DirectAdmin默认密码

作者: admin
时间: 2015-01-25
分类: DirectAdmin
评论

cat /usr/local/directadmin/scripts/setup.txt

cPanel安全自动设置脚本KalluscPHarden

作者: admin
时间: 2015-01-23
分类: 其他,系统安全
评论

安装教程

cd /usr/local/src
wget http://techsware.in/downloads/harden.sh
chmod 755 harden.sh
./harden.sh

1：什么是KalluscPHarden？
答：KalluscPHarden是一个shell脚本，基于cPanel服务器安全加固、检查。

2：会为cPanel做什么？
答：改变调整设置，密码修改强度，后台进程检查，编译器的访问安全，Shell Bomb Fork保护等设置....

3：有什么额外的应用程序将安装到服务器？
答：CSF，CMM，CMQ，CMC，Maldet，Rkhunter，Linux Socket 监控，Linux的环境安全等

4：服务器会有哪些地方被调整/加固？
答：Apache，cPanel，FTP，SSH，MySQL，CSF，PHP等

5: What additional hardening steps it does ?
Ans : TMP hardening, Logrotate hardening, Daily Rkhunter scanning, rDNS Check, Disable unwanted processes, SYN FLOOD Kernel Tweak, etc

6: How to recover the old configuration, before running this tool?
Ans : All configurations will be backup as conf_file.beforetweak before making changes to it. So you can compare the configurations in you want to check anything.

7: Any more tweaks it do ?
Ans : Check change log for recent changes to the script

8：这个脚本多少钱？
答：它是完全免费的。

9：想知道更多？
Ans : Please feel free to reach me at kallu[at]techsware.in

官方主页：http://techsware.in/kcpharden.html

DirectAdmin 安装 modsecurity WEB防火墙

作者: admin
时间: 2015-01-23
分类: DirectAdmin
评论

请注意，安装适用于 CustomBuild 2.0

cd /usr/local/directadmin/custombuild
./build update
./build set modsecurity yes
./build set modsecurity_ruleset comodo
./build modsecurity

wordpress后台暴力破解规则

/usr/local/cwaf/tmp/rules/workdir1/rules
新建文件，内容如下，保存后设置所属用户重启apache

SecAction phase:1,nolog,pass,initcol:ip=%{REMOTE_ADDR},initcol:user=%{REMOTE_ADDR},id:5000134
<Locationmatch "/wp-login.php">
	# Setup brute force detection.
	# React if block flag has been set.
	SecRule user:bf_block "@gt 0" "deny,status:401,log,id:5000135,msg:'ip address blocked for 5 minutes, more than 10 login attempts in 3 minutes.'"
	# Setup tracking. On a successful login, a 302 redirect is performed, a 200 indicates login failed.
	SecRule RESPONSE_STATUS "^302" "phase:5,t:none,nolog,pass,setvar:ip.bf_counter=0,id:5000136"
	SecRule RESPONSE_STATUS "^200" "phase:5,chain,t:none,nolog,pass,setvar:ip.bf_counter=+1,deprecatevar:ip.bf_counter=1/180,id:5000137"
	SecRule ip:bf_counter "@gt 10" "t:none,setvar:user.bf_block=1,expirevar:user.bf_block=300,setvar:ip.bf_counter=0"
</locationmatch>

SecAction phase:1,nolog,pass,initcol:ip=%{REMOTE_ADDR},initcol:user=%{REMOTE_ADDR},id:5000234
<Locationmatch "/xmlrpc.php">
	# Rate limit requests to xml-rpc
	SecRule user:bf_block "@gt 0" "deny,status:401,log,id:5000235,msg:'ip address blocked for 5 minutes, more than 10 attempts in 3 minutes.'"
	# Setup tracking. Whenever it gets a 200 or 405 status code, increase our brute force counter.
	SecRule RESPONSE_STATUS "^(200|405)" "phase:5,chain,t:none,nolog,pass,setvar:ip.bf_counter=+1,deprecatevar:ip.bf_counter=1/180,id:5000237"
	SecRule ip:bf_counter "@gt 10" "t:none,setvar:user.bf_block=1,expirevar:user.bf_block=300,setvar:ip.bf_counter=0"
</Locationmatch>

规则来自：https://github.com/sensson/puppet-directadmin/blob/master/templates/modsecurity/modsec-wordpress.conf.erb

CSF防火墙 SYNFLOOD 攻击防御

作者: admin
时间: 2015-01-23
分类: 系统安全
评论

SYNFLOOD is disabled by default. If you are not receiving any sort of attack, there is no need to enable it. If you are expecting an attack, enable it and set the rules a bit strict, like

SYNFLOOD_RATE = "5/s"
SYNFLOOD_BURST = "3"

i.e. if 5 connections are received from an IP/sec for 3 times, block it. Make sure don't keep it too strict if you are not receiving an attack else it will generate false positives and will block legit connections.

摘自：http://www.webhostingtalk.com/showthread.php?t=892958

非常有用的一个自动更新配置脚本

作者: admin
时间: 2015-01-23
分类: 管理维护,DirectAdmin
评论

Hello,
update script not part from directadmin.com
**** USE IT YOUR OWN RISKS ****
*****
*****
*****
GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
Copyright (C) 2006,2007 Free Software Foundation, Inc.
51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Update script made by Wael Isa
H188, R4008, Arad 240, Kingdom of Bahrain
http://www.web4host.net
Version: 1.8.1
Release Date: 1 / 9 / 2006
*****
*****
*****
If you find update script useful, please consider to make a donation to support this freeware.
Please keep in mind that donations are welcome, but in no way required to use and distribute update.script.
You can support update.script by paypal – CLICK HERE
update.script Version: 1.8.1
update script tested in this OS 32bit and 64bit.

RedHat Linux

RedHat Fedora

RedHat Enterprise

CentOS

Debian

OpenSSL (You need to build ssh, apache, php, etc after upgrade)
Exim
OpenSSH
ProFTP
ProFTP with mod_clamav
phpMyAdmin
F-PROT Anti-Virus
AVG
ClamAV
MODclamAV
MRTG
SquirrelMail
SquirrelMail full language pack
SpamAssassin
MODsecurity 2.x (Apache 2.x Only)
ImageMagick
GraphicsMagick
eAccelerator
FFMPEG-php
PHP Clamav
Webmin control panel (You need to open one port 10000 in your firewall)
MailScanner
Suhosin
NoBody Check

安装

mkdir /usr/local/updatescript
cd /usr/local/updatescript
wget http://tools.web4host.net/update.script
chmod 755 update.script
Run this to read how to use.

运行以下命令查看如何使用

./update.script

查看更多：http://www.web4host.net/update-script/

简单Linux安全自动设置脚本 ELS

作者: admin
时间: 2015-01-23
分类: 系统安全
评论

ELS stands for Easy Linux Security. ELS was created by Richard Gannon, Martynas Bendorius and Wael Isa. ELS takes many of the tasks performed by our Administrators and puts it into an easy to use program for anyone to use. It is released under the GNU/GPL so it is free to use.

This program is always being improved with new features and bugfixes, so be sure to keep it up to date. If you found a bug or would like an improvement, please let us know! If you really like this program, donations are welcome!

支持的操作系统 :

* Red Hat Linux
* Red Hat Enterprise Linux
* Fedora Core
* CentOS
* Debian

ELS 有哪些功能:

* Install RKHunter
* Install RKHunter Cronjob which emails a user-set email address nightly
* Install/update APF
* Install/update BFD
* Install CHKROOTKIT
* Install CHKROOTKIT Cronjob which emails a user-set email address nightly
* Disable Telnet
* Force SSH Protocol 2
* Secure /tmp
* Secure /var/tmp
* Secure /dev/shm
* 安装/升级 Zend Optimizer
* 安装/升级 eAccelerator
* MySQL 4.1 and 5.0 Configuration Optimization
* Upgrade MySQL to 5.0
* Tweak WHM Settings for security and stability
* Configure RNDC if not already done (cPanel only)
* Change SSH port (also configure APF as necessary)
* Add wheel user and disable direct root login over SSH
* 优化 MySQL tables
* 安装/升级 Libsafe
* 安装/升级 ImageMagick (from latest source)
* Uninstall LAuS
* Harden sysctl.conf
* Install Chirpy’s Free Exim Dictionary Attack ACL (cPanel only)
* 更多!

安装 ELS, 以ROOT身份运行以下命令:

wget -O installer.sh http://els.web4host.net/installer.sh
chmod +x installer.sh
sh installer.sh

官方网站：http://www.web4host.net/easy-linux-security/

DirectAdmin 取消 Brute Force Monitor 监控通知

作者: admin
时间: 2015-01-23
分类: DirectAdmin
评论

有些管理员不希望每个IP被封锁都得到DA的通知

brute_force_notice_ip.sh 的触发只发生在DA发送XX IP尝试多少次登入失败通知的时候，现在DA已经添加了一个选项，以防止发送，但brute_force_notice_ip.sh 仍然工作。

该directadmin.conf选项将是：

hide_brute_force_notifications=0

这是默认（选项禁用，发送通知）

如果你想不发通知，但brute_force_notice_ip.sh仍然工作，设置directadmin.conf：
hide_brute_force_notifications=1

MYSQL错误 MySQL server PID file could not be found!

作者: admin
时间: 2015-01-23
分类: 管理维护,MYSQL
2 条评论

MySQL错误提示如下：

ERROR! MySQL server PID file could not be found!
Starting MySQL.. ERROR! The server quit without updating PID file (/var/lib/mysql/server.pcpartsadvice.com.pid)

解决办法：

# rm /var/lib/mysql/mysql.sock
# service mysqld restart

Linux DDos(SYN Flood)/CC攻击的检测和防范

作者: admin
时间: 2015-01-23
分类: 系统安全
评论

netstat 工具来检测SYN攻击

# netstat -n -p -t
tcp0 0 10.11.11.11:23124.173.152.8:25882 SYN_RECV-
tcp0 0 10.11.11.11:23236.15.133.204:2577 SYN_RECV-
tcp0 0 10.11.11.11:23127.160.6.129:51748 SYN_RECV-

LINUX系统中看到的，很多连接处于SYN_RECV状态（在WINDOWS系统中是SYN_RECEIVED状态），源IP地址都是随机的，表明这是一种带有IP欺骗的SYN攻击。

# netstat -n -p -t | grep SYN_RECV | grep :80 | wc -l
324

查看在LINUX环境下某个端囗的未连接队列的条目数，显示TCP端囗22的未连接数有324个，虽然还远达不到系统极限，但应该引起管理员的注意。

[root@pub wxjsr]# netstat -na | grep SYN_RECV
tcp 0 0 58.193.192.20:80 221.0.108.162:32383 SYN_RECV
tcp 0 0 58.193.192.20:80 125.85.118.231:2601 SYN_RECV
tcp 0 0 58.193.192.20:80 222.242.171.215:2696 SYN_RECV
tcp 0 0 58.193.192.20:80 116.52.10.51:2629 SYN_RECV
tcp 0 0 58.193.192.20:80 218.171.175.157:1117
[root@pub wxjsr]# netstat -na | grep SYN_RECV |wc
11 66 979

查看系统SYN相关的配置

Linux内核提供了若干SYN相关的配置，用命令： sysctl -a | grep syn

[root@metc apache2]# /sbin/sysctl -a | grep syn
net.ipv6.conf.default.max_desync_factor = 600
net.ipv6.conf.all.max_desync_factor = 600
net.ipv6.conf.eth0.max_desync_factor = 600
net.ipv6.conf.lo.max_desync_factor = 600
net.ipv4.netfilter.ip_conntrack_tcp_timeout_syn_recv = 60
net.ipv4.netfilter.ip_conntrack_tcp_timeout_syn_sent = 120
net.ipv4.tcp_max_syn_backlog = 1280
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5
fs.quota.syncs = 18

防范SYN攻击设置

#缩短SYN- Timeout时间：

iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
iptables -A INPUT -i eth0 -m limit --limit 1/sec --limit-burst 5 -j ACCEPT

#每秒最多3个 syn 封包进入表达为：

iptables -N syn-flood
iptables -A INPUT -p tcp --syn -j syn-flood
iptables -A syn-flood -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j RETURN
iptables -A syn-flood -j REJECT

#设置syncookies：

sysctl -w net.ipv4.tcp_syncookies=1
/sbin/sysctl -w net.ipv4.tcp_max_syn_backlog=3000
/sbin/sysctl -w net.ipv4.tcp_synack_retries=1
/sbin/sysctl -w net.ipv4.tcp_syn_retries=1
sysctl -w net.ipv4.conf.all.send_redirects=0
sysctl -w net.ipv4.conf.all.accept_redirects=0
sysctl -w net.ipv4.conf.all.forwarding=0
/sbin/sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1
/sbin/sysctl -w net.ipv4.conf.default.accept_source_route=0 # 禁用icmp源路由选项
/sbin/sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1 # 忽略icmp ping广播包，应开启
/sbin/sysctl -w net.ipv4.icmp_echo_ignore_all=1 # 忽略所有icmp ping数据，覆盖上一项

转载：http://www.tuicool.com/articles/m6nE3q

CC攻击防御脚本

作者: admin
时间: 2015-01-23
分类: 系统安全
评论

cat>>/home/cc.sh< #!/bin/sh
status=`netstat -na|awk '$5 ~ /[0-9]+:[0-9]+/ {print $5}' |awk -F ":" -- '{print $1}' |sort -n|uniq -c |sort -n|tail -n 1`
NUM=`echo $status|awk '{print $1}'`
IP=`echo $status|awk '{print $2}'`
result=`echo "$NUM > 150" | bc`
if [ $result = 1 ]
then
echo IP\:$IP is over $NUM, BAN IT!
echo $(date +"%y-%m-%d") `uptime`
/sbin/iptables -I INPUT -s $IP -j DROP
fi
EOF
ln -sf /usr/bin/apt-get /usr/bin/yum
yum install -y bc

执行/home/cc.sh即可！也可以将执行脚本加入到Cron执行！

转载：http://www.jb4.net/archives/74.html

nginx防御CC攻击 HttpGuard

作者: admin
时间: 2015-01-23
分类: 系统安全
4 条评论

什么是HttpGuard

HttpGuard是基于openresty,以lua脚本语言开发的防cc攻击软件。而openresty是集成了高性能web服务器Nginx，以及一系列的Nginx模块，这其中最重要的，也是我们主要用到的nginx lua模块。HttpGuard基于nginx lua开发，继承了nginx高并发，高性能的特点，可以以非常小的性能损耗来防范大规模的cc攻击。
下面介绍HttpGuard防cc的一些特性。

限制访客在一定时间内的请求次数
向访客发送302转向响应头来识别恶意用户,并阻止其再次访问
向访客发送带有跳转功能的js代码来识别恶意用户，并阻止其再次访问
向访客发送cookie来识别恶意用户,并阻止其再次访问
支持向访客发送带有验证码的页面，来进一步识别，以免误伤
支持直接断开恶意访客的连接
支持结合iptables来阻止恶意访客再次连接
支持白名单功能
支持根据统计特定端口的连接数来自动开启或关闭防cc模式

github项目地址：https://github.com/centos-bz/HttpGuard
联系作者：admin#centos.bz
赞助作者持续开发:查看支付宝条码

开始部署HttpGuard

一、安装openresty或者nginx lua

假设我们把HttpGuard安装到/data/www/waf/，当然你可以选择安装在任意目录,nginx运行的用户为www。

cd /data/www
wget --no-check-certificate https://github.com/centos-bz/HttpGuard/archive/master.zip
unzip master.zip
mv HttpGuard-master waf
chown www waf/logs

三、生成验证码图片(可选)

为了支持验证码识别用户，我们需要先生成验证码图片。生成验证码图片需要系统安装有php，以及php-gd模块。

以命令行执行getImg.php文件

cd /data/www/waf/captcha/
/usr/local/php/bin/php getImg.php

大概要生成一万个图片，可能需要花几分钟的时间。

四、修改nginx.conf配置文件

向http区块输入如下代码：

lua_package_path "/data/www/waf/?.lua";
lua_shared_dict guard_dict 100m;
lua_shared_dict dict_captcha 70m;
init_by_lua_file '/data/www/waf/init.lua';
access_by_lua_file '/data/www/waf/runtime.lua';
lua_max_running_timers 1;

记得要修改相关的路径。

五、配置HttpGuard

HttpGuard全部的配置项都在config.lua文件中,请根据以下文章修改配置文件。

https://www.lxconfig.com/thread-121-1-1.html