rsync –delete –stats -vae ssh 12.123.123.123:/backup/cpbackup/daily/ /backup/cpbackup/daily/ –exclude-from ‘/root/exclude.txt’ I added the file exclude.txt because with this code you can have certain files not be transferred. In this case I added pending and spam emails. So my exclude.txt file has this in it: *.*.dwhs1234.dwhs.net *.*.dwhs1234.dwhs.net:2, *.*.dwhs1234.dwhs.net:2,* *.msg” core.* *.*.mbox:2, This is for a cpanel based [...]

Click to continue →

chown -R cali:cali public_html -R means reciprocal

Click to continue →

wget http://tsd.student.utwente.nl/skdetect/skdetect-1.0pre4cvs ./skdetect-1.0pre4cvs

Click to continue →

Install chkrootkit To install chrootkit, SSH into server and login as root. At command prompt type: cd /root/ At command prompt type: wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz At command prompt type: tar xvzf chkrootkit.tar.gz At command prompt type: cd chkrootkit-0.47 At command prompt type: make sense To run chkrootkit At command prompt type: /root/chkrootkit-0.47/chkrootkit Make sure you run [...]

Click to continue →

nmap localhost (checks listening ports) lsof -i :1980 (checks what running on that port) kill -15 (kills what’s running on that port) —-check open ports—- check for open ports: ‘netstat -a’

Click to continue →

—-Server e-mail every time someone logs in as root To have the server e-mail you everytime someone logs in as root, SSH into server and login as root. At command prompt type: pico .bash_profile Scroll down to the end of the file and add the following line: echo ‘ALERT – Root Shell Access on:’ `date` [...]

Click to continue →

service iptables start service iptables stop service iptables restart

Click to continue →

iframe / gariben hack find and removers. iframe / gariben is a script kiddie code added usually via a cracked password or hidden mysql code added to a vulnerable script. I usually refreshes the web page to some sort of web page that downloads a virus. 1. find /home/username \( -name “*.php” -o -name “*.html” [...]

Click to continue →

Remove any old versions: rm -fv csf.tgz Download and install: wget http://www.configserver.com/free/csf.tgz tar -xzf csf.tgz cd csf sh install.sh To disable run this from root: sh disable_apf_bfd.sh To update from root run this: /usr/sbin/csf -u To flush all blocks run this: /usr/sbin/csf -f Usage: /usr/sbin/csf [option] [value] Option Meaning -h, –help Show this message -l, [...]

Click to continue →

ssh -l root 12.123.123.12 The options are as follows: -a Disables forwarding of the authentication agent connection. -A Enables forwarding of the authentication agent connection. This can also be specified on a per-host basis in a configuration file.Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote [...]

Click to continue →