If you are getting the below error while updating the Plesk versions or installing the microupdates
—-
ERROR: Unable to download the MD5 sum for the new Parallels Installer binary.
Not all packages were installed.
Please, contact product technical support.
—-
Solution
—–
Remove cache from /var/cache/parallels_installer/ and start autoinstaller again.
/usr/local/psa/admin/sbin/autoinstaller –select-product-id plesk –select-release-current –reinstall-patch –install-component base
—–
Unified Communications (UC) Certificates (also called SAN Certificates) use Subject Alternative Names o secure multiple sites (e.g. fully qualified domain names) with one certificate. Four SANs are included in the base price of the UC Certificate, but you can purchase additional names at any time during the lifetime of the certificate.
With a UC Certificate, you can secure:
www.linuxwebhostingsupport.in
www.example2.com
www.example3.net
mail.example.net
dev.example2.com
The CSR generation process is little different for creating an UCC certificates. We will have to create a Openssl based configuration file and then create private key and CSR from it.
Step 1: Create a custom OpenSSL Conf file.
The following is an example conf file that can be used for creation of a SAN/UCC cert. Save it as multissl.conf
———–
[ req ]
default_bits = 2048
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
req_extensions = req_ext # The extentions to add to the self signed cert
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = US
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = Iowa
localityName = Locality Name (eg, city)
localityName_default = Iowa City
organizationName = Organization Name (eg, company)
organizationName_default = The University of Iowa
organizationalUnitName = Organizational Unit Name (eg, section)
organizationalUnitName_default = Domain Control Validated
commonName = Common Name (eg, YOUR SSL domain name)
commonName_max = 64
[ req_ext ]
subjectAltName = @alt_names
[alt_names]
DNS.1 = www.linuxwebhostingsupport.in
DNS.2 = www.example1.com
DNS.3 = example2.com
———–
Notes:
The alt_names section (DNS.1, DNS.2, ….) are the list of all other domain names you wish to secure with this cert. Additional can be added such as DNS.4, etc.
The following examples assume that you name the above config file file multissl.conf (if it is named differently you must adjust the filename in the below examples accordingly.
Step 2: Generate the Private key and CSR with OpenSSL
Execute the following OpenSSL command
$ openssl req -nodes -newkey rsa:2048 -keyout serverfqdn.key -out multidomain.csr -config multissl.conf
* Replace “serverfqdn” with the fully qualified domain name of the server (ie: sample.server.uiowa.edu). Note: it may also be helpful to add a year to the filename.
You will then see output and be prompted for configuration as seen in the following example. Enter your details accordingly.
——————————————
$ openssl req -nodes -newkey rsa:2048 -keyout serverfqdn.key -out multidomain.csr -config multissl.conf
Generating a 2048 bit RSA private key
………………………………….+++
…………………………………………………………+++
writing new private key to ‘serverfqdn.key’
—–
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [US]:US
State or Province Name (full name) [Iowa]:Iowa
Locality Name (eg, city) [Iowa City]:Iowa City
Organization Name (eg, company) [The University of Iowa]:My Company name
Organizational Unit Name (eg, section) [Domain Control Validated]:IT SUPPORT
Common Name (eg, YOUR SSL domain name) []:www.linuxwebhostingsupport.in
——————————————
Note: Replace www.linuxwebhostingsupport.in with the “primary” domain name you want secured with this certificate (likely, but not necessarily the hostname of the machine).
At this point you should have the new key file, and CSR. Save the key file in a secure place, it will be needed to apply the new certificate. The CSR can now be submitted to request the SSL Cert.
SSL Report : www.linuxwebhostingsupport.in
This is a simple guide for setting up a strong TLS/SSL configuration on your server.
If you configure a web server’s TLS configuration, you have primarily to take care of three things:
1. disable SSL 2.0 (FUBAR) and SSL 3.01 (POODLE),
2. disable TLS 1.0 compression (CRIME),
3. disable weak ciphers (DES, RC4), prefer modern ciphers (AES), modes (GCM), and protocols (TLS 1.2).
Your Server’s Certificate
Let’s start with your digital certificate, which is at the core of HTTPS. The certificate enables clients to verify the identity of servers, through a chain of trust from your server’s certificate through intermediate certificates and up to a root certificate trusted by users’ browsers. Your server certificate should be 2048 bits in length. Using 4096 bit certificate is more secure however it require more computation times and hence slow compared to 2048 bit certs.
Basic HTTPS Setup
Here are basic SSL configurations, first for Apache:
; ... SSLEngine on SSLCertificateFile /etc/ssl/certs/your_cert SSLCertificateChainFile /etc/ssl/certs/chained_certs SSLCertificateKeyFile /etc/ssl/certs/your_private_key <;/VirtualHost>;
And then for Nginx:
server {
...
ssl on;
ssl_certificate /etc/ssl/certs/your_cert_with_chain;
ssl_certificate_key /etc/ssl/certs/your_private_key;
ssl_session_cache shared:SSL:50m;
ssl_session_timeout 10m;
}
In Nginx, the ssl_certificate parameter is confusing. It expects your certificate plus any necessary intermediate certificates, concatenated together.
Make sure all of these files are at least mode 0444, except your private key, which should be 0400.
Software versions
On the server side you should update your OpenSSL to 1.0.1c+ so you can support TLS 1.2, GCM, and ECDHE as soon as possible. Fortunately that’s already the case in Ubuntu 12.04 and later.
On the client side the browser vendors are starting to catch up. As of now, Chrome 30, Internet Explorer 11 on Windows 8, Safari 7 on OS X 10.9, and Firefox 26 all support TLS 1.2.
Cipher Suite Configuration
The recommended cipher suites for Apache are follows
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH SSLHonorCipherOrder on
The recommended cipher suite for backwards compatibility (IE6/WinXP):
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4 SSLHonorCipherOrder on
And here’s the same configuration for Nginx:
ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH'; ssl_prefer_server_ciphers on;
The recommended cipher suite for backwards compatibility (IE6/WinXP):
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4"; ssl_prefer_server_ciphers on;
If your version of OpenSSL is old, unavailable ciphers will be discarded automatically. Always use the full ciphersuite above and let OpenSSL pick the ones it supports.
The ordering of a ciphersuite is very important because it decides which algorithms are going to be selected in priority. The recommendation above prioritizes algorithms that provide perfect forward secrecy.
Prioritization logic
ECDHE+AESGCM ciphers are selected first. These are TLS 1.2 ciphers and not widely supported at the moment. No known attack currently target these ciphers.
PFS ciphersuites are preferred, with ECDHE first, then DHE.
AES 128 is preferred to AES 256. At the moment, AES128 is preferred, because it provides good security, is really fast, and seems to be more resistant to timing attacks.
In the backward compatible ciphersuite, AES is preferred to 3DES. BEAST attacks on AES are mitigated in TLS 1.1 and above, and difficult to achieve in TLS 1.0. In the non-backward compatible ciphersuite, 3DES is not present.
RC4 is removed entirely. 3DES is used for backward compatibility
Protocol Support: SSL or no SSL
To prevent downgrade attacks and poodle attack, we will also disable old SSL protocols
For Apache:
SSLProtocol all -SSLv2 -SSLv3
For Nginx:
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
This disables all versions of SSL, enabling only TLS 1.0 and up. All versions of Chrome and Firefox support at least TLS 1.0.
The POODLE bug is a new bug discovered by Google in the SSLv3 protocol. The fix is easy, disable support for SSLv3.
See the google security blog for more info on the bug: http://googleonlinesecurity.blogspot.nl/2014/10/this-poodle-bites-exploiting-ssl-30.html.
Fix POODLE
To fix the bug, disable SSLv3 and use a secure cipherlist. SSL v2 is also insecure, so we need to disable it too.
So edit the Apache config file and add following
SSLProtocol All -SSLv2 -SSLv3
All is a shortcut for +SSLv2 +SSLv3 +TLSv1 or – when using OpenSSL 1.0.1 and later – +SSLv2 +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2, respectively. The above line enables everything except SSLv2 and SSLv3
And then restart the Apache service
service httpd restart
cPanel/WHM
If you have a cPanel server, you should not edit Apache configurations directly, instead you can do this from WHM.
1. Visit your server’s WHM Panel ( https://<yourserversip>:2087 )
2. Navigate to the Apache Configuration Panel of WHM.
3. Scroll down to the ‘Include Editor’ Section of the Apache Configuration.
4. Click ‘Pre Main Include’, which will jump to the corresponding section. Via the drop-down selector, choose ‘All Versions’.
5. An empty dialogue box will appear allowing you to input the needed configuration updates. In this box, copy and paste the following:
SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On
For Nginx
If you’re running an NGINX web server that currently uses SSLv3, you need to edit the NGINX configuration (nginx.conf). You will need to add the following line to your server directive:
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
Then restart the nginx service
service nginx restart
For LiteSpeed:
Update to LiteSpeed version 4.2.18.
For more information about Litespeed & POODLE: http://www.litespeedtech.com/support/forum/threads/lsws-4-2-18-released-%E2%80%94-addresses-poodle-sslv3-vulnerability.9948/
Note about Mail Servers:
The POODLE attack requires the client to retry connecting several times in order to downgrade to SSLv3, and typically only browsers will do this. Mail Clients are not as susceptible to POODLE. However, users who want better security should switch to Dovecot until we upgrade Courier to a newer version.
For cpsrvd:
1. Go to WHM => Service Configuration => cPanel Web Services Configuration
2. Make sure that the “TLS/SSL Protocols” field contains “SSLv23:!SSLv2:!SSLv3”.
3. Select the “Save” button at the bottom.
For cpdavd:
1. Go to WHM => Service Configuration => cPanel Web Disk Configuration
2. Make sure that the “TLS/SSL Protocols” field contains “SSLv23:!SSLv2:!SSLv3”.
3. Select the “Save” button at the bottom.
For Dovecot:
1. Go to WHM => Service Configuration => Mailserver Configuration.
2. SSL Protocols should contain “!SSLv2 !SSLv3”. If it does not, replace the text in this field.
3. Go to the bottom of the page, and select the Save button to restart the service.
For Courier:
Courier has released a new version to mitigate this as of 10/22, until we have an opportunity to review, test, and publish the new version of Courier please switch to Dovecot for enhanced security.
For Exim:
1. Go to Home » Service Configuration » Exim Configuration Manager
2. Under Advanced Editor, look for ‘openssl_options’.
3. Make sure the field contains “+no_sslv2 +no_sslv3”.
4.Go to the bottom of the page, and select the Save button to restart the service.
For Lighttpd:
Lighttpd releases before 1.4.28 allow you to disable SSLv2 only.
If you are running at least 1.4.29, put the following lines in your configuration file:
ssl.use-sslv2 = "disable" ssl.use-sslv3 = "disable"
How to verify the Poodle is disabled
You can use a website like http://poodlebleed.com/ for a web based check.
Manual check
To make sure services on your server are not accepting SSLv3 connections, you can run the openssl client on your server against the SSL ports. This command is run as follows:
openssl s_client -connect linuxwebhostingsupport.in:443 -ssl3
If it fails (which is what you want), you should see something like this at the top of the output:
3078821612:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1257:SSL alert number 40
3078821612:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:596:
A new vulnerability has been found that potentially affects most versions of the Linux and Unix operating systems, in addition to Mac OS X. Known as the “Bash Bug” or “ShellShock,” the GNU Bash Remote Code Execution Vulnerability could allow an attacker to gain control over a targeted computer if exploited successfully. And because Bash is everywhere on Linux and UNix-like machines and interacts with all parts of the operating system, everyone anticipates that it will have lot of repercussions.
How does Shellshock work?
Shellshock exploits a flaw in how Bash parses environment variables; Bash allows functions to be stored in environment variables, but the issue is Bash will execute any code placed after the function in the environment variable value.
For example, an environment variable setting of VAR=() { ignored; }; /bin/id will execute /bin/id when the environment is imported into the bash process.
I am vulnerable?
You can check if you’re vulnerable by running the following lines in your default shell.
env X=”() { :;} ; echo vulnerable” `which bash` -c “echo Check completed”
If you see the word “vulnerable” echo’d back , then you’re at risk.
How Shellshock is Impacting the Web
The most likely route of attack is through Web servers utilizing CGI (Common Gateway Interface), the widely-used system for generating dynamic Web content. An attacker can potentially use CGI to send a malformed environment variable to a vulnerable Web server. The attacker is able to inject environment variables inside all bash process spawned by a web server under the CGI specification. This will occur directly if the CGI script is programmed in bash or indirectly by system calls inside other types of CGI scripts since the environment will propagate to the sub-shell. The vulnerability will automatically be triggered at the shell process instantiation. Furthermore if specific headers are used as attack points, the payload may not appear in the webserver logs, letting a compromise occur with virtually no trace of the intrusion.
Example:
CGI stores the HTTP headers in environment variables. Let’s say the example.com is running a CGI application written in Bash script.
We can modify the HTTP headers such that it will exploit the shellshock vulnerability in the target server and executes our code.
curl -k http://example.com/cgi-bin/test -H “User-Agent: () { :;}; echo Hacked > /tmp/Hacked.txt”
Here, the curl is sending request to the target website with the User-Agent containing the exploit code. This code will create a file “Hacked.txt” in the “/tmp” directory of the server.
What can I do to protect myself?
Major operating software vendors including RedHaT, CentOS, etc are already released a initial patch for this bug.
Debian—https://www.debian.org/security/2014/dsa-3032
Ubuntu—http://www.ubuntu.com/usn/usn-2362-1/
Red Hat—https://access.redhat.com/articles/1200223*
CentOS—http://centosnow.blogspot.com/2014/09/critical-bash-updates-for-centos-5.html
Novell/SUSE— http://support.novell.com/security/cve/CVE-2014-6271.html
If a patch is unavailable for a specific distribution of Linux or Unix, it is recommended that users switch to an alternative shell until one becomes available.
Need expert assistanace?
I can help you to patch your server against this bug and make sure you and your customers are secure. Mail me at therealfreelancer[at]gmail[dot]com.
If you use the rsync utility to keep your backups synchronized between your servers or with a local machine, you might want to prevent the script from using too much bandwidth. However, rsync makes a lots of network I/O. The point of limiting bandwidth is to make sure your backup scripts don’t clog up the network connection.
Naturally, limiting the amount of bandwidth your backups are using is going to make them happen more slowly, but if you can deal with that, this is the way to do it.
Normal rsync command
rsync –avz -e ‘ssh’ /path/to/source user@remotehost:/path/to/dest/
What you’ll want to do is use the –bwlimit parameter with a KB/second value, like this:
rsync –bwlimit=<kb/second> –avz -e ‘ssh’ /path/to/source user@remotehost:/path/to/dest/
So if you wanted to limit transfer to around 10000KB/s (9.7MB/s), enter:
rsync –bwlimit=10000 –avz -e ‘ssh’ /path/to/source user@remotehost:/path/to/dest/
Example:-
rsync –bwlimit=10000 –avz -e ‘ssh’ /backup/ root@192.168.0.51:/backup/
Spoofing is where the mail headers are manipulated to appear as if the mail comes from some other domain. When emails are set to be from an email address on your domain and bounce, they are sent to our servers, attempting to deliver themselves to that mailbox. Generally, you will never see these emails; however, if the email spoofer happens to configure the “From:” header to be a real email box, the bounce will come back to your mailbox and you will receive the email. There is a high chance that a very large number of spam message already sent from server. This can cause high load in the server and sometimes leads to the blacklist of your mail server IP address.
There are two ways in which a spoofed mail can be created.
1. Exploiting vulnerable form to mail scripts to send out spoofed mails through local mail agent.
2. Using stolen mail account login details to send spoofed mails through SMTP authentication.
Let’s look at a solution on how spoofing can be prevented in Exim mail servers commonly implemented in cPanel/WHM servers.
I. Blocking all un-authenticated spoofed outbound emails
1. Login to WHM >> EXIM CONFIGURATION MANAGER >> ADVANCED EDITOR
2. Add the following entry in the top using Add additional configuration setting:
domainlist remote_domains = lsearch;/etc/remotedomains
3. Add the following code under acl_not_smtp :
deny
condition = ${if ! match_domain{${domain:${address:$h_From:}}}{
+local_domains : +remote_domains}}
message = Sorry, you don’t have\
permission to send email from this server with a header that\
states the email is from ${lc:${domain:${address:$h_from:}}}.
accept
Here, the ACL will check for the presence of domain name part of the from address in either of the files – /etc/localdomains or /etc/remotedomains. If there is a mismatch, server will reject the email.
II. Blocking all authenticated spoofed outbound emails
1. WHM >> EXIM CONFIGURATION MANAGER >> ADVANCED EXIM EDITOR
2. Search for acl_smtp_data and add the following lines under it:
deny
authenticated = *
condition = ${if or {{ !eqi{$authenticated_id} {$sender_address} }\
{ !eqi{$authenticated_id} {${address:$header_From:}} }\
}\
}
message = Your FROM address ( $sender_address , $header_From )
must match your authenticated email user ( $authenticated_id ).
Treating this as a spoofed email.
Here, for all authenticated users, the rule will check whether the authenticated userid matches with the from address. If it matches, it will allow the email. Else, it will display the message “Your FROM must match your authenticated email user. Treating this as spoofed email”
PS: If the acl_smtp_data is mentioned as something else(like acl_smtp_data = check_message), locate check_message and add the above lines just under it.
IMPORTANT points to keep in mind
a. POP before SMTP won’t work with this setting. You will have to ask your customers to use the option – “My Server Requires Authentication” in the SMTP settings of their email client.
b. Username in the format user+domain.com will not work. They have to use user@domain.com instead.
Also your customer cannot change the from field to something other than original authentcated user. People use this method in Website Contact forms.
Setting SPF records
Another way to prevent spoofing is using SPF records. You must specify valid spf records for your domain, so that only the intended people or server can send mails on behalf of your domain name.
Apache: Multiple SSL websites on a single IP address
Update: This is a new update from a cPanel Tech
“There is nothing to enable. As long as you are using cPanel & WHM version 11.38 on CentOS, RHEL, or CloudLinux version 6 or newer, SNI works out of the box”.
One of the frustrating limitations in supporting secure websites has been the inability to share IP addresses among SSL websites.
When website administrators and IT personnel are restricted to use a single SSL Certificate per socket (combination of IP Address and socket) it can cost a lot of money. Well we can actually share IP addresses for multiple secure websites. Solving this limitation required an extension to the Transport Layer Security (TLS) protocol that includes the addition of what hostname a client is connecting to when a handshake is initiated with a web server. The name of the extension is Server Name Indication (SNI). SNI is supported in Apache v2.2.12 , and OpenSSL v0.9.8j or later.
With SNI, you can have many virtual hosts sharing the same IP address and port, and each one can have its own unique certificate
Prerequisites to use SNI
Use OpenSSL 0.9.8f or later
Build OpenSSL with the TLS Extensions option enabled (option enable-tlsext; OpenSSL 0.9.8k and later has this enabled by default).
Apache must have been built with that OpenSSL (./configure –with-ssl=/path/to/your/openssl). In that case, mod_ssl will automatically detect the availability of the TLS extensions and support SNI.
Apache must use that OpenSSL at run-time, which might require setting LD_LIBRARY_PATH or equivalent to point to that OpenSSL, maybe in bin/envvars. (You’ll get unresolved symbol errors at Apache startup if Apache was built with SNI but isn’t finding the right openssl libraries at run-time.)
Setting up SNI with Apache
The configuration is pretty simple and straight forward, though I recommend making a backup of your existing httpd.conf file before proceeding.
# Ensure that Apache listens on port 443 Listen 443 # Listen for virtual host requests on all IP addresses NameVirtualHost *:443 # Go ahead and accept connections for these vhosts # from non-SNI clients SSLStrictSNIVHostCheck off # Because this virtual host is defined first, it will # be used as the default if the hostname is not received # in the SSL handshake, e.g. if the browser doesn't support # SNI. DocumentRoot /www/example2 ServerName www.linuxwebhostingsupport.in # Other directives here SSLEngine On SSLCertificateFile /path/to/linuxwebhostingsupport.in.crt SSLCertificateKeyFile /path/to/linuxwebhostingsupport.in.key SSLCertificateChainFile /path/to/CA.crt DocumentRoot /www/example2 ServerName www.abdulwahabmp.co.in # Other directives here SSLEngine On SSLCertificateFile /path/to/abdulwahabmp.co.in.crt SSLCertificateKeyFile /path/to/abdulwahabmp.co.in.key SSLCertificateChainFile /path/to/CA.crt
That it!!!. Just restart APache service. Now go and check your Websites using https. That should be working.
Plesk support SNI from 10.2.x version onwards.
SNI will work on following Operating systems out of box
OpenSuSE Linux 11.3 or later.
Ubuntu Linux 10.4 or later.
Debian Linux 6.0 or later.
RedHat Linux 6.0 or later.
CentOS Linux 60.0 or later
Supported Desktop Browsers
Internet Explorer 7 and later
Firefox 2 and later
Opera 8 with TLS 1.1 enabled
Google Chrome:
Supported on Windows XP on Chrome 6 and later
Supported on Vista and later by default
OS X 10.5.7 in Chrome Version 5.0.342.0 and later
Chromium 11.0.696.28 and later
Safari 2.1 and later (requires OS X 10.5.6 and later or Windows Vista and later).
Note: No versions of Internet Explorer on Windows XP support SNI
ConfigServer firewall is a popular Linux firewall security suite. It is easy to install, flexible to configure and secure with extra checks.
CSF is generally considered a more advanced firewall as there are more configuration options compared to other firewalls, while still being simple enough to install and configure that even novice administrators can use it. Some of the MANY functions of CSF are given below:-
Removing Your Current Firewall
To prevent any conflicts in operation we will need to remove your current firewall. The most common software firewalls on our dedicated servers are APF and CSF, so we have provided instructions on how to remove APF below. If you are using a different software firewall be sure to follow that programs uninstall directions before continuing. After completing the uninstall continue with the CSF installation below.
Using Yum to Remove APF
If it was installed via yum, which is most likely, you will first need to identify the name of your APF package:
rpm -qa |grep -i apf
In this case:
[root@host ~]# rpm -qa | grep apf
apf-9.6_5-1
In order to remove that package, and get your server ready for CSF installation, run the following command:
[root@host ~]# rpm -e apf-9.6_5-1
If you see this:
[root@host ~ ]# rpm -e apf-9.6_5-1
error: Failed dependencies:
apf >= 9.6_5-1 is needed by (installed) bfd-1.2-1.noarch
It means you have BFD installed, and it will need to be removed before you can proceed to removing APF:
[root@host ~ ]# rpm -e bfd-1.2-1.noarch
Then attempt to remove apf again:
[root@host ~ ]# rpm -e apf-9.6_5-1
Any further dependency errors can be handled in the same way as long as you are aware of what you are removing. If you have any questions or get stuck at any point feel free to contact me here.
Removing Source Installed APF
This can be a bit trickier, and if you are not sure what you’re doing you may want to contact me . If you are confident and wish to proceed you will find a list of commands below that you can use to remove APF if it is installed in the most common CentOS directories.
Stopping APF and iptables clears all of the rules from your firewall and ensures that removing the APF installation won’t cause access problems:
[root@host ~ ]# /etc/init.d/iptables stop
[root@host ~ ]# /etc/init.d/apf stop
Remove all of the APF related files:
[root@host ~ ]# rm -Rfv /etc/apf
[root@host ~ ]# rm -fv /etc/cron.daily/fw
[root@host ~ ]# rm -fv /etc/init.d/apf
Remove APF from the list of programs that start at boot:
[root@host ~ ]# chkconfig apf off
Installing CSF
So, login to your server via ssh and let’s start CSF installation by retrieving the package files using wget command:
# wget http://configserver.com/free/csf.tgz
Unpack the archive:
# tar xfvz csf.tgz
Navigate to the uncomperssed csf directory:
# cd csf
Check CSF will work on your server
CSF provides a test script. We can check whether CSF works with your Server or not prior to installing it.
#perl csftest.pl
Testing ip_tables/iptable_filter…OK
Testing ipt_LOG…OK
Testing ipt_multiport/xt_multiport…OK
Testing ipt_REJECT…OK
Testing ipt_state/xt_state…OK
Testing ipt_limit/xt_limit…OK
Testing ipt_recent…OK
Testing xt_connlimit…OK
Testing ipt_owner/xt_owner…OK
Testing iptable_nat/ipt_REDIRECT…OK
Testing iptable_nat/ipt_DNAT…OK
RESULT: csf should function on this server
If you get this output, you can proceed to installation. Otherwise you need to enable each missing modules and then install csf.
Run the installer:
Now there founr installation scripts
install.cpanel.sh For cPanel
install.directadmin.sh
install.generic.sh
install.sh
csf installation for cPanel and DirectAdmin is preconfigured to work on those servers with all the standard ports open.. So install as per your requirement.
#sh install.sh
csf auto-configures your SSH port on installation where it’s running on a non-standard port. CSF also auto-whitelists your connected IP address where possible on installation.
Configuration
By default CSF is in Test mode. So you need to disable the test mode once you configured the firewall correctly. Then only the lfd daemon starts.
“/etc/csf/csf.conf” is the main CSF configuration file.
TCP_IN/TCP_OUT/UDP_IN/UDP_OUT = : These are the ports you want to leave open for your server to operate. If you change the default SSH port make sure to add it here. Also add any other services you might have running such as Shoutcast or game servers. All the ports not mentioed here will be blocked.
LF_DSHIELD = 0: Change this option to 86400. This is an automatic updated list of known attacking IPs. Enabling this will stop them from being able to connect to your server.
Spam Protection Alerts
If you want to add some spam protection, CSF can help. Look in the configuration for the following:
LF_SCRIPT_ALERT = 0 change this to 1. This will send an email alert to the system administrator when the limit configured below is reached within an hour.
LF_SCRIPT_LIMIT = 100 change this to 250. This will alert you when any scripts sends out 250 email messages in an hour.
Providing all the configuration options for CSF here is beyond the scope of the article. Please refer to this README from csf for more details
Note:
If you have installed CSF on cPanel/WHM, it also installs WHM plugin to manage CSF. You can access it from
WHM >> Home >> Plugins >> CnfigServer Firewall
Now TEST all your services to make sure everything is working – SSH, FTP, http. After you do a few quick tests go back into the Firewall Configuration page.
TESTING = 1 change this to 0 and click Change at the bottom. Then Restart csf+lfd using below commands
#csf -r
Or
#/etc/init.d/csf restart
That’s it, the firewall is successfully installed and running!!
Common commands:-
To block an IP Permenently
#csf -d IP
To allow or whitelist IP permenently.
#csf -a IP
To temporary block IP
#csf -td IP
To temporary allow an IP
#csf -ta IP
To check an IP is blocked in firewall
#iptables -nL | grep IP
or
# csf -g IP
To find Reason for block.
#grep IP /var/log/lfd.log
To remove a permanent block
#csf -dr IP
To remove IP from allow list
#csf -ar IP
To disable csf
#csf -x
To enable CSF
#csf -e
To restart
#csf -r
CSF is an increasingly popular alternative to the stock firewalls on some servers. Should you require any other help , please contact me.
Hi
This is simple BIND dns server setup. You can use this for a reference. Yes, it will work because i have tested in real dedicated servers.
Installation:-
If the DNS daemon is not installed on your server, installing it is very simple. Using the built in package manager “YUM” (YellowDog Updater Modified) you can install the DNS daemon with “yum install bind”. The resulting screen will appear something like the below image, type “y” to continue the installation.
There are very few files for the BIND daemon configuration that the user will need to modify. First is the main configuration file which is referred to as named.conf and is found in the /etc directory. The other file you will need to address is the zone file for your specific domain. These files are normally located in /var/named and have filenames like domain.com.hosts.
Let’s start with the named.conf file. Using your favorite editor (if you do not have one I recommend nano as a simple text editor) open the file for editing. An example of this command using nano would be “nano /etc/named.conf”. This file can contain hundreds of options and settings, but we’re only going to concern ourselves with a select few for this configuration.
For security we will disable recursion. This is important due to spoofed DNS queries to DNS servers which allow recursion used to attack/overload a remote DNS host. So find the line that contains “recursion” and change the “yes” to “no”. This line will be in the options section, but if you cannot locate the line, use the “CTRL+W” key command to locate where the line is.
In this same section we also want to change the “listen-on” line. By default the server only listens on its local loopback port. The IP address “127.0.0.1” for IPv4 and “::1” for IPv6 is already entered into this line, remove these loopback addresses and enter your IP address or “0.0.0.0” for IPv4 and “::” for IPv6. These changes will allow your publically accessible IP addresses to respond to DNS queries. The last line in this section that must be changed is the “allow-query” line. The default setting is to not allow other hosts to query your DNS server. Change the word “localhost” in this line to “0.0.0.0” to allow anyone to query your server for the DNS information regarding the domains you host on the server.
You’re not finished with this file yet. You need to add an entry to tell the DNS server to load the zone file for the domain you want to host. Use the down arrow to move to the last line of the file and hit enter once or twice.
You are going to enter these lines, replacing “yourdomain.tld” with your domain name. For example replace “yourdomain.tld” with “serverpronto.com”. Do not put a www or mail or any other text in front of the domain name, those are hostnames or subdomains are not configured in this file.
zone “yourdomain.tld” {
type master;
file “/var/named/yourdomain.tld.db”;
notify yes;
allow-transfer { Slave-DNS-Server; };
};
The line that begins with “notify” and the line that follows only apply if you are using a slave DNS server and should be omitted if you are hosting your DNS on a single server. However, I must mention that a single server DNS configuration is not recommended.
Save this file with “CTRL+O” and exit the file with CTRL+X”.
Now you need to create the file that the configuration in /etc/named.conf pointed to. This file also has a very specific structure and syntax. The file you want to create will be in the /var/named directory. To create the file and edit it all at once type “/var/named/yourdomain.tld.db” replacing the “yourdomain.tld” as you did when entering the data in the named.conf file.
After you open the new file it will be empty. The contents of the file will be grouped by purpose, the first section is information for the DNS server to manage the DNS zone’s status, configuration and updates.
$TTL 86400 ; Time To Live before remote DNS server removes stale records from cache
@ IN SOA ns1.yourdomain.tld. useremail.yourdomain.tld. ( ; Responsible name server and responsible email address without the “@” symbol.
1123161063 ; serial number
10800 ; refresh (3 hours)
3600 ; retry (1 hour)
604800 ; expire (1 week)
3600 ; minimum (1 hour)
)
The above text is the first section of the file. The text in red can be left out or copied into teh file, that text is descriptive as to what the items is. Some further explanation is:
TTL – This is the time a remote DNS server will hold a record in its cache before refreshing the cache for a new record when requested again. Shorten this number to make frequent changes or a week before a major change to propagate changes quickly. Increase this number to reduce overall load on the server and allow remote DNS servers to provide data from cache and not query the server as frequently.
SOA – “Start of Authority” record. This is a specific record type used to provide responsible server and persons data.
Serial Number – This number tacks zone file versions among multiple primary/secondary DNS servers.
The remaining numbers tell the DNS servers when to refresh or expire records, and can safely be left at the default setting.
The next records that must be added to the zone file are the NS records to provide the name server data to querying clients. The NS records will look like this:
IN NS ns1.yourdomain.tld.
IN NS ns2.yourdomain.tld.
Please make note of the “.” (dot) behind records that contain hostnames. This is an important item throughout the files. These nameserver (NS) records generally match the nameserver records you create with your registrar and must contain valid hostnames that are valid “A” records within the domain they refer to. Additionally these nameservers referred to in these lines must host your domain.
The next record you should insert into the file is the MX record which identifies the Mail Exchanger (MX) host for your domain. This record should appear like this:
IN MX 10 mail.yourdomain.tld.
The hostname you use for this record must be a valid “A” record or “CNAME” record in the domain and should respond to email transfers for your domain.
Now we begin the main record portion of the file. The records you will now enter refer to hosts within the domain. Here is an example of some of the records you may enter:
IN A 127.0.0.1
mail IN A 127.0.0.1
www IN CNAME yourdomain.tld.
ns1 IN A 127.0.0.1
ns2 IN A 127.0.0.2
After you look over these lines I want to point out a few items.
Once the records are entered, save this file with “CTRL+O” and exit the file with CTRL+X”.
Now that all of the data is entered for your domain simply applying these changes should activate the DNS zone on your server. To apply the changes restarting the DNS daemon is required. Use this command to restart the daemon:
“service named restart”
The textual output on the server should indicate success or failure. If success is indicated there is only one last item to check and that is the firewall rules to ensure the client queries will be allowed. Use this command to query the firewall rules for UDP port 53 access:
“iptables -vnL | grep 53″
The server should respond with a line similar to this:
” 0 0 ACCEPT udp — * * 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:53″
If this response is not received please review your IPtables rules to make changes to allow the queries.
Powered by WordPress & Theme by Anders Norén