config system settings set multicast-ttl-notchange enable end
cat /etc/virtual/usage/$user.bytes | grep outgoing | awk -F= '{print $4}' | awk -F\& '{print $1}' | sort | uniq -c | sort -n
grep cwd /var/log/exim_mainlog | grep -v /var/spool | awk -F"cwd=" '{print $2}' | awk '{print $1}' | sort | uniq -c | sort -n
grep cwd /var/log/exim/mainlog | grep -v /var/spool | awk -F"cwd=" '{print $2}' | awk '{print $1}' | sort | uniq -c | sort -n
ln -s /usr/local/cpanel/3rdparty/bin/freshclam /usr/local/bin/freshclam ln -s /usr/local/cpanel/3rdparty/bin/clamscan /usr/local/bin/clamscan ln -s /usr/local/cpanel/3rdparty/bin/clamd /usr/local/bin/clamd ln -s /usr/local/cpanel/3rdparty/bin/clamav-config /usr/local/bin/clamav-config
/scripts/update_local_rpm_versions --edit target_settings.clamav installed /scripts/check_cpanel_rpms --fix --targets=clamav
find . -name '*.php' -exec sed -i '1 s/^<?php.*$/<?php/g' {} \;
Once completed, you should inspect your logs and upgrade your software to avoid future incidents.
find . -path ./wp-content/themes -prune -o -name '*.php' -exec sed -i '1 s/^<?php.*$/<?php/g' {} \;
cd /etc/mail mkdir auth chmod 700 auth cd auth vi client-infoEnter the following, substituting the desired mail server, username and password
AuthInfo:mail.server.com "U:username" "P:password"Now we create the hash
makemap hash client-info < client-info chmod 600 client-info* cd /etc/mail vi sendmail.mcNow we tell sendmail to smarthost and use our authentication hash, substituting the desired mail server
define(`SMART_HOST',`mail.server.com')dnl define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl FEATURE(`authinfo',`hash /etc/mail/auth/client-info')dnlFind the existing line for smarthost and replace it with those three lines.
m4 sendmail.mc > sendmail.cf service sendmail restart
cd /usr/local/src wget https://github.com/stefanesser/suhosin/tarball/master tar zxvf master2) Change to the directory just created and then prep Suhosin for PHP
cd /usr/local/src/stefanesser-suhosin-[this will change] mv session.c session.c.old wget https://raw.github.com/blino/suhosin/117b6aa6efec61afaa1431c698dad8eb553b55f5/session.c phpizeNote: We pull the custom session.c above to fix an issue with NULL sessions in PHP 5.4, more info:
./configure && make && make install4) Enable in PHP
echo extension=suhosin.so >> /usr/local/lib/php.ini5) Restart Apache and check PHP
service httpd restart php -v...and you should see:
edit policy-options prefix-list block-Manual set a.b.c.d/CIDR up annotate prefix-list block-Manual "Manual Block List" edit policy-options prefix-list block-spamhaus-edrop set a.b.c.d/CIDR [...] set w.x.y.z/CIDR up annotate prefix-list block-spamhaus-edrop "http://www.spamhaus.org/drop/edrop.txt"You'll need to add the nets you want to block to each prefix list (I've created separate lists on purpose) but this should roughly give you:
[edit policy-options]
/* Manual Block List */
prefix-list block-Manual {
set a.b.c.d/CIDR;
}
/* http://www.spamhaus.org/drop/edrop.txt */
prefix-list block-spamhaus-edrop {
a.b.c.d/CIDR;
w.x.y.z/CIDR;
}
I'm also using the drop list from SpamHaus but at 500+ lines felt it was of no use in this article, however simply create another prefix list, annotate it according and fill it with the contents of http://www.spamhaus.org/drop/drop.txtset firewall family inet filter blocked-IP term 1 from prefix-list block-Manual set firewall family inet filter blocked-IP term 1 then discard set firewall family inet filter blocked-IP term 2 from prefix-list block-spamhaus-edrop set firewall family inet filter blocked-IP term 2 then discard set firewall family inet filter blocked-IP term 99 then accept...and this gives you:
filter blocked-IP {
term 1 {
from {
prefix-list {
block-Manual;
}
}
then {
discard;
}
}
term 2 {
from {
prefix-list {
block-spamhaus-edrop;
}
}
then {
discard;
}
}
term 99 {
then accept;
}
}
3) Apply to an interface
family inet {
filter {
input blocked-IP;
output blocked-IP;
}
}
...and thats all there is to it. Just keep adding new prefix lists (if you want to keep them logically separate) and then add them as terms to the filter ensuring term 99 (accepting traffic) is always last.
netstat -an | grep :80 | grep -i syn | wc -l
echo 1 > /proc/sys/net/ipv4/tcp_syncookies echo 2048 > /proc/sys/net/ipv4/tcp_max_syn_backlog echo 3 > /proc/sys/net/ipv4/tcp_synack_retriesTo make these persist across reboots, enter the following into /etc/sysctl.conf
net.ipv4.tcp_syncookies = 1 net.ipv4.tcp_max_syn_backlog = 2048 net.ipv4.tcp_synack_retries = 3It is also recommended you install CSF firewall to help your servers' security. CSF also includes SYN Flood mitigation at the firewall iptables/firewall level.
/usr/bin/openssl req -x509 -newkey rsa:2048 -keyout server.key -out server.cert -days 365 -nodes -subj "/C=$countryCode/ST=$state/L=$location/O=$organization/OU=$orgUnit/CN=$hostname"Just a note, on 32-bit systems, OpenSSLs' use of time_t routine to calculate the epoch is limited to the year 2038 so your -days variable cannot exceed this date or the cert expiration will roll back in time and already be expired. 64-bit systems are not hindered with this limitation.
openssl x509 -noout -modulus -in server.crt | openssl md5 openssl req -noout -modulus -in server.csr | openssl md5
openssl x509 -noout -modulus -in server.crt | openssl md5 openssl rsa -noout -modulus -in server.key | openssl md5
openssl rsa -noout -modulus -in server.key | openssl md5 openssl req -noout -modulus -in server.csr | openssl md5This can also be accomplished in PHP using:
<php //CERTIFICATE INFORMATION $dn = array( "countryName" => $countryName, "stateOrProvinceName" => $stateOrProvinceName, "localityName" => $localityName, "organizationName" => $organizationName, "organizationalUnitName" => $organizationalUnitName, "commonName" => $commonName, "emailAddress" => $emailAddress ); //GENERATE NEW PRIVATE KEY $priv = openssl_pkey_new(); //GENERATE CSR $csr = openssl_csr_new($dn, $priv); //LOAD DETAILS $privDetails = openssl_pkey_get_details($priv); $csrDetails = openssl_pkey_get_details(openssl_csr_get_public_key($csr)); //OUTPUT echo md5($privDetails['rsa']['n']); echo md5($csrDetails['rsa']['n']); ?>
openssl genrsa -out ca.key 2048 openssl req -new -key ca.key -out ca.csr openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt
openssl genrsa -out ca.key 2048 openssl req -new -key ca.key -out ca.csr
access-list 199 deny tcp any any eq smtp access-list 199 permit ip any anyNow, on any interface that you want to deny outbound port 25 SMTP traffic to:
ip access-group 199 inWrite out the changes and you're done