Upgrading OpenSSH on CentOS

If you’ve taken a peek at your PCI scan results lately, you may have noticed that your scan provider is now requiring OpenSSH 6.6 or higher due to CVE-2014-2532 – a version that is not currently available in the CentOS 5 or 6 repositories. A Yum update isn’t going to help you much there.

You can, however, easily compile your own RPM and manually upgrade OpenSSH. The commands below are the ones I used to install version 6.6 (the latest stable at the time of this post), but can essentially be used for any compatible version.

First, download the OpenSSH source tarball from the vendor and unpack it. You can find the tarballs at http://www.openssh.com/portable.html

cd /usr/src

wget http://mirror.team-cymru.org/pub/OpenBSD/OpenSSH/portable/openssh-6.8p1.tar.gz

tar -xvzf openssh-6.8p1.tar.gz

You may need to install a few things for the RPM build to work:

yum install rpm-build gcc make wget openssl-devel krb5-devel pam-devel libX11-devel xmkmf libXt-devel

Copy the spec file and tarball:

mkdir -p /root/rpmbuild/{SOURCES,SPECS}

cp ./openssh-6.8p1/contrib/redhat/openssh.spec /root/rpmbuild/SPECS/

cp openssh-6.8p1.tar.gz /root/rpmbuild/SOURCES/

Do a little magic:

cd /root/rpmbuild/SPECS
sed -i -e "s/%define no_gnome_askpass 0/%define no_gnome_askpass 1/g" /usr/src/redhat/SPECS/openssh.spec
sed -i -e "s/%define no_x11_askpass 0/%define no_x11_askpass 1/g" /usr/src/redhat/SPECS/openssh.spec
sed -i -e "s/BuildPreReq/BuildRequires/g" /usr/src/redhat/SPECS/openssh.spec

…and build your RPM:

rpmbuild -bb openssh.spec

Now if you go back into /root/rpmbuild/RPMS/<arch> , you should see three RPMs. Go ahead and install them:

rpm -Uvh *.rpm

To verify the installed version, just type ‘ssh -v localhost’ and you should see the banner come up, indicating the new version.

*IMPORTANT! You may want to open a new SSH session to your server before exiting, to make sure everything is working! If you have a problem, simply:

yum downgrade openssh-server

By thecpaneladmin.com 

Protecting from DDOS Attacks

If you want to protect your apache webserver against DOS,DDOS or brute force attacks use mod_evasive module.mod_evasive is an evasive maneuvers module for Apache to provide evasive action in the event of an HTTP DoS or DDoS attack or brute force attack. It is also designed to be a detection and network management tool, and can be easily configured to talk to ipchains, firewalls, routers, and etcetera. mod_evasive presently reports abuses via email and syslog facilities.

Detection is performed by creating an internal dynamic hash table of IP Addresses and URIs, and denying any single IP address from any of the following:

* Requesting the same page more than a few times per second

* Making more than 50 concurrent requests on the same child per second

* Making any requests while temporarily blacklisted (on a blocking list)

This method has worked well in both single-server script attacks as well as distributed attacks, but just like other evasive tools, is only as useful to the point of bandwidth and processor consumption (e.g. the amount of bandwidth and processor required to receive/process/respond to invalid requests), which is why it's a good idea to integrate this with your firewalls and routers for maximum protection.

This module instantiates for each listener individually, and therefore has a built-in cleanup mechanism and scaling capabilities. Because of this per-child design, legitimate requests are never compromised (even from proxies and NAT addresses) but only scripted attacks. Even a user repeatedly clicking on 'reload' should not be affected unless they do it maliciously. mod_evasive is fully tweakable through the Apache configuration file, easy to incorporate into your web server, and easy to use.

Install mod_evasive in Debian:

#apt-get install libapache2-mod-evasive

This will complete the installation

Test mod_evasive Module

open any browser,open your apache server home page, and click the reload button as fast as you can.

by: http://bigmyx.blogspot.com.br/2011/06/protecting-from-ddos-attacks.html

tags: ddos, protecting ddos, ddos protection, ddos mitigation

Block backup in cPanel, during business hours

Block backup in cPanel, during business hours

This example will release the full backup in cPanel from 23:00 PM to 06:00 AM everyday including Sunday:


In the shell type the following command:

env EDITOR=nano crontab -e

At the end of the file enter:

00 23 * * 1,2,3,4,5,6,7 chmod 755 /scripts/pkgacct 

00 06 * * 1,2,3,4,5,6,7 chmod 000 /scripts/pkgacct

Type CTRL + X (to exit), then Y (To tell you want to save changes) and ENTER (To confirm you want to save the file).

Now restart CRON service, your server:

/etc/init.d/crond restart

How to enable Xcache in cPanel to speed up website?

Xcache can be enabled in cPanel by using Easy Apache.

1. Log into your cPanel server
2. After you login, search for "EasyApache" in left column and click on the link
3. Select "Previously Saved Config" and click on "start customizing"
4. For both Apache and PHP, click on "next step" button
5. Look for "xcache for php" and check the box
6. Click on "save and build"
7. Allow the build process to finish
8. To enable xcache, you will need to make changes to php.ini before it can be used by your scripts.
   1. Login into your server using SSH
   2. After you login, enter "pico  /usr/local/lib/php.ini"
   3. Hold ctrl+W and search for "xcache"
   4. Make necessary changes and to enter ctrl+O to save the file
   5. Aftererwards you will need to restart Apache in WHM for changes to take affect

Here is recommended settings for xcache in cPanel ---  

xcache.admin.pass=""xcache.admin.user="mOo"xcache.cacher="On"xcache.coredump_directory=""xcache.count="1"xcache.coveragedump_directory="/tmp/pcov/"xcache.coverager="Off"xcache.gc_interval="300"xcache.mmap_path="/dev/zero"xcache.optimizer="On"xcache.readonly_protection="Off"xcache.size="50M"xcache.slots="8K"xcache.test="Off"xcache.ttl="3600"xcache.var_count="2"xcache.var_gc_interval="300"xcache.var_maxttl="7200"xcache.var_size="16M"xcache.var_slots="8K"xcache.var_ttl="3600" 

How to Install CSF firewall in cPanel?

CSF firewall is fairly easy to install and require only few steps through SSH.  Please follow the steps at the following url -http://configserver.com/free/csf/install.txt

If you still need assistance, please contact our support team.

rm -fv csf.tgz
wget http://www.configserver.com/free/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh