Webmaster manual for a root server

I receive quite often questions about server and server problems. Most of the webmasters have a root server or at least a vhosting and usually these servers comes with administration “duties”. Here is bellow my list with commands I am using for my servers:

What I do in case nothing is working and I want to repair my system?

/etc/init.d/psa stopall
umount -a
xfs_check /dev/md1
xfs_repair /dev/md1
xfs_check /dev/md5
xfs_repair /dev/md5
xfs_check /dev/md6
xfs_repair /dev/md6
xfs_check /dev/md7
xfs_repair /dev/md7
xfs_check /dev/md8
xfs_repair /dev/md8
mount /dev/md1 /mnt
mount /dev/md6 /mnt/var
mount /dev/md5 /mnt/usr
mount /dev/md7 /mnt/home
mount /dev/md8 /mnt/srv
chroot /mnt
/etc/init.d/psa start

Obviously, the above commands must match the existing partitioning on your root server.

How to see the last commands in the system for the current user (or any user)?

less ~/.bash_history

or

history

Note: These two will work ONLY is history hasn’t be set to 0 (like for instance issuing a >.bash_history or export HISTSIZE=0

How can I allow ftp upload resume?

vi /etc/proftpd.conf
/etc/init.d/xinetd restart

Who is using the memory?

top

Where to tune Apache?

/etc/apache/httpd.conf
/etc/apache/server-tunning.conf

Where are Apache logs?

/var/log/apache2

How can I show IPs in case of the bot attack?

netstat -nt

Show unique ips TCP

netstat -anp |grep ‘tcp’ | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n

Show unique ips UDP

netstat -anp |grep ‘udp’ | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n

How can I ban an IP in IP tables?

iptables -I INPUT -s 217.218.36.11 -j DROP

How can I backup the MySql database?

mysqldump –user=admin –password=SSSS –create-options database_name > /tmp/database_name.sql
or
mysqldump -user=admin –password= SSSS –all-databases -p –create-options | bzip2 -c > databasebackup.sql.bz2
or
mysqldump -uadmin -pSSSS –all-databases –create-options | bzip2 -c > databasebackup2.sql.bz2

Note: It is strongly recommended to stop MySQL prior to launch the commands above.

How can I import the MySql database?

mysql -uadmin -pSSSS database_name < /tmp/database_name.sql

Note: If the –create-options parameter has been given when the databases were dumped, databases will be automatically imported when importing

How can I rebuild the Webalizer stats?

rm -f /usr/local/psa/var/lib/webalizer/webalizer.cache
touch /usr/local/psa/var/lib/webalizer/webalizer.cache
chown root:root /usr/local/psa/var/lib/webalizer/webalizer.cache
chmod 644 /usr/local/psa/var/lib/webalizer/webalizer.cache
stat -f /usr/local/psa/var/lib/webalizer/webalizer.cache
cd /usr/local/psa/admin/sbin/
/usr/local/psa/admin/sbin/statistics

How can I restart the MySql?

/etc/init.d/mysql restart

How can I do remote backup?

/usr/local/psa/bin/pleskbackup all ftp://username:password@backup.onlinehome-server.info/httpdocs/backup.file

What about a complete big backup?

/usr/local/psa/bin/pleskbackup all allbackup.file
tar czf /srv/www/vhosts backup

How to tar a folder (with all sub-folders and files)?

tar czf /volumes/myexternaldrive/backup01.tgz myfolder

How do I extract a file?

tar -xzvf MyArchive.tgz Source_file
or
tar –extract –gunzip –verbose –file=MyArchive.tgz Source_file
tar xzvf /volumes/myexternaldrive/backup01.tgz myfolder/subfolder/thefiletorestore

How to install SOAP extension for php 5?

rpm -Uvh ftp://fr2.rpmfind.net/linux/SuSE-Linux/i386/update/10.2/rpm/x86_64/php5-soap-5.2.0-12.x86_64.rpm

How to launch an sql against the database?

mysql -uadmin -pparola baza_date < /srv/www/vhosts/domeniu.com/httpdocs/clean.sql

What version of Linux I am using?

cat /proc/version
cat /etc/issue

or version specifc:

cat /etc/redhat-release
cat /etc/debian_version

Root viruses check – Rhunter

wget http://superb-east.dl.sourceforge.net/sourceforge/rkhunter/rkhunter-1.3.4.tar.gz
tar -xzvf rkhunter-1.3.4.tar.gz
cd rkhunter-1.3.0.tar.gz
./installer.sh –layout /usr/local –install

add RHunter in cronjob
vi /etc/cron.daily/rkhunter.sh
and add
#!/bin/bash
/usr/local/bin/rkhunter -c | mail -s “RKhunter Scan Details” email@domain.com
exit 0

Root viruses check – chkrootkit

wget –passive-ftp ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz
tar xvfz chkrootkit.tar.gz
cd chkrootkit-/
./chkrootkit

netstat -an |grep “[.:]${465}[^0-9.]”
netstat -e -p
netstat -a |grep 4000

netstat -e -p -n -a | grep 465
ps ax | grep 3456

How to change the SSH port?

vi /etc/ssh/sshd_config (change to the port 8993)
/etc/rc.d/sshd restart

How to limit the wrong longins (3 mins SSHD)?

iptables -A INPUT -m tcp -p tcp –dport 8993 -m state –state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m tcp -p tcp –dport 8993 -m state –state NEW -m limit –limit 2/min –limit-burst 2 -j ACCEPT
iptables -A INPUT -m tcp -p tcp –dport 8993 -j DROP

How to list applications connected to Internet and the ports used?

netstat -lptu

How to search a file?

find / -name pleskbackup

or faster if you’ve created an indexed database of files. First run updatedb (and have it scheduled to run from time to time, daily if there aren’t many files or weekly if there are many files) and once the database has been created (and updated) you can simply type: locate filename

For full paths of commands in your path you can use: which filename

How to find the biggest files in the HDD?

du -a /var | sort -n -r | head -n 10
find . -type f -size +500000k -exec ls -lh {} \; | awk ‘{ print $9 “: ” $5 }’
rm -rf /fisier

How to deactivate ZMD?

/var/lib/zmd/zmd.db
ps -axfu | grep parse-metadata
kill -9 32323
rm /var/lib/zmd/zmd.db
/etc/init.d/novell-zmd start

How to find the users with rights to log into the system?

cat /etc/passwd |grep -v nologin | cut -d: -f1

Who is logged in the system?

w
who -a
users
last (includes also users that have logged since the last time the database has been initialized)
grep sshd /var/log/messages

Bad cases, harddisk is crashed, no boot (needs physical access to the server)

fsck -fCV /dev/md1
mount /dev/md1 /mnt
chroot /mnt
lilo (kinda obsoleted, grub is the standard bootloader nowadays)
exit
umount /mnt

How to check the harddisk partitions?

fdisk -l

How can I see errors in logs?

tail -n 500 /var/log/messages
tail -f /var/log/messages
tail -f /var/log/mail.info
tail -f /var/log/warn
tail -f /var/log/mail.err
tail -f /var/log/mail.warn
tail -f /var/log/apache2/access_log
tail -f /var/log/apache2/error_log