rsync –delete –stats -vae ssh 12.123.123.123:/backup/cpbackup/daily/ /backup/cpbackup/daily/ –exclude-from ‘/root/exclude.txt’
I added the file exclude.txt because with this code you can have certain files not be transferred. In this case I added pending and spam emails.
So my exclude.txt file has this in it:
*.*.dwhs1234.dwhs.net
*.*.dwhs1234.dwhs.net:2,
*.*.dwhs1234.dwhs.net:2,*
*.msg”
core.*
*.*.mbox:2,
This is for a cpanel based server.

Click to continue →

chown -R cali:cali public_html
-R means reciprocal

Click to continue →

wget http://tsd.student.utwente.nl/skdetect/skdetect-1.0pre4cvs
./skdetect-1.0pre4cvs

Click to continue →

Install chkrootkit
To install chrootkit, SSH into server and login as root.
At command prompt type: cd /root/
At command prompt type: wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz
At command prompt type: tar xvzf chkrootkit.tar.gz
At command prompt type: cd chkrootkit-0.47
At command prompt type: make sense
To run chkrootkit
At command prompt type: /root/chkrootkit-0.47/chkrootkit
Make sure you run it on a regular basis, perhaps including it [...]

Click to continue →

nmap localhost (checks listening ports)
lsof -i :1980 (checks what running on that port)
kill -15 (kills what’s running on that port)
—-check open ports—-
check for open ports: ‘netstat -a’

Click to continue →

—-Server e-mail every time someone logs in as root
To have the server e-mail you everytime someone logs in as root, SSH into server and login as root.
At command prompt type: pico .bash_profile
Scroll down to the end of the file and add the following line:
echo ‘ALERT – Root Shell Access on:’ `date` `who` | mail -s [...]

Click to continue →

service iptables start
service iptables stop
service iptables restart

Click to continue →

iframe / gariben hack find and removers. iframe / gariben is a script kiddie code added usually via a cracked password or hidden mysql code added to a vulnerable script. I usually refreshes the web page to some sort of web page that downloads a virus.
1.
find /home/username \( -name “*.php” -o -name “*.html” -o -iname [...]

Click to continue →

Remove any old versions: rm -fv csf.tgz
Download and install:
wget http://www.configserver.com/free/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh
To disable run this from root:
sh disable_apf_bfd.sh
To update from root run this:
/usr/sbin/csf -u
To flush all blocks run this:
/usr/sbin/csf -f
Usage: /usr/sbin/csf [option] [value]
Option Meaning
-h, –help [...]

Click to continue →

ssh -l root 12.123.123.12

Click to continue →