpanel’s internal php may solve it. I did that:


    /scripts/makecpphp



    I have restarted cPanel (look above for command) and the problem is fixed like magic.


    REFERENCES

    http://wiki.cpaneldirect.net/wiki/index.php/Fantastico_is_not_installed_at_the_default_location

    http://controlpanelblog.com/cpanel/fantastico-is-not-installed-at-the-default-location-usrlocalcpanel3rdpartyfantastico-either-move-the-fantastico-directory-from-its-current-location-to-usrlocalcpanel3rdpartyfantastico-or.html


    Install Fantastico to cPanel

    SkyHi @ Saturday, June 19, 2010

    The following article explains how to add Fantastico to cPanel, since it is not installed by default. Fantastico allows you to install various scripts that are available for cPanel.


    Before you begin, you will need to purchase a Fantastico license.


    To install Fantastico, please follow these steps:


    1. Open a web browser and connect to your cPanel Control Panel located at https://ip address:2087.
    2. Login as the Administrator using the information sent to you in your setup email.
    3. From the menu, under Plugins, click Fantastico De Luxe WHM Admin (located at the bottom).


      If this option is not available, see the additional steps below.
    4. Click Click here to begin the install of Fantastico.

    5. Select a version from the dropdown menu. We recommend choosing the Stable version.

    6. Follow the remaining installation steps, using the default information.
    7. Once this process completes you may exit the browser.

    Fantastico should now be configured for your cPanel control panel and you may begin adding various features. To log into Fantastico, open a browser and go to http://ip address:2083. At the bottom of the screen you will see the Fantastico icon; click on it to start Fantastico.





    Additional Steps - Download Fantastico


    If the Fantastico install option is not available, you will need to manually download Fantastico onto your VPS.


    1. Connect to your VPS using an SSH connection.
    2. Log in as the Administrator user.
    3. Change to the proper cgi folder using the following command:

      cd /usr/local/cpanel/whostmgr/docroot/cgi
    4. Download the Fantastico install file using the following command:

      wget http://www.netenberg.com/files/free/fantastico_whm_admin.tgz
    5. Extract the install file using the following command:

      tar -xzpf fantastico_whm_admin.tgz
    6. Remove the install file using the following command:

      rm -rf fantastico_whm_admin.tgz
    7. Log out of the SSH connection.
    8. Log out and log back into cPanel in a web browser.
    9. From the menu, under Plugins, click Fantastico De Luxe WHM Admin (located at the bottom).

    10. Continue the install using the steps above.

    REFERENCES
    http://www.hosting.com/support/cpanelvps/installfantastico/

    Server Install: CentOS 5.3 and cPanel

    SkyHi @ Saturday, June 19, 2010

    Today I helped David Kosmider at HillSeven configure a secure CentOS server with cPanel. Below is a walk-through of how I did it.

    Before We Begin

    • Your server’s IP address must be authorized to install cPanel. This can be done when purchasing your license.
    • This post does not cover the CentOS installation. I hope to write on this in the future.
    • Important: I’m assuming you have a fresh/clean install of CentOS 5.3. cPanel requires that you have no other software installed. If you have installed other software, there is a good chance the install may fail.
    • There are many ways to configure a server. This is how I do it. I offer no guarantees that this will work for you.

    Let’s begin.

    Login As Root

    Log into your machine using SSH. Use the ’su’ command to become the root user. You will be prompted for a password.

    su
    Password: [enter password]

    Set Hostname

    Open the file /etc/sysconfig/network and change the HOSTNAME= value to mach your Fully Qualified Domain Name (FQDN) host name.

    nano /etc/sysconfig/network

    HOSTNAME=hostname.domain.com

    Change the host associated with your main private IP address in your /etc/hosts file.

    nano /etc/hosts

    127.0.0.1 localhost
    192.168.x.x hostname.domain.com hostname

    Finally, run the hostname command, replacing hostname.domain.com with your FQDN.

    hostname hostname.domain.com

    Update Yum Repositories

    Let’s update our YUM packages.

    yum update

    Press ‘y’ to continue.

    Install Perl

    Perl needs to be installed. Let’s install that now.

    yum install perl

    Download cPanel Installation Files

    cd ~
    wget http://layer1.cpanel.net/latest

    Begin cPanel Installation

    Let’s now start the installation. This may take several hours to complete. Maybe a good time to see that movie at the theater you’ve been itching to.

    sh latest

    Logging In

    Once completed, you should see:

    cPanel Layer 2 Install Complete

    Now you can login to your cPanel.

    Visiting http://[your_ip_address]:2086 or https://[your_ip_address]:2087 should bring up a login prompt.

    Enter root for the user ID and your root password.

    Complete cPanel Installation

    You should see the cPanel interface now. Go through these steps. Basic networking knowledge is needed to complete this.

    Once you’re finished, you have successfully installed cPanel on CentOS Server! Congrats! The last thing is to secure your machine. We will use the iptables firewall in CentOS for this.

    Securing CentOS

    There are many many ways to secure your server. The important thing is to secure it using something. This is the configuration I used. You may want to add or remove entries as needed. These commands will setup a firewall using iptables and will allow basic service ports to be accessed. I suggest you read up on iptables to gain a better understanding first.

    Let’s make sure iptables is installed:

    yum install iptables

    Enter the commands below to build your firewall:

    /sbin/iptables -A INPUT -i lo -j ACCEPT
    /sbin/iptables -A INPUT -i ! lo -d 127.0.0.0/8 -j REJECT
    /sbin/iptables -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT
    /sbin/iptables -A OUTPUT -j ACCEPT
    /sbin/iptables -A INPUT -p tcp –dport 80 -j ACCEPT
    /sbin/iptables -A INPUT -p tcp –dport 443 -j ACCEPT
    /sbin/iptables -A INPUT -p tcp –dport 110 -j ACCEPT
    /sbin/iptables -A INPUT -p tcp –dport 25 -j ACCEPT
    /sbin/iptables -A INPUT -p tcp –dport 2082 -j ACCEPT
    /sbin/iptables -A INPUT -p tcp –dport 2083 -j ACCEPT
    /sbin/iptables -A INPUT -p tcp –dport 2086 -j ACCEPT
    /sbin/iptables -A INPUT -p tcp –dport 2087 -j ACCEPT
    /sbin/iptables -A INPUT -p tcp –dport 2089 -j ACCEPT
    /sbin/iptables -A INPUT -p tcp –dport 2095 -j ACCEPT
    /sbin/iptables -A INPUT -p tcp –dport 2096 -j ACCEPT
    /sbin/iptables -A INPUT -p tcp -m state –state NEW –dport 22 -j ACCEPT
    /sbin/iptables -A INPUT -p icmp -m icmp –icmp-type 8 -j ACCEPT
    /sbin/iptables -A INPUT -j REJECT
    /sbin/iptables -A FORWARD -j REJECT

    What did we just do?

    You restricted all incoming traffic to the following ports/services:

    • Port 80 – HTTP
    • Port 443 – HTTPS
    • Port 110 – POP3
    • Port 25 – SMTP
    • Port 2082 – cPanel
    • Port 2083 – cPanel
    • Port 2086 – cPanel
    • Port 2087 – cPanel
    • Port 2089 – cPanel Licensing
    • Port 2095 – Webmail
    • Port 2096 – Webmail (Secure)
    • Port 22 – SSH
    • ICMP – Ability to ping server

    You can read more on the ports that cPanel uses at http://www.cpanel.net/2007/06/getting-the-most-out-of-your-systems-firewall.html.

    If you need to start over, use this command to remove the current iptables:

    /sbin/iptables -F

    After you are done, save your iptables. If you do not, you will lose your firewall settings on reboot:

    /sbin/service iptables save

    You’re Done

    Admittedly, I am no cPanel expert; however, if you run into difficulty, let me know. I will do my best to help. As always, I would love to hear feedback. Happy installing everyone!

    Admittedly, I am no cPanel expert; however, if you run into difficulty, let me know. I will do my best to help. As always, I would love to hear feedback. Happy installing everyone!


    To run cPanel on your server without any problem you need to open following ports on your servers in firewall / IPTables.



    20 FTP TCP inbound and outbound



    21 FTP TCP,UDP inbound and outbound



    22 SSH inbound



    25 SMTP TCP inbound and outbound



    26 SMTP TCP inbound and outbound



    37 RDATE TCP outbound



    43 WHOIS TCP outbound



    53 DNS TCP/UDP inbound and outbound



    80 HTTP TCP inbound and outbound



    110 POP3 TCP inbound



    113 IDENT TCP outbound



    143 IMAP TCP inbound



    443 HTTPS TCP inbound



    465 SMTP TLS/SSL TCP/UDP inbound and outbound



    873 RSYNC TCP/UDP outbound



    993 IMAP SSL TCP inbound



    995 POP3 SSL TCP inbound



    2082 CPANEL TCP inbound



    2083 CPANEL SSL TCP inbound



    2086 WHM TCP inbound



    2087 WHM SSL TCP inbound



    2089 CP LICENCE TCP outbound



    2095 WEBMAIL TCP inbound



    2096 WEBMAIL SSL TCP inbound



    3306 MYSQL TCP


    Useful
    cPanel Command List

    Ever locked yourself out of your Server while making some iptables changes? What about when you change your SSH port and then forget what you set it to? These are common support tickets we receive at RackWire.com. In many cases this is something our customer’s can fix on their own if they are using cPanel on thier VPS/Server.

    cPanel comes with a number of “hidden” autofix commands that allow for administrators to fix common problems simply be logging into WHM and going to a special URL. Two of the most useful ones I’ve seen are flushing iptables and restarting SSH in “safe mode” (basically the default settings and port).


    Flushing iptables rules http://yourdomain.com:2086/scripts2/doautofixer?autofix=iptablesflush


    Restart SSH in safe mode http://yourdomain.com:2086/scripts2/doautofixer?autofix=safesshrestart


    Once you hit the URL you will be prompted to log in. Simply enter your root password and cPanel will do the rest. These have definitely saved me on more than one occasion when my attempt to ’secure’ my server worked a little too well. Remember that if you happen to also lock yourself out of WHM through iptables, you will not be able to hit the URL’s I mentioned. In that case, contact support.


    Here are some other userful commands as well:


    Reset the Firewall Settings https://yourdomain.com:2087/scripts2/doautofixer?autofix=iptablesflush


    Reset the SSH Settings http://yourdomain.com:2086/scripts2/doautofixer?autofix=safesshrestart


    bsdbindfix http://yourdomain.com:2086/scripts2/doautofixer?autofix=bsdbindfix


    Autorepair http://yourdomain.com:2086/scripts2/doautofixer?autofix=autorepair


    Compress Zlib http://yourdomain.com:2086/scripts2/doautofixer?autofix=Compress-Zlib-1.42.tar.gz


    Compresszlibfix http://yourdomain.com:2086/scripts2/doautofixer?autofix=compresszlibfix


    dbdmysql http://yourdomain.com:2086/scripts2/doautofixer?autofix=dbdmysql


    Cooldiagnose_apache_conf http://yourdomain.com:2086/scripts2/doautofixer?autofix=diagnose_apache_conf


    fpindexfile http://yourdomain.com:2086/scripts2/doautofixer?autofix=fpindexfile


    libxml2-2.6.28.tar.gz http://yourdomain.com:2086/scripts2/doautofixer?autofix=libxml2-2.6.28.tar.gz


    libxml64fix http://yourdomain.com:2086/scripts2/doautofixer?autofix=libxml64fix


    pro* http://yourdomain.com:2086/scripts2/doautofixer?autofix=pro*


    spamd_dbm_fix http://yourdomain.com:2086/scripts2/doautofixer?autofix=spamd_dbm_fix


    test http://yourdomain.com:2086/scripts2/doautofixer?autofix=test


    vfilterfix http://yourdomain.com:2086/scripts2/doautofixer?autofix=vfilterfix


    yumduprpmfix http://yourdomain.com:2086/scripts2/doautofixer?autofix=yumduprpmfix


    resellerresourceacctounts http://yourdomain.com:2086/scripts2/doautofixer?autofix=resellerresourceacctounts


    horde_sqmail_current_fix http://yourdomain.com:2086/scripts2/doautofixer?autofix=horde_sqmail_current_fix


    Good Luck, and if you need more help you can always Contact RackWire.com Support!




    REFERENCES

    http://gaclabs.com/2009/09/server-install-centos-5-3-and-cpanel

    http://www.cpanel.net/2007/06/getting-the-most-out-of-your-systems-firewall.html

    http://www.webhosting.uk.com/forums/control-panel-questions/4542-open-ports-run-cpanel-behind-iptables.html

    http://my.myriadnetwork.com/kb/questions.php?questionid=181

    http://blog.rackwire.com/tag/cpanel-commands/



    Install CSF Firewall for Cpanel

    SkyHi @ Saturday, June 19, 2010

    CSF firewall commonly known as Configserver Security and Firewall has become one of the popular firewall not just because of its easy of use it also provides a cpanel interface and can be easily installed and tuned by any novice users. If you are running cpanel without firewall then CSF firewall is very much recommended, considering the security aspects of your server.



    You can visit the CSF firewall website for more information.

    You can also download necessary files there.

    Important Features



    * WHM Interface for CPanel

    * Firewall Running Status

    * Easy to Install and Administer

    * Brute Force Attack Prevention

    * One Click Server Security Checks

    * Port scan prevention and blocking

    * Intrusion detection system

    * Easy Installation and Configuration

    * IP Blocking and more..



    Let us prepare a linux based server running with cpanel. Note that CSF firewall requires to remove any currently running IP based firewall (APF or other IP tables firewall). It comes with all necessary scripts that will remove APF or IP tables firewall.

    Installation Steps



    1. Download the package here




    Code:

    wget <<path_of_tgz_file>>

    2. Untar it




    Code:

    tar -zxf csf.tgz

    3. Run the Install script.




    Code:

    sh csf/install.sh

    Thats it! wait until the script ends!



    4. Remove APF or IPTables Firewall



    If you have any existing IP tables firewall remove them using uninstall scripts located at /etc/csf. In this case i was running APF firewall and BFD in my server so i have to remove it.




    Code:

    sh /etc/csf/remove_apf_bfd.sh

    5. Start the Firewall in Testing Mode



    Start the firewall with the following command.




    Code:

    csf -s<br />// start the firewall<br />csf -r<br />// restart the firewall<br />csf -f<br />// flush the rules or stop the firewall.

    If you are running a VPS plan, then you might get the error like this



    "iptables LKM ip_tables missing so this firewall cannot function unless you enable MONOLITHIC_KERNEL in /etc/csf/csf.conf

    Error: aborted, at line 156"



    To fix:

    Open the /etc/csf/csf.conf and look for a line MONOLITHIC_KERNEL = "0" and change to MONOLITHIC_KERNEL = "1"



    Thats all! Now restart the firewall.



    7. Specify which ports you want to allow.



    It is very important to check the firewall on which ports to open and close all remaining port numbers. Open the /etc/csf/csf.conf and edit the following line with port numbers



    # Allow incoming TCP ports

    TCP_IN = "20,21,22,25,53,80,110,143,443,465,953,993,995,207 7,2078,2082,2083,2087"

    # Allow outgoing TCP ports

    TCP_OUT = "20,21,22,25,37,43,53,80,110,113,443,587,873,953,2 087,2089,2703"

    # Allow incoming UDP ports

    UDP_IN = "20,21,53,953"

    # Allow outgoing UDP ports

    # To allow outgoing traceroute add 33434:33523 to this list

    UDP_OUT = "20,21,53,113,123,873,953,6277"



    21 => FTP

    22 => SSH

    23 => Telnet

    25 => SMTP Mail Transfer

    43 => WHOIS service

    53 => name server (DNS)

    80 => HTTP (Web server)

    110 => POP protocol (for email)

    443 => HTTP Secure (SSL for https:// )

    995 => POP over SSL/TLS

    9999 => Urchin

    3306 = > MysQL Server

    2082 => CPANEL Default

    2083 => CPANEL - Secure/SSL

    2086 => CPANEL WHM

    2087 => CPANEL WHM - Secure/SSL

    2095 => cpanel webmail

    2096 => cpanel webmail - secure/SSL

    Plesk Control Panel => 8443

    DirectAdmin Control Panel => 2222

    Webmin Control Panel => 10000





    6. Disable the Testing Mode and Start the Firewall



    Remember by default the firewall is running in testing mode. You might want to disable the firewall running in testing mode.




    Code:

    vi /etc/csf/csf.conf

    //Look for the first line and set testing mode to "0"

    TESTING = "0"



    //Now restart the firewall!


    Code:

    csf -r

    In Cpanel



    If you have successfully installed the CSF firewall, then you will find this CSF Security & Firewall option within cpanel WHM at the bottom of the menu. Just click on the link and you can also edit the firewall settings inside Cpanel, which is very easy to do.



    CSF Firewall in Cpanel

    Config Files



    /etc/csf/csf.conf CSF Firewall configuration file

    /etc/csf/csf.allow => Config file to allow IPs

    /etc/csf/csf.deny => Config file to deny IPs

    /etc/csf/ => Alert files with TXT extension are stored within this directory

    Final Steps



    1. Check the status of firewall inside cpanel

    2. Harden the firewall security by performing the system security check. To do this go to Cpanel WHM > CSF Firewall & Security > Check System Security. There it will list WARNINGS based on your server.

    Frequently Asked Questions

    1. How do i know whether the firewall is running or not?



    Just login to Cpanel WHM > Config Security & Firewall > Status: Running



    Another good idea is to check and see which ports have been opened and closed by firewall.



    To look for open ports, just use the following commands in linux and observe which ports are open.



    netstat -nap

    OR

    nmap fuser localhost

    2. How do i Remove the CSF Firewall



    Just run the uninstall script located at /etc/csf/ directory




    Code:

    sh /etc/csf/uninstall.sh




    REFERENCES
    http://underhost.us/forums/tutorials-how-cpanel-whm/471-install-csf-firewall-cpanel.html
    http://www.serveridol.com/2010/03/13/installing-csf-on-whmcpanel-for-centos/
    http://forum.microfusionz.com/index.php/topic/278-csf-firewall-installation-guide-cpanel-centos-4x-5x/
    http://tutorials.ausweb.com.au/web/Tutorials/VPS-hosting-tutorials/How-to-install-CSF-Firewall-on-virtuozzo/

    How to Install SPF records on a cPanel server

    SkyHi @ Saturday, June 19, 2010
    Sender Policy Framework (SPF) is an attempt to control forged e-mail. SPF is not directly about stopping spam – junk email. It is about giving domain owners a way to say which mail sources are legitimate for their domain and which ones aren’t. While not all spam is forged, virtually all forgeries are spam. SPF was created in 2003 to help close loopholes in email delivery systems that allow spammers to “spoof” or steal your email address to send hundreds, thousands or even millions of emails illicitly.

    Why do I want to have SPF records for my domains?

    Many mail servers are now testing for the presence of SPF records so if you don’t have one your email will probably not be delivered to that server. A good example is Hotmail that is testing for SPF records since 2004.


    What syntax should I use?

    Now that you have learnt what it is and why you should use it, it’s time to see what syntax you should use.

    For SPF to work you have to add to each DNS zone a record similar to this:


    domain.com. 14400 IN TXT “v=spf1 a mx -all”

    How to install SPF records?

    Now that we know what they are and how to write them it’s time to install them.

    I’ll divide my presentation in two sections.

    In the first one I will teach you how to add a SPF record automatically to newly created accounts and in the second section how to add them to domains that are already setup and don’t have them.

    If this is a new cPanel server or you want all the domains that you add on the server from now on to have a SPF record you have to do the fallowing:


    1. Login to WHM using root
    2. Click on Edit Zone Templates and then on “standard”
    3. Add at the end of file:
    4. %domain%. IN TXT “v=spf1 a mx -all” You can replace “v=spf1 a mx -all”


      with the syntax that you decide it’s the best for you.

    5. Repeat step 2 and 3 for the “simple” zone template

    That’s it ! From now on all the accounts that you will create on the server will have a SPF record.


    Now what do we do with all the accounts that are already created and don’t have a SPF record?


    Here is a simple bash script to do this for you.

    Run as root the fallowing:


    for i in `ls /var/cpanel/users` ;do /usr/local/cpanel/bin/spf_installer $i ;done

    Wait for it to finish. (it might take a few minutes!).


    That’s about it. Hope it helps a lot a people !


    REFERENCES

    http://blog.goodealhosting.cn/2010/02/how-to-install-spf-records-on-a-cpanel-server/

    Common Cpanel issues

    SkyHi @ Saturday, June 19, 2010

    authentication issue


    /etc/init.d/courier-imap restart

    /etc/init.d/courier-authlib restart
    ======================

    blockip issue

    1) grep /etc/sysconfig/iptables

    2) grep /etc/apf/iptables-deny

    3) iptables -L | grep

    ========================
    To unblock the ip 206.18.97.243

    iptables -D INPUT -s 206.18.97.243 -p tcp -j DROiP
    service iptables save
    ———————–

    iptables -I INPUT -s 60.48.177.152 -j DROP

    4) grep /etc/icf/deny.host
    ==================================

    cpanel issue
    =============

    /usr/local/cpanel/

    list of scripts r there

    ./cpkeyclt for updating the cpanel version
    ./cpup updating the cpanel

    —————–

    fatal error
    a) we can resolve this issue by upgrading the cpanel to latest version

    upgrade the cpanel
    ———

    1) whm >> update config

    cPanel/WHM Updates

    select <>

    2) save

    3) /scripts/upcp –force
    =====================================

    cannot access the cpanel
    ————————

    tail -f /usr/local/cpanel/logs/error_log

    1) check the .htaccess file

    2) /scricpts/upcp –force

    3) vi /var/cpanel/users/

    delete suspended entry if there is

    4) /scripts/updateuserdomains

    ———————–

    Cpanel/whm License expired
    —————————-

    cd /usr/localcpanel

    ./cpkeyclt
    ========================

    check the given file for park domain

    1) /var/cpanell/users/

    2) /scripts/updateyuserdomains

    3) /var/named/domain.db

    4) /etc/named.conf

    5) /usr/local/apache/conf/conf.httpd

    6) /etc/localdomains

    7) /etc/userdomains

    8) /etc/trueuserdomains

    9) /etc/trueuserowners

    10) /etc/valiases/

    11) /etc/vdomainaliases/

    12) /etc/vfilters/

    ====================================

    crontab issue

    crontab -e -u

    crontab -l -u

    cron for updatetime error

    solluction
    ———-

    port open 123 in /etc/cpf/conf.apf

    =============================

    Weblog issue

    /home/delight1/tmp/awstats

    AllowToUpdateStatsFromBrowser = 0 to 1

    ===================================

    ftpissue

    1) vi /etc/pureftpd.conf
    search passive
    enable passive range 3000-5000
    2) /etc/apf/conf.apf
    enable ingress ftp enable
    search ingress

    3000-5000

    ————————————————–
    synchronize ftp passowrd – whm
    ———————————————-
    switch to pure-ftp
    ———————————————-

    insmod ip_conntrack_ftp
    lsmod
    modprobe ip_conntrack_ftp

    ———————————————–

    I am sorry, Ftp client is not provided by us. You have to get it from the internet. If you want you can us this ftp client
    http://software.visicommedia.com/en/products/aceftpfreeware/
    ====================================

    mailmonissue

    mailmon/maillist

    /script/fixmailmon

    =====================================

    dnsissue for cluster servers

    /scripts/dnscluster synczone
    ======================================

    changing logindetails

    1) vi /etc/ssh/sshd_config

    PermitRootLogin no

    2) useradd admin
    passwd admin

    3) whm >> Security >> Manage Wheel Group Users

    Add a user to the wheel group

    4) make port oen

    vi /etc/apf/apf.conf
    search ingress
    add the port there

    restart apf
    save iptables
    restart iptables

    ===================================

    Bandwidth issue

    http://forums.vpslink.com/showthread.php?t=2461

    ^MWe cannot support this type of issue through our ticketing system, however, please consider the following advice (you are welcome to follow it at your discretion):

    #1 – Disable Image Hotlinking See these instructions to disable hotlinking via mod_rewrite as a basis for implementing an HTTP referrer check and blocking visitors who may be viewing your content from someone else’s site.

    #2 – Block dubious bots – Set up a robots.txt directive to Disallow: /pot-o-honey/ under your web root, then add a script under /pot-o-honey/ which adds IP addresses which access the script to a log. Create a link to the script from your index page and hide the link from real visitors:

    Code:

    Link

    Block every IP which shows up in the log file.

    #3 – Check your logs – It sounds as though the traffic is primarily web traffic (so this may not be a major component to the issue) but you should run a security audit and review your logfiles if you continue to see excessive bandwidth usage on your VPS.
    ===================================

    shell access
    Main >> Account Functions >> Manage Shell Access
    Main >> Security >> Security Center >> Compilers Tweak >>enable compilers
    for /usr/bin/gcc*
    /usr/bin/g++*
    ====================================

    rvskin issue

    As posted in the RVskins forum, the fix should be:

    rm -f /usr/local/cpanel/Cpanel/rvversion
    perl /root/rvadmin/auto_rvskin.pl

    =====================================

    perl issue (YaBB.pl)

    1)add entry in apache conf

    AddHandler cgi-script .cgi .pl

    2) cp -p YaBB.pl /home//cgi-bin/YaBB.pl

    3)add entry in virtual entry of apache conf

    Options FollowSymLinks +ExecCGI
    ===================================

    protect listings of map content

    http://www.roscripts.com/forum/hosting/69-need-hide-website-folder.html

    ====================================

    GETTING BLANK PAGE

    -It might be as simple as turning on “short_open_tag” (currently set to Off) for PHP5.

    killall -9 httpd

    then restart apache

    ====================================

    OUTLOOK ERROR CODES

    http://support.microsoft.com/kb/813514

    http://www.nthelp.com/50/Outlook_error_codes.htm

    ====================================

    Frontpage issue

    To publish using Frontpage Extensions, your domain *MUST* point to our servers and be fully propagated before you can publish your web!

    To publish using Frontpage2000 do the following:
    1. Open Frontpage
    2. Open your web
    3. Go to File —- Publish Web
    4. Enter http://www.yourdomain.com, hit OK
    5. It will prompt for your user name and password, these can be found in your confirmation email
    6. Once published, you can view your domain at domain.com
    ===========================================

    Solution for the RVSiteBuilder issue in cPanel

    1. Make sure ioncube is selected under WHM->Server Configuration >> Tweak Settings >> PHP section
    2. perl /var/cpanel/rvglobalsoft/rvsitebuilder/panelmenus/cpanel/scripts/autofixphpini.pl
    3. Restart cPanel service: /usr/local/cpanel/startup
    4. Open /usr/local/cpanel/3rdparty/etc/php.ini and add and search for zend_extension
    5. Add following line at the end of the zend section, just before the line where it says Windows extension
    zend_extension=”/usr/local/cpanel/3rdparty/fantastico/loaders/ioncube_loader_lin_5.2.so”
    6. Save and quit the file.
    7. Restart cPanel service: /usr/local/cpanel/startup

    ========================================

    Error from datacenter:

    22/06/2008 15:06 3:34 Connected ok, but error occured receiving from socket
    22/06/2008 15:06 0:00 An existing connection was forcibly closed by the remote host 87.117.197.52:25

    type this command at the shell prompt:

    ulimit -a

    root@nameless1 [~]# ulimit -a
    core file size (blocks, -c) 1000000
    data seg size (kbytes, -d) unlimited
    file size (blocks, -f) unlimited
    max locked memory (kbytes, -l) unlimited
    max memory size (kbytes, -m) unlimited
    open files (-n) 4096
    pipe size (512 bytes, -p) 8
    stack size (kbytes, -s) 8192
    cpu time (seconds, -t) unlimited
    max user processes (-u) 14335
    virtual memory (kbytes, -v) unlimited

    check whether the max user processes is aroung a value of 14000, if it is a high value, change it to value like this. then add thising
    ulimit -u 14335

    then add it in the .bashrc file
    =============================

    get error while connecting to remote database using mysql_connect function: we receive the following error when calling that mysql_connect function:

    ___________________
    MySQL Connection Error #2003

    Can’t connect to MySQL server on
    ‘mysql.leglobal.dreamhosters.com’ (4)

    fix: try using stopping the firewall of our server, check if the remote ip is blocked, then allow their ip in the apf or csf firewall. restart the firewall. then check :
    telnet remote server 3306
    if this is connecting without any problem, the issue is fixed.

    =================================

    phpmyadmin error:

    Cannot start session without errors, please check errors given in your PHP
    and/or webserver log file and configure your PHP installation properly.

    Fix:uscripts/makecpphp
    Fix: run /scripts/makecpphp
    then /scripts/upcp

    Also check whether /home/phpmyadmin/ exists, if not mkdir phpmyadmin and then
    chown cpanelphpmyadmin.cpanelphpmyadmin phpmyadmin
    and check if /var/cpanel/userhomes contains cpanel-phpmyadmin:

    root@hostname /var/cpanel/userhomes#ll
    drwxr-xr-x 3 cpanel-phpmyadmin cpanel-phpmyadmin 4096 May 7 03:09 cpanel-phpmyadmin
    ====================================

    For updating the nameservers in the new server after account transfer:

    check in the Main >> IP Functions >> Show IP Address Usage for the new server : here it is 208.43.163.240 (only one ip)

    and check the same in old server( it may be difft ips)

    Now , take a backup of /var/named of old server
    then for each of the IPs in the used server, run perl -pi -e “s//208.43.163.240/g,” /var/named/* in the old server itself. So that the old servers db file so ll be updated as to resolve all the accouts to new IP. This will reduce any downtime that may have occurred till the new namservers are all set.
    =========================================

    Named errors:

    /etc/init.d/ipaliases restart
    /scripts/fixnamedviews

    ==========================================
    issue: phpmyadmin not working:

    fix: the mysql.sock was absent in /tmp , create a symb link and issue is fixed

    also for fantastico

    ==================

    IMPORTANT:

    IF a custom php.ini do not work (ex: register global to be turned on or off), with a domain , when the server has both php 4
    and 5: then the php must be compiled as suphp: you can change it at “configure php and suexec” option at the whm. It wont wor
    k with cgi
    ====================================

    Spamd not running
    error on restarting exim

    fix: type cpan
    this will provide you a cpanel prompt. here you have to type
    cpan > force install Mail::SpamAssassin
    this will reinstall spamassassin

    =============================================

    wget error while upgrading fantanstico:

    in whm>fantastico>settings, here set the wget timout to be 30 s or more

    ===========

    In fantastico of a domain , what ever application is chosen, we get an error “This application is currently not available. Please contact your host.”

    Fix: Login to your whm -> click on ‘Fantastico De Luxe WHM Admin’ -> then click on ‘Detect/Fix common problems’, this will resolve your issue. I hope this clarifies.
    Fantastico error

    Solln:

    enable ioncube in tweak setting and run /scripts/makecpphp

    ===================

    to call the php extensions as php5 files, add the following in the .htaccess file in the public_html folder.

    Options All -Indexes
    AddHandler application/x-httpd-php5 .php

    The first line is to disable the indexing (directory index which would call the index.php file as per the order), next is to use addhandler.

    refer http://nsdesign.net/cgi-bin/newdesk/new/cgi-bin/staff.cgi?do=ticket&cid=12883
    ==================================

    to compress a folder using tar

    tar -cvf example.tar.gz example

    ===================================

    Premature end of script headers : in apache logs
    Fix: check the permissions, folder permission to be 755 and file permission to be 644
    ===================================

    formmail issues:

    http://www.interads.co.uk/formmail/

    ( http://www.scriptarchive.com/formmail.html

    http://www.tectite.com/formmailpage.php)

    ==================================

    SOCKET ERROR::
    try telnet using correct port
    if it’s not working open that port using
    iptables -I INPUT -p tcp -s 63.247.77.234 –dport 443 -j accept
    ============================================

    Perl issue

    n my case, there was a problem with access right to yaml file (it was owned by root). I changed the owner and works fine:

    Code:
    chown ename:ename /home/ename/.cpaddons/cPanel\:\:Support\:\:cPSupport.0.yaml

    ====================================

    Error from park wrapper: Using nameservers with the following IP

    Go to whm and check tweak settings

    Allow Creation of Parked/Addon Domains that resolve to other servers (ie domain transfers) [This can be a major security problem. If you must have it enabled, be sure to not allow users to park common internet domains.]
    and make sure it is checked

    or
    Add IP to
    /etc/ips.remotedns

    ============================

    ssl issue

    Error code: sec_error_untrusted_issuer

    Sol:

    when the error page shown.

    on the page Click on ” or Add an Exception”

    Box Pops Up — in the box click on ” Get a certificate “

    Certificate will be added and click ” verify the certificate “

    This will fix the issue..

    ========================

    If you are speaking of Domain Keys, this can be enabled from any of your cPanels.
    From your WHM, ensure your cPanels are using the x3 theme. From cPanel, you will see a Mail Authentication section. You will be able to enable Domain Keys from there.

    ===================================

    scenario

    After changing the primary ip of the Cpanel server following mail comes to the Admin from cpanel@server.xxxx.com

    IMPORTANT: Do not ignore this email.
    The hostname (server.xxxxx.com) resolves to . It should resolve to
    xxx.xxx.xx.x. Please be sure to correct /etc/hosts as well as the ‘A’
    entry in zone file for the domain.

    You may be able to
    automaticly correct this problem by using the ‘ Add an A
    entry for your
    hostname ‘ under ‘ Dns Functions ‘ in your Web Host Manager

    But the host name resolves to the server properly.

    ANSWER
    The problem was not with the /etc/hosts …etc
    Check the /etc/ipaddrpool is the new ip listed. I got a old ip listed there.
    check /etc/ips .

    The problem was some one saved the old eth configuration in
    /etc/sysconfig/network-scripts/fcfg-eth0.back - when the network is restarted
    the old ip gets loaded and created an conflict.

    After removing the old ip’s config and restarting the network the old Ip is
    gone but the secondary ips are also missing ….!!

    Go to WHM and remove the secondary ips once and added the secondary
    ip’s again issue fixed…..!

    =================================

    exim issue (-53)

    /scripts/exim_tidydb

    EXIM mail server & CPanel

    “19d 1K30Yy-0000nQ-Oh var/spool/input/output error”

    Struggled for three days for solution.

    Scenario

    I saw the exim mail queue is more than 50000 and tried to remove frozen mails.
    got an error while running the command

    exiqgrep -z -i | xargs exim -Mrm

    19d 1K30Yy-0000nQ-Oh error
    I tried
    exim -Mrm
    1K30Yy-0000nQ-Oh
    got the message as
    “19d 1K30Yy-0000nQ-Oh input/output error”

    But I was able to run other commands like
    exim -bpru|grep frozen|awk {‘print $3′}|xargs exim -Mrm
    to remove frozen mails…

    /scripts/eximup –force made a mess the server hung up
    /scripts/exim4 –force success but same error.
    Answer

    It was simple but it didn’t strike for 3 days …
    1.locate 1K30Yy-0000nQ-Oh
    2.cd /var/spool/exim/input/y
    3.rm -rf 1K30Yy-0000nQ-Oh

    Then tried the same command
    exiqgrep -z -i | xargs exim -Mrm
    as well as
    exiqgrep -o 432000 -i | xargs exim -Mrm
    Wow it is working again…

    ======================================

    unable to check htaccess file, ensure it is readable

    Then first please check the permissions of your folder and .htaccess file because folder permission are most likely 755 and .htaccess permission 644 . To change permissions use : chmod 644 the_name_of_your_path after that still you are getting same problem,then might be Frontpage Extension problem.

    * Login into your CPanel account
    * Click on Frontpage Extensions icon
    * Click on Reinstall extensions button beside your problem domain.
    * Done.

    The .htaccess pcfg_openfile: unable to check htaccess file problem will be fixed.

    ================================

    EXIM mail server & CPanel

    “Server replied: 421 Unexpected failure, please try later”

    Gone crazy seeing that error

    Scenario

    The server stopped sending and receiving emails.. squirrel mail throws error
    “Server replied: 421 Unexpected failure, please try later”

    checked via sending mail from root to user wow works ..but no donuts

    The mails which I sent got bounced back with error
    Technical details of permanent failure:
    “PERM_FAILURE: Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the other server returned was: 530 530 5.7.1 Client was not authenticated (state 13).”
    Checked the logs it said it is unable to locate user permission error

    Google & Cpanel forum helped me again …..

    Answer

    The problem was /etc/localdomains file permission problem it must be “644 “
    changed and restarted exim …
    The mails started working again.

    ===============================

    Steps for resetting word press login details

    http://codex.wordpress.org/Resetting_Your_Password#Through_phpMyAdmin

    ================================

    reverse DNS (PTR request

    If you want your mail delivered properly the Official Host Name of the sending server should match the PTR (reverse DNS) of the sending IP Address, and there should be an “A” record that matches the official host name as well.

    ======================================

    WWW::Curl::Easy module needs to be installed on the server

    step 1 :login whm >> module installers >> click manage button in per module >> search “WWW::Curl::Easy” there and install

    step 2: login cpanel >> perl modules >> search ” WWW::Curl::Easy” and install

    =========================================

    taking php.ini from local settings

    for this edit two files

    .htaccess and create php5.cgi in public_html folder

    vi php5.cgi

    #!/bin/sh
    /usr/local/cpanel/cgi-sys/php5 -c /home/dtn/public_html/php.ini

    vi .htaccess

    Options All -Indexes
    AddHandler application/x-httpd-php5 .php
    Act

    =======================

    time reset for server

    ntpdate clock.redhat.com



    REFERENCES

    http://abinz.wordpress.com/common-cpanel-issues/