CSF AND BFD install

APF or CSF – A policy based iptables firewall system used for the easy configuration of iptables rules.

cd /usr/local/src
wget http://www.configserver.com/free/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh
echo "CSF successfully installed!"
When your configuration is complete, you need to set the following in /etc/csf/csf.conf to disable “TESTING” mode and enable your firewall:
TESTING = “1″
to
TESTING = “0″

Brute Force Detection – BFD is a shell script for parsing applicable logs and checking for authentication failures and blocks the attackers ip in the firewall

cd /usr/local/src
wget http://www.rfxn.com/downloads/bfd-current.tar.gz
tar -xvzf bfd-current.tar.gz
cd bfd-1.4
./install.sh
echo -e "Please enter your email:"
read email
echo "You entered: $email"
echo "ALERT_USR="1"" >> /usr/local/bfd/conf.bfd
echo "EMAIL_USR="$email"" >> /usr/local/bfd/conf.bfd
echo "Brute Force Detection has been installed!"
echo "Email would be sent to $email"
/usr/local/sbin/bfd -s

ClamAV is the best malicious scanning tool which comes with Cpanel/ WHM on Linux server.

ClamAV is the best malicious scanning tool which comes with Cpanel/ WHM on Linux server.

You can use following steps to install and scan Clam AV.

Login your WHM >>> find the option "Manage Plugins >>> select Clam AV >>> install.

Once it is install then login your Linux server via SSH and create a directory under /home using following command.

cd /home; mkdir clamscan-infectedfiles

And then use following command to scan the Clam AV.

clamscan --exclude mail --exclude clamscan-infectedfiles -ri [a-z]* --move=clamscan-infectedfiles

Once the scanning process is completed then you will get the complete scanning report in following format.

==============================
----------- SCAN SUMMARY -----------
Known viruses:
Engine version:
Scanned directories:
Scanned files:
Infected files: 0
Data scanned: MB
Data read: MB (ratio 0.89:1)
Time: 000.000 sec (10 m 21 s)
=====================================

Maldet - Linux Malware Detect (LMD)

Linux Malware Detect (LMD) is a malware scanner for Linux released under the GNU GPLv2 license, that is designed around the threats faced in shared hosted environments.

cd /usr/local/src
wget http://www.rfxn.com/downloads/maldetect-current.tar.gz
tar -xzvf maldetect-current.tar.gz
cd maldetect-*
sh install.sh
cd ..
rm -Rf maldetect-current.tar.gz
echo "Linux Malware Detect has been installed!"

To run the maldet

>maldet -a /

RootKit Hunter – A tool which scans for backdoors and malicious softwares present in the server.

Rkhunter (Rootkit Hunter) is an open source Unix/Linux based scanner tool for Linux systems released under GPL that scans backdoors, rootkits and local exploits on your systems. It scans hidden files, wrong permissions set on binaries, suspicious strings in kernel etc. To know more about Rkhunter and its features visit http://www.rootkit.nl/.

Installation

cd /usr/local/src
wget https://dl.dropbox.com/s/i5sd0ljp6pejhn6/rkhunter-1.4.0.tar.gz
wget http://downloads.sourceforge.net/project/rkhunter/rkhunter/1.4.0/rkhunter-1.4.0.tar.gz
tar -xzvf rkhunter-1.4.0.tar.gz
cd rkhunter-1.4.0
./installer.sh --install
rkhunter --check
echo "Rkhunter successfully installed!"
log : /var/log/rkhunter.log

To update it
=========
rkhunter --update
rkhunter --propupd
=========

set crontab to scan and email the report

#!/bin/sh
(
/usr/local/bin/rkhunter --versioncheck
/usr/local/bin/rkhunter --update
/usr/local/bin/rkhunter --cronjob --report-warnings-only
) | /bin/mail -s 'rkhunter Daily Run (PutYourServerNameHere)' your@email.com

CHKRootKit –Detects hacker software and notifies via email

Please keep in mind that, you can use chkrootkit to find the files and processes associated with a rootkit, but you can’t be 100% sure that all pieces of rootkits are found and removed. You can safeguard your system from rootkits by ensuring that all applications and softwares are up-to-date and the system kept patched against all known vulnerabilities.

cd /usr/local/src
wget https://dl.dropbox.com/s/4rmbi1dmifn4si2/chkrootkit.tar.gz
wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz
tar -xvzf chkrootkit.tar.gz
cd chkrootkit-*/
make sense
./chkrootkit
cd ..
echo "CHRootKit has been installed!"

Enable Automatic Server Scanning

You can add a cron entry for running chkrootkit automatically and send a scan report to your mail address. Create and add the following entries to “/etc/cron.daily/chkrootkit.sh”

#!/bin/sh
(
/usr/local/chkrootkit/chkrootkit
) | /bin/mail -s ‘CHROOTKIT Daily Run (ServerName)’ your@email.com

Creating custom php.ini for needed users

If you have a site on your cPanel VPS that needs a custom php.ini file, you can set that up by following these steps:

1,Copy /usr/local/lib/php.ini to the site's Web root folder (public_html).
>cp /usr/local/lib/php.ini /home/USERNAME/public_html
2,Make sure the file is owned by their cPanel user
>chown USERNAME:USERNAME php.ini
3,Add the following to the site's ".htaccess" file
  SetEnv PHPRC /home/USERNAME/public_html/php.ini
or
   suPHP_conf /home/user/someplace/php.ini

Custom Values should be added in .htaccess in a format as shown in example below

php_value memory_limit 128M
php_value max_execution_time 3600
php_value post_max_size 5M
php_value upload_max_filesize 5M

Updating mysql user password

root#mysql
mysql> use mysql;
mysql>

SET PASSWORD FOR 'user-name-here'@'hostname-name-here' = PASSWORD('new-password-here');  
or
UPDATE mysql.user SET Password=PASSWORD('new-password-here') WHERE User='user-name-here' AND Host='host-name-here';  

mysql>flush privileges
mysql>quit

Now restart mysqld