Category: Cpanel and WHM Page 2 of 3

How to Disable SSLv3 for Apache,Nginx, Litespeed, cPanel

On July 22, 2015

The POODLE bug is a new bug discovered by Google in the SSLv3 protocol. The fix is easy, disable support for SSLv3.

See the google security blog for more info on the bug: http://googleonlinesecurity.blogspot.nl/2014/10/this-poodle-bites-exploiting-ssl-30.html.

Fix POODLE

To fix the bug, disable SSLv3 and use a secure cipherlist. SSL v2 is also insecure, so we need to disable it too.

So edit the Apache config file and add following

SSLProtocol All -SSLv2 -SSLv3

All is a shortcut for +SSLv2 +SSLv3 +TLSv1 or – when using OpenSSL 1.0.1 and later – +SSLv2 +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2, respectively. The above line enables everything except SSLv2 and SSLv3

And then restart the Apache service

service httpd restart

cPanel/WHM

If you have a cPanel server, you should not edit Apache configurations directly, instead you can do this from WHM.

1. Visit your server’s WHM Panel ( https://<yourserversip>:2087 )
2. Navigate to the Apache Configuration Panel of WHM.
3. Scroll down to the ‘Include Editor’ Section of the Apache Configuration.
4. Click ‘Pre Main Include’, which will jump to the corresponding section. Via the drop-down selector, choose ‘All Versions’.
5. An empty dialogue box will appear allowing you to input the needed configuration updates. In this box, copy and paste the following:

SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On

For Nginx

If you’re running an NGINX web server that currently uses SSLv3, you need to edit the NGINX configuration (nginx.conf). You will need to add the following line to your server directive:

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

Then restart the nginx service

service nginx restart

For LiteSpeed:

Update to LiteSpeed version 4.2.18.

For more information about Litespeed & POODLE: http://www.litespeedtech.com/support/forum/threads/lsws-4-2-18-released-%E2%80%94-addresses-poodle-sslv3-vulnerability.9948/

Note about Mail Servers:

The POODLE attack requires the client to retry connecting several times in order to downgrade to SSLv3, and typically only browsers will do this. Mail Clients are not as susceptible to POODLE. However, users who want better security should switch to Dovecot until we upgrade Courier to a newer version.

For cpsrvd:

1. Go to WHM => Service Configuration => cPanel Web Services Configuration
2. Make sure that the “TLS/SSL Protocols” field contains “SSLv23:!SSLv2:!SSLv3”.
3. Select the “Save” button at the bottom.

For cpdavd:

1. Go to WHM => Service Configuration => cPanel Web Disk Configuration
2. Make sure that the “TLS/SSL Protocols” field contains “SSLv23:!SSLv2:!SSLv3”.
3. Select the “Save” button at the bottom.

For Dovecot:

1. Go to WHM => Service Configuration => Mailserver Configuration.
2. SSL Protocols should contain “!SSLv2 !SSLv3”. If it does not, replace the text in this field.
3. Go to the bottom of the page, and select the Save button to restart the service.

For Courier:

Courier has released a new version to mitigate this as of 10/22, until we have an opportunity to review, test, and publish the new version of Courier please switch to Dovecot for enhanced security.

For Exim:

1. Go to Home » Service Configuration » Exim Configuration Manager
2. Under Advanced Editor, look for ‘openssl_options’.
3. Make sure the field contains “+no_sslv2 +no_sslv3”.
4.Go to the bottom of the page, and select the Save button to restart the service.

For Lighttpd:

Lighttpd releases before 1.4.28 allow you to disable SSLv2 only.

If you are running at least 1.4.29, put the following lines in your configuration file:

ssl.use-sslv2 = "disable"
ssl.use-sslv3 = "disable"

How to verify the Poodle is disabled

You can use a website like http://poodlebleed.com/ for a web based check.

Manual check

To make sure services on your server are not accepting SSLv3 connections, you can run the openssl client on your server against the SSL ports. This command is run as follows:

openssl s_client -connect linuxwebhostingsupport.in:443 -ssl3

If it fails (which is what you want), you should see something like this at the top of the output:

3078821612:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1257:SSL alert number 40
3078821612:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:596:

Shellshock How to check if you are vulnerable

By wahab

On September 27, 2014

In Cpanel and WHM, Linux server, Plesk

A new vulnerability has been found that potentially affects most versions of the Linux and Unix operating systems, in addition to Mac OS X. Known as the “Bash Bug” or “ShellShock,” the GNU Bash Remote Code Execution Vulnerability could allow an attacker to gain control over a targeted computer if exploited successfully. And because Bash is everywhere on Linux and UNix-like machines and interacts with all parts of the operating system, everyone anticipates that it will have lot of repercussions.

How does Shellshock work?

Shellshock exploits a flaw in how Bash parses environment variables; Bash allows functions to be stored in environment variables, but the issue is Bash will execute any code placed after the function in the environment variable value.

For example, an environment variable setting of VAR=() { ignored; }; /bin/id will execute /bin/id when the environment is imported into the bash process.

I am vulnerable?

You can check if you’re vulnerable by running the following lines in your default shell.

env X=”() { :;} ; echo vulnerable” `which bash` -c “echo Check completed”

If you see the word “vulnerable” echo’d back , then you’re at risk.

How Shellshock is Impacting the Web

The most likely route of attack is through Web servers utilizing CGI (Common Gateway Interface), the widely-used system for generating dynamic Web content. An attacker can potentially use CGI to send a malformed environment variable to a vulnerable Web server. The attacker is able to inject environment variables inside all bash process spawned by a web server under the CGI specification. This will occur directly if the CGI script is programmed in bash or indirectly by system calls inside other types of CGI scripts since the environment will propagate to the sub-shell. The vulnerability will automatically be triggered at the shell process instantiation. Furthermore if specific headers are used as attack points, the payload may not appear in the webserver logs, letting a compromise occur with virtually no trace of the intrusion.

Example:

CGI stores the HTTP headers in environment variables. Let’s say the example.com is running a CGI application written in Bash script.

We can modify the HTTP headers such that it will exploit the shellshock vulnerability in the target server and executes our code.

curl -k http://example.com/cgi-bin/test -H “User-Agent: () { :;}; echo Hacked > /tmp/Hacked.txt”

Here, the curl is sending request to the target website with the User-Agent containing the exploit code. This code will create a file “Hacked.txt” in the “/tmp” directory of the server.

What can I do to protect myself?

Major operating software vendors including RedHaT, CentOS, etc are already released a initial patch for this bug.

Debian—https://www.debian.org/security/2014/dsa-3032

Ubuntu—http://www.ubuntu.com/usn/usn-2362-1/

Red Hat—https://access.redhat.com/articles/1200223*

CentOS—http://centosnow.blogspot.com/2014/09/critical-bash-updates-for-centos-5.html

Novell/SUSE— http://support.novell.com/security/cve/CVE-2014-6271.html

If a patch is unavailable for a specific distribution of Linux or Unix, it is recommended that users switch to an alternative shell until one becomes available.

Need expert assistanace?

I can help you to patch your server against this bug and make sure you and your customers are secure. Mail me at therealfreelancer[at]gmail[dot]com.

Limit /throttle rsync transfer speed

By wahab

On August 26, 2014

In Cpanel and WHM, Linux server, Plesk

If you use the rsync utility to keep your backups synchronized between your servers or with a local machine, you might want to prevent the script from using too much bandwidth. However, rsync makes a lots of network I/O. The point of limiting bandwidth is to make sure your backup scripts don’t clog up the network connection.

Naturally, limiting the amount of bandwidth your backups are using is going to make them happen more slowly, but if you can deal with that, this is the way to do it.

Normal rsync command

rsync –avz -e ‘ssh’ /path/to/source user@remotehost:/path/to/dest/

What you’ll want to do is use the –bwlimit parameter with a KB/second value, like this:

rsync –bwlimit=<kb/second> –avz -e ‘ssh’ /path/to/source user@remotehost:/path/to/dest/

So if you wanted to limit transfer to around 10000KB/s (9.7MB/s), enter:

rsync –bwlimit=10000 –avz -e ‘ssh’ /path/to/source user@remotehost:/path/to/dest/

Example:-

rsync –bwlimit=10000 –avz -e ‘ssh’ /backup/ root@192.168.0.51:/backup/

Blocking spoofed outgoing mails from your cPanel server

By wahab

On August 19, 2014

In Cpanel and WHM

Spoofing is where the mail headers are manipulated to appear as if the mail comes from some other domain. When emails are set to be from an email address on your domain and bounce, they are sent to our servers, attempting to deliver themselves to that mailbox. Generally, you will never see these emails; however, if the email spoofer happens to configure the “From:” header to be a real email box, the bounce will come back to your mailbox and you will receive the email. There is a high chance that a very large number of spam message already sent from server. This can cause high load in the server and sometimes leads to the blacklist of your mail server IP address.

There are two ways in which a spoofed mail can be created.

1. Exploiting vulnerable form to mail scripts to send out spoofed mails through local mail agent.
2. Using stolen mail account login details to send spoofed mails through SMTP authentication.
Let’s look at a solution on how spoofing can be prevented in Exim mail servers commonly implemented in cPanel/WHM servers.

I. Blocking all un-authenticated spoofed outbound emails
1. Login to WHM >> EXIM CONFIGURATION MANAGER >> ADVANCED EDITOR

2. Add the following entry in the top using Add additional configuration setting:

domainlist remote_domains = lsearch;/etc/remotedomains

3. Add the following code under acl_not_smtp :

deny
condition = ${if ! match_domain{${domain:${address:$h_From:}}}{
+local_domains : +remote_domains}}
message = Sorry, you don’t have\
permission to send email from this server with a header that\
states the email is from ${lc:${domain:${address:$h_from:}}}.
accept

Here, the ACL will check for the presence of domain name part of the from address in either of the files – /etc/localdomains or /etc/remotedomains. If there is a mismatch, server will reject the email.

II. Blocking all authenticated spoofed outbound emails
1. WHM >> EXIM CONFIGURATION MANAGER >> ADVANCED EXIM EDITOR

2. Search for acl_smtp_data and add the following lines under it:

deny
authenticated = *
condition = ${if or {{ !eqi{$authenticated_id} {$sender_address} }\
{ !eqi{$authenticated_id} {${address:$header_From:}} }\
}\
}
message = Your FROM address ( $sender_address , $header_From )
must match your authenticated email user ( $authenticated_id ).
Treating this as a spoofed email.
Here, for all authenticated users, the rule will check whether the authenticated userid matches with the from address. If it matches, it will allow the email. Else, it will display the message “Your FROM must match your authenticated email user. Treating this as spoofed email”

PS: If the acl_smtp_data is mentioned as something else(like acl_smtp_data = check_message), locate check_message and add the above lines just under it.
IMPORTANT points to keep in mind
a. POP before SMTP won’t work with this setting. You will have to ask your customers to use the option – “My Server Requires Authentication” in the SMTP settings of their email client.
b. Username in the format user+domain.com will not work. They have to use user@domain.com instead.

Also your customer cannot change the from field to something other than original authentcated user. People use this method in Website Contact forms.

Setting SPF records

Another way to prevent spoofing is using SPF records. You must specify valid spf records for your domain, so that only the intended people or server can send mails on behalf of your domain name.

Apache: Multiple SSL websites on a single IP address

By wahab

On July 2, 2013

In Cpanel and WHM, Linux server, Plesk

Apache: Multiple SSL websites on a single IP address

Update: This is a new update from a cPanel Tech
“There is nothing to enable. As long as you are using cPanel & WHM version 11.38 on CentOS, RHEL, or CloudLinux version 6 or newer, SNI works out of the box”.

One of the frustrating limitations in supporting secure websites has been the inability to share IP addresses among SSL websites.
When website administrators and IT personnel are restricted to use a single SSL Certificate per socket (combination of IP Address and socket) it can cost a lot of money. Well we can actually share IP addresses for multiple secure websites. Solving this limitation required an extension to the Transport Layer Security (TLS) protocol that includes the addition of what hostname a client is connecting to when a handshake is initiated with a web server. The name of the extension is Server Name Indication (SNI). SNI is supported in Apache v2.2.12 , and OpenSSL v0.9.8j or later.

With SNI, you can have many virtual hosts sharing the same IP address and port, and each one can have its own unique certificate

Prerequisites to use SNI

Use OpenSSL 0.9.8f or later
Build OpenSSL with the TLS Extensions option enabled (option enable-tlsext; OpenSSL 0.9.8k and later has this enabled by default).
Apache must have been built with that OpenSSL (./configure –with-ssl=/path/to/your/openssl). In that case, mod_ssl will automatically detect the availability of the TLS extensions and support SNI.
Apache must use that OpenSSL at run-time, which might require setting LD_LIBRARY_PATH or equivalent to point to that OpenSSL, maybe in bin/envvars. (You’ll get unresolved symbol errors at Apache startup if Apache was built with SNI but isn’t finding the right openssl libraries at run-time.)

Setting up SNI with Apache

The configuration is pretty simple and straight forward, though I recommend making a backup of your existing httpd.conf file before proceeding.

# Ensure that Apache listens on port 443
Listen 443

# Listen for virtual host requests on all IP addresses
NameVirtualHost *:443

# Go ahead and accept connections for these vhosts
# from non-SNI clients
SSLStrictSNIVHostCheck off

# Because this virtual host is defined first, it will
# be used as the default if the hostname is not received
# in the SSL handshake, e.g. if the browser doesn't support
# SNI.
DocumentRoot /www/example2
ServerName www.linuxwebhostingsupport.in

# Other directives here
SSLEngine On
SSLCertificateFile /path/to/linuxwebhostingsupport.in.crt
SSLCertificateKeyFile /path/to/linuxwebhostingsupport.in.key
SSLCertificateChainFile /path/to/CA.crt

DocumentRoot /www/example2
ServerName www.abdulwahabmp.co.in

# Other directives here
SSLEngine On
SSLCertificateFile /path/to/abdulwahabmp.co.in.crt
SSLCertificateKeyFile /path/to/abdulwahabmp.co.in.key
SSLCertificateChainFile /path/to/CA.crt

That it!!!. Just restart APache service. Now go and check your Websites using https. That should be working.

Plesk support SNI from 10.2.x version onwards.

SNI will work on following Operating systems out of box

OpenSuSE Linux 11.3 or later.
Ubuntu Linux 10.4 or later.
Debian Linux 6.0 or later.
RedHat Linux 6.0 or later.
CentOS Linux 60.0 or later

Supported Desktop Browsers
Internet Explorer 7 and later
Firefox 2 and later
Opera 8 with TLS 1.1 enabled
Google Chrome:
Supported on Windows XP on Chrome 6 and later
Supported on Vista and later by default
OS X 10.5.7 in Chrome Version 5.0.342.0 and later
Chromium 11.0.696.28 and later
Safari 2.1 and later (requires OS X 10.5.6 and later or Windows Vista and later).
Note: No versions of Internet Explorer on Windows XP support SNI

Installing and managing firewall using ConfigServer Firewall (CSF)

By wahab

On July 1, 2013

In Cpanel and WHM, Linux server

ConfigServer firewall is a popular Linux firewall security suite. It is easy to install, flexible to configure and secure with extra checks.
CSF is generally considered a more advanced firewall as there are more configuration options compared to other firewalls, while still being simple enough to install and configure that even novice administrators can use it. Some of the MANY functions of CSF are given below:-

Daemon process that checks for login authentication failures for:

Courier imap, Dovecot, uw-imap, Kerio
openSSH
cPanel, WHM, Webmail (cPanel servers only)
Pure-ftpd, vsftpd, Proftpd
Password protected web pages (htpasswd)
Mod_security failures (v1 and v2)
Suhosin failures
Exim SMTP AUTH
Custom login failures with separate log file and regular expression matching

SSH login notification
SU login notification
SYN Flood protection
Ping of death protection
Port Scan tracking and blocking
IPv6 Support with ip6tables
…lots more!

Removing Your Current Firewall
To prevent any conflicts in operation we will need to remove your current firewall. The most common software firewalls on our dedicated servers are APF and CSF, so we have provided instructions on how to remove APF below. If you are using a different software firewall be sure to follow that programs uninstall directions before continuing. After completing the uninstall continue with the CSF installation below.
Using Yum to Remove APF
If it was installed via yum, which is most likely, you will first need to identify the name of your APF package:
rpm -qa |grep -i apf
In this case:
[root@host ~]# rpm -qa | grep apf
apf-9.6_5-1
In order to remove that package, and get your server ready for CSF installation, run the following command:
[root@host ~]# rpm -e apf-9.6_5-1
If you see this:
[root@host ~ ]# rpm -e apf-9.6_5-1
error: Failed dependencies:
apf >= 9.6_5-1 is needed by (installed) bfd-1.2-1.noarch
It means you have BFD installed, and it will need to be removed before you can proceed to removing APF:
[root@host ~ ]# rpm -e bfd-1.2-1.noarch
Then attempt to remove apf again:
[root@host ~ ]# rpm -e apf-9.6_5-1
Any further dependency errors can be handled in the same way as long as you are aware of what you are removing. If you have any questions or get stuck at any point feel free to contact me here.
Removing Source Installed APF
This can be a bit trickier, and if you are not sure what you’re doing you may want to contact me . If you are confident and wish to proceed you will find a list of commands below that you can use to remove APF if it is installed in the most common CentOS directories.
Stopping APF and iptables clears all of the rules from your firewall and ensures that removing the APF installation won’t cause access problems:
[root@host ~ ]# /etc/init.d/iptables stop

[root@host ~ ]# /etc/init.d/apf stop
Remove all of the APF related files:
[root@host ~ ]# rm -Rfv /etc/apf
[root@host ~ ]# rm -fv /etc/cron.daily/fw
[root@host ~ ]# rm -fv /etc/init.d/apf
Remove APF from the list of programs that start at boot:
[root@host ~ ]# chkconfig apf off

Installing CSF

So, login to your server via ssh and let’s start CSF installation by retrieving the package files using wget command:

# wget http://configserver.com/free/csf.tgz

Unpack the archive:

# tar xfvz csf.tgz
Navigate to the uncomperssed csf directory:

# cd csf

Check CSF will work on your server
CSF provides a test script. We can check whether CSF works with your Server or not prior to installing it.

#perl csftest.pl

Testing ip_tables/iptable_filter…OK
Testing ipt_LOG…OK
Testing ipt_multiport/xt_multiport…OK
Testing ipt_REJECT…OK
Testing ipt_state/xt_state…OK
Testing ipt_limit/xt_limit…OK
Testing ipt_recent…OK
Testing xt_connlimit…OK
Testing ipt_owner/xt_owner…OK
Testing iptable_nat/ipt_REDIRECT…OK
Testing iptable_nat/ipt_DNAT…OK

RESULT: csf should function on this server

If you get this output, you can proceed to installation. Otherwise you need to enable each missing modules and then install csf.

Run the installer:
Now there founr installation scripts
install.cpanel.sh For cPanel
install.directadmin.sh
install.generic.sh
install.sh

csf installation for cPanel and DirectAdmin is preconfigured to work on those servers with all the standard ports open.. So install as per your requirement.

#sh install.sh

csf auto-configures your SSH port on installation where it’s running on a non-standard port. CSF also auto-whitelists your connected IP address where possible on installation.
Configuration

By default CSF is in Test mode. So you need to disable the test mode once you configured the firewall correctly. Then only the lfd daemon starts.

“/etc/csf/csf.conf” is the main CSF configuration file.
TCP_IN/TCP_OUT/UDP_IN/UDP_OUT = : These are the ports you want to leave open for your server to operate. If you change the default SSH port make sure to add it here. Also add any other services you might have running such as Shoutcast or game servers. All the ports not mentioed here will be blocked.

LF_DSHIELD = 0: Change this option to 86400. This is an automatic updated list of known attacking IPs. Enabling this will stop them from being able to connect to your server.

Spam Protection Alerts
If you want to add some spam protection, CSF can help. Look in the configuration for the following:

LF_SCRIPT_ALERT = 0 change this to 1. This will send an email alert to the system administrator when the limit configured below is reached within an hour.

LF_SCRIPT_LIMIT = 100 change this to 250. This will alert you when any scripts sends out 250 email messages in an hour.
Providing all the configuration options for CSF here is beyond the scope of the article. Please refer to this README from csf for more details

Note:

If you have installed CSF on cPanel/WHM, it also installs WHM plugin to manage CSF. You can access it from

WHM >> Home >> Plugins >> CnfigServer Firewall
Now TEST all your services to make sure everything is working – SSH, FTP, http. After you do a few quick tests go back into the Firewall Configuration page.

TESTING = 1 change this to 0 and click Change at the bottom. Then Restart csf+lfd using below commands

#csf -r
Or
#/etc/init.d/csf restart

That’s it, the firewall is successfully installed and running!!
Common commands:-

To block an IP Permenently
#csf -d IP

To allow or whitelist IP permenently.
#csf -a IP

To temporary block IP
#csf -td IP

To temporary allow an IP
#csf -ta IP

To check an IP is blocked in firewall
#iptables -nL | grep IP
or
# csf -g IP

To find Reason for block.

#grep IP /var/log/lfd.log

To remove a permanent block
#csf -dr IP

To remove IP from allow list
#csf -ar IP

To disable csf
#csf -x

To enable CSF
#csf -e

To restart
#csf -r
CSF is an increasingly popular alternative to the stock firewalls on some servers. Should you require any other help , please contact me.

Plesk to cPanel Manual migration

By wahab

On June 24, 2013

In Cpanel and WHM, Plesk

Migrating accounts manually is a surprisingly simple task. All that needs to be done are the following:

Populate /etc/trueuserdomains on the source server
Package an account of your choice into a single file
Copy the packaged account to the cPanel server
Restore the account on the cPanel server

Steps:-

1. On the source server (Plesk), download the script that builds the list of accounts at /etc/trueuserdomains:

# wget http://httpupdate.cpanel.net/cpanelsync/transfers_DEVEL/pkgacct/updateuserdomains-universal

and the script that packages the accounts:

#wget http://httpupdate.cpanel.net/cpanelsync/transfers_DEVEL/pkgacct/packages-pXa


2. Make them both of the scripts executable:

# chmod +x updateuserdomains-universal
# chmod +x pkgacct-*


3. Execute updateuserdomains-universal:

# ./updateuserdomains-universal
Now there should be a plain text file at /etc/trueuserdomains that contains a list of accounts that can be packaged.

4. To package an account, select a user from /etc/trueuserdomains (we'll use "alice" in the example below), and run the pkgacct script that we downloaded in the first step.

# ./pkgacct-pXa alice

his will package the entire account to a single file here:
/home/cpmove-alice.tar.gz

The amount of time that this process takes will depend on the size of the account. I would strongly advise running the "screen" command before packaging (and restoring) accounts. This will allow the package/restore processes to continue even if you get disconnected from the server.

Also, if the /home directory is too small, you can specify which partition to use like this:

# ./pkgacct-pXa alice /disk1

where "/disk1" is only an example, and likely does not exist on your server. If it did, and if you ran that command, then you would end up with a file here:

/disk1/cpmove-alice.tar.gz

5. Copy the archive to the new server by running this from the source server:

# scp /home/cpmove-alice.tar.gz root@x.x.x.x:/home

6. On the cPanel server, after running "screen" (if you choose to use screen), run these commands to restore the account:
# cd /home

# /scripts/restorepkg cpmove-alice.tar.gz

Leave a comment if you have any doubts
Thanks!

Server migration

By wahab

On January 22, 2013

In Cpanel and WHM, Linux server, Plesk

On occasion, you may want to move from one server to another. For example, you may be upgrading to a dedicated server or moving to a server with a different PHP deployment method. Server migration is a process in which data is moved from one server to another. Whatever the case, most people will agree that it is never a joyous event to switch server. Your sites will be down/unstable/inaccessible during the migration period and it could potentially lead to loss of sales. In this article, we are going to show you how you can migrate your site to a new server effortlessly and without any (or minimal) downtime. Below are the basic steps needs to be followed for a server migration with minimum downtime.

1. Prepare Your DNS

When you move your site(s) to a new server, you will likely get new IP addresses. The problem is that DNS servers cache domain name queries for as long as possible to provide the fastest response. Because of these DNS caching, once you change your IP, it can take up to three days before the changes propagate throughout the Internet. To keep this from happening, your first step in preparing for the migration is to change your DNS record TTL (Time To Live). This value designates how long your DNS entries should be cached. So the first thing you need to do before migrating is to lower the TTL to reasonable levels.

2. Set up Your New Server

Make sure your new server has the correct operating system installed and ready and that all hardware meets your applications specifications. Also setup the new IP addresses.

3. Tune Your Server

Check your file system and make sure your partitions are set up as you need them. Set up RAID if required. This is also the perfect time to implement any security practices within the OS and firewall (if installed). It’s important to complete these steps before you get too far because they’re much easier to do without content on the server.

4. Install Base Applications

Once you have installed the OS and setup the file system, you are ready to install the base applications, like the Web server, e-mail server, database server, PHP, etc.. Also verify the services are running fine on thr new server.

5. Begin Data Migration

Once the base applications are installed, you are ready to do the initial migration of your application data. This includes the database data, your application code files, mail server account configuration, logs, file caches, etc..

6. Bring your new server to life.

Once the data is migrated the server is configured to work everything correctly, you should change your sites domain DNS records to point to the new server address.

Data Migration

If you are using any Control Panels like cPanel, Plesk, etc., it rather easy to move data/accounts between servers as each control panel will give you option to move accounts.

cPanel Server to cPanel server migration

To migrate from one cPanel server to another, please do this:

1. Log into WHM as root on the new cPanel server

2. Click “Copy multiple accounts/packages from another server”

3. Fill in the required information like source server details and click “Fetch Account List”

You will then be given the option to choose which accounts and packages to transfer.

cPanel also does support migraring accounts from different control panel other than cPanel itself.

Server without a control panel

Rsync is a simple and very powerfull tools which can be used to transfer files between servers efficently.

First copy all the configurations files for the services like Webserver, Email server, etc. Then transfer the account data from old server.

Rsync example:-

#rsync -avz -e ssh /home root@remoteserverip:/home

-v: verbose, will tell you what file its on, how many left to check, etc.
-a: archive, will set most of the preferable options.
–progress: gives you per-file data transfer rates, and spinning progress bars if you’re into that sort of thing.
-z, –compress compress file data during the transfer

System files:-

Please note that we do not need to copy the server related files. We can exclude from the rync list. The most important excludes are the ones that reference hardware and system files that keep track of the server’s status while it’s running. That’s why directories like /boot, /proc, and /dev are essential excludes. The destination server should already have those directories and config files in place and they shouldn’t be overwritten.

Example
#rsync -avz -e ssh –exclude-from=”/home/exclude.txt” /home root@remoteserverip:/home

Finalizing the migration

Doing one pass got the more static files over to the new server. That’s good, but that may not be everything you needed to copy. An active database or a directory where a lot of files get created and deleted may have been copied but changed already. Or, more practically, they may have been in your exclude file.

To get those last files you’ll want to bring the services that use them down. That way you know the entire file will be migrated with no changes made after your last sync.

Edit your exclude file to remove references to the busy files you were holding off on then run the rsync command again.

Upgrading OpenSSH on CentOS 5 server

By wahab

On August 4, 2012

In Cpanel and WHM, Linux server, Plesk

Upgrading openssh

RHEL5 and CentOS 5 run an older version of ssh, which makes doing a chroot sftp or scp more difficult.

Pre-requisites:=

You need to have following packages and it’s dependencies installed:-

Yum install -y rpm-devel rpm-build pam pam-devel perl openssl-devel tcp-wrappers

Steps:-

It is not recommended to build RPM as root user.

1. Login to server using SSH as a normal user.
2. In your home directory create a file .rpmmacros and add following entires to ot.

%_topdir %(echo $HOME)/rpmbuild

3. Next step is creating the build environment. In your home directory, create following directories:-

$mkdir rpmbuild
$cd rpmbuild
$mkdir BUILD RPMS SOURCES SPECS SRPMS

4. Download the latest openssh from their site. http://filedump.se.rit.edu/pub/OpenBSD/OpenSSH/portable/
5. Once it is downloaded, copy the tarball to the rpmbuild/SOURCES directory that you made.
6. You will also need to extract the tarball and copy over the spec file.

$tar xvf openssh-.tar.gz
$cd openssh-
$cp contrib/redhat/openssh.spec $HOME/rpmbuild/SPECS
$cd ..
$cp openssh-.tar.gz rpmbuild/SOURCES

7. Edit the spec file(HOME/rpmbuild/SPECS/openssh.spec).

Also change

%define no_x11_askpass 0
from 0 to 1. We don’t need the X11 accessories for this.

Do the same with

%define no_gnome_askpass 0
for the same reason. Lastly, comment out the line

%define build6x 0
As we’re not building for RHEL6.

8. Build rpm. In $HOME/rpmbuild/SPECS run the following command:-

$rpmbuild -ba openssh.spec
The above command should build and create several rpms in $HOME/rpmbuild/RPMS/i386

9. In the i386 directory holding the rpms run,

$rpm -Uvh openssh*
It should update openssh, openssh-server, and openssh-clients.

10. It will also create a new file in /etc/ssh called sshd_config.rpmnew. Make sure you have a copy of your old sshd_config. The rest of this will be done as root or with root privilege.

#cd /etc/ssh
#cp sshd_config sshd_config.orig
#mv sshd_config.rpmnew sshd_config

11. Restart the SSH service.

#/etc/init.d/sshd restart or
#service sshd restart

Check the versions of the OpenSSH installed

#rpm -qa | grep openssh

Change the passwords of all the cpanel accounts

By wahab

On July 6, 2012

In Cpanel and WHM

There will always be time when you need to change passwords of all the cpanel accounts. Following scripts will allow you to change the passwords of the accounts.

Steps:-

1. Create a file called change.sh and add following code in to it.

ls -1 /var/cpanel/users | while read user; do
# Generate a random password and assign it the variable pass
pass=`echo “$user $pass” >> new-passwords.txt
#Change the password of the account
/scripts/realchpass $user $pass
/scripts/ftpupdate
done

2. Give execution permission to the file you have craeted

chmod +x change.sh

3. Run the script

sh change.sh

This script will change passwords of all the accounts and create a file called new-passwords.txt and stores the user name and passwords of each account in the file.