Hosting Blog

If you haven’t noticed I’ve changed the Forum Topics and Hosting Blog sections on the frontpage of WebHostGear to include the latest posts. The blog now also tells you how long ago the posts were made so you can easily see the latest ones and it gives me more incentive to write more! I can’t link to other articles though this blog thing yet because the editor is screwed up so the formatting might change a bit for the next news post once I get that fixed up!

Nobody Check
Plans are underway for Nobody Check to include support for Plesk and DirectAdmin amoung a few other changes for version 1.0.3 and should be released early next week. I’m happy with the feedback received from the script but could always use more. The tool has been mentioned in a few big sites like WHT, HostingTech, TheWhir and Ping Zine to name a few.

That’s it for now, I’m working on a few upcoming interviews with some big companies like Ping Zine, ControlScan, and possibly Relio so look for that soon!

EDIT: I fixed the WYSIWYG editor in the blog, it was a mod_rewrite rule that kept giving error pages for anything that loaded. w00t!

I’ve been seeing some new breads of server attacks lately. These are
much harder ones to spot. These new types of attack grab the users from
the passwd list and find all files or folders that have write atrributes
set then inject .htaccess and other php files that essentially destroy
all users accounts on the server.

The exploit works on systems that do not have phpsuexec enabled and
users find along with a PHP.

I’ve been working on a new tool called Find Lockdown which logs all find
commands from all users except root (or any others you specify). It will
be released soon in our projects section
http://www.webhostgear.com/cid_23.html

If you haven’t noticed we released a new tool called Nobody Check at
http://www.webhostgear.com/353.html

We also are available for professional assistance through Hire an Expert
at http://www.webhostgear.com/350.html

There were some problems with Apache early this morning (1am) that I
didn’t catch until about 6am today. If you tried to access the site
then, you couldn’t =) The semaphore were full, I’ve never run into this
problem before. Every time I tried to start Apache it would error out
disk was out of space.

warn pid file /usr/local/apache/logs/httpd.pid overwritten — Unclean
shutdown of previous Apache run?
semget: No space left on device

I checked the space and log file sizes, all were fine. Thankfully I
managed to find a nice script on cpanel forums that helped me get things
back to normal once again.

#!/bin/bash

ipcs -s | grep nobody | perl -e ‘while () {
@a=split(/\s+/); print `ipcrm sem $a[1]`}’

/scripts/restartsrv httpd

Cheers

Steve

Well I just got back from my brothers wedding in Maui. We had a blast,
what a beautiful place to get hitched! Now that I’m tanned and relaxed
I’ll mention some upcoming things on WHG

If you haven’t already I suggest checking out our antivirus.exim
tutorial at http://www.webhostgear.com/338.html Many people overlook
this little gem but it’s definately something you should consider
getting use to tinkering with.

I’m interested in knowing what kind of other things you’d like to see on
the site. More tutorials, interviews, reviews? Are you guys/gals after
something in particular then drop me a line
http://www.webhostgear.com/48.html

I’ve also been working on my own custom rulesets for antivirus.exim and
mod_security which are real nice and blocking a lot of new attacks out
there.

Hope everyone had a great week, I’ll keep you posted!

Steve

Well I’m excited to keep digging into the depths of email. Since all the support problems today are related to email I think it doesn’t hurt anyone to go the extra mile and learn as much as they can about it and their MTA.

While playing around with Exim I’ve found it has some great possibilities that I’m going to start putting to use privately and some on this site. Such as central filters that can help reduce the amount of spam in your clients mailboxes server wide. Also furthing the ability to track spam going out of your server instead of just being received. No one wants their system blacklisted so we’re going to be putting together some nice email, spam and blacklist related articles for you.

I’ve also been busy making a few custom tools that will be on the site shortly to do specific things or tasks that are very handy.

Steve

I’m so tired of people with no morals and no respect for others and their business. What’s happening to everyone today? Everywhere I go I see stressed people, road rage, computer madness, yelling phone calls, rude employees and no respect for others.

Is this a sign of the times, are people just now short fuses with a gigantic bomb at the end, waiting to blow up on anyone for the slightest thing? I watched a show on TV last night where the recreated the 1800s settlers with log cabins, horses, no cars and a 10 mile hike to the nearest store. They were always busy working together, everyone put in their share. Sometimes I think the world is better off without computers, cars and the whole rat race of buy/spend.

Why is that that soon as someone gets a raise they increase their cost of living by getting a fancier appartment, newer car or go on a shopping spree to blow it? Doesn’t anyone today want to retire tomorrow instead of living in the now and being stuck with nothing but stress and debt?

If you know where all the good people have gone who aren’t rat race maniacs, please point me in that direction. I’m getting off this hamster wheel but I watch my friend and others run on it like a non-stop battle till the death.

After using PerlDesk, Kayako eSupport and Cerebus helpdesk systems I’m
really suprised that these aren’t better polished products. eSupport
claims to have a padlock that goes onto tickets that other staff are
viewing, however it never works. It also strips out users pasted in
messages and anything with a > is removed from the ticket view
completely, you have to edit the ticket and view the headers to see the
actual message and sometimes this doesn’t work.

How can companies claim to offer professional grade support systems that
actually remove the contents a user puts in? I’m really suprised by the
lack of a good web based ticket system. If anyone finds one that is
meant for an actual company with more than 3 people please let me know.

I took my dog Jax out for a walk tonight and on the way back I came
across a Compaq DeskPro PC sitting beside the garbage bin. I guess
whoever put it there must have thought it might be good enough to not
throw out. After putting my dog inside I returned and brought back with
new discovery to my apartment with a feeling of excitement! I quickly
took the cables out of the older system and hooked it up.

The system booted! It was a Pentium 3 500 Mhz, 320 MB ram, DVD-ROM with
a 10 gig drive, network card ready to go. It had Windows 98 on it but I
couldn’t get it to load in safe mode or anything else. I ripped out the
drive and mounted it in my external USB case and hooked it up to my
other system. After hooking it up I did a virus scan, the thing was a
breading ground for trojans and viruses with over 50 findings. I quickly
disconnected the drive and put it back into the system.

There’s only one thing to do with a finding like this. I whipped out my
CentOS 3.4 CDs and began installing it. The installation went great and
finished in about 20 minutes. I logged into console and began playing
with my new toy! I quickly got it setup on my network and logged into my
new box through my laptop. W00t nothings better than finding some
working free gear!

Cheers

Steve

For anyone using LogWatch and is worried about sshd Authentication
Failures then you need to understand that there are thousands of robots
and scripts that will scan random IPs for easy login access to servers.
This is nothing to worry about.

Logwatch Authentication Failures

sshd:
Authentication Failures:
unknown (202.172.251.200): 251 Time(s)
Invalid Users:
Unknown Account: 499 Time(s)

All you need to do is block the IP that’s scanning your system. You can
do this automatically by following my tutorial on Preventing Brute Force
Attacks http://www.webhostgear.com/240.html

Changing your SSH port number will sometimes help for scanners that are
not targetted but anyone can still do a port scan and run the bot on the
different port. Blocking them with your firewall is be best method.

Once BFD and APF are setup you dont’ need to worry about LogWatch
Authentication Failures anymore.

Steve