Author: wahab Page 6 of 7

Upgrading OpenSSH on CentOS 5 server

By wahab

On August 4, 2012

In Cpanel and WHM, Linux server, Plesk

Upgrading openssh

RHEL5 and CentOS 5 run an older version of ssh, which makes doing a chroot sftp or scp more difficult.

Pre-requisites:=

You need to have following packages and it’s dependencies installed:-

Yum install -y rpm-devel rpm-build pam pam-devel perl openssl-devel tcp-wrappers

Steps:-

It is not recommended to build RPM as root user.

1. Login to server using SSH as a normal user.
2. In your home directory create a file .rpmmacros and add following entires to ot.

%_topdir %(echo $HOME)/rpmbuild

3. Next step is creating the build environment. In your home directory, create following directories:-

$mkdir rpmbuild
$cd rpmbuild
$mkdir BUILD RPMS SOURCES SPECS SRPMS

4. Download the latest openssh from their site. http://filedump.se.rit.edu/pub/OpenBSD/OpenSSH/portable/
5. Once it is downloaded, copy the tarball to the rpmbuild/SOURCES directory that you made.
6. You will also need to extract the tarball and copy over the spec file.

$tar xvf openssh-.tar.gz
$cd openssh-
$cp contrib/redhat/openssh.spec $HOME/rpmbuild/SPECS
$cd ..
$cp openssh-.tar.gz rpmbuild/SOURCES

7. Edit the spec file(HOME/rpmbuild/SPECS/openssh.spec).

Also change

%define no_x11_askpass 0
from 0 to 1. We don’t need the X11 accessories for this.

Do the same with

%define no_gnome_askpass 0
for the same reason. Lastly, comment out the line

%define build6x 0
As we’re not building for RHEL6.

8. Build rpm. In $HOME/rpmbuild/SPECS run the following command:-

$rpmbuild -ba openssh.spec
The above command should build and create several rpms in $HOME/rpmbuild/RPMS/i386

9. In the i386 directory holding the rpms run,

$rpm -Uvh openssh*
It should update openssh, openssh-server, and openssh-clients.

10. It will also create a new file in /etc/ssh called sshd_config.rpmnew. Make sure you have a copy of your old sshd_config. The rest of this will be done as root or with root privilege.

#cd /etc/ssh
#cp sshd_config sshd_config.orig
#mv sshd_config.rpmnew sshd_config

11. Restart the SSH service.

#/etc/init.d/sshd restart or
#service sshd restart

Check the versions of the OpenSSH installed

#rpm -qa | grep openssh

Change the passwords of all the cpanel accounts

By wahab

On July 6, 2012

In Cpanel and WHM

There will always be time when you need to change passwords of all the cpanel accounts. Following scripts will allow you to change the passwords of the accounts.

Steps:-

1. Create a file called change.sh and add following code in to it.

ls -1 /var/cpanel/users | while read user; do
# Generate a random password and assign it the variable pass
pass=`echo “$user $pass” >> new-passwords.txt
#Change the password of the account
/scripts/realchpass $user $pass
/scripts/ftpupdate
done

2. Give execution permission to the file you have craeted

chmod +x change.sh

3. Run the script

sh change.sh

This script will change passwords of all the accounts and create a file called new-passwords.txt and stores the user name and passwords of each account in the file.

Restrict access to website using IP address in IIS 7

By wahab

On June 10, 2012

In Plesk, Windows Server

We can restrict the access to a website using IP addresses or domain name in IIS 7 easily using the “IP and Domain Restrictions” module. Unlike IIS 6, this module is not enabled by default when you install Internet Information Services (IIS). we need to install it. But don’t worry, this can also be done easily through Server Manager.

You can follow the below step by step instruction:-

Enabling the “IP and Domain Restrictions” module

1. Open the Server Manager by selecting the path Start > Administrative Tools > Server Manager.

2. Click “Add Role Services” link to add the required Role. Check the “IP and Domain Restrictions” check box in “Select Role Services” screen and click “Next” to continue and complete the module installation. If the module is already installed, it will show as “installed”.

Configuring the “IP and Domain Restrictions” module

1. Start Internet Information Services (IIS) and open “IP and Domain Restrictions”.

Click to enlarge the image

2. Inside IPv4 Addresses and Domain Restrictions, select “Add Allow Entry” or “Add Deny Entry” to add Allow or Deny entries. You can specify IP address, an IP address range or a Domain Name.

Click to enlarge the image

3. For setting default policy, Click on “Edit feature settings” and select “Allow” or “Deny” as required.

Click to enlarge the image

Note:-

1. Please note that configuring Allow or Deny restrictions using Domain name require reverse DNS look up every time a request arrives the server. Performing reverse DNS lookups is a potentially expensive operation that can severely degrade the performance of your IIS server.
2. IP entries are applied instantly without the need for a restart of the site or iis. The entries are processed in order so if you place deny and allow entries in the wrong order then you may lock the incorrect people out of the website.

Distributed Denial of service(DDOS)

By wahab

On June 10, 2012

In Cpanel and WHM, Linux server, Plesk, Windows Server

A denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a computer or network resource unavailable to its intended users. The speciality of the DDOS is that, it relays attacks not from a single network/host like DOS. The DDOS attack will be launched from different dynamic networks which has already been compromised.

Types:-

Ping of death :-
Attacker deliverately sending a ping packet, normally 64 bytes, that is larger than the 65,535 bytes. Many computer systems cannot handle an IP packet larger than the maximum IP packet size of 65,535, and often causes computer systems crash. A ping packet of size greater than 65,535, can be sent if it is fragmented.When a receiving computer reassembles the packet, a buffer overflow occurs, which often causes computer to crash.

Ping of flood:-
An attacker overwhelming the victim’s network with ICMP Echo Request (ping) packets. A flood of ping traffic can consume singificant bandwidth on low to mid-speed networks bringing down a network to a crawl.

Smurf Attack:-
Smurf attack exploits the target by sending repeated ping request to broadcast address of the target network. The ping request packet often uses forged IP address (return address), which is the target site that is to receive the denial of service attack. The result will be lots of ping replies flooding back to the innocent, spoofed host. If number of hosts replying to the ping request is large enough, the network will no longer be able to receive real traffic.

SYN Floods :-
When establishing a session between TCP client and server, a hand-shaking message exchange occurs betwen a server and client. A session setup packet contains a SYN field that identifies the sequence in the message exchange. An attacker may send a flood of connection request and do not respond to the replies, which leaves the request packets in the buffer so that legitimate connection request can’t be accommodated.

Teardrop Attack :-
Teardrop attack exploits by sending IP fragment packets that are difficult to reassemble. A fragment packet identifies an offset that is used to assemble the entire packet to be reassembled by the receiving system. In the teardrop attack, the attacker’s IP puts a confusing offset value in the sebsequent fragments and if the receiving system doesn’t know how to handle such situation, it may cause the system to crash.

Prevetion:-

1. Install Intrusion Detection System (IDS)
2. Implement Sysctl. Prevent ping attacks (ping of death, ping of flood, and smurf attacks) by disabling ping responses on the network machines. Enable IP Spoofing protection, and TCP SYN Cookie Protection.
3. Install advanced firewall and DDoS utilities.
4. Install Apache mod_evasive and mod_security modules to protect against HTTP DDoS attacks.

Mod_security:-
Since DDOS normally targets HTTP. Its always good to have a filtering system for apache . So that the request gets analyzed before web server handles it.

Mod_evasive:-
Detection is performed by creating an internal dynamic hash table of IP Addresses and URIs, and denying any single IP address from any of the following:

1. Requesting the same page more than a few times per second
2. Making more than 50 concurrent requests on the same child per second
3. Making any requests while temporarily blacklisted (on a blocking list)

Note:-
1. Well there are no 100% prevention or protection against DDOS.
2. This steps won’t be enough if the DDOS attack is of very high volume.

How dns works

By wahab

On June 10, 2012

In Cpanel and WHM, Linux server, Plesk, Windows Server

A DNS client “resolves” an IP address by sending a specially formatted request to a DNS server. The client has to know the address of one or more DNS servers in advance. The reply from the server may be a direct reply with the IP address associated with the hostname, a referral to another DNS server, or a response indicating the requested name can’t be found in DNS.

Typically, the request will ask the server to “recursive“, i.e. if it cannot answer the question from its own local memory, it should go ask other servers on behalf of the client. This behavior helps the local server build up its own cache of addresses frequently looked up.

Another form of query is called iterative query, where a client machine sends the request to a known DNS server , if that DNS server fail to resolve the domain name into a IP, then the client sends the request to another DNS and this process goes on and on until it get the required IP resolution by sending address resolution request to all its known DNS.If every known DNS fail to give the IP, then client goes to the root domain.

When you type a URL into your browser, it uses the following steps to locate the correct website:

A DNS client uses a resolver to request resolution of a host name to an IP address. The resolver is really just a special-purpose application that’s sole function is to act as an intermediary between name servers and various applications that need name resolution, such as Web browsers, e-mail applications, and so on. Here’s an example: Assume you fire up your browser and direct it to connect to www.mysite.com.

1. Your browser checks it’s cache (memory) to see if it knows which IP address the domain name resolves to. If it knows, it will resolve it and display the web page.
2. If the domain name is unable to be resolved, the browser will check your hosts file for a DNS entry.
3. If there’s no entry in the hosts file, the browser will check the default DNS server (specified via your computer’s network settings, /etc/resolv.conf). This is usually your ISP’s DNS server or your employer’s. If the default DNS server has an entry for that domain name, the browser will display the applicable website.
4. If the default name server has no cached results, it sends a DNS query to the root server for the .com domain.
5. The root server responds with the addresses of the name servers that are authoritative for the mysite.com domain.
6. Your ISP’s name server then builds another request for www.mysite.com and submits it to mysite.com’s name server, which responds with the IP address of www.mysite.com.
7. That information is passed back to your resolver, which passes it to your application.

How to install an SSL certificate on Ubuntu for Nginx

By wahab

On June 10, 2012

In Linux server

Introduction

SSL (Secure Sockets Layer) is a protocol that provides secure communication over the internet. It uses cryptographic algorithms to encrypt data between the web server and the client’s browser. SSL is now deprecated, and TLS (Transport Layer Security) is the newer version that’s used widely.

In this tutorial, we’ll walk you through the steps to install and secure your website with SSL on Ubuntu 22.04 using Nginx. By the end of this guide, you’ll have a secure, encrypted connection between your web server and your users’ browsers, helping to ensure their safety and privacy.

Note: Originally, this blog was written for an old versions of Nginx and Ubuntu, I have updated to match the latest Ubuntu and Nginx recently.

Section 1: Installing Nginxon Ubuntu 22.04

Apache2 is a popular open-source web server software that plays a crucial role in hosting websites on the internet. In this section, we will walk through the process of installing Apache2 on Ubuntu 22.04.

Step 1: Update the Package List
Before installing any new software, it’s always a good idea to update the package list to ensure you are installing the latest version of the software. To update the package list, open the terminal on Ubuntu 22.04 and run the following command:

sudo apt update

Step 2: Install Nginx
Once the package list is updated, you can proceed with installing Nginx by running the following command:

sudo apt install nginx

This command will download and install Nginx along with all its dependencies. During the installation process, you will be prompted to confirm the installation by typing y and pressing Enter.

Enable and Start the Apache2 service

sudo systemctl enable nginx
sudo systemctl start nginx

Step 3: Verify NginxInstallation
To test if Nginx is working correctly, open a web browser and enter your server’s IP address or domain name in the address bar. You should receive the default Nginx landing page:

Congratulations, you have successfully installed Nginx on Ubuntu 22.04! In the next section, we will proceed with securing the web server by enabling SSL.

If you encounter any issues like Connection timeout or Unable to reach the website during the verification process, one possible cause could be that the Ubuntu firewall is blocking nginx traffic.

To check if Nginx is currently enabled in the firewall, you can use the Nginx is not listed as an allowed service, you can add it by running the following command:

sudo ufw allow 'Nginx Full'

This will allow both HTTP (port 80) and HTTPS (port 443) traffic to pass through the firewall, ensuring that your website is accessible to visitors.

Section 2: Installing SSL Certificate on Ubuntu 22.04 with Nginx

There are different types of SSL certificates, including domain validated, organization validated, and extended validation certificates. Each type has different features and provides varying levels of trust and security.

To install an SSL certificate on Ubuntu 22.04 with Nginx, you’ll need to follow these steps:

Obtain an SSL certificate: You can purchase an SSL certificate from a certificate authority (CA) or obtain a free SSL certificate from Let’s Encrypt. If you already have an SSL certificate, make sure it is valid and up-to-date.

Configure Apache2 to use the SSL certificate: Apache2 needs to be configured to use the SSL certificate for secure communication. This involves creating a virtual host for the SSL-enabled website, specifying the SSL certificate and key files, and enabling SSL encryption.

You can read more about different SSL certificate types, the process to create a Certificate signing request(CSR), etc in the below blog post:

SSL Certificates: What They Are and Why Your Website Needs Them

Here are the steps for creating and configuring virtual hosts for Apache on Ubuntu 22.04:

1. Create a new virtual host configuration file:

sudo nano /etc/nginx/sites-available/linuxwebhostingsupport.in

Add the following configuration to the file, replacing linuxwebhostingsupport.in with your own domain name:

server {
    listen 80;
    listen [::]:80;

    server_name linuxwebhostingsupport.in;

    root /var/www/html/linuxwebhostingsupport.in/html;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name linuxwebhostingsupport.in;

    root /var/www/html/linuxwebhostingsupport.in/html;
    index index.html;

    ssl_certificate /etc/ssl/certs/linuxwebhostingsupport.in.crt;
    ssl_certificate_key /etc/ssl/certs/linuxwebhostingsupport.in.key;
    ssl_trusted_certificate /etc/ssl/certs/linuxwebhostingsupport.in_cabundle.crt;

    location / {
        try_files $uri $uri/ =404;
    }
}

Note: replace the paths to SSL certificate files with your own paths.

2. Create the documentroot
Run the following command to create the directory:

sudo mkdir -p /var/www/html/linuxwebhostingsupport.in/html

3. Test the Nginx configuration:

sudo nginx -t

If there are any issues, this check will show

4. Enable the virtual host configuration file:

If the configuration test is successful, enable the server block by creating a symbolic link in the /etc/nginx/sites-enabled directory:

sudo ln -s /etc/nginx/sites-available/linuxwebhostingsupport.in /etc/nginx/sites-enabled/

5. Create an HTML file named index.html in the new directory by running the following command:

sudo nano /var/www/html/linuxwebhostingsupport.in/html/index.html

This will open a text editor. Add the following code to the file:

<html>
    <head>
        <title>Hello, world!</title>
    </head>
    <body>
        <h1>Hello, world!</h1>
        <p>Welcome to my website!</p>
    </body>
</html>

5. Reload Nginx for the changes to take effect:

sudo systemctl reload Nginx

Section 3: Testing SSL on Ubuntu 22.04 with Nginx

Test your SSL configuration by visiting your domain in a web browser and verifying that the SSL certificate is valid and the website loads correctly over HTTPS. The browser should display a padlock icon and the connection should be secure

You can also use the online tools like https://www.sslshopper.com/ssl-checker.html to check the configuration further. It can show if there any issues with certificate chain or trust.

Section 4. Troubleshooting SSL on Ubuntu 22.04 with Apache2

1. Certificate errors: If you encounter a certificate error, such as a warning that the certificate is not trusted or has expired, check the certificate’s validity and ensure it’s installed correctly. You can check the certificate’s details using your web browser, and make sure it matches the domain name and other relevant details.

2. Mixed content warnings: If you see mixed content warnings, which indicate that some parts of the site are not secure, check for any resources that are still being loaded over HTTP instead of HTTPS. This can include images, scripts, and other files.

3. SSL handshake errors: If you see an SSL handshake error, this usually means there’s an issue with the SSL configuration. Check your Apache configuration files and make sure the SSL directives are properly set up. You can also check for any issues with the SSL certificate, such as an invalid or mismatched domain name.

4. Server configuration errors: If the SSL certificate is working properly, but the site is still not loading over HTTPS, check your server configuration files to make sure the VirtualHost configuration is correct. Make sure the correct SSL certificate and key files are specified and that the SSL directives are set up correctly.

5. Browser-specific issues: If you’re only experiencing SSL issues in a specific web browser, make sure the browser is up to date and try clearing the cache and cookies. You can also try disabling any browser extensions that may be interfering with the SSL connection.

Remember, troubleshooting SSL issues can be complex and may require some technical expertise. If you’re not comfortable with these steps or need additional help, it’s always a good idea to consult with a professional. You can contact me at admin @ linuxwebhostingsupport.in

Section 5: Best Practices for SSL Configuration on Ubuntu 22.04 with Apache2

Here are some tips and best practices for configuring SSL on Ubuntu 22.04 with Apache2:

1. Keep SSL certificates up to date: Make sure to renew your SSL certificates before they expire. This can be done through the certificate authority where you purchased the certificate. Keeping your SSL certificates up to date will ensure that your website visitors are not presented with security warnings or errors.

2. Configure Nginx for HTTPS-only access: To ensure that your website visitors are accessing your site securely, configure your Nginx server to only serve HTTPS traffic. This can be done by redirecting all HTTP traffic to HTTPS. To do this, add the red colored line to your server block of Nginx virtual host configuration file:

server {
    listen 80;
    server_name linuxwebhostingsupport.in;
    return 301 https://$server_name$request_uri;
}

3. Use secure ciphers and protocols: To protect the confidentiality and integrity of your website traffic, use secure ciphers and protocols. Disable weak ciphers and protocols such as SSLv2 and SSLv3. Use TLSv1.2 or higher, and prefer the use of forward secrecy. You can configure this in your Nginx virtual host configuration file by adding the following lines:

ssl_protocols TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;

Make sure to adjust the file paths and other configuration options to match your specific setup.

You can find more detailed instruction on making your SSL configuration strong and best practices in the below post:

Strong TLS/SSL Security on your server

By following these best practices, you can ensure that your SSL configuration is secure and up to date.

Section 6. Summary

In this tutorial, we discussed how to install and configure SSL certificates on Ubuntu 22.04 with Nginx. We covered the different types of SSL certificates, the steps for obtaining and installing an SSL certificate, and how to configure Nginx to use the SSL certificate. We also discussed how to create virtual hosts for both SSL and non-SSL sites and how to troubleshoot SSL issues.
It’s important to emphasize the importance of SSL for website security and user trust. SSL encryption helps protect sensitive information, such as passwords and credit card numbers, from being intercepted by attackers. Additionally, having a valid SSL certificate gives users confidence that they are interacting with a legitimate website and not an imposter.

To follow best practices for SSL configuration, it’s recommended to keep SSL certificates up to date, configure Nginx for HTTPS-only access, and use secure ciphers and protocols. By following these best practices, website owners can help ensure the security and trustworthiness of their website.

Case insensitive url Aapche Webserver

By wahab

On June 10, 2012

In Cpanel and WHM, Linux server, Plesk

How to enable Case-Insensitive url’s ?

Webserver: Apache

OS: Linux

One of our customer had opened ticket. He has a very interesting need. He wants his site urls to be Case-insensitive . I will explain with examples:- He needs the following urls to work currently he is getting 404 errors for each request.

http://yourdomain.com/Yourpage.html

http://yourdomain.com/YourPage.html

We were unable to add rewrite rules in his htaccess files as we need to write rule for every single file that has a mixture of upper and lower case.

http://yourdomain.com/yourpage.html => This is the correct url

He needs this url http://yourdomain.com/Yourpage.html to load even if they have one spelling mistake or there is one capitalization error. This was found very strange. We have managed to fix the issue by adding an apache module server wide, which neutralise all the the upper case and lower case characters to a single format.

Solution: If you want requested URLs to be valid whether uppercase or lowercase letters are used and with one spelling mistake, “mod_speling” module needs to be enabled in apache.

The mod_speling module is part of the standard Apache distribution but is not enabled by default, so you need to explicitly enable it. When mod_speling is installed, it may be turned on for a particular scope (such as a directory, virtual host, or the entire server) by setting the CheckSpelling directive to On.

For making URL case-insensitive in cPanel:

First run belwow on Cpanel based server : /scripts/easyapache And select ‘Spelling’ from the available module list for apache. Once apache/php are recompiled with this option and easyapache finishes, you can put below code in the .htaccess or in the virtual host entry of the particular domain to apply it to any directory/directories :

< IfModule mod_speling.c > CheckCaseOnly On CheckSpelling On < / IfModule > This helped to fix this particular issue

Verify PHP/cURL is working correctly

By wahab

On February 15, 2012

In Cpanel and WHM, Linux server, Windows Server

Simply, cURL is a command line tool for getting or sending files using URL syntax. It supports a range of common Internet protocols, including HTTP, FTP, SCP, SFTP, TFTP, TELNET, FILE, IMAP, POP3, SMTP and RTSP, etc. The command is designed to work without user interaction.

Usage:-

Basic use of cURL involves simply typing curl at the command line, followed by the URL of the output to retrieve.
To retrieve the google.com homepage, type:
curl www.google.com
What is PHP/CURL?
The module for PHP that makes it possible for PHP programs to access curl-functions from within PHP.

How to verify cURL is working correctly?.

cURL does have very powerfull functions which inturn not used properly may leads to complete breakdown of your server. Because of this most of the hosting companies disable some of these dangerous functions. But for a PHP Programmer cURL is an essential tool and must requires basic functionality atleast. It is very easy to check the PHP/cURL is working normal.

Steps:-

1. Create a php file “check_cURL.php” with following content using any of your favourite editor.

<?php
/**
* Initialize the cURL session
*/
$ch = curl_init();
/**
* Set the URL of the page or file to download.
*/
curl_setopt($ch, CURLOPT_URL,
‘http://news.google.com/news?hl=en&topic=t&output=rss’);
/**
* Create a new file
*/
$fp = fopen(‘rss.xml’, ‘w’);
/**
* Ask cURL to write the contents to a file
*/
curl_setopt($ch, CURLOPT_FILE, $fp);
/**
* Execute the cURL session
*/
curl_exec ($ch);
/**
* Close cURL session and file
*/
curl_close ($ch);
fclose($fp);
?>

2. Execute the “check_cURL.php” script (I just run “php -q check_cURL.php” from the terminal)

3. Check the output file “rss.xml”. If the file contains data, we can conclude curl is working fine.

How does this script works:-

The check_cURL.php is simple php script which when called connects to the url specified(Google in our example) and download its source code. The script then writes its output to downloaded content to the output file(rss.xml in our example).

Custom php.ini per domain in Plesk Windows server

By wahab

On January 31, 2012

In Plesk, Windows Server

There will always be the scenarios where we need to set some special php settings for a particular domain or for a particular directory. This can be easily done in a Linux server, but with Windows it is always issues. But we can done this windows servers also and tell you what i have verified this by myself.

Prerequisites:-

*Custom php,ini file only works with php handler as “cgi” and not with “fastcgi” nor with ISAPI extension. So you need to verify this before you proceed further.

Follow the below steps to set the correct php mode.

1. Log in to your Hosting Control Panel
2. Select your domain name
3. Under “Web Site” tab, click on “Web Hosting Settings”
4. Under “PHP Support”, select your desired “PHP Mode” settings(cgi mode)
5. Hit the “Ok” button to activate.

Assumptions:-

The default location of php.ini for PHP5 is the PleskPHP5 base directory %plesk_dir%AdditionalPleskPHP5 (Eg: c:Program FilesParallelsPleskAdditionalPleskPHP5). If you place an PHP info page, you can easily find out from where the current php settings is loaded.
The document root of the domain “maindomain.com” is “d:Inetpubvhostsmaindomain.comhttpdocs”. Please note that this may be different in your hosting environment.
The server I am working on is a x86 based server.
Plesk version is 10.3.1, but it should work with others also.

Turn off the register_globals

I will explain the procedures with an example to turn off the register globals . There are two ways to configure php values for a particular domain:-

1. By placing an customized php.ini page on the corresponding directory or in domain.
2. By creating a Windows registry value for the particular php settings.
Placing an customized php.ini page on the corresponding directory
You need to place the php.ini file in “maindomain.com/httpdocs” directory or if you want to apply the only to a addon domain or a directory, then use the directory “maindomain.com/httpdocs/addondomain.com”.

Follow the below steps:-

1. Copy the PHP version 5 (php.ini-recommended or php.ini) ini file from the PHP location %plesk_dir%\AdditionalPleskPHP5 to the location “maindomain.com/httpdocs”
2. Rename the copied file to the exact name as ‘php-cgi-fcgi.ini‘. This is the most important step and won’t work otherwise.
3. You can make the changes needed to the above ini file, say set the “register_globals = Off”.
3. Create a php info page the corresponding directory and verify it is loading the correct “php.ini” (check the loaded configuration file section). Also verify whether the value you have changed is now updated under the ‘PHP info’ page.

This should do the work. If this method doesn’t work for you, here is the second method.

Creating a Windows registry value

Even though this is a simple procedure, i do not recommend anyone to edit the Windows Registry because if you screw up anything with Registry, you will also screwed up 🙂

When running PHP on Windows, the configuration values can be modified on a per-directory basis using the Windows registry. The configuration values are stored in the registry key HKLMSOFTWAREPHP5Per Directory Values, in the sub-keys corresponding to the path names. For example, configuration values for the directory c:inetpubwwwroot would be stored in the key HKLMSOFTWAREPHP5Per Directory Valuescinetpubwwwroot. The settings for the directory would be active for any script running from this directory or any subdirectory of it. The values under the key should have the name of the PHP configuration directive and the string value.

Simply, you can only add individual php configuration value inside of php.ini through the registry, which means that you have to set up keys to the file path ( where the client’s hosting folder located ) and then add a string value, string name will be the php.ini configuration name and value will be how you want it to be. So for setting register_globals to off for the maindomain.com, you have to setup keys to the path “HKEY_LOCAL_MACHINE > SOFTWARE > Wow6432Node > PHP > Per Directory Values > C > Inetpub > vhosts > maindomain.com > httpdocs” and then add a string value, string name will be “register_globals” and value will be 0 to put register_globals= off.
Note:

For 32 bit Windows registry path is , HKLMSOFTWAREPHP5Per Directory Values
For x64 based Windows registry path is, HKEY_LOCAL_MACHINESOFTWAREWow6432NodePHP5Per Directory Values

Reference:-

http://forum.parallels.com

http://www.php.net

IPTABLES complete cheatlist

By wahab

On November 17, 2011

In Cpanel and WHM, Linux server, Plesk

Please note that the iptables rules are stored in the /etc/sysconfig/iptables file. If you view this file, you’ll see all the default rules.

1. Delete Existing Rules

Before you start building new set of rules, you might want to clean-up all the default rules, and existing rules. Use the iptables flush command as shown below to do this.

iptables -F
(or)
iptables –flush
service iptables save

2. Set Default Chain Policies

The default chain policy is ACCEPT. Change this to DROP for all INPUT, FORWARD, and OUTPUT chains as shown below.

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

When you make both INPUT, and OUTPUT chain’s default policy as DROP, for every firewall rule requirement you have, you should define two rules. i.e one for incoming andone for outgoing.
Change default policy for INPUT/OUTPUT/FORWARD to ACCEPT. All inbound connections will be allowed

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

3.Block an IP for inbound connection

iptables -A INPUT -s 192.168.1.5 -j DROP
iptables -A INPUT -i eth0 -p tcp -s “$BLOCK_THIS_IP” -j DROP
4.Allow an IP for inbound connection

iptables -A INPUT -s 192.168.1.5 -j ACCEPT

5.Block outbound IP address

iptables -A OUTPUT -d <IP> -j DROP

6.Block outbound PORT

iptables -A OUTPUT -p tcp –dport <PORT> -j DROP

7.Block outbound IP:PORT

iptables -A OUTPUT -p tcp -d <IP> –dport <PORT> -j DROP

8.Allow port 2222 for inbound tcp connections

iptables -A INPUT -p tcp –dport 2222 -j ACCEPT

9.White list an IP

iptables -A INPUT -i eth0 -s <IP> -j ACCEPT

10.Open port 5666

iptables -I INPUT -p tcp -m tcp –dport 5666 -j ACCEPT
11.Allow ALL Incoming SSH

The following rules allow ALL incoming ssh connections on eth0 interface.

iptables -A INPUT -i eth0 -p tcp –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPT

12.Allow Incoming SSH only from a Sepcific Network

The following rules allow incoming ssh connections only from 192.168.100.X network.

iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0/24 –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPT

In the above example, instead of /24, you can also use the full subnet mask. i.e “192.168.100.0/255.255.255.0″.

13. Allow Incoming HTTP and HTTPS

The following rules allow all incoming web traffic. i.e HTTP traffic to port 80.

iptables -A INPUT -i eth0 -p tcp –dport 80 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp –sport 80 -m state –state ESTABLISHED -j ACCEPT

The following rules allow all incoming secure web traffic. i.e HTTPS traffic to port 443.

iptables -A INPUT -i eth0 -p tcp –dport 443 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp –sport 443 -m state –state ESTABLISHED -j ACCEPT

14.Combine Multiple Rules Together using MultiPorts

When you are allowing incoming connections from outside world to multiple ports, instead of writing individual rules for each and every port, you can combine them together using the multiport extension as shown below.

The following example allows all incoming SSH, HTTP and HTTPS traffic.

iptables -A INPUT -i eth0 -p tcp -m multiport –dports 22,80,443 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m multiport –sports 22,80,443 -m state –state ESTABLISHED -j ACCEPT

15.Allow Outgoing SSH

The following rules allow outgoing ssh connection. i.e When you ssh from inside to an outside server.

iptables -A OUTPUT -o eth0 -p tcp –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPT

Please note that this is slightly different than the incoming rule. i.e We allow both the NEW and ESTABLISHED state on the OUTPUT chain, and only ESTABLISHED state on the INPUT chain. For the incoming rule, it is vice versa.

16.Allow Outgoing SSH only to a Specific Network

The following rules allow outgoing ssh connection only to a specific network. i.e You an ssh only to 192.168.100.0/24 network from the inside.

iptables -A OUTPUT -o eth0 -p tcp -d 192.168.100.0/24 –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPT

17.Allow Ping from Outside to Inside

The following rules allow outside users to be able to ping your servers.
iptables -A OUTPUT -p icmp –icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp –icmp-type echo-reply -j ACCEPT
19.Allow Loopback Access

You should allow full loopback access on your servers. i.e access using 127.0.0.1

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

20. Allow MySQL connection only from a specific network

iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0/24 –dport 3306 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp –sport 3306 -m state –state ESTABLISHED -j ACCEPT

21.Prevent DoS Attack

The following iptables rule will help you prevent the Denial of Service (DoS) attack on your webserver.

iptables -A INPUT -p tcp –dport 80 -m limit –limit 25/minute –limit-burst 1000 -j ACCEPT
In the above example:
-m limit: This uses the limit iptables extension

–limit 25/minute: This limits only maximum of 25 connection per minute. Change this value based on your specific requirement
–limit-burst 1000: This value indicates that the limit/minute will be enforced only after the total number of connection have reached the limit-burst level.

22.Port forwarding using IPTables

Forward port 80 from IP address to another IP

iptables -t nat -A PREROUTING -i eth0 -p tcp –dport 80 -j DNAT –to <DESTIP>:80
iptables -t nat -A POSTROUTING -p tcp –dst <DESTIP> –dport 80 -j SNAT –to <SRCIP>
iptables -t nat -A OUTPUT –dst <SRC> -p tcp –dport 80 -j DNAT –to <DESTIP>:80

Removing the above rules
iptables -t nat -D PREROUTING -i eth0 -p tcp –dport 80 -j DNAT –to <DESTIP>:80
iptables -t nat -D POSTROUTING -p tcp –dst <DESTIP> –dport 80 -j SNAT –to <SRCIP>
iptables -t nat -d OUTPUT –dst <SRC> -p tcp –dport 80 -j DNAT –to <DESTIP>:80

23.List all the rules in the iptables

iptables -L

24.Check an IP in the rule

iptables -nL | grep <IP>

25.Save the current iptables rules

iptables-save > File_name

26.Restore iptable rules from the file

iptables-restore < File_name