namebench : DNS Benchmark Utility

Namebench use to find out the fastest DNS servers available for your computer to use. Namebench run benchmark using your web browser history, tcpdump output, or standardized datasets in order to provide an individualized recommendation.

This is the result from my benchmarking

I got Google Public DNS is the fastest and followed by P1 DNS server... maybe Google DNS server it the fastest in term of speed, but from my experience, Level 1 (4.2.2.1,4.2.2.2,4.2.2.3,4.2.2.4) DNS server the fastest propagated DNS.

To install:-

Download here.

tar -zxvf namebench-1.0.5.tgz
cd namebench-1.0.5/
python setup.py install
./namebench.py

ip_conntrack: table full, dropping packet

Happen on my old freaking old server this afternoon....i unable to SSH into server at all...and need to physical access and here what i got after plugged the monitor...

ip_conntrack: table full, dropping packet

keep coming and coming... to solve this issue, i need to increase it value..but before that need to check current value first. To do so, need run following command.

cat /proc/sys/net/ipv4/ip_conntrack_max

to find out current usages:-

cat /proc/sys/net/ipv4/netfilter/ip_conntrack_count

Temporary solve this issue by increase the value

echo 191072 > /proc/sys/net/ipv4/ip_conntrack_max

To make the permanent changes, i need to change value from kernel it self, so i edit this file

vi /etc/sysctl.conf

and add this value at the end of file

net.ipv4.ip_conntrack_max=191072

and update the kernel with latest configuration by exec this command

sysctl -p

Simple Password Generator

Edit this file .bashrc at your home dir.

sudo vi /home/harith/.bashrc

add following script at the end

genpasswd() {
local l=$1
[ "$l" == "" ] && l=20
tr -dc A-Za-z0-9_ < /dev/urandom | head -c ${l} | xargs }

Open your terminal and run this command to generate random password

genpasswd 16

Example:

harith@thinkmachine:~$ genpasswd 16
Br1WleFsmhJ4Dkwb
harith@thinkmachine:~$

Clear queue mails in QMail Server

1) wget http://www.japanitup.com/scripts/qmailclear.sh
2) sh qmailclear.sh


[root@www home]# /var/qmail/bin/qmail-qstat
messages in queue: 0
messages in queue but not yet preprocessed: 0
[root@www home]#

Mysql is not running but lock exists issue

/etc/init.d/mysql status

coming back with:

mysql is not running but lock exists


Solved by removing the lock file:

rm /var/lock/subsys/mysql

MySQL Error : mysql is not running but lock exists

/etc/init.d/mysql status

coming back with:

mysql is not running but lock exists

Solved by removing the lock file:

rm /var/lock/subsys/mysql

Installing JBoss Java Application Server in RHEL / CentOS 5

Just execute following command:-

yum install java-1.5.0-sun-devel jbossas

For old RHEL use following command:-

up2date -i java-1.5.0-sun-devel jbossas

Done.

Install Suhosin as extension / PHP harden

Download the latest version of suhosin:-

wget http://download.suhosin.org/suhosin-0.9.27.tgz

Suhosin required php-devel:-

yum install php-devel

Install suhsosin:-

cd suhosin-0.9.27
phpize
./configure
make
make install

Congfirue Suhosin congiguration file:-

echo 'extension=suhosin.so' > /etc/php.d/suhosin.ini

Restart your webserver..
blockquote>

/etc/init.d/httpd restart

Check your suhsosin:-

php -v

or crate phpinfo page.

Locate Table Consuming High Resources

You need to install perl modules:-

cpan -i Term::ReadKey
cpan -i  Term::ANSIColor
cpan -i  Time::HiRes

after that, install mytop

wget http://jeremy.zawodny.com/mysql/mytop/mytop-1.6.tar.gz
tar -zxvf mytop-1.6.tar.gz
cd mytop-1.6
perl Makefile.PL
make
make test
make install

mirror : wget http://notepad.harithdawi.com/files/mysql/mytop-1.6.tar.gz

execute below command (mydb is the database name)

mytop -u dba -p 'password' -h 10.2.4.5 -d mydb

• -u : Database username.


• -p : Database password.


• -h : Database server IP address.


• -d : Database name

Server under DDOS attack

Check server load:-

harith@vps:~$ w
 05:59:01 up 8 days, 21:24,  2 users,  load average: 0.54, 0.39, 0.18
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
root     pts/0    124.217.240.33   Mon12    2days  0.01s  0.01s -bash
harith   pts/1    118.101.132.110  05:41    0.00s  0.00s  0.00s w
harith@vps:~$

Count total httpd processes:-

harith@vps:~$ ps -aux | grep -i HTTP | wc -l
130
harith@vps:~$<

Determine the attacking network

netstat -lpn | grep :80 | awk '{print $5}' | sort

if you have more 30 connection from 1 single ip, maybe your server under attack.

block the ip:-

iptables -A INPUT -s <Source IP> -j DROP

Disable IMCP request in Linux

Disable IMCP request in Linux:-

iptables -A OUTPUT -p icmp --icmp-type echo-request -j DROP

The result:-

harith@nobody:~$ ping server-ayam.harithdawi.com
PING yahoo.com (xxx.xxx.xxx.xxx) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted

Foward CPanel & exim server incoming / outgoing mail

Edit following file:

/etc/antivirus.exim

for CPanel 11 edit folowing file:

/etc/cpanel_exim_system_filter

Catch all outgoing email

#Catch all outgoing email account user1@domain1.com and froward to tracker@domain1.com
#Just put domain1.com instead of user1@domain1.com to catch all email account for the domain

if first_delivery
and ( ("$h_from:" contains "user1@domain1.com")
#or (”$h_from:” contains “user2@domain1.com”)
)
then
unseen deliver "tracker@domain1.com"
endif

Catch all incoming emails

#Catch all incoming email for account user1@domain1.com and froward to tracker@domain1.com

if first_delivery
and ( ("$h_to:" contains "user1@domain1.com")
or (”$h_cc:” contains “user1@domain1.com”)
)
then
unseen deliver "tracker@domain1.com"
endif

Quick understanding ownership and permissions in Linux

List all file and folder with permisson info:-

harith@cengkeh:~/test$ ls -lah
total 8.0K
drwxr-xr-x 2 harith harith 4.0K 2009-02-23 03:12 .
drwxr-xr-x 48 harith harith 4.0K 2009-02-23 03:12 ..
-rw-r--r-- 1 harith harith 0 2009-02-23 03:12 file1
-rw-r--r-- 1 harith harith 0 2009-02-23 03:12 file2
-rw-r--r-- 1 harith harith 0 2009-02-23 03:12 file3
harith@cengkeh:~/test$

Understanding file/folder permission:-

-                (rw-)          (rw-)          (r--)           1               Harith          Harith
|                  |                 |                 |
type            owner      group        others

Type of file (type)

d                — a directory/folder
-(dash)    — a regular file
l                 — a symbolic link to another program or file elsewhere on the system

r — file can be read
w — file can be written to
x — file can be executed (if it is a program)

Get Public IP from Linux command

Just copy paste following command and hit enter:-

wget -q -O - checkip.dyndns.org|sed -e 's/.*Current IP Address: //' -e 's/<.*$//'

Result:-

harith@cengkeh:~$ wget -q -O - checkip.dyndns.org|sed -e 's/.*Current IP Address: //' -e 's/<.*$//'
124.13.233.xxx
harith@cengkeh:~$

Other option is using curl :-

curl -s checkip.dyndns.org|sed -e 's/.*Current IP Address: //' -e 's/<.*$//'

if you dont have curl, download by using following command:-

sudo apt-get install curl

Unable to start apache after make some changes

Unable to start apache after make some changes? by default apache have config file syntax checking. You can execute below command to check you syntax.

# httpd -t
# httpd -S


If the syntax of the output will look like this:-

Syntax OK

it mean you configure correctly.

If the out put similar with this,

Syntax error on line 44 of /etc/apache/httpd.conf:
bla...bla...bla.....

correct the syntax and try start again:-

# vi +44 /etc/apache/httpd.conf

For more info ,check log file :-

tail -f /var/log/httpd-error.log

egrep -i 'warn|error' /var/log/httpd-error.log

How to make SYN flood (basic)

What is SYN flood?

A SYN flood is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target's system. (read more)

Download hping (http://www.hping.org/)

Debian / ubuntu

#sudo apt-get install hping

Use this commnad to execute attack:-

sudo hping - -faster -S <ip address or domain name>

For batter result, get ethernet packet generator ( http://packeth.sourceforge.net/)

Print out kernel message or control ring buffer

Print out kernel message or control ring buffer

dmesg [ -c ] [ -n level ] [ -s bufsize ]

Options

-c
Clear the ring buffer contents after printing.
-sbufsize
Use a buffer of size bufsize to query the kernel ring buffer. This is 16392 by default. (The default kernel syslog buffer size was 4096 at first, 8192 since 1.3.54, 16384 since 2.1.113.) If you have set the kernel buffer to be larger than the default then this option can be used to view the entire buffer.
-nlevel
Set the level at which logging of messages is done to the console. For example, -n 1 prevents all messages, expect panic messages, from appearing on the console. All levels of messages are still written to /proc/kmsg, so syslogd(8) can still be used to control exactly where kernel messages appear. When the -n option is used, dmesg will not print or clear the kernel ring buffer.

When both options are used, only the last option on the command line will have an effect.

How to install Cpanel & WHM in Fedora

yum -y install tcp_wrappers-devel perl tar

mkdir /home/cpins

cd /home/cpins

wget http://layer1.cpanel.net/latest

sh latest &

& wait... until the cpanel said "done"

How to install Cpanel & WHM

Get the power of root.

1. cd /home
2. wget http://layer1.cpanel.net/latest
3. sh latest

Count the connection and sort by IP in Linux

Count the connection and sort by ip : -

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n