How To Compile Php-cgi For Max Security On Dreamhost
Jan 10, 2007
I want to compile a php-cgi on dreamhost with maximum security in particular ensuring that all temporary files are stored in my own directories, what are the settings to configure for that?
What .htaccess settings do I need to help with that?
I realized that some of the temp gzip files where going into the servers main temp folders.
I copied the default config file and renamed it as .config but I get this:
Code: WARNING: No module dm-mem-cache found for kernel 2.6.27.10-grsec, continuing anyway WARNING: No module dm-region_hash found for kernel 2.6.27.10-grsec, continuing anyway WARNING: No module dm-message found for kernel 2.6.27.10-grsec, continuing anyway WARNING: No module dm-raid45 found for kernel 2.6.27.10-grsec, continuing anyway
when doing 2.6.26+ or w/e it is, how do you enable conntrack, what options do i need to enable under make menuconfig?
net.netfilter.nf_conntrack_acct = 1 net.netfilter.nf_conntrack_generic_timeout = 120 error: "net.netfilter.nf_conntrack_icmp_timeout" is an unknown key error: "net.netfilter.nf_conntrack_tcp_timeout_close" is an unknown key error: "net.netfilter.nf_conntrack_tcp_timeout_time_wait" is an unknown key error: "net.netfilter.nf_conntrack_tcp_timeout_last_ack" is an unknown key error: "net.netfilter.nf_conntrack_tcp_timeout_close_wait" is an unknown key error: "net.netfilter.nf_conntrack_tcp_timeout_fin_wait" is an unknown key error: "net.netfilter.nf_conntrack_tcp_timeout_established" is an unknown key error: "net.netfilter.nf_conntrack_tcp_timeout_syn_recv" is an unknown key error: "net.netfilter.nf_conntrack_tcp_timeout_syn_sent" is an unknown key error: "net.netfilter.nf_conntrack_udp_timeout" is an unknown key error: "net.netfilter.nf_conntrack_udp_timeout_stream" is an unknown key net.netfilter.nf_conntrack_max = 262144
and how do i know which hardware/devices that i can remove?
Linux: CentOS 5.2 PHP: 5.2.6 PHP-GD: php-gd.i386 0:5.2.6-jason.1 Apache: 2.2.8 with mod_proxy (Lighttpd serves in the background)Question:
I've built my server with PHP 5.2.6 and Apache and I've also installed php-gd by running 'yum install php-gd', but an application (clip bucket) I'm using requires GD with TTF enabled for the cpatcha image in 'singup'. I've checked my phpinfo [url] but didn't seem to find TTF enabled with my GD, so I wonder how to recompile GD with TTF enabled?
How do you go about getting hardware info so you know what drivers to compile in? I want to build a very small and fast loading kernel for this web server.
I'm running off of a VPS and the default install of MySQL uses a lot of memory. Is there a way to just download the sources and compile a minimal install of just what i need to run say WHMCS/forum?
I'm trying to compile PHP with curl enabled but I cannot get it work.
Here is the part of config.log
.... configure:32740: checking whether to enable calendar conversion support configure:32778: result: no configure:33078: checking whether to enable ctype functions configure:33116: result: yes configure:33416: checking for cURL support configure:33455: result: yes configure:33464: checking if we should use cURL for url streams configure:33482: result: no configure:33492: checking for cURL in default path configure:33497: result: found in /usr configure:33515: checking for cURL 7.10.5 or greater configure:33529: result: libcurl 7.15.5 configure:33538: checking for SSL support in libcurl configure:33542: result: yes configure:33560: checking how to run the C preprocessor configure:33678: result: gcc -E configure:33702: gcc -E conftest.c configure:33708: $? = 0 configure:33740: gcc -E conftest.c conftest.c:201:28: error: ac_nonexistent.h: No such file or directory configure:33746: $? = 1 configure: failed program was: | /* confdefs.h. */ | | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" ...
As you can see it shows "ac_nonexistent.h: No such file or directory" I installed both gcc and gcc-c++ libraries but it doesn't work.
I been trying to compile the linux2.6.22.1 with grsecurity test patches. Im running 2.6.21.5-grsecurity currently. And when i try to make bzImage and only the bzimage I get this error
Code: /bin/sh: line 1: 14228 File size limit exceeded(core dumped) objcopy -O binary -R .note -R .comment -S vmlinux arch/i386/boot/compressed/vmlinux.bin make[2]: *** [arch/i386/boot/compressed/vmlinux.bin] Error 153 make[1]: *** [arch/i386/boot/compressed/vmlinux] Error 2 has an error number first but different ones each time. I tried the compile on gcc 3 and gcc 4 same thing. Other kernels compile fine except this one. I compiled the very same kernel, same config and evrything on a centos5 server and it done fine. never had this problem before and I always have always upgraded with grsecurity testing patches
Im running centos 4.5 ulimit shows
Code: [/linux]# ulimit -a core file size (blocks, -c) 1000000 data seg size (kbytes, -d) unlimited file size (blocks, -f) unlimited pending signals (-i) 16317 max locked memory (kbytes, -l) 32 max memory size (kbytes, -m) unlimited open files (-n) 4096 pipe size (512 bytes, -p) 8 POSIX message queues (bytes, -q) 819200 stack size (kbytes, -s) 8192 cpu time (seconds, -t) unlimited max user processes (-u) 14335 virtual memory (kbytes, -v) unlimited file locks (-x) unlimited
Today I got the devastating and heart-stopping news that all administraters fear most: "I'm looking at your website, and something's terribly wrong!!!"
The person went on to say that each page was just "filled with code ro something." When I finally saw it myself I discovered that my raw PHP pages were being served to the end user with no compilation --all of my top secret code; a real nightmare.
I went to look at the error logs and found that for several restarts Apache had not been compiling PHP.
[Sun Apr 22 04:02:18 2007] [notice] Apache/1.3.27 (Unix) (Red-Hat/Linux) mod_gzip/1.3.19.1a configured -- resuming normal operations [Sun Apr 22 04:02:18 2007] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec) [Sun Apr 22 04:02:18 2007] [notice] Accept mutex: sysvsem (Default: sysvsem) [Sun Apr 22 21:21:57 2007] [error] [client 209.85.60.98] File does not exist: /var/www/html/a1b2c3d4e5f6g7h8i9/nonexistentfile.php [Sun Apr 22 21:21:57 2007] [error] [client 209.85.60.98] File does not exist: /var/www/html/adxmlrpc.php [Sun Apr 22 21:21:57 2007] [error] [client 209.85.60.98] File does not exist: /var/www/html/adserver/adxmlrpc.php [Sun Apr 22 21:21:57 2007] [error] [client 209.85.60.98] File does not exist: /var/www/html/phpAdsNew/adxmlrpc.php [Sun Apr 22 21:21:57 2007] [error] [client 209.85.60.98] File does not exist: /var/www/html/phpadsnew/adxmlrpc.php [Sun Apr 22 21:21:57 2007] [error] [client 209.85.60.98] File does not exist: /var/www/html/phpads/adxmlrpc.php [Sun Apr 22 21:21:57 2007] [error] [client 209.85.60.98] File does not exist: /var/www/html/Ads/adxmlrpc.php [Sun Apr 22 21:21:57 2007] [error] [client 209.85.60.98] File does not exist: /var/www/html/ads/adxmlrpc.php [Sun Apr 22 21:21:57 2007] [error] [client 209.85.60.98] File does not exist: /var/www/html/xmlrpc.php [Sun Apr 22 21:21:57 2007] [error] [client 209.85.60.98] File does not exist: /var/www/html/xmlrpc/xmlrpc.php [Sun Apr 22 21:21:57 2007] [error] [client 209.85.60.98] File does not exist: /var/www/html/xmlsrv/xmlrpc.php [Sun Apr 22 21:21:57 2007] [error] [client 209.85.60.98] File does not exist: /var/www/html/blog/xmlrpc.php [Sun Apr 22 21:21:57 2007] [error] [client 209.85.60.98] File does not exist: /var/www/html/drupal/xmlrpc.php [Sun Apr 22 21:21:57 2007] [error] [client 209.85.60.98] File does not exist: /var/www/html/community/xmlrpc.php [Sun Apr 22 21:21:57 2007] [error] [client 209.85.60.98] File does not exist: /var/www/html/blogs/xmlrpc.php [Sun Apr 22 21:21:57 2007] [error] [client 209.85.60.98] File does not exist: /var/www/html/blogs/xmlsrv/xmlrpc.php [Sun Apr 22 21:21:57 2007] [error] [client 209.85.60.98] File does not exist: /var/www/html/blog/xmlsrv/xmlrpc.php [Sun Apr 22 21:21:57 2007] [error] [client 209.85.60.98] File does not exist: /var/www/html/blogtest/xmlsrv/xmlrpc.php [Sun Apr 22 21:21:57 2007] [error] [client 209.85.60.98] File does not exist: /var/www/html/b2/xmlsrv/xmlrpc.php [Sun Apr 22 21:21:57 2007] [error] [client 209.85.60.98] File does not exist: /var/www/html/b2evo/xmlsrv/xmlrpc.php [Sun Apr 22 21:21:57 2007] [error] [client 209.85.60.98] File does not exist: /var/www/html/wordpress/xmlrpc.php [Sun Apr 22 21:21:57 2007] [error] [client 209.85.60.98] File does not exist: /var/www/html/phpgroupware/xmlrpc.php [Mon Apr 23 04:02:21 2007] [notice] SIGUSR1 received. Doing graceful restart
WTH?
I could be WAAAY off base, but my first reaction was that I'd been hacked -- someone had found a way to disable PHP so they could find sensitive information in raw PHP pages. That could be totally wrong.
At any rate, even if I never learn why Apache sometimes will compile without PHP (and some other modules) without me telling it to do so, I'd like to be prepared for an embarassment like like this.
Is there any way, say, in the .htaccess file (or anywhere, anyway), I can tell Apache not to serve **ANY** pages unless the PHP module is present?
We run CentOS for our web servers (not providing hosting) and manually compile Apache, PHP etc. What would be the benefits to using Yum rather than compiling the software ourselves?
The way I see it, Yum allows Apache etc to automatically update to latest versions and saves time. When compiling myself though, I can specify exactly where to install to and which modules etc to install with the software. Is there any reason we should be using Yum instead?
I'm setting up a Linux machine specifically for use as a VNC here at work.
The IT Manager said he'd used Ubuntu before but left the distro up to me.
I set up my test machine with Ubuntu but need to compile Apache for portions of it to work. I've never had any problems building Apache before, but this is what I'm getting here. I have a feeling that, since I've not used Ubuntu before, that I'm just missing a step. I also noticed that the "make" command doesn't work. Does that need to be installed and compiled as well?
========================================= root@vnc01:/etc/httpd-2.2.3# ./configure /usr/local/apache configure: WARNING: you should use --build, --host, --target configure: WARNING: invalid host type: /usr/local/apache checking for chosen layout... Apache checking for working mkdir -p... yes checking build system type... /usr/local/apache checking host system type... /usr/local/apache checking target system type... /usr/local/apache
Configuring Apache Portable Runtime library ...
checking for APR... reconfig configuring package in srclib/apr now configure: WARNING: you should use --build, --host, --target configure: WARNING: invalid host type: /usr/local/apache checking build system type... /usr/local/apache checking host system type... /usr/local/apache checking target system type... /usr/local/apache Configuring APR library Platform: /usr/local/apache checking for working mkdir -p... yes APR Version: 1.2.7 checking for chosen layout... apr checking for /usr/local/apache-gcc... no checking for gcc... no checking for /usr/local/apache-cc... no checking for cc... no checking for cc... no checking for /usr/local/apache-cl... no checking for cl... no configure: error: no acceptable C compiler found in $PATH See `config.log' for more details. configure failed for srclib/apr root@vnc01:/etc/httpd-2.2.3#
The config.log file doesn't honestly show any errors that I can see pertaining to any compile errors.
Recently purchased a new dedicated machine from a Savvis wholesaler, with intentions of using it as a backup server, CentOS 5.0 default install with default install of cPanel/WHM (not configured by the DC) -- Went to recompile apache with the appropriate addons and modules and this is why I get, any ideas?
Linux local.hostname 2.6.18-8.el5 #1 SMP Thu Mar 15 19:57:35 EDT 2007 i686 athlon i386 GNU/Linux
Quote:
Building Apache Config.....Done Downloading and compiling apache+modules....
Fetching http://layer1.cpanel.net/buildapache.sea (0)....@75.126.236.226......connected......receiving...1%...2%...3%...4%...5%...6%...7%...8%...9%...10%...11%...12%...13%...14%...15%...16%...17%...18 %...19%...20%...21%...22%...23%...24%...25%...26%...27%...28%...29%...30%...31%...32%...33%...34%...35%...36%...37%...38%...39%...40%...41%...42%...43 %...44%...45%...46%...47%...48%...49%...50%...51%...52%...53%...54%...55%...56%...57%...58%...59%...60%...61%...62%...63%...64%...65%...66%...67%...68 %...69%...70%...71%...72%...73%...74%...75%...76%...77%...78%...79%...80%...81%...82%...83%...84%...85%...86%...87%...88%...89%...90%...91%...92%...93 %...94%...95%...96%...97%...98%...99%...100%......Done Verifying archive integrity... All good. Uncompressing buildapache........................................................................................................................................... ...................................................................................................................................................... ...................................................................................................................................................... ........................................................................................................................................... Checking Update System........Rpm Sanity Check PASSED! Verifying compiler and libs....Verifying installation....Kernel Headers look good! Using newyum support... Loading "installonlyn" plugin Setting up Install Process Setting up repositories Reading repository metadata in from local files Excluding Packages in global exclude list Finished Parsing package install arguments Nothing to do
Done Done ******************************** This is buildapache version 1.5.402 (for cpanel <= 10.9.3) (ap=1.3.37) ******************************** buildapache configured from Web Host Manager Apache configured from Web Host Manager! Untarring expat...Fetching http://httpupdate.cpanel.net/buildap...-1.95.6.tar.gz (0)....@75.126.236.226......connected......receiving...1%...2%...4%...5%...7%...8%...9%...11%...12%...14%...15%...16%...18%...19%...21%...22%...23%... 25%...26%...28%...29%...30%...32%...33%...35%...36%...37%...39%...40%...42%...43%...44%...46%...47%...49%...50%...51%...53%...54%...56%...57%...58%... 60%...61%...63%...64%...65%...67%...68%...70%...71%...72%...74%...75%...77%...78%...79%...81%...82%...84%...85%...87%...88%...89%...91%...92%...94%... 95%...96%...98%...99%...100%......Done Done
make[1]: *** [install-data] Error 127 make: *** [install-all] Error 2 /etc/rc.d/init.d/httpd start: httpd could not be started Setting /home permissions to 0711......Done Setting permissions for........Done This script will install Postgres 7.3.x or later If you have an older version installed you wil need to Dump your databases to a file and then restore them after the install as 7.3.x is not backwards compatible. If you do not have any databases, you can just run: mv /var/lib/pgsql /var/lib/pgsql.old /sbin/service postgresql stop /sbin/service postgresql start to force creating a 7.3.x style setup. Do not do this if you have databases that you wish to keep!
Are you sure you wish to proceed? Loading "installonlyn" plugin Setting up Install Process Setting up repositories Reading repository metadata in from local files Excluding Packages in global exclude list Finished Parsing package install arguments Nothing to do Stopping postgresql service: [ OK ] Starting postgresql service: [ OK ] You should now configure postgresql from WHM! You should now configure postgresql from WHM! You should now configure postgresql from WHM! You should now configure postgresql from WHM! Fetching http://httpupdate.cpanel.net/buildap...-2.6.22.tar.gz (0)....@75.126.236.226......connected......receiving...1%...2%...3%...4%...5%...6%...7%...8%...9%...10%...11%...12%...13%...14%...15%...16%...17%...18 %...19%...20%...21%...22%...23%...24%...25%...26%...27%...28%...29%...30%...31%...32%...33%...34%...35%...36%...37%...38%...39%...40%...41%...42%...43 %...44%...45%...46%...47%...48%...49%...50%...51%...52%...53%...54%...55%...56%...57%...58%...59%...60%...61%...62%...63%...64%...65%...66%...67%...68 %...69%...70%...71%...72%...73%...74%...75%...76%...77%...78%...79%...80%...81%...82%...83%...84%...85%...86%...87%...88%...89%...90%...91%...92%...93 %...94%...95%...96%...97%...98%...99%...100%......Done
I'm trying to install Clamav on my Centos box (64bit version) but on the Make command I get the following error:
/usr/local/lib/libz.a(gzio.o): relocation R_X86_64_32 against `a local symbol' can not be used when making a shared object; recompile with -fPIC /usr/local/lib/libz.a: could not read symbols: Bad value collect2: ld returned 1 exit status make[2]: *** [libclamav.la] Error 1 make[2]: Leaving directory `/root/clamav-0.88/libclamav' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/root/clamav-0.88' make: *** [all] Error 2
I'm guessing is something to do with X86_64 but I still can't find a solution to this.
I'd like to give my username on my server permission to access g++ to compile custom C++ programs. I know I can just su - and compile as root, but I really don't like that.
What do I need to do to allow ONLY my username permission to do that?
I run a web hosting company and one of my servers is a LAMP server running CentOs 5. A user of mine has a Joomla installation running to manage his website and he has run into the following problem that I am puzzled by.
When Joomla adds a component or module to itself, or when a user uses the Joomla upload functionality, Joomla will add the new files under the user name "apache". This makes sense as it is the apache service running PHP that is actually creating the files.
However, when he FTP's into the account to modify these files, he doesn't have the appropriate permissions to do so as he doesn't have a root level login, just permissions on his home directory which is the site. Any help would be much appreciated.
Also, does anyone know how to change the owner/group of a directory and all of its sub directories in Linux without changing the actual permissions? I.e. some of the files in the folder have different permissions (0644 as apposed to 0755) than its parent but if I do a top down user/group change on the folder it will change everything in that folder to 0755.
Recently I had a "falling out" with DreamHost. I had their downtime and everything everyone else experiences, and I was ok with that. I could look past the small problems and love DreamHost for the good things it offered. The good cheap things(Shared Hosting).
I was running a small video blog(externally hosted videos) with WordPress as my street pimp. Everything was going great. It started out slow, as most sites do, but I was really happy to be seeing 1.5-5K unique hits daily. This went on for a good 2 months lovely. I was very satisfied. Well one day I became "Mr Big" and hit 12K in about 10 hours. DreamHost quickly turned my account off, as I was affecting the other sites on the server that I shared. Understandable. Well they eventually referred me to their VPS (dreamhostps.com)and I quickly signed up, thinking I had just solved all my problems.
Haha, what a lying **** she turned out to be. Promising me love and compassion, but only bringing deceit and pain. Spending an extra $25/mo(250 MB/250 MHz guaranteed) I thought I was golden. Now I cant get 50 uniques an hour without getting a Internal Server Error. WHY DREAMHOST?! WHY MUST YOU HATE ME??
Im currently looking to get away from DH. I cant stand these problems. I need something that can withstand 15K unique hits on a mildly modified WP site serving external videos. What are my options?
I guess I should also include my budget... which isnt much at all. Im not going above $50/mo, but would love to get something around $35-45.
I spent an afternoon completely away from computers, and when I got back, I received this email from the Dreamhost Security Bot: -----
We have noticed your myacct user causing a large amount of load on the webserver. We also noticed that domains under this user are running outdated web software that may be hackable. Often times when domains get hacked the hackers will launch malicious processes that use a great deal of CPU time and thus increase the load on the machine caused by your user. This does not necessarily mean that your sites are hacked, but they could be. To ensure that your user is not compromised and contributing to server load unnecessarily (and, also not engaging in illegal activity typically associated with these types of hacks) we ask that you review the following and act accordingly.
Comment: so far, so good
Most commonly hacking exploits of this nature occur through known vulnerabilities in outdated copies of web software (blogs, galleries, carts, wikis, forums, CMS scripts, etc.) running under your domains. To secure your sites you should:
1) Update all pre-packaged web software to the most recent versions available from the vendor. The following site can help you determine if you're running a vulnerable version: [url]
- WordPress installations need to be updated to the current release of 2.8.5.
- Joomla installations need to be updated to the respective current secure release: 1.0.15 or 1.5.14.
- Any old/outdated/archive installations that you do not intend to maintain need to be deleted from the server.
The (OUTDATED!) domains above have been disabled by renaming the domain directory to end in "_DISABLED_FOR_POSSIBLE_EXPLOIT__CONTACT_DREAMHOST". Please do not reinstate them until you are ready to immediately upgrade them, or until you have already upgraded them. -----
So, nine of my sites were disabled, for a period of four hours, with NO ADVANCE WARNING from Dreamhost.
I send them a response, pointing out that:
1. I run a tripwire program, integrit, on a daily basis. It showed no evidence that any of these sites had been hacked.
2. My access logs showed no increase in activity on this date.
They wrote, "We have noticed your myacct user causing a large amount of load on the webserver." Well, I certainly would like some details on this, but I haven't received any.
Here's part of the response I got: -----
In the case of some of the domains that were disabled your softwares were years out-of-date. ------
no. Wordpress 2.8.4 was released August 12, 2009. Joomla 1.5.12 was released July 1, 2009. The only software that was "years" out of date was on two sites that had been disabled by me six months ago.
It's clear that these people are making things up as they go along. All they really had to do was send me a note saying, "Hey, Bob, could you update these Wordpress and Joomla sites sometime in the next few days?"
Just read about some deal they're having where they're selling you a domain and 2 years of unlimited bandwidth hosting for 24 dollars or so. Is this legit?
Is quality sacrificed for this kind of pricing?
I'm currently with downtownhost and they are amazing by the way but if it's that cheap, I might be forced to switch.
it says domain is already in system. it seems the previous guy was hosting it on dreamhost. basically they said I can't host this domain, and that i have to pay extra to have it added. anyway to circumvent this?
i have decide to buy hosting plan on dreamhost with a discount coupon of 24$ per year, i want to know whether this offer is valid for year or for ever.