Showing posts with label Linux. Show all posts
Showing posts with label Linux. Show all posts

Tuesday, January 26, 2016

Outgoing Email Counts For DirectAdmin Users

Replace $user with the system user and it will return a count of outgoing mails, per-user for the current day ($user and $user.bytes in this directory reset at midnight)
cat /etc/virtual/usage/$user.bytes | grep outgoing | awk -F= '{print $4}' | awk -F\& '{print $1}' | sort | uniq -c | sort -n

Find Files Sending SPAM On cPanel Exim Server

This will check your exim_mainlog and dump the paths from which mail has been sent along with the number. Check the listed directory for malware, shells, etc:
grep cwd /var/log/exim_mainlog | grep -v /var/spool | awk -F"cwd=" '{print $2}' | awk '{print $1}' | sort | uniq -c | sort -n

Find Files Sending SPAM On DirectAdmin Exim Server

This will check your exim_mainlog and dump the paths from which mail has been sent along with the number. Check the listed directory for malware, shells, etc:
grep cwd /var/log/exim/mainlog | grep -v /var/spool | awk -F"cwd=" '{print $2}' | awk '{print $1}' | sort | uniq -c | sort -n

Friday, October 2, 2015

Find List What Programs, Services, Daemons, Applications Are Using SWAP Memory In Linux

for file in /proc/*/status ; do awk '/VmSwap|Name/{printf $2 " " $3}END{ print ""}' $file; done | sort -k 2 -n -r | less

Tuesday, July 21, 2015

Symlink ClamAV Binaries On A Linux cPanel Server

ln -s /usr/local/cpanel/3rdparty/bin/freshclam /usr/local/bin/freshclam
ln -s /usr/local/cpanel/3rdparty/bin/clamscan /usr/local/bin/clamscan
ln -s /usr/local/cpanel/3rdparty/bin/clamd /usr/local/bin/clamd
ln -s /usr/local/cpanel/3rdparty/bin/clamav-config /usr/local/bin/clamav-config

Install ClamAV From The Command Line On A cPanel Server

Pretty simple task here and makes installing ClamAV easier shot you not have the root password for the customers installation:
/scripts/update_local_rpm_versions --edit target_settings.clamav installed
/scripts/check_cpanel_rpms --fix --targets=clamav

Monday, April 13, 2015

Recursively Find All Files With Only One Line Of Text On Linux

A nice one-liner for finding files that only contain a single line of text which is often the case with Wordpress exploits.
find . -type f -print0 | xargs -0 wc -l | awk '$1==1{print $2}'
...an alternate version:
find . -type f -exec sh -c '[ 1 -eq $(wc -l {}|cut -d" " -f1) ] && echo {}' \;

Wednesday, September 24, 2014

Kill All Processes In Linux Via Search GREP

Sometimes killall -9 simply doesn't work with all processes and as a result you are left searching/GREPing for process names to kill them off.

This Simplifies this task by killing all processes that are the result of that search:
kill -9 `ps -ef | grep processname | grep -v grep | awk '{print $2}'`

Monday, September 8, 2014

Change Clock Date Time Sync On Xen Linux VPS

Set the following in sysctl.conf on your VPS. This will allow your VPS to have a clock that is not forcibly synced with the host node.
xen.independent_wallclock = 1

Wednesday, July 2, 2014

How To Fix Permissions On Home Directory

This will ensure the user and group match the username in /home (non-recursively)
for i in `ls`; do { chown $i:$i $i; }; done;

Monday, March 10, 2014

Wednesday, January 29, 2014

How To Disable Eximstats on cPanel

Eximstats does just what it implies, keeps stats on exim(email). Sometimes you don't care about these stats and want to free your database and I/O up for more important things. Luckily you can via the following CLI command:
/usr/local/cpanel/bin/tailwatchd -–disable=Cpanel::TailWatch::Eximstats
You may want to truncate the related tables for eximstats in MySQL before doing this (to save time if they are crashed,etc) but is not required nor necessary as the above will clear the tables (but will bawk if they are crashed, etc)

Thursday, December 26, 2013

How To Fix [ERROR] Fatal error: Can't open and lock privilege tables: Table 'mysql.host' doesn't exist

Time to time on new installs of MySQL I encounter this error which is luckily very easy to fix.

From the command line simply run:
mysql_install_db --user=mysql
You may also encounter this error in part when trying to start/stop/restart the service and see:
ERROR! MySQL server PID file could not be found!
...which usually reveals itself in the err log in /var/lib/mysql

Thursday, December 19, 2013

Remove PHP Malware Hack Exploit Injection

If all your PHP files have been injected on the first line with an exploit of some sort, you can use the follow FIND and SED commands to replace the entire first line with a normal PHP open tag:
find . -name '*.php' -exec sed -i '1 s/^<?php.*$/<?php/g' {} \;
Once completed, you should inspect your logs and upgrade your software to avoid future incidents.

If you are running this to clean up a Wordpress site, I recommend using this modified version which will skip the themes directory which should be processed manually (the above tends to be too greedy and will 'splode theme files):
find . -path ./wp-content/themes -prune -o -name '*.php' -exec sed -i '1 s/^<?php.*$/<?php/g' {} \;

Monday, December 16, 2013

How To Fix scp: command not found

On the server that will not accept the SCP connection run (assuming CentOS/RHEL):
yum install openssh-clients -y

Thursday, December 12, 2013

How To Hide Warning: Permanently added to the list of known hosts From SSH Commands

Add the following to $HOME/.ssh/config
LogLevel=quiet
If you want to suppress this output per-command, add the following to your SSH command:
-o LogLevel=quiet