Harnessing the Power of Linux

Linux is a powerful and stable platform that enables us to perform a variety of tasks, such as penetration testing, hosting, VPN management, and firewall configuration, which are not easily achievable on a Windows platform. In this article, I will highlight some of the most useful tools and commands you will need for managing servers or desktops effectively.

Linux offers several advantages over Windows that have made my life significantly easier:

Stability and Performance: Linux is renowned for its stability and performance, especially when running server applications. This ensures minimal downtime and efficient resource usage.
Security: Linux has robust security features, making it less vulnerable to malware and attacks. The open-source nature allows for quick patches and community-driven improvements.
Flexibility and Customization: With Linux, you can customize nearly every aspect of the operating system to suit your needs, from the kernel to the desktop environment.
Command Line Efficiency: The powerful command-line interface allows for efficient management of tasks, automation through scripting, and access to a wide range of utilities and tools.
Cost-Effectiveness: Linux is free and open-source, reducing licensing costs and providing access to a plethora of free software and tools.

By leveraging these advantages, Linux has greatly simplified the management of my servers and desktops, streamlining workflows and enhancing productivity.

Below, I will share some of the most useful commands to make your life easier:

Useful Commands Index:

Good Linux Flavors:

Linux Kodachi security distribution developed by EEDS.
Other recommended security distributions Tails, JonDo, Qubes-os, SubgraphOS, Whonix.
Centos is best used in servers for web hosting EEDS uses CentOs 64 to host all the websites.
Linux Mint is best to be used in desktops for daily tasks if you need to replace Windows then go for it.
Debian is best for VPS nods where you have to host minor services such as VPN and Proxy services.
Kali Matriux Parrot BlackArch Weaknetlabs Cyborghawk Pentoo Bugtraq Samurai is best to be used for penetration testing it has most of the tools you need. Don’t miss shygirl script which is a cool add-on for Kali – Backtrack that we have written.
Debian can also be used for hosting OS virtual images such as Vmware and Virtualbox. If you need to combine both beauty and lightness go for Linux Mint Debian version which its based on Debian directly and not on Ubuntu.
If you are looking for very light open-source network boot firmware with plenty of features use IPXE.

Useful Packages:

For CentOs where you host websites additionally, you will need the following packages:

Htop to view system usage CPU + ram ..etc better than Linux top command.
Mytop to view MySQL database queries.
CSF user friendly and powerful firewall.
CXS exploit scanner.
CalmAv Anti virus for Linux.
Cpanel user friendly OS management software.

Packages and Installation

To install cxs exploit scanner:

wget https://www.configserver.com/cp/cxs.html  # Get the install script from http://www.configserver.com/cp/cxs.html
tar -xzf cxsinstaller.tgz
perl cxsinstaller.pl
rm -fv cxsinstaller.*

To install prm:

wget http://www.rfxnetworks.com/downloads/prm-current.tar.gz
tar xvfz prm-current.tar.gz
cd prm-*/
./install.sh

To install csf firewall:

wget http://www.configserver.com/cp/csf.html
tar -xzf csf.tgz
cd csf
sh install.sh

To install htop:

wget https://www.rpmfind.net/linux/rpm2html/search.php?query=htop
rpm -Uvh htop-1.0.3-1.el6.rf.x86_64.rpm

To remove rpm package htop as an example:

rpm -e htop

How to install Apache + PHP + Mysql on Ubuntu box:

ShellScript

sudo su
apt-get install apache2 -y
apt-get install php5 libapache2-mod-php5 -y
apt-get install mysql-server mysql-client -y
/etc/init.d/apache2 restart
sudo a2enmod ssl
sudo ln -s /etc/apache2/sites-available/default-ssl /etc/apache2/sites-enabled/000-default-ssl
sudo /etc/init.d/apache2 restart
cd /var/www

ShellScript

Update Apcache and PHP vis ssh:

/scripts/easyapache

To update Mysql:

/scripts/mysqlup

Force ftp to update via ssh if cpanel is installed:

/scripts/ftpup --force

Install ms fonts on Ubuntu or Linux Mint:

sudo apt-get install msttcorefonts

Updating ubuntu:

ShellScript

update Ubuntu
apt-get update
apt-get upgrade
apt-get update && apt-get dist-upgrade

ShellScript

Update Backtrack:

ShellScript

update ubuntu
apt-get update
apt-get upgrade
apt-get update && apt-get dist-upgrade
msfupdate
apt-get install libcrafter blueranger dbd inundator intersect mercury cutycapt trixd00r artemisa rifiuti2 netgear-telnetenable jboss-autopwn deblaze sakis3g voiphoney apache-users phrasendrescher kautilya manglefizz rainbowcrack rainbowcrack-mt lynis-audit spooftooph wifihoney twofi truecrack uberharvest acccheck statsprocessor iphoneanalyzer jad javasnoop mitmproxy ewizard multimac netsniff-ng smbexec websploit dnmap johnny unix-privesc-check sslcaudit dhcpig intercepter-ng u3-pwn binwalk laudanum wifite tnscmd10g bluepot dotdotpwn subterfuge jigsaw urlcrazy creddump android-sdk apktool ded dex2jar droidbox smali termineter bbqsql htexploit smartphone-pentest-framework fern-wifi-cracker powersploit webhandler

ShellScript

Removing old kernels to have space for new kernel installations (/boot) – CentOS:
Recommended way:

ShellScript

#Edit /etc/yum.conf and set the following parameter
installonly_limit=2
yum install yum-utils 
package-cleanup --oldkernels --count=2
#Done. This will erase in a good fashion the old kernels, and, keep just the last 2 of them for the next upgrades.

ShellScript

Old way:

ShellScript

uname -r
rpm -q kernel
rpm -e the-old-kernel    #example : rpm -e kernel-2.6.32-279.el6.x86_64
yum update
#check if the new kernel is there:
cat /boot/grub/grub.conf
#reboot
shutdown -r now

ShellScript

Install FTP server (vsftpd) for Ubuntu:

ShellScript

sudo apt-get install vsftpd
nano /etc/vsftpd.conf
#uncomment the follwoing:
write_enable=YES
chroot_local_user=YES 
local_enable=YES
sudo service vsftpd restart

ShellScript

Install Webmin For Ubuntu:

ShellScript

sudo apt-get install perl libnet-ssleay-perl openssl libauthen-pam-perl libpam-runtime libio-pty-perl apt-show-versions python
wget http://prdownloads.sourceforge.net/webadmin/webmin_1.650_all.deb
sudo dpkg -i webmin_1.650_all.deb
#access it via web browser 
https://yourip:10000/
#For some reasons webmin won't auto start after reboot you need to run this command to get it working again:
sudo /etc/init.d/webmin start

ShellScript

Install or upgrade Openssl on Centos (Compile from source):

ShellScript

wget http://www.openssl.org/source/openssl-1.0.0k.tar.gz
tar xvfz openssl-1.0.0k.tar.gz
cd openssl-1.0.0k 
make clean
./config shared –prefix=/usr –openssldir=/usr/local/openssl
make && make test
make install

ShellScript

Install or upgrade Openssl on Centos via yum:

ShellScript

sudo rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-6-1.noarch.rpm
yum --enablerepo=axivo update openssl
# or
yum --enablerepo=axivo install openssl

ShellScript

Uninstall a library in Linux opposite of make install:

make clean
make uninstall

Find if package is installed on Centos for example (openssl):

su -c 'yum list openssl'
rpm -qa | grep openssl

Instal apache + php + SSL on Debian and Ubuntu:

sudo apt-get install apache2 php5 openssl ssl-cert 
sudo a2ensite default-ssl
sudo a2enmod ssl
sudo service apache2 restart

Install liver-helper on the Debian system to create the fresh live images:

ShellScript

nano /etc/apt/sources.list
# Add the following
deb https://www.debian.org/CD/live/ wheezy-snapshots main contrib non-free
deb-src https://www.debian.org/CD/live/ wheezy-snapshots main contrib non-free

apt-get update
apt-get install live-build
mkdir /root/my-livecd
cd /root/my-livecd
lb clean
lb config --interactive shell   # To disable interactive shell use lb config --interactive disabled
lb build
exit
# A file called  binary-hybrid.iso will be on same folder

ShellScript

Create live image from current installation on Debian or Ubuntu:

ShellScript

wget -O - http://www.remastersys.com/debian/remastersys.gpg.key | apt-key add -
nano /etc/apt/sources.list
# Add the following:
deb http://www.remastersys.com/ wheezy main
deb-src http://www.remastersys.com/ wheezy main
# For Ubuntu use the following:
deb http://www.remastersys.com/ubuntu precise main
deb http://www.remastersys.com/ubuntu quantal main

sudo apt-get update
sudo apt-get install remastersys

# Usage sudo remastersys backup|clean|dist [cdfs|iso] [filename.iso]
# Config global settings
nano /etc/remastersys.conf
# To make a livecd/dvd backup and call the iso custom.iso with user personal folders:
sudo remastersys backup Debian-live-custom.iso 
# or 
sudo remastersys backup Ubuntu-live-custom.iso 

# To clean up temporary files of remastersys
sudo remastersys clean

To make a livecd/dvd backup and call the iso custom.iso without user personal folders:
sudo remastersys dist custom.iso

# To make a distributable livecd/dvd filesystem only
sudo remastersys dist cdfs

ShellScript

How to install ConfigServer ModSecurity Control:

wget http://download.configserver.com/cmc.tgz
tar -xzf cmc.tgz
cd cmc/
sh install.sh

How to install Commodo Web Application Firewall:
First you will need access from here.

wget https://waf.comodo.com/cpanel/cwaf_client_install.sh
sh cwaf_client_install.sh

To add to Commodo Web Application Firewall Cpanel ModSecurity™ Vendors you need to imort the following file:

https://waf.comodo.com/doc/meta_comodo_apache.yaml

To check all ModSecurity™ Vendors installed by Cpanel:

cat /var/cpanel/modsec_cpanel_conf_datastore

If apache won’t start due errors on CWAF rules run the following:

/usr/local/cpanel/scripts/modsec_vendor update --auto

or if problem is not fixed:

rm -rf /var/cpanel/cwaf/rules/*
/var/cpanel/cwaf/scripts/updater.pl

After upgrading WHM Perl gets updated and CWAF won’t start throwing the following error:
No response from subprocess (/usr/local/cpanel/whostmgr/docroot/cgi/addon_cwaf.cgi): The subprocess reported error number 2 when it ended.
To solve it:

cp -avr /var/cpanel/cwaf/modules/CPAN/lib/* /usr/local/cpanel/3rdparty/perl/522/lib64/perl5/cpanel_lib

Install FFmpeg on CentOS:

ShellScript

nano /etc/yum.repos.d/atrpms.repo
# paste the following:
[atrpms]name=Fedora Core $releasever - $basearch - ATrpms baseurl=http://dl.atrpms.net/el$releasever-$basearch/atrpms/stable gpgkey=http://ATrpms.net/RPM-GPG-KEY.atrpms enabled=1 gpgcheck=1 # Then run: yum update yum install ffmpeg # To check the version: ffmpeg -version

ShellScript

To install Elasticsearch on CentOS:

ShellScript

cd ~
sudo yum update
su -c "yum install java-1.8.0-openjdk"

wget https://download.elastic.co/elasticsearch/elasticsearch/elasticsearch-1.7.2.zip  
unzip elasticsearch-1.7.2.zip 
rm -f elasticsearch-1.7.2.zip
mv elasticsearch-* elasticsearch 
sudo mv elasticsearch /usr/local/share

curl -L http://github.com/elasticsearch/elasticsearch-servicewrapper/tarball/master | tar -xz
mv *servicewrapper*/service /usr/local/share/elasticsearch/bin/
rm -Rf *servicewrapper*
sudo /usr/local/share/elasticsearch/bin/service/elasticsearch install
sudo /etc/init.d/elasticsearch start

# To test
curl http://localhost:9200 

To check how many records have been stored to elasticsearch's search index:

curl -XGET 'http://localhost:9200/wcf/com_woltlab_wbb_post/_count?q=*'

ShellScript

To install ImageMagick:

yum install ImageMagick

To install RED5 server on a Debian node:

ShellScript

apt-get update
apt-get install red5-server
service red5-server start


# Ports that should be opened by now:
RTMP: 1935
Debug proxy: 1936
HTTP servlet: 5080
RTMPT: 8088

# Navigate to verify its there
http://fpus3.digi77.com:5080/

# Install Cometchat Whiteboard plugin
cd /usr/share/red5/webapps
wget http://www.cometchat.com/extra/ccred5whiteboard.tar.gz
tar -xzf ccred5whiteboard.tar.gz
mv ccred5whiteboard.tar.gz ccred5whiteboard.tar
tar xvf ccred5whiteboard.tar

# Install Cometchat Screenshare plugin
wget http://www.cometchat.com/extra/ccred5screenshare.tar.gz
tar -xzf ccred5screenshare.tar.gz
mv ccred5screenshare.tar.gz ccred5screenshare.tar
tar xvf ccred5screenshare.tar

rm -f ccred5whiteboard.tar
rm -f ccred5screenshare.tar

service red5-server restart

ShellScript

To disable ApacheBooster:

/scripts/manage_apacheboooster --disable

To enable ApacheBooster:

/scripts/manage_apacheboooster --enable

To update ApacheBooster:

/scripts/updateapachebooster

To install Let’s Encrypt plugin for SSL certificates and enable it on WHM Cpanel:

/scripts/install_lets_encrypt_autossl_provider

To disable and uninstall the Let’s Encrypt plugin, run the following command:

 /usr/local/cpanel/scripts/uninstall_lets_encrypt_autossl_provider

Resources Monitor

Server resources like CPU and Memory some times are overloaded trace the reason:

top -c
htop
ps -eo pcpu,pid,user,args | sort -k1 -r | head -10
ps aux | grep php

If you have prm installed usage:

prm -t 
prm -s

For Apache Web server resources you can use:

yum install apachetop
apachetop -f /var/log/apache2/access_log

To run shell script or php script on the background:

ShellScript

# First make sure /var/run/screen has mode 775:
chmod 775 /var/run/screen

# Then to run php script on background:
screen php searchindex.php   #or just type screen then Enter and type your command

# To view the list of all screen processes:
screen -ls

# To detach the screen:
CTRL+A followed by d 

# Or
screen -d SCREENID

# To attach the screen at anytime:
screen -r SCREENID

# To kill the screen
screen -X -S SCREENID quit

# Example:
screen -X -S 17285.pts-1.british quit

ShellScript

To Avoid CTRL D from logging off the user while using screen:

IGNOREEOF=4

Here is another way but for my self I prefer screen:

ShellScript

# press Ctrl+Z to suspend the program
# list the current jobs    
jobs 
# resume the job that's next in the queue
fg  
# resume job [number]
fg %[number] 
# Push the next job in the queue into the background
bg  
# Push the job [number] into the background
bg %[number]
# Kill the job numbered [number]   
kill %[number] 
# Send the signal [signal] to job number [number] 
kill -[signal] %[number] 
# disown the process(no more terminal will be owner), so command will be alive even after closing the terminal.
disown %[number]

ShellScript

Or you can use nohup:

nohup ./yourscript &

# Send output to a file the nohup command does not automatically put the command in background. This must be done explicitly with &.
nohup date > date.log &

How to install Sar (Sysstat) Performance Monitoring in Debian:

ShellScript

sudo apt-get install sysstat
# Set Enabled to ture
nano /etc/default/sysstat

# Set interval from every 10 minutes to every 2 minutes.
nano /etc/cron.d/sysstat

# Change
5-55/10 * * * * root command -v debian-sa1 > /dev/null && debian-sa1 1 1
# To
*/2 * * * * root command -v debian-sa1 > /dev/null && debian-sa1 1 1

# Restart the service
service sysstat restart


# Usage Examples

# System CPU statistics 3 times (with 1 second interval)
sar 1 3

# Reports run queue and load average (sar -q)
sar -q
sar -q 1 3

# Overall I/O Activities (sar -b)
sar -b 1 3

# Individual Block Device I/O Activities (sar -d)
sar -d 1 1

#Report network statistics (sar -n)
sar -n ALL
sar -n DEV
sar -n IP

# CPU Usage of ALL CPUs (sar -u)
sar -u 
sar -u  ALL

# Memory Free and Used (sar -r)
sar -r 1 3

# CPU Usage of Individual CPU or Core (sar -P)
sar -P ALL 1 1

# Swap Space Used (sar -S)
sar -S 1 3

# Display context switch per second (sar -w)
sar -w 1 3

#  Report Sar Data Using Start Time (sar -s)
sar -s

ShellScript

Logs

Monitor server logs:

tail -f /var/log/messages

For example only get logs related to digi77

tail -f /var/log/messages | grep digi77

Apache logs on Centos located in /etc/httpd/logs:

tail -f /etc/httpd/logs/error_log
tail -f /etc/httpd/logs/access_log

Combine Apache and server logs:

tail -f /usr/local/apache/logs/error_log and tail -f /var/log/messages

Monitor all files downloads exe from digi77:

grep CustomLog /etc/httpd/conf/httpd.conf
tail -f /usr/local/apache/domlogs/digi77.com |grep .exe

Exclude the word “file does” example:

tail -f /etc/httpd/logs/error_log |grep -i -v "file does"

To disable logs in Apache comment (ErrorLog “logs/error_log” ) in the httpd configuration file and restart Apache.

locate -s httpd.conf

If you have space problems because of Apache logs:

for i in /usr/local/apache/logs/* ; do cat /dev/null > $i ; done
for i in /usr/local/apache/domlogs/* ; do cat /dev/null > $i ; done
rm -f /usr/local/apache/logs/archive/*.gz
rm -f -r /usr/local/apache.backup  
rm -f -r /usr/local/apache.backup_archive

Apache logs on Ubuntu:

tail -f /var/log/apache2/error.log

To prevent and stop the logs on CentOS box:

ShellScript

#login to the box
unset HISTFILE
cat > /var/log/lastlog
CTR+D
cat > /var/log/utmp
CTR+D
cat > /var/log/wtmp
CTR+D
cat > /var/log/secure
CTR+D
# Type your commands
exit

ShellScript

To find and shred all server logs (Be careful):

find /var/log -type f | xargs shred -v --remove

For my sql logs you have to change the config file:

locate -s my.cnf
nano /etc/my.cnf

Then add this to it:

[mysqld]
set-variable=long_query_time=3
slow_query_log_file=/var/log/mysql/log-slow-queries.log
log-error=/var/log/mysql/errors.log

Then you need to create some files:

mkdir /var/log/mysql
touch /var/log/mysql/log-slow-queries.log
chown mysql.mysql -R /var/log/mysql
touch /var/log/mysql/errors.log
chown mysql.mysql -R /var/log/mysql

Now you are ready to view the logs:

tail -f /var/log/mysql/log-slow-queries.log
tail -f /var/log/mysql/log-slow-queries.log and /var/log/mysql/errors.log

To find list huge files +1G in general:

 find . -size +1G -printf '%s %p\n'

To find list huge error_log – over 50 MB – files along with the size they occupy:

find /home/*/public_html/ -type f -iname error_log -size +50M -exec du -sh {} \;

To find list and DELETE! huge error_log – over 50 MB – files:

  
find /home/*/public_html/ -type f -iname error_log -size +50M -exec rm -f {} \;

Repair

Repair Mysql tables:

myisamchk -r -t=/home/oman0/tmp *.MYI     
myisamchk -m *.MYI
myisamchk -e *.MYI
myisamchk -e -r post.MYI
myisamchk -e -o post.MYI
myisamchk -A --auto-repair post.MYI

Or use:

mysql
use tabe_name:
repair table pm;
repair table pmreceipt;
repair table pmtext;
repair table post;

Rebuild Apache config file:

/scripts/rebuildhttpdconf

Repair Apache config file:

/usr/local/cpanel/bin/apache_conf_distiller --update
/usr/local/cpanel/bin/build_apache_conf

If you face a problem with yum on VPS node:

nano  /etc/yum/pluginconf.d/fastestmirror.conf
#set "enable=0"

Fix Easyapache Timeout on connect:

nano /etc/hosts
#File should look like this

127.0.0.1               localhost.localdomain localhost
216.185.115.91          saver.digi77.com saver

#or

127.0.0.1               localhost localhost4 localhost4.localdomain4
::1             localhost localhost6 localhost6.localdomain6
65.201.24.159          master.xxxx.gov.om master


/scripts/easyapache --build

Fix FastCGI Data Timeout Error (mod_fcgid read data timeout in 40 seconds):

nano /usr/local/apache/conf/includes/post_virtualhost_global.conf
#Add to the end of the file the following:

 FcgidProcessLifeTime 8200
 FcgidIOTimeout 8200
 FcgidConnectTimeout 400
 FcgidMaxRequestLen 1000000000

If Openssl causes errors while updating CENTOS update or upgrade use the following command:

yum update --exclude openssl* --skip-broken

If you can’t restore a user from Cpanel backup and you get one of this error messages:

“Cannot restore. That user already exists on this system”
“Sorry, a passwd entry for that username already exists”

/scripts/restorepkg --force username
#for example user oman0
/scripts/restorepkg --force oman0

If Apache troughs the following error:
“SecurityException in Application.cpp:188: Do not have root privileges. Executable not set-uid root?”

chmod +s /opt/suphp/sbin/suphp

Bash script to remove cpmove.psql folders from cPanel home user accounts:

ShellScript

# Write a short script  cpremove.sh
nano cpremove.sh

# Paste the below 
for user in `ls -A /var/cpanel/users`
do 
    rm -rf /home/$user/cpmove.psql*
done

# Run th script
. cpremove.sh

# Delete it
rm -f cpremove.sh

ShellScript

If a package is causing error when running yum command for example OpenSSL you have to exclude it as the following:

nano /etc/yum.conf
# Then 
exclude=bind-chroot courier* dovecot* exim* filesystem httpd* mod_ssl* mydns* mysql* nsd* php* proftpd* pure-ftpd* ruby* spamassassin* squirrelmail* openssl*

Fix RPM Installation via WHM/Cpanel:

/usr/local/cpanel/scripts/check_cpanel_rpms --fix

To rebuild the RPM database via:

yum clear all
mkdir /root/old_rpm_dbs/
mv /var/lib/rpm/__db* /root/old_rpm_dbs/
rpm --rebuilddb

To clean up yum:

su -c 'yum clean headers'
su -c 'yum clean packages'
su -c 'yum clean metadata'

If one of the yum sources fails you will have to disable it:
Example “http://dl.atrpms.net/el6-x86_64/atrpms/stable/repodata/repomd.xml: [Errno 14] PYCURL ERROR 7 – “couldn’t connect to host”

cd /etc/yum.repos.d/
nano atrpms.repo
# Now set enable from 1 to 0
yum update

Remove package without the dependencies:

rpm -e --nodeps packakgename

Some times when you run a bash script via corn job you get the following error “sudo: sorry, you must have a tty to run sudo” to solve it use the following:

nano /etc/sudoers
# Repalce Defaults  requiretty with:
Defaults   !requiretty

Apache2 Configuration Files Location on Debian:

nano /etc/apache2/apache2.conf
# listening ports
nano /etc/apache2/ports.conf

Some times system gives you error of permission denied to .htaccess file an error message that would look like this: “Permission denied: /var/www/abc/.htaccess pcfg_openfile: unable to check htaccess file” or “Server unable to read htaccess file, denying access to be safe”

To solve it do the following:

chmod 755 Direcroty_contaning_.htacess -R
cd Direcroty_contaning_.htacess
chmod 644 .htaccess

Other issue might occur when trying to protect a directory with a password where WordPress would always show you page not found error all you have to do is add the following on WordPress .htaccess:

ErrorDocument 401 default

Tweaks and Information

Get PHP version:

php -v

Get Mysql version:

mysql -v

Get Apache version:

httpd -v

Get Openssl version:

openssl version

Get php config file location:

php --ini

Get installed php modules:

php -m

Protecting upload folder:

chmod -R 775 uploads

Set write permission to a file:

chmod -R 0755 fp.php

To switch to the new user with users profile and variables:

su - username

To continue with the current profile and variables:

su username

Ask CalmAv to scan home for viruses then output results to a file:

clamscan -r --bell -i /home/ > /home/digi77/www/v.txt

To change Linux default Editor:

export EDITOR=pico
export EDITOR=vi
export EDITOR=nano

export VISUAL=vi
export VISUAL=pico
export EDITOR=nano

To change file modification date:

touch -d '5 May 2013 10:22' sendmessage.php

To change the owner of a file or folder:

chown oman0.oman0 public_html/ -R

Change SSH port number:

nano /etc/ssh/sshd_config
sudo /etc/init.d/ssh restart

If SSH is stuck and you can’t connect:

rm /etc/ssh/ssh_host_*
dpkg-reconfigure openssh-server
reboot
#Update client side hosts:
~/.ssh/known_hosts files

Change Ftp port number:

nano /etc/pure-ftpd.conf

To search in nano editor:

CTRL W

Copy file and replace original with no prompt:

yes | cp sendmessage.php /home/digi77/forum/

To edit cron jobs:

crontab -e

To list them:

crontab -l

Execute a cron job every 5 Minutes

*/5 * * * * bash /root/stat.sh  > /var/www/myfile.html

Execute a cron job every 5 Days

0 0 */5 * * bash /root/stat.sh  > /var/www/myfile.html

Cron job simplification:

+---------------- minute (0 - 59)
 |  +------------- hour (0 - 23)
 |  |  +---------- day of month (1 - 31)
 |  |  |  +------- month (1 - 12)
 |  |  |  |  +---- day of week (0 - 6) (Sunday=0 or 7)
 |  |  |  |  |
 *  *  *  *  *  command to be executed

To view day of the week:

echo $(( $(date -d "$1" +%w ) + 1 ))

To delete files older than a year:

find /home/digi77/www/uploads/  -name '*.*' -mtime +360 -exec rm {} \;

To delete files older than 2 days:

ls -t | sed -e '1,2d' |xargs rm

To check disk health and folder sizes:

du -h --max-depth=1

View folder size in summary for MG:

du -s -m /home/digi77

Kill a process by its name (example process name is: cxs):

kill -9 `ps -ef | grep cxs | grep -v grep | awk '{print $2}'`

To extract .rar compressed files:

yum install rar unrar
unrar x -kb

To compress and add folder to .tar and .gz file:

tar -cf thefile.tar /home 
gzip -1 thefile.tar

To compress and add folder to tar then auto gzip it -z for backups:

tar -zcf theBackupFileofDigi77.tar /home/digi77

To extract from zip file:

unzip filename.zip

To extract from password protected zip file:

sudo unzip -P the_Password filename.zip

To add to zip file;

zip -r thedes.zip thesourc.wav

Add the file to the same folder as in the original directory hierarchy:

zip -g xxx.mp3 folder/file

To extract from tar or .gz file:

tar -xvf thefile.tar
gunzip -c thefile.tar.gz | tar xvf

How to install 7zip on Linux Centos:

rpm --import http://apt.sw.be/RPM-GPG-KEY.dag.txt
Check machine architecture: uname -i
wget http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el6.rf.x86_64.rpm
rpm -K rpmforge-release-0.5.3-1.el6.rf.x86_64.rpm
rpm -i rpmforge-release-0.5.3-1.el6.rf.x86_64.rpm
yum -y install p7zip

On Debian or Ubuntu:

sudo apt-get install p7zip-full

To create an encrypted zip file with 7z archiver:

7za a -tzip -pMY_SECRET -mem=AES256 secure.zip doc.pdf doc2.pdf doc3.pdf

To uncompress a zip file that is encrypted with 7za command:

7za e secure.zip

To extract a password protected file on CentOS:

7za x thefile.zip -pThePassword

To extract a password protected file on Debian:

7z x thefile.zip -pThePassword

To set root email foward:

/root/.forward

To prevent Cpanel from restarting Apache and other services:

nano /etc/chkserv.d/chkservd.conf

Display list of updated software centOS:

yum list updates

Updaye centOS:

yum update

Find out if httpd package is installed or not:

rpm -qa | grep httpd*
yum list installed httpd

Update package httpd:

yum update httpd

Add Apache httpd to system start-up:

chkconfig httpd --add
chkconfig  httpd  on --level 2,3,5

Check if on the list:

chkconfig --list httpd

Remove from the list:

chkconfig httpd off
chkconfig httpd --del

Or use:

sudo apt-get install sysv-rc-conf
sysv-rc-conf

Let apache2 start with OS boot Ubuntu:

sudo update-rc.d -f apache2 remove
update-rc.d apache2 defaults
service apache2 stop
service apache2 start

Restart a service like ssh:

sudo service ssh restart
or
sudo /etc/init.d/ssh restart

Clear temporary blocked ips from CSF firewall:

perl /etc/csf/csf.pl -tf
# or
csf -tf

Clear permanent blocked ips from CSF firewall:

perl /etc/csf/csf.pl -df
# or
csf -df

Disable CSF firewall:

csf -x
# or enable it by:
csf -e

Restart CSF firewall:

perl /etc/csf/csf.pl -r

FTP Passive Mode blocked by CSF firewall:

# PureFTPd
nano /etc/pure-ftpd.conf
#Set PassivePortRange    32000 33000

# ProFTPd
nano /etc/pure-ftpd.conf
# Set PassivePorts    32000 33000
# Change CSF settings TCP_IN: 20,21,22,25,53,80,110,143,443,32000:33000
# Restart FTP + Restart CSF

Directory permission reference:

755 -- **ALL** Folders (Including those that script authors tell you to set 777)
644 -- Non Script Files (Images, Basic HTML, Templates, Etc)
600 -- PHP Scripts (*.php, *.php4, *.php5)
755 -- CGI and Shell Scripts (*.cgi, *.pl, *.pm, *.py, *.e, *.sh)
400 -- RARE When PHP scripts **DON'T** want to be writable
755 -- RARE PHP Scripts used under CLI as a shell script

Allow TLS via FTP (Proftp – Ubuntu ) and restrict access via TLS only:

ShellScript

mkdir /etc/proftpd/ssl
openssl req -new -x509 -days 180 -nodes -out /etc/proftpd/ssl/ftp.cert.pem -keyout /etc/proftpd/ssl/ftp.key.pem

#uncomment the following from the file  /etc/proftpd/proftpd.conf
nano  /etc/proftpd/proftpd.conf
#include /etc/proftpd/tls.conf

#add the follwing at the end of the file just before  

TLSEngine on
TLSLog /var/log/proftpd/tls.log
TLSProtocol SSLv23
TLSOptions NoCertRequest
TLSRSACertificateFile /etc/proftpd/ssl/ftp.cert.pem
TLSRSACertificateKeyFile /etc/proftpd/ssl/ftp.key.pem
TLSVerifyClient off
TLSRequired on


/etc/init.d/proftpd restart

ShellScript

Prevent script from running twice:

#!/bin/bash

(
  # Wait for lock on /var/lock/.myscript.exclusivelock (fd 200) for 10 seconds
  flock -x -w 10 200 || exit 1

  # Do stuff
  cd /home
  ./myscript
) 200>/var/lock/.myscript.exclusivelock

To know how long (execution time) your shell script took to execute:

#!/bin/bash
start=$(date +%s.%N)

# HERE Your CODE

end=$(date +%s.%N)    
runtime=$(python -c "print ${end} - ${start}")

echo "Runtime was $runtime"

Compress http output using DEFLATE – gzip:

ShellScript

nano /usr/local/apache/conf/includes/post_virtualhost_global.conf
#Add to the end of the file the following:
AddOutputFilterByType DEFLATE text/plain
AddOutputFilterByType DEFLATE text/xml
AddOutputFilterByType DEFLATE application/xhtml+xml
AddOutputFilterByType DEFLATE text/css
AddOutputFilterByType DEFLATE application/xml
AddOutputFilterByType DEFLATE image/svg+xml
AddOutputFilterByType DEFLATE application/rss+xml
AddOutputFilterByType DEFLATE application/atom_xml
AddOutputFilterByType DEFLATE application/x-javascript
AddOutputFilterByType DEFLATE application/x-httpd-php
AddOutputFilterByType DEFLATE application/x-httpd-fastphp
AddOutputFilterByType DEFLATE application/x-httpd-eruby
AddOutputFilterByType DEFLATE text/html
SetOutputFilter DEFLATE
SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ no-gzip dont-vary
SetEnvIfNoCase Request_URI \.(?:exe|t?gz|zip|bz2|sit|rar)$ no-gzip dont-vary
SetEnvIfNoCase Request_URI \.pdf$ no-gzip dont-vary
SetEnvIfNoCase Request_URI \.avi$ no-gzip dont-vary
SetEnvIfNoCase Request_URI \.mov$ no-gzip dont-vary
SetEnvIfNoCase Request_URI \.mp3$ no-gzip dont-vary
SetEnvIfNoCase Request_URI \.mp4$ no-gzip dont-vary
SetEnvIfNoCase Request_URI \.rm$ no-gzip dont-vary
BrowserMatch ^Mozilla/4 gzip-only-text/html
BrowserMatch ^Mozilla/4\.0[678] no-gzip
BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html
Header append Vary User-Agent env=!dont-vary

ShellScript

Get Ip from file .eeds-xxxx:

cat .eeds-xxxx|cut -d : -f 1}

Get process age for openvpn:

ps -eo pid,command,etime|grep 'openvpn --daemon --config'|cut -d / -f 2|sed 's/^ *//;s/ *$//'

Get Status from file in this format ip:status:country -> 69.55.49.223:[secure]:USA

cat .eeds-ipinfo|cut -d : -f 2|cut -d [ -f 2|cut -d ] -f 1

Get country from file in this format ip:status:country -> 69.55.49.223:[secure]:USA

geoiplookup `cat .eeds-xxxx|cut -d : -f 1`|cut -d : -f 2|cut -d , -f 2|sed 's/^ *//;s/ *$//'

Get Tor Ip then send to file:

curl --proxy socks5h://localhost:9050 -s -m 30 https://www.digi77.com/xx/xxx/xxxxx.php > .eeds-xxx

Get Dns Info from resolv.conf:

cat /etc/resolv.conf |grep Dnsused|cut -d : -f 2
cat /etc/resolv.conf |grep nameserver|cut -d r -f 3|sed 's/^ *//;s/ *$//'| awk 'NR==1'
cat /etc/resolv.conf |grep nameserver|cut -d r -f 3|sed 's/^ *//;s/ *$//'| awk 'NR==2'

In Debian in order to allow x86 32-bit applications to work on 64-bit OS installation:

sudo dpkg --add-architecture i386
sudo apt-get update

Delete GPA default expired keys on Debian:

truncate -s 0 ~/.gnupg/pubring.kbx

To check if your processors are 32-bit or 64-bit :

getconf LONG_BIT

To know the graphic card driver that is being used (VGA):

lspci |grep VGA

Change node time to GMT+4 Oman time:

cd /etc
ln -sf /usr/share/zoneinfo/Asia/Muscat localtime

Change node time to GMT+4 Moscow time:

rm /etc/localtime
cd /etc
ln -s /usr/share/zoneinfo/Europe/Moscow localtime

Or in Debian use:

sudo dpkg-reconfigure tzdata

Use ‘rdate’ or ‘ntpdate’ to synchronize your server time with reference time. Make sure your firewall allows it or switch it off temporary csf -x

service ntpd stop
ntpdate clock.redhat.com
service ntpd start

Set php time zone to GMT+4 – Debian:

php --ini
nano /etc/php5/cli/php.ini
date.timezone ="Asia/Muscat"

Disable script watch for cpanel:

/usr/local/cpanel/bin/tailwatchd --disable=Cpanel::TailWatch::ChkServd

Enable script watch for cpanel

/usr/local/cpanel/bin/tailwatchd --enable=Cpanel::TailWatch::ChkServd

Enable all monitoring services for Cpanel:

whmapi1 enable_monitor_all_enabled_services

Get md5 of a file or list of files:

md5sum *.tar

Count number of lines in file:

wc -l myfile
#Use the following to get the number only
cat myfile |wc -l

Check if file /etc/passwd exists or not:

[ -f /etc/passwd ] && echo "File exists" || echo "File does not exists"

Check if file /etc/passwd exists or not on shell script:

FILE='/etc/passwd'
if [ -f $FILE ];
then
   echo "File $FILE does exists"
else
   echo "File $FILE does not exists"
fi

Redirect your Webserver home page from HTTPS to HTTP

RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI}   !^/(.*)\.(css|png|js|jpe?g|gif|bmp)$
RewriteRule ^$ http://%{HTTP_HOST} [L,R]

Redirect your Webserver home page from HTTP to HTTPS

RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

Email list clean up – Read a file Line By Line and check if the email is not valid and output to text file:

while read line; do sendmail -bv "$line"; done < emails.txt |grep failed > invalidemails.txt

Now you can grep all email addresses from a Text File using regular expressions:

grep -E -o "\b[a-zA-Z0-9.-]+@[a-zA-Z0-9.-]+\.[a-zA-Z0-9.-]+\b" invalidemails.txt > invalidemails2.txt

Find PHP root path of the current valuable folder for installations:

List directory and file structure:

tree -d /path

Networking

To Get your remote IP:

echo $SSH_CLIENT | awk '{ print $1}'

Get your local ip from eth0:

/sbin/ifconfig eth0 | grep "inet addr" | awk -F: '{print $2}' | awk '{print $1}'

Function to get your local IP:

#!/bin/bash
function int-ip { /sbin/ifconfig $1 | grep "inet addr" | awk -F: '{print $2}' | awk '{print $1}'; }
IP_ADDR=$(int-ip eth0)

Function to get your local IP and allow traffic forwarding:

#!/bin/bash
function int-ip { /sbin/ifconfig $1 | grep "inet addr" | awk -F: '{print $2}' |$
IP_ADDR=$(int-ip eth0)
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to $IP_ADDR
echo 1 > /proc/sys/net/ipv4/ip_forward

Resolve domain name to ip number:

sudo apt-get install dnsutils
dig +short google.com | awk 'NR==1'

Extract ips from a file:

grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' pentest.txt |sort -n|uniq -u

Commands you need to change ip address or configure your network cards on Centos:

nano /etc/sysconfig/network
nano /etc/resolv.conf
nano /etc/hosts
nano /etc/sysconfig/network-scripts/ifcfg-eth0
service network restart

Get connections per port number:

netstat -tuna | awk -F':+| +' 'NR>2{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

Get connections per IP number (useful if you are facing DDOS attack):

netstat -ntu | awk -F"[ :]+" 'NR>2{print $6}'|sort|uniq -c|sort -nr
#or
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
#or
netstat -ntu | tail -n +3 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

Find applications with ports that they are using TCP:

netstat -tlnp

Find applications with ports that they are using TCP UDP:

lsof -i -P

Kill an application by the port its using (Example port: 51128) :

kill -9 $(sudo netstat -anp | grep :51128 | awk '{print $7}' | cut -d '/' -f 1)

Installing and Configuring ufw (Uncomplicated Firewall) first, ufw needs to be enabled:

sudo apt-get install ufw
sudo ufw enable

To see the firewall status, enter:

sudo ufw status

To change default profile so it accepts all incoming and outgoing traffic:

sudo ufw status verbose
sudo ufw default allow incoming
sudo ufw reset
sudo ufw enable

To allow ufw to forward VPN traffic:

nano /etc/default/ufw
# Set 
DEFAULT_FORWARD_POLICY="ACCEPT"

Similarly, to close an opened port:

sudo ufw deny 22
sudo ufw deny 80/tcp

To remove a rule, use delete followed by the rule:

sudo ufw delete deny 22

Allow specific ports:

sudo ufw allow ssh
sudo ufw allow 22/tcp
sudo ufw allow www or sudo ufw allow 80/tcp
sudo ufw allow ftp or sudo ufw allow 21/tcp

It is also possible to allow access from specific hosts or networks to a port. The following example allows ssh access from host 192.168.0.2 to any ip address on this host:

sudo ufw allow proto tcp from 192.168.0.2 to any port 22
sudo ufw allow proto tcp from 128.199.214.224 to 39.129.27.211 port 42121
sudo ufw allow from 192.168.255.255   # Alow all ports from 192.168.255.255

Adding the –dry-run option to a ufw command will output the resulting rules, but not apply them. For example, the following is what would be applied if opening the HTTP port:

sudo ufw --dry-run allow http

To allow ports 1000 through 2000, use the command:

sudo ufw allow 1000:2000/tcp

ufw can be disabled by:

sudo ufw disable

To view the numbered format:

sudo ufw status numbered

Delete specific number:

sudo ufw delete 3

Reset Everything:

sudo ufw reset

Block IP address in Iptables:

sudo iptables -I INPUT -s 192.168.0.1 -j DROP

UnBlock IP address in Iptables:

sudo iptables -D INPUT -s 192.168.0.1 -j DROP

Flush All Chains:

sudo iptables -F

Determine a rule’s line number :

sudo iptables -L --line-numbers
sudo iptables -L --line-numbers|grep 24.2x3.1x9.2xx    # with specific ip

Delete Rule by Chain and Number:

sudo iptables -D INPUT 7

List Rules as Tables:

sudo iptables -L
sudo iptables -L|grep  24.2x3.1x9.2xx    # with specific ip

Set static ip on Centos:

ShellScript

nano /etc/sysconfig/network
#Sample static ip configuration should look like this

NETWORKING=yes
HOSTNAME=server1.cyberciti.biz # set ur own
GATEWAY=192.168.1.254 # set ur own


nano /etc/sysconfig/network-scripts/ifcfg-eth0
#Sample static ip configuration should look like this

# Intel Corporation 82573E Gigabit Ethernet Controller (Copper)
DEVICE=eth0
BOOTPROTO=static # for dynamic ip set this to dhcp
DHCPCLASS=
HWADDR=00:30:48:56:A6:2E
IPADDR=192.168.1.10       # set ur own
NETMASK=255.255.255.0 # set ur own
ONBOOT=yes
 
 
nano /etc/resolv.conf
#Sample static ip configuration should look like this

search cyberciti.biz
nameserver 192.168.1.254
nameserver 8.8.8.8 # set ur own dns ips
nameserver 8.8.4.4 # set ur own dns ips

/etc/init.d/network restart
#or
serivec network restart
 
#To verify new static ip configuration for eth0, enter:
ifconfig eth0
route -n
ping 192.168.1.254
ping google.com

ShellScript

Get network drivers support for Debian live cd and make it connect on boot:

ShellScript

cd /root
wget http://cdimage.debian.org/cdimage/unofficial/non-free/firmware/stable/current/firmware.zip
unzip firmware.zip
rm -f firmware-b43-installer_015-14.1_all.deb
rm -f firmware-b43legacy-installer_015-14.1_all.deb
rm -f amd64-microcode_1.20120910-2_i386.deb
rm -f intel-microcode_1.20130222.1_i386.deb
rm -f ixp4xx-microcode_2.4-3_armel.deb
rm -f prism2-usb-firmware-installer_0.2.9+dfsg-5_armel.deb
rm -f prism2-usb-firmware-installer_0.2.9+dfsg-5_armhf.deb
rm -f prism2-usb-firmware-installer_0.2.9+dfsg-5_i386.deb
rm -f prism2-usb-firmware-installer_0.2.9+dfsg-5_powerpc.deb
rm -f firmware-b43-lpphy-installer_015-14.1_all.deb
dpkg -i *.deb

rm -f *.deb
rm -f firmware.zip

nano /etc/network/interfaces
# Add the following before any command avoid any duplicates:

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug eth0
iface eth0 inet dhcp

allow-hotplug eth1
iface eth1 inet dhcp

allow-hotplug eth2
iface eth2 inet dhcp

allow-hotplug eth3
iface eth3 inet dhcp


# To test
/etc/init.d/networking restart

# Or ge the drivers from non free Debian Source
sudo nano /etc/apt/sources.list
deb http://ftp.nl.debian.org/debian stable main contrib non-free

sudo apt-get update
sudo apt-get install firmware-b43legacy-installer firmware-brcm80211 firmware-ivtv firmware-linux-free firmware-qlogic firmware-adi firmware-crystalhd firmware-iwlwifi firmware-linux-nonfree firmware-ralink firmware-atheros firmware-bnx2 firmware-intelwimax firmware-libertas firmware-myricom firmware-realtek firmware-b43-installer firmware-bnx2x firmware-ipw2x00 firmware-linux firmware-netxen

ShellScript

To forward all incoming traffic to digi77.com on port 80 and redirect it to remote website -google.com- on port 443:

ShellScript

sudo apt-get install socat
socat TCP4-LISTEN:80,fork TCP4:google.com:443

# or use redir if local ip is 129.13.124.21 then forward all port 80 and 8080 traffic to google.com on port 443

redir --laddr=129.13.124.21 --lport=80  --caddr=google.com --cport=443|redir --laddr=129.13.124.21 --lport=8080  --caddr=google.com --cport=443

# Or use iptables:

sudo sysctl net.ipv4.ip_forward=1
sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 173.194.37.37:443
sudo iptables -t nat -A POSTROUTING -j MASQUERADE

ShellScript

Add bash file to allow incoming traffic to be forwarded to the internet mostly used for vpn connections:

ShellScript

#!/bin/bash
iptables -t nat -A POSTROUTING -o venet0 -j SNAT --to 141.0.162.111    # Sometimes change venet0 to eth0 change the ip as well
echo 1 > /proc/sys/net/ipv4/ip_forward

ShellScript

More tips on port forwarding see here.

To monitor your bandwidth usage you can use tools such as iftop and vnstat:

To install:

 sudo apt-get install iftop
 sudo apt-get install vnstat

Iftop usage:

iftop
# Sort by 40s column display port and hide hostname:
iftop -n -o 40s -P

vnstat usage (You can swap eth0 with venet0):

vnstat -i eth0 -h               # -h Hourly  -d Daily  -m Monthly
vnstat -i eth0 -d								
vnstat -i eth0 -m

To block bit torrent traffic on vps node using iptables ( Uncomment the the rest if you only need them ):

ShellScript

iptables -N LOGDROP > /dev/null 2> /dev/null
iptables -F LOGDROP
iptables -A LOGDROP -j LOG --log-prefix "LOGDROP "
iptables -A LOGDROP -j DROP
#iptables -A FORWARD -m string --algo bm --string "BitTorrent" -j LOGDROP
iptables -A FORWARD -m string --algo bm --string "BitTorrent protocol" -j LOGDROP
#iptables -A FORWARD -m string --algo bm --string "peer_id=" -j LOGDROP
#iptables -A FORWARD -m string --algo bm --string ".torrent" -j LOGDROP
#iptables -A FORWARD -m string --algo bm --string "announce.php?passkey=" -j LOGDROP
#iptables -A FORWARD -m string --algo bm --string "torrent" -j LOGDROP
#iptables -A FORWARD -m string --algo bm --string "announce" -j LOGDROP
#iptables -A FORWARD -m string --algo bm --string "info_hash" -j LOGDROP
#iptables -A FORWARD -m string --string "get_peers" --algo bm -j LOGDROP
#iptables -A FORWARD -m string --string "announce_peer" --algo bm -j LOGDROP
#iptables -A FORWARD -m string --string "find_node" --algo bm -j LOGDROP

ShellScript

Change webserver apache port number:

nano /etc/apache2/ports.conf
Listen 8010

To have apache listen on two ports:

Listen 80
Listen 8010

To make the apache server accept connections on two specified interfaces and port numbers, enter:

Listen 212.53.2.1:80
Listen 212.53.2.5:8010

To check if the remote node is blocking any given port number:

nc -vv google.com 21

To split a file into smaller chunks of 100MB:

split --bytes 100M --numeric-suffixes --suffix-length=3 thebigfile.sql split-file

Find the word userOption51 in every file on the directory and return only file names -l:

grep -rl userOption51

For accelerated download instead of wget use axle:

sudo apt-get install axel 
# Limit speed 
axel -s 5242880 http://download.com/my.iso 
# Limit a number of connection
axel -n 3 -s 5242880 http://download.com/my.iso

Security

Display connect time in hours:

ac

Display list of last logged-in users:

last

Display list of bad last login attempts:

lastb

Display last time user logged in:

lastlog

Display last command executed in reverse order:

lastcomm

Display currently logged in users:

who

Display who is logged in and what they are doing:

List Linux hidden users hunt for hackers:

cat /etc/passwd | grep /home | cut -d: -f1
cat /etc/passwd |grep 500* 
cat /etc/passwd
cat /etc/sudoers

Another method to hunt for shells:

ShellScript

find /home -name "*php*" -print | xargs grep -F 'base64_decode($_POST["qer"]).";"); ?'
find /home -name "*php*" -print | xargs grep -F 'c99sh'
find /home -name "*php*" -print | xargs grep -F 'owned by uid'
find /home -name "*php*" -print | xargs grep -F 'eval(gzinflate(base64_decode'

ShellScript

Add user fox with root privilege:

useradd -G root fox
passwd fox
id fox

Delete the user along with the home folder:

userdel -r fox

Get the root password:

head -10 /etc/shadow

Kick a user from ssh session:

ps aux | grep sshd
ps aux | grep pts/1
kill -9 26882

If your server is under DDOS attack on port 80 these commands are useful:

ShellScript

netstat -alpn | grep :80 | awk '{print $4}' | cut -d: -f1 | sort | uniq -c
netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
netstat -tn 2>/dev/null | grep :80 | awk '{print $5}' | cut -f1 -d: | sort | uniq -c | sort -rn | head
netstat -s

ShellScript

Find who is using a specific port ex:8443 :

lsof -w -n -i tcp:8443
fuser -n tcp 8443 
netstat -anp|grep :8443[[:blank:]]

Clean user and mysql history:

cat > .bash_history
history -c
cat > /root/.mysql_history

Get email notification sent to you if ssh is accessed via root:

cd /root
nano .bashrc
echo 'ALERT - Root Shell Access (Your server Name) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d'(' -f2 | cut -d')' -f1`" youremail@yourdomain.com

Add ssh keys to server:

nano /root/.ssh/authorized_keys
or
nano /root/.ssh/authorized_keys2
# each key on single line

Disable root login if you have ssh keys set:

nano /etc/ssh/sshd_config
#Add the following after #PermitEmptyPasswords no:
PasswordAuthentication  no
sudo service ssh restart

Mitigating the Beast, Heartbleed, and POODLE attack on TLS on CentOS with this changes you will get grade A on sslabs detailed guide is here.

Disable file listing on your Webserver add this line to the beginning of .htaccess file:

Options All -Indexes

Deny Baidu from accessing your site via .htaccess

RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} Baidu
RewriteRule ^.*$ http://127.0.0.1 [R,L]
BrowserMatchNoCase Baiduspider bad_bot
Deny from env=bad_bot

Protecting a directory with Apache and .htaccess:

htpasswd -c /etc/apache2/.htpasswd user1
htpasswd /etc/apache2/.htpasswd user2

Create a .htaccess file in the folder you wish to protect:

AuthType Basic
AuthUserFile /etc/apache2/.htpasswd
AuthName "Enter password"
Require valid-user

Shred all files in folder and sub folders:

find -type f -execdir shred -v -u '{}' \;
rm -rf *

To check for Bash ‘shell shock’ vulnerability:

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

If it says vulnerable then update your system immediately. A respond from patched system looks like this:

bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test

To generate new pgp – gpg keys on CentOS server:
# Make sure you choose a strong password with a key strength of 4096 bits

--gen-key

To view private keys:

gpg -K

To view public keys:

gpg -k

To Export private key:

gpg --armor --export-secret-keys sales@digi77.com > private-key.asc

To Export public key:

gpg --armor --export sales@digi77.com  > public-key.asc

More OpenPGP/GPG commands 1 , 2.

Hardening SSH server you will need to use Xshell or SecureCRT as SSH client:
Delete all host keys:

ls -l /etc/ssh/
rm -f /etc/ssh/ssh_host_*_key*
ls -l /etc/ssh/

Generate new RSA (4096) host key:
# Do not set a password

ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key

You can import ssh_host_rsa_key to puttyGEN. Then export putty-public-key / putty-private-key / screen key to be pasted in /root/.ssh/authorized_keys )

nano /root/.ssh/authorized_keys

– Change Default port to a higher number 41221

nano /etc/ssh/sshd_config

Then:

Port 41221

– Comment dsa and ecdsa “HostKey”

#HostKey /etc/ssh/ssh_host_dsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key

– Change “PasswordAuthentication” to “no”

PasswordAuthentication no

– Paste the following to the end of the config file:

ShellScript

KexAlgorithms diffie-hellman-group-exchange-sha256
Ciphers aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512,hmac-sha2-256,hmac-ripemd160     #Putty does not support hmac-sha2-512  
#New cent os will through error you need to use  the follwing to see what is supported:
ssh -Q mac
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
# Check ssh config for errors before restarting
sshd -t

ShellScript

Mail Exim

Check mail logs:

tail -f /var/log/exim_mainlog

Exim mail cleaner:

ShellScript

exiqgrep -i -o 172000 | xargs exim -Mrm
exim -bp - shows mail queue
exim -M emailID - force delivery of one message
exim -Mvl messageID - View Log for message
exim -Mvb messageID - View Body for message
exim -Mvh messageID - View Header for message
exim -Mrm messageID - ReMove message (no errors sent)
exiqgrep -zi | xargs exim -Mrm - Remove all frozen mails in q

ShellScript

Exim mail queue run:

exim -q -v

Exim mail counter:

exim -bpc

To change max load value of Exim mail:

first locate exim.conf
locate -s exim.conf
nano exim.conf
#change max load value

Install sendmail on Ubuntu:

apt-get install sendmail
apt-get install bsd-mailx

How to extract file attachment from email file linux or .eml format:
Install uudeview:

#Debian or Ubuntu
sudo apt-get install uudeview
#CentOS
yum install uudeview

Run uudeview:

cd /home/oman0/mail/.hproxy@digi77_com/new  # change this to your mail box folder it can be /new or /cur
uudeview -c -i *  
# c for clear email when done -i for skip encoding confirmation 
uudeview -c -i mail-file-name

MySQL

Usefull scripts to tune Mysql let it run at least for 48 hours before you run those scripts:
# Note binary log will slow down the performance of you Database make sure its always OFF!

ShellScript

# First is ssh script:
wget https://launchpad.net/mysql-tuning-primer/trunk/1.6-r1/+download/tuning-primer.sh
sh tuning-primer.sh

# Second is Perl script:
wget http://mysqltuner.pl
mv index.html mysqltuner.pl 
# or 
wget https://raw.githubusercontent.com/major/MySQLTuner-perl/master/mysqltuner.pl
perl mysqltuner.pl

ShellScript

To prune Mysql bin logs (This statement has no effect if the server was not started with the –log-bin option to enable binary logging. ):

PURGE BINARY LOGS TO 'mysql-bin.000054';

Examples on how to change Mysql variables values without shutting down this will be valid for one session only for permanent changes edit /etc/my.cnf:

SQL

select @@sql_log_bin;
set @@sql_log_bin=0;
select @@max_heap_table_size;
set @@max_heap_table_size=2147483648;
select @@tmp_table_size;
set @@tmp_table_size=2147483648;
set storage_engine=INNODB;
set global max_connections := 800;
set global max_allowed_packet=1073741824;
select @@key_buffer_size;
set global key_buffer_size=67108864;
select @@join_buffer_size;
set @@join_buffer_size=262144;
select @@query_cache_size;  
set global query_cache_size=0;
select @@query_cache_limit;
set global query_cache_limit=1048576;

SQL

Check if a column in MySQL table has duplicate values:

SELECT my_column, COUNT(*) as count
FROM my_table
GROUP BY my_column
HAVING COUNT(*) > 1;

How to select records from two tables wcf1_user_option_value and wcf1_user where wcf1_user.wbbPosts < 10 and birth date on wcf1_user_option_value not equal to 0000-00-00:

SELECT *
FROM wcf1_user_option_value
JOIN wcf1_user ON wcf1_user_option_value.userid = wcf1_user.userid
WHERE wcf1_user.wbbPosts < '10' and wcf1_user_option_value.userOption2 !='0000-00-00'

How to update a table based on information on another table giving that you have primary and foreign key on those tables:

UPDATE wcf1_user_option_value AS U1,  wcf1_user AS U2 
SET U1.userOption2 = '0000-00-00'
WHERE U1.userid =U2.userid  and U2.wbbPosts=127148

How to replace data in rows with a given word:

UPDATE wcf1_user SET `signature`=REPLACE(`signature`,'[size]','[/size]');

To increase the primary key id by given number:

update Table_name set id = id +844798 order by id desc;

To reset the primary key id to start from 1 and forward:

ALTER TABLE Table_name DROP id;
ALTER TABLE Table_name ADD  id BIGINT( 200 ) NOT NULL AUTO_INCREMENT FIRST ,ADD PRIMARY KEY (id);

To change the next increment number for primary key id:

Alter table Table_name AUTO_INCREMENT=1087063;

Convert Your Database from Swidish_latin_ci to utf8 (utf8_general_ci) or (utf8_unicode_ci):

SQL

# Export DB as Latin
mysqldump --opt -u DB_USER --password=DB_Password --default-character-set=latin1 --skip-extended-insert DB_NAME -r Exported_DB_NAME.sql

# Check file encoding type it may be Asci or Latin 
file -ib Exported_DB_NAME.sql

# Now replace all words of latin1 to utf8
sed -e's/latin1/utf8/g' Exported_DB_NAME.sql > Exported_DB_NAME_sed.sql

# Get tools for conversion 
yum install dejavu-sans-mono-fonts
yum install recode

# Prepare your OS for UTF8 you may need to do this every time before you run the converting tool
export LANG=en_US.utf8

# This tools won't work with Arabic 
iconv -f ISO-8859-1 -t UTF-8 DB_NAME.sql  > UTF8_DB.sql

# So we use this tool instead to convert the Latin encoded DB to UTF8 
recode ms-arab Exported_DB_NAME_sed.sql  

# Import you UTF8 DB
mysql -u DB_USER --password=DB_Password --default-character-set=utf8 DB_NAME < Exported_DB_NAME_sed.sql

SQL

Export specific table:

mysqldump -u DB_USER --password=DB_Password --default-character-set=utf8 --skip-extended-insert DB_NAME Table_Name > Exported_DB_Table_NAME.sql

Export specific table row by row:

mysqldump --opt -u DB_USER --password=DB_Password --default-character-set=utf8 --skip-extended-insert DB_NAME Table_Name > Exported_DB_Table_NAME.sql

Restore specific table:

mysql -u DB_USER --password=DB_Password --default-character-set=utf8 DB_NAME < Exported_DB_Table_NAME.sql

Export and Compress the DB:

mysqldump -u DB_USER --password=DB_Password --default-character-set=utf8 --skip-extended-insert DB_NAME | gzip -9 > Exported_DB_NAME.gz

Export 100 rows only of the DB Table:

mysqldump -u DB_USER --opt --where="1 limit 100" --password=DB_Password --default-character-set=utf8 --skip-extended-insert DB_NAME Table_Name > Exported_DB_Table_NAME.sql

Restore a single table from a full mysql mysqldump file:

sed -n -e '/CREATE TABLE.*`mytable`/,/CREATE TABLE/p' mysql.dump > mytable.dump

To change MySQL data directory:

# Stop mysql
/etc/init.d/mysql stop

# Copy mysql folder
cp -R -p /var/lib/mysql /home

# Create temp folder and change owner
mkdir /home/temp
chown mysql.mysql /home/temp

# Edit mysql config file
nano /etc/my.cnf

[mysqld]

datadir=/home/mysql tmpdir=/home/temp # Start mysql /etc/init.d/mysql restart # If everything is ok we delete the original data directory rm -fr /var/lib/mysql

To repair innodb tables on startup:

[mysqld]
innodb_force_recovery = 1

If mysql refuses to start:

ps aux | grep mysql
sudo kill -9 2804 3009 # based on top cpmmand results
# Then start my sql in safe mode:
sudo -u mysql mysqld_safe --log-error=/tmp/mysql.log
# Watch logs for error
tail -f /tmp/mysql.log

To restore mysql files specially ibd format for Worpress make sure you do the following:

/etc/init.d/mysql stop
chmod 660 filename
chown mysql.mysql filename
/etc/init.d/mysql start

Stop mysql service:

/etc/init.d/mysql stop

Start mysql service:

/etc/init.d/mysql start

InnoDB maintains a cache memory, called the buffer pool. With the parameter innodb_buffer_pool_size you can define the size of this pool. The required size can be calculated with the following query:

SQL

SELECT CONCAT(ROUND(KBS/POWER(1024,
IF(PowerOf1024<0,0,IF(PowerOf1024>3,0,PowerOf1024)))+0.49999),
SUBSTR(' KMG',IF(PowerOf1024<0,0,
IF(PowerOf1024>3,0,PowerOf1024))+1,1)) recommended_innodb_buffer_pool_size
FROM (SELECT SUM(data_length+index_length) KBS FROM information_schema.tables
WHERE engine='InnoDB') A,
(SELECT 3 PowerOf1024) B;

SQL

PHP script that would convert DB + Tables + Columns into utf8_unicode_ci but it wont convert the data that is already stored it will work for future inserted data:

ShellScript

Changed collation of DATABASE $database to $new_collation
";

// Loop through all tables changing collation
$result=mysql_query('show tables');
while($tables = mysql_fetch_array($result)) {
$table = $tables[0];
mysql_query("ALTER TABLE $table DEFAULT CHARACTER SET $new_charset COLLATE $new_collation");
print "
Changed collation of $table to $new_collation and charset of $new_charset
";

// loop through each column changing collation
$columns = mysql_query("SHOW FULL COLUMNS FROM $table where collation is not null");
while($cols = mysql_fetch_array($columns)) {
$column = $cols[0];
$type = $cols[1];
mysql_query("ALTER TABLE $table MODIFY $column $type CHARACTER SET $new_charset COLLATE $new_collation");
print "
Changed collation of $table and $column to  $new_collation and charset of $new_charset
";
}

print "
Changed collation of $table to $new_collation
";
}
print '
The collation of your database $database has been successfully changed!
'; 
?>

# Put it on a file and run it like this on SSH
php latinToutf.php

ShellScript

Shell script to backup Mysql database one by one each on separate files:

ShellScript

#!/bin/bash
# Prepare mysql and rest
fulldate="`date`"
OUTPUT="/home/backup"
domanvalue="mysql"
echo "Backing mysql folder at: /home/mysql " $fulldate

# MySQL User
USER='root'
# MySQL Password
PASSWORD='Your DB Password goes here'
  
start=$(date +%s.%N)
fulldate="`date`"
bakdate="`date +%y%m%d`"
cd $OUTPUT

echo "Starting MySQL Backup";
echo `date`;
databases=`mysql --user=$USER --password=$PASSWORD -e "SHOW DATABASES;" | tr -d "| " | grep -v Database`
for db in $databases; do
    if [[ "$db" != "information_schema" ]] && [[ "$db" != _* ]] ; then
        echo "Dumping database: $db"
        mysqldump --force --opt --user=$USER --password=$PASSWORD --databases $db > $OUTPUT/$domanvalue-$bakdate-$db.sql
	    7za a -tzip -pYour7zippasswordgoeshere -mem=AES256 $domanvalue-$bakdate-$db.zip $domanvalue-$bakdate-$db.sql
		rm -f $OUTPUT/$domanvalue-$bakdate-$db.sql
    fi
done
echo "Finished MySQL Backup";

ShellScript

Hold Tight...

Warith AL Maawali

Residence:

Uptime Binary:

Mantra:

ONS

EEDS

NSSG

Visual basic

Gambas

PHP

Delphi

Bash

Linux world the guide you need

Harnessing the Power of Linux

Useful Commands Index:

Good Linux Flavors:

Useful Packages:

Packages and Installation