Common cPanel/WHM /Scripts

Hello Guys!
Here you can find some common cPanel scripts which are useful for the task given below.

Common cPanel /Scripts

/scripts/installzendopt - Install Zend Optimizer /scripts/fixndc - Hostname A Entry Missing!  then restart bind and apache
Install Cron on New Server /scripts/installrpm anacron vixie-cron ; /etc/rc.d/init.d/crond start
/scripts/cleanbw - Bandwidth issues /scripts/fixwebalizer (To fix problem in webalizer that stop updating stats)
/scripts/fixcommonproblems
/scripts/fixeverything
/usr/local/cpanel/bin/convertmailman2 - Fixing Mail List MailMan /scripts/reinstallmailman - Reinstall MailMan
/scripts/fixhome - Fix Permissions on accountsEdit mySQL conf file: pico /etc/my.cnf
Edit php.ini: pico /usr/local/lib/php.ini
Edit Apache Conf: pico /etc/httpd/conf/httpd.conf
Checking Real Time Top Processes Login to SSH and run: top
Run cpanel backup /scripts/cpbackup
To try and fix domain controller: /scripts/fixndc

Quotas /scripts/initquotas – takes a while to run
/scripts/resetquotas
/scripts/fixquotas – takes a while to run

/scripts/adddns Add a Dns Entry
/scripts/addfpmail Install Frontpage Mail Exts
/scripts/addservlets Add JavaServlets to an account (jsp plugin required)
/scripts/adduser Add a User
/scripts/admin Run WHM Lite
/scripts/apachelimits Add Rlimits (cpu and mem limits) to apache.
/scripts/dnstransfer Resync with a master DNS Server
/scripts/editquota Edit A User’s Quota
/scripts/finddev Search For Trojans in /dev
/scripts/findtrojans Locate Trojan Horses
Suggest Usage
/scripts/findtrojans > /var/log/trojans
/scripts/fixtrojans /var/log/trojans
/scripts/fixcartwithsuexec Make Interchange work with suexec
/scripts/fixinterchange Fix Most Problems with Interchange
/scripts/fixtrojans Run on a trojans horse file created by findtrojans to remove them
/scripts/fixwebalizer Run this if a user’s stats stop working
/scripts/fixvaliases Fix a broken valias file
/scripts/hdparamify Turn on DMA and 32bit IDE hard drive access (once per boot)
/scripts/initquotas Re-scan quotas. Usually fixes Disk space display problems
/scripts/initsuexec Turn on SUEXEC (probably a bad idea)
/scripts/installzendopt Fetch + Install Zend Optimizer
/scripts/ipusage Display Ipusage Report
/scripts/killacct Terminate an Account
/scripts/killbadrpms Delete “Security Problem Infested RPMS”
/scripts/mailperm Fix Various Mail Permission Problems
/scripts/mailtroubleshoot Attempt to Troubleshoot a Mail Problem
/scripts/mysqlpasswd Change a Mysql Password
/scripts/quicksecure Kill Potential Security Problem Services
/scripts/rebuildippool Rebuild Ip Address Pool
/scripts/remdefssl Delete Nasty SSL entry in apache default httpd.conf
/scripts/restartsrv Restart a Service (valid services: httpd,proftpd,exim,sshd,cppop,bind,mysql)
/scripts/rpmup Syncup Security Updates from RedHat/Mandrake
/scripts/runlogsnow Force a webalizer/analog update.
/scripts/secureit Remove non-important suid binaries
/scripts/setupfp4 Install Frontpage 4+ on an account.
/scripts/simpleps Return a Simple process list. Useful for finding where cgi scripts are running from.
/scripts/suspendacct Suspend an account
/scripts/sysup Syncup Cpanel RPM Updates
/scripts/unblockip Unblock an IP
/scripts/unsuspendacct UnSuspend an account
/scripts/upcp Update Cpanel
/scripts/updatenow Update /scripts
/scripts/wwwacct Create a New Account

/scripts/runweblogs account username for awstats to run manually

Sometimes such behavior of apache/httpd (taking more and more memory until it dies or crashes the server) can be caused by corrupted MySQL database. Try to do the following:
1) Kill the mysql server
/etc/rc.d/init.d/mysql stop

2) Repair all SQL databases:
myisamchk -r /var/lib/mysql/*/*.MYI

3) Start mysql again:
/etc/rc.d/init.d/mysql start

How to install RkHunter on linux server / linux system / cPanel Server

Rkhunter is a very useful tool that is used to check for trojans, rootkits, and other
security problems.This tutorial will touch on installing and setting up a daily report
http://rkhunter.sourceforge.net/

# wget http://downloads.sourceforge.net/project/rkhunter/rkhunter/1.3.8/rkhunter-1.3.8.tar.gz
# wget http://sourceforge.net/projects/rkhunter/files/latest/download

# tar - xzvf rkhunter-1.3.8.tar.gz

# cd rkhunter-1.3.8.tar.gz OR  cd rkhunter-*
# ./installer.sh --layout default --install
# cd ..
# rm -Rf rkhunter*
# /usr/local/bin/rkhunter --update
# /usr/local/bin/rkhunter --propupd

Now cron it to run on daily basis and email you

 # nano -w /etc/cron.daily/rkhunter.sh

#!/bin/sh
(
/usr/local/bin/rkhunter --versioncheck
/usr/local/bin/rkhunter --update
/usr/local/bin/rkhunter --cronjob --report-warnings-only
) | /bin/mail -s 'rkhunter Daily Run (YourServer HostName Here)' your@email.com

Remember to change YourServerNameHere and your@email.com

 #chmod 700 /etc/cron.daily/rkhunter.sh

 You can update rootkit hunter to latest version using
# rkhunter --update
and you can do scan using
#/usr/local/bin/rkhunter -c OR rkhunter --check

Rkhunter Installation

http://www.webhostgear.com/141.html

Rkhunter is a very useful tool that is used to check for trojans, rootkits, and other
security problems.This tutorial will touch on installing and setting up a daily report

for rkhunter.

Installing:

wget http://downloads.rootkit.nl/rkhunter-1.2.7.tar.gz
tar -zxvf rkhunter-1.2.7.tar.gz
cd rkhunter-1.2.7
./installer.sh

Now you can run a test scan with the following command:

/usr/local/bin/rkhunter -c

How to setup a daily scan report?

pico /etc/cron.daily/rkhunter.sh

add the following replacing your email address:

#!/bin/bash
(/usr/local/bin/rkhunter -c --cronjob 2>&1 | mail -s "Daily Rkhunter Scan Report"
email@domain.com)

chmod +x /etc/cron.daily/rkhunter.sh

Updating rkhunter
gets the latest database updates from their central server and matches your OS
better to prevent false positives.

# rkhunter --update

I just got a false positive!! What do i do?False positives are warnings which indicates
there is a problem, but aren't really a problem. Example: some Linux distro updated
a few common used binaries like `ls` and `ps`. You (as a good sysadmin) update
the new packages and run (ofcourse) daily Rootkit Hunter. Rootkit Hunter isn't yet
aware of these new files and while scanning it resports some "bad" files. In this
case we have a false positive. You could always have your datacenter or a system
administrator check out the server to verify that it is not compromised.

More information on rkhunter can be found here: http://www.rootkit.nl

How to install RkHunter on linux server

wget http://downloads.rootkit.nl/rkhunter-1.2.7.tar.gz

tar -zxvf rkhunter-1.2.7.tar.gz

cd rkhunter-1.2.7

./installer.sh

Now you can run a test scan with the following command:

/usr/local/bin/rkhunter -c

How to setup a daily scan report?

vi /etc/cron.daily/rkhunter.sh

#!/bin/bash

(/usr/local/bin/rkhunter -c --cronjob 2>&1 | mail -s "Daily Rkhunter
Scan
Report" email@domain.com)

# chmod

# rkhunter --update

x /etc/cron.daily/rkhunter.sh

How to change Exim Sending IP

How to change Exim Sending IP

Changing Exim Sending IP

For start with second method it needs to turn on “Mail Server IP change feature of cPanel“. This can be done through “Exim Configuration Editor”.

i.e. Main >> Service Configuration >> Exim Configuration Editor

The “Domains and IPs” section of ”Exim Configuration Editor” has a line as following:

** Send outgoing mail from the ip that matches the domain name in /etc/mailips (*: IP can be added to the file to change the main outgoing interface) [?]
Ticking the check box along above stated line will enable that feature.

Or, in /etc/exim.conf.localopts, add/change this line:
per_domain_mailips=1

After editing /etc/exim.conf.localopts run the script “buildeximconf” in “/script” and restart exim server.

i.e. /scripts/buildeximconf; /etc/init.d/exim restart

After this initial step of second method you need to make use of /etc/mailips file to proceed further with mail IP change.
For changing mail interface IP of the server globally, add the IP which want to set as mail IP to /etc/mailips in following given syntax:

*: xxx.xxx.xxx.xxx
where “xxx.xxx.xxx.xxx” stands for the IP which want to set as mail IP in the server.

The second method also provide you a frendly feature to set mail IPs for each domain. For setting mail IP per domain wise, follow below given syntax:

xxx.xxx.xxx.xxx hostname.tld

where “xxx.xxx.xxx.xxx” stands for the IP which want to set as domain mail IP and hostname.tld stands for the domain name.

If you have multiple dedicated IP domains already, I’ve devised a simple one liner using awk and sed to populate/etc/mailips automatically:

awk ‘{ print $2″: “$1 }’ /etc/domianips | sed ‘s/:$//’ >> /etc/mailips
===========================================================>

Reference : http://docs.cpanel.net/twiki/bin/view/AllDocumentation/WHMDocs/EximDifferentIps

How to Install ChkRootKit on linux System / Server / cPanel Server Centos

Install ChkRootKit on linux System / Server / cPanel Server Centos

Install ChkRootKit

Follow these steps to install ChkRootKit

Login to SSH as root

cd /usr/local/src/

– Down load the chkrootkit.
# wget http://www.spenneberg.org/chkrootkit-mirror/files/chkrootkit.tar.gz
# wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz

- Unpack the chkrootkit you just downloaded.
# tar -xvzf chkrootkit.tar.gz

- Change to new directory
# cd chkrootkit-*
(select the version )

- Compile chkrootkit
# make sense

- Run chkrootkit
# ./chkrootkit

How to setup a daily scan report?

- Load crontab
# crontab -e

- Add this line to the top:
===============================================================>
0 1 * * * (cd /usr/local/src/chkrootkit*; ./chkrootkit 2>&1 | mail -s “chkrootkit output” email@domain.com)
===============================================================>

Hard Disk Format Command/delete a partition with fdisk / View Hard Drive Partitions with fdisk and parted commands

Linux Hard Disk Format Command

Q. I've installed a new 250GB SATA hard disk on our office CentOS Linux server. How do I format a hard disk under Linux operating system from a shell prompt?
A.. There are total 4 steps involved for hard disk upgrade and installation procedure:
Step #1 : Partition the new disk using fdisk command
Following command will list all detected hard disks:
# fdisk -l | grep '^DOutput:

Disk /dev/sda: 251.0 GB, 251000193024 bytes Disk /dev/sdb: 251.0 GB, 251000193024 bytes

A device name refers to the entire hard disk. For more information see Linux partition naming convention and IDE drive mappings.
To partition the disk - /dev/sdb, enter:
# fdisk /dev/sdbThe basic fdisk commands you need are:

• m - print help
• p - print the partition table
• n - create a new partition
• d - delete a partition
• q - quit without saving changes
• w - write the new partition table and exit

Step#2 : Format the new disk using mkfs.ext3 command

To format Linux partitions using ext2fs on the new disk:
# mkfs.ext3 /dev/sdb1

Step#3 : Mount the new disk using mount command

First create a mount point /disk1 and use mount command to mount /dev/sdb1, enter:
# mkdir /disk1
# mount /dev/sdb1 /disk1
# df -H

Step#4 : Update /etc/fstab file

Open /etc/fstab file, enter:
# vi /etc/fstab
Append as follows:

/dev/sdb1 /disk1 ext3 defaults 1 2

Save and close the file.

Task: Label the partition

You can label the partition using e2label. For example, if you want to label the new partition /backup, enter
# e2label /dev/sdb1 /backup
You can use label name insted of partition name to mount disk using /etc/fstab:
LABEL=/backup /disk1 ext3 defaults 1 2

Linux: How to delete a partition with fdisk command

Q. My system comes with pre installed Linux and XP. Now I would like to delete a partition. How do I delete a partition?

A. Hard disks can be divided into one or more logical disks called partitions. This division is described in the partition table found in sector 0 of the disk.

You need to use fdisk command. It is a menu driven program for creation and manipulation of partition tables. However this program needs the device name (hard disk name) to manipulate partitions. Usually you use following names
/dev/hda
/dev/hdb
/dev/sda
/dev/sdb

So,
=> /dev/hd[a-h] for IDE disks
=> /dev/sd[a-p] for SCSI disks
=> /dev/ed[a-d] for ESDI disks
=> /dev/xd[ab] for XT disks.

A device name refers to the entire hard disk. For more information see Linux partition naming convention and IDE drive mappings.

Before typing any one of the following command(s) make sure you have the backup of important data.

First, get a listing of your current partition scheme, type the following command:
# fdisk -l.
Output:

Disk /dev/hda: 20.0 GB, 20060651520 bytes
255 heads, 63 sectors/track, 2438 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
   Device Boot      Start         End      Blocks   Id  System
/dev/hda1               1        1024     8225248+   b  W95 FAT32
/dev/hda2   *        1025        2438    11357955    c  W95 FAT32 (LBA)
Disk /dev/hdb: 80.0 GB, 80060424192 bytes
255 heads, 63 sectors/track, 9733 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
   Device Boot      Start         End      Blocks   Id  System
/dev/hdb1   *           1        2432    19535008+  83  Linux
/dev/hdb2            2433        2554      979965   82  Linux swap / Solaris
/dev/hdb3            2555        6202    29302560   83  Linux
/dev/hdb4            6203        9733    28362757+   5  Extended
/dev/hdb5            6203        9733    28362726   83  Linux

From above output I have two hard disks:
=> /dev/hda - 20 GB
=> /dev/hdb - 80 GB

Let us assume that you want to remove a partition from /dev/hdb disk. Type the following command:
# fdisk /dev/hdb
Output:

The number of cylinders for this disk is set to 9733.
There is nothing wrong with that, but this is larger than 1024,
and could in certain setups cause problems with:
1) software that runs at boot time (e.g., old versions of LILO)
2) booting and partitioning software from other OSs
   (e.g., DOS FDISK, OS/2 FDISK)
Command (m for help):

Now type p command to list partition:
Command (m for help): pOutput:

Disk /dev/hdb: 80.0 GB, 80060424192 bytes
255 heads, 63 sectors/track, 9733 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
   Device Boot      Start         End      Blocks   Id  System
/dev/hdb1   *           1        2432    19535008+  83  Linux
/dev/hdb2            2433        2554      979965   82  Linux swap / Solaris
/dev/hdb3            2555        6202    29302560   83  Linux
/dev/hdb4            6203        9733    28362757+   5  Extended
/dev/hdb5            6203        9733    28362726   83  Linux

Now let us say you want to delete /dev/hdb3 (3rd partition). Type the d command to delete a partition:
Command (m for help): d
Partition number (1-4): 3

It will prompt you for the partition number. Type 3:

Verify that partition deleted:
Command (m for help): p

Now save the changes and exit to shell prompt. Type the w command:
Command (m for help): w

Reboot the system.

Linux Partition Naming Convention ( IDE Drive Mappings )

Q. I am new to Linux and I not able to understand /dev/hdc (is it C: drive?) under Linux. This is quite confusing for a new Linux user like me. What device naming convention followed by Linux? Can you explain it in layman's term?

A. Linux does not follows DOS or Windows XP style partition names or drive names. It is true that it is a bit confusing for a new Linux user. Linux use combination of bus and . For example if you are using IDE hard disk or CDROM it is will use HD word. If you are using SCSI interface it will use SD word.
A typical home pc or laptop has 2 or 4 IDE channels as follows:

• ide0 = primary
• ide1 = secondary
• ide2 = tertiary
• ide3 = quaternary

For example:

• ide0 = primary master = hda
• ide1 = primary slave = hdb
• ide2 = secondary master = hdc
• ide3 = secondary slave = hdd

and so on...
SCSI devices are listed as devices sda, sdb, sdc, sdd, sde, sdf, and sdg in the /dev directory. Similarly, partitions on these disks can range from 1 to 16 and are also in the /dev directory.
Now each hard drive has 4 primary partitions (limit of PC x86 architecture). First partition is denoted by number 1. For example:

• First partition : /dev/hda1
• Second partition : /dev/hda2
• Third partition : /dev/hda3
• Fourth partition : /dev/hda4

You can run command fdisk -l to display list of partitions:

How to track spammer in whm?

tep 1)

Login to your server and su - to root.

Step 2)

Turn off exim while we do this so it doesn't freak out.
/etc/init.d/exim stop

Step 3)

Backup your original /usr/sbin/sendmail file. On systems using Exim MTA, the sendmail file is just basically a pointer to Exim itself.
mv /usr/sbin/sendmail /usr/sbin/sendmail.hidden

Step 4)

Create the spam monitoring script for the new sendmail.
pico /usr/sbin/sendmail

Paste in the following:

Code:

#!/usr/local/bin/perl
# use strict;
use Env;
my $date = `date`;
chomp $date;
open (INFO, ">>/var/log/spam_log") || die "Failed to open file ::$!";
my $uid = $>;
my @info = getpwuid($uid);
if($REMOTE_ADDR) {
print INFO "$date - $REMOTE_ADDR ran $SCRIPT_NAME at $SERVER_NAME n";
}
else {
print INFO "$date - $PWD - @infon";
}
my $mailprog = '/usr/sbin/sendmail.hidden';
foreach (@ARGV) {
$arg="$arg" . " $_";
}
open (MAIL,"|$mailprog $arg") || die "cannot open $mailprog: $!n";
while (<STDIN> ) {
print MAIL;
}
close (INFO);
close (MAIL);

Step 5)

Change the new sendmail permissions
chmod +x /usr/sbin/sendmail

Step 6)


Create a new log file to keep a history of all mail going out of the server using web scripts
touch /var/log/spam_log

chmod 0777 /var/log/spam_log

Step 7)

Start Exim up again.
/etc/init.d/exim start

Step 8)

Monitor your spam_log file for spam, try using any formmail or script that uses a mail function - a message board, a contact script.
tail - f /var/log/spam_log

Sample Log Output

Mon Apr 11 07:12:21 EDT 2005 - /home/username/public_html/directory/subdirectory - nobody x 99 99 Nobody / /sbin/nologin

Log Rotation Details

Your spam_log file isn't set to be rotated so it might get to be very large quickly. Keep an eye on it and consider adding it to your logrotation.

pico /etc/logrotate.conf
FIND:
# no packages own wtmp -- we'll rotate them here
/var/log/wtmp {
monthly
create 0664 root utmp
rotate 1
}
ADD BELOW:
# SPAM LOG rotation
/var/log/spam_log {
monthly
create 0777 root root
rotate 1
}

Notes:

You may also want to chattr + i /usr/sbin/sendmail so it doesn't get overwritten.

Enjoy knowing you can see nobody is actually somebody =)

Warning : Do this at your own risk

Modifying SMTP Relay Settings for Exim

cPanel’s stock installation of Exim includes a Tailwatchd driver called Antirelayd . Antirelayd is a daemon that checks /var/log/maillog for POP3 and IMAP logins and keeps track of valid logins for SMTP relaying. It reads/etc/relayhosts file automatically which is dynamically-updated, so any IPs that you add to this file will not be retained.

By default on all cPanel servers, authentication is required to send email via SMTP. Exim lets you authenticate two ways:

• Directly through SMTP with a valid username/password
• Through POP3 login, which allows the user to relay through the mail server for 30 minutes without re-authenticating

To always force SMTP authentication regardless of POP authentication, type the following command via SSH as root:

/usr/local/cpanel/bin/tailwatchd –disable=Cpanel::TailWatch::Antirelayd

To reverse this setting back to the default:

/usr/local/cpanel/bin/tailwatchd –enable=Cpanel::TailWatch::Antirelayd

You can alternatively disable/enable Antirelayd in WHM > Service Manager.

It’s generally not a good idea to allow open relaying through your mail server unless you want to get blacklisted.  There may be situations where you need to permanently let another server send mail through your server without authentication, in which case you can add their IP to /etc/alwaysrelay . A post in the cpanel forums suggests an alternate solution as well:

In WHM > Exim Configuration Editor > Advanced Editor, find this section:

accept hosts = +auth_relay_hosts
endpass
message = $sender_fullhost is currently not permitted to \
relay through this server. Perhaps you \
have not logged into the pop/imap server in the \
last 30 minutes or do not have SMTP Authentication turned on in your email client.
authenticated = *

Appended to this suggestion is changing:

accept hosts = +auth_relay_hosts

to

accept hosts = /etc/exim_smtp_whitelist

There are minor tweaks you can make to exim.conf to remove SMTP authentication altogether, but you won’t find that information here. We don’t want to encourage bad mail server setup that will make the SPAM problem on the Internet even worse.

You can test to see if your server is open relay by sending an email via Telnet and getting a 550 error:

:~$ telnet thecpaneladmin.com 25
Trying 69.174.52.38...
Connected to thecpaneladmin.com.
Escape character is '^]'.
220-thecpaneladmin.com ESMTP Exim 4.69 #1 Tue, 23 Feb 2010 20:37:54 -0500
220-We do not authorize the use of this system to transport unsolicited,
220 and/or bulk e-mail.
helo thecpaneladmin.com
250 thecpaneladmin.com Hello myserver.com [x.x.x.x]
mail from: admin@thecpaneladmin.com
250 OK
rcpt to: test@test.com
550-mail1.thecpaneladmin.com (thecpaneladmin.com) [xx.xx.xx.xx] is
550-currently not permitted to relay through this server. Perhaps you have not
550-logged into the pop/imap server in the last 30 minutes or do not have SMTP
550 Authentication turned on in your email client.