I've been trying to use mod_forensics – [url]-- which has helped on one server track down some one causing the segmentation fault due to trying to abuse FrontPage shtml.dll, but on another server also suffering from regular segmentation faults, this tool has not helped.
What other tools are available to track down the cause(s) of Apache segmentation faults?
I just installed Apache 2.4.4 and it seems to run fine overall. But in my error.log I get about 3 of these every hour or so.error.log:[Sat Jun 15 20:57:44.095961 2013] [core:notice] [pid 31400:tid 16384] AH00052: child pid 1971 exit signal Segmentation fault (11)
track down what causes this? What module? vhost?Otherwise the server seems to run fine. It's on Linux with PHP 5.3.26 and MySQL 5.1.
On and off for a few weeks, I've been getting this showing up in logwatch. Virtually no usable information seems to be on the web about it either:
--------------------- Kernel Begin ------------------------
WARNING: Segmentation Faults in these executables
php-cgi : 3 Time(s)
WARNING: General Protection Faults in these executables
php-cgi : 4 Time(s)
---------------------- Kernel End -------------------------
Anytime I've gotten these before, they were stored in:
/var/log/messages
Today (according to logwatch), I got a protection fault in "top".
But when I view /var/log/messages... nothing is there relating to a fault.
The only kernel message that appears is a martian source.
I also hadn't logged into ssh today, isn't "top" an ssh command.
Can anyone please tell me how dangerous in fact Apache's TRACE and TRACK functions?
I have read common explanation but would disabling TRACK and TRACE improve my server's ability to fight cross site scripting and similar attacks and make it more secure?
I recently build an apache server in Solaris10 SRAC server and enabled the following modules.
LoadModule foo_module modules/mod_foo.so
LoadModule jk_module modules/mod_jk.so
LoadModule weblogic_module modules/mod_wl_22.so
LoadModule rewrite_module modules/mod_rewrite.so
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadFile "/usr/lib/libxml2.so"
LoadModule xml2enc_module modules/mod_xml2enc.so
LoadModule proxy_html_module modules/mod_proxy_html.so
Post that I tried a simple Reverse Proxy setup to confirm the apache work fine as a reverse proxy
### Proxy Setup ####
ProxyVia On
ProxyPass /console http://<apps-host>:8980/console
<Location /console>
ProxyPassReverse http://<apps-host>:8980/console
</Location>
Post these changes when I try starting apache I get the error - Segmentation Fault - core dumped
Checked the Error Logs it shows -
[Mon May 27 14:09:24 2013] [notice] child pid 29964 exit signal Segmentation fault (11)
[Mon May 27 14:09:32 2013] [notice] child pid 29963 exit signal Segmentation fault (11)
[Mon May 27 14:11:14 2013] [notice] caught SIGTERM, shutting down
[Mon May 27 14:11:19 2013] [warn] RSA server certificate CommonName (CN) `BUNTY RAY' does NOT match server name!?
[Mon May 27 14:11:19 2013] [warn] No JkLogFile defined in httpd.conf. Using default /opt/apache-2.2.24/logs/mod_jk.log
[code]....
There are some great tools to optimize MySQL, however I have not been able to find the equivalent for Apache + PHP. I have a lot of experience tweaking these two in extreme traffic environments, but there is no beating a program that can simultaneously evaluate several inputs over time to calculate optimal settings.
View 11 Replies View RelatedI am just wondering if there are any frontends for the mod_status and (extended) status output.
View 0 Replies View RelatedI have a server that is monitored with a system that automatically reboots if a service appears to be down. The server is being rebooted several times a month and it seems to be getting more frequent.
The server load is almost never high. It's a dual Xeon with hyperthreading and the load is almost always below 1. Practically the only time it goes high is during cPanel backup and it hardly ever reboots during that.
The DC tried replacing the RAM, but a day and a half later it rebooted again.
The server has 1 fairly active MySQL message board and 3 fairly high bandwidth sites (images and video clips), and the rest of the sites are quite small and inactive. One thing the tech said was "Apache gets a lot of traffic so I'm not surprised to see an apache restart once a month or so. You have 115 concurrent connections to apache and over 25,000 hits in the last 2 hours alone" but I've gotten reboots a few times/week.
I bought a plan from SurpassHosting and hosted my site, tenshi-dream.net. The domain name was purchased from namecheap.
Recently I noticed that most of the time, only the main page (tenshi-dream.net) can be access but not the rest of the pages (eg. log.tenshi-dream or tenshi-dream.net/network.html)
Hence, I submitted a ticket to SurpassHosting. After investigation, they replied that the cause was not them and told me to contact server2.verygoodserver.com. I have no idea why because when I check Whois database, my domain does not belong to that nameserver.
I wish to move to another host but am afraid that the problem will still persist.
One of my CPanel server often has MySQL downtime randomly.. once every 30-60 minutes
I suspect is an overload or one of the user database is broken.
How do I check and fix?
i have 2 blogs with ixwebhosting.com from 1 1/2 years. from 10 days my blogs are getting attack frequently. every time i am cleaning and reporting to them. they are also clean it. but it is attacking again. They said my system has virus. (but i have latest bitdifender 2010 total security,probably the best antivirus) i also have account with 3 more hosts with many sites. everything works fine.
i am asking them why only this account getting affected if i have virus in my system.i already moved one site to another host where it is working fine now. Except this problem they are very good. So i can't left them.
if any one has experience this kind of problems, please suggest me what to do?
my friend is getting frequently 500 - Internal Error on his sites when ever he starts to get good amount of traffic at a moment, and by the time it resets to normal more than half the traffic is lost, he is using wordpress blog, some other applications not of any traffic, an IPB forum, and some other image hosting script
in total he has 3 databases used, he's not running to outage of RAM, he is using max.
70% of RAM at the pt. when this occurs, checked once long way back..
he usually gets lots of traffic to blog and image host as he posts some real good stuff..
On 11/29/07, I posted the following question, but have received no replies to date:
Quote:
TITLE: Are frequent failure notices common with VPS hosting?
We have a VPS1 account at Liquid Web ($60/month). Below I have copied just the most recent series of failure notices (clamd, cpsrvd, exim, ftpd, mysql, pop, spamd). We tend to receive these by e-mail on a fairly regular basis, accompanied by the usual message "A restart was attempted automagicly."
Since March 2006, when we first switched our web host to LW, there have been well over a hundred of them.
My question is: Are such frequent failures commonplace (i.e.: benign) on a VPS, or should I be concerned about them?
I usually check our web site after receiving each notice, and it is always up by the time I get there. Nevertheless, it would be nice to know if all these occurrences are considered normal. For example, 19 exim failures over a 6.5-hour span on 9/29/07 do seem a bit extreme.
If anyone reading this thread is technically inclined, I'd like to know what process or hardware state is usually responsible for causing such failures.
FYI, I use cPanel in my web browser to administer the site from a Macintosh computer running OS 9.2.2. I have never used SSH, and have also never read any raw logs. If I did, I'm not sure what they would tell me about this, anyway.
I should also say that our site uses nowhere near the capacity provided by our VPS1 account. We are well below the maximum HD space and monthly allowable bandwidth. The site uses only standard HTML, text include files, and GIF/JPG graphics files; no streaming. There is only limited use of a CGI script for routine form submissions, and currently there are no PHP scripts running for BBs, calendars, blogs, chat rooms, or any MySQL databases being used. In short, I would think that the site places little load on the server or its processes.
I would greatly appreciate any feedback.
cpanel @ host.xxxxxx.net 9/9/07, 11:53 PM cpsrvd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/10/07, 2:06 AM mysql on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/10/07, 2:06 AM spamd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/10/07, 2:07 AM clamd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/10/07, 2:07 AM cpsrvd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/10/07, 2:08 AM ftpd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/10/07, 2:08 AM named on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/10/07, 2:08 AM pop on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/27/07, 11:42 PM cpsrvd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/29/07, 12:59 AM exim on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/29/07, 1:09 AM exim on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/29/07, 1:30 AM exim on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/29/07, 1:39 AM exim on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/29/07, 1:58 AM exim on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/29/07, 2:10 AM exim on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/29/07, 2:22 AM exim on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/29/07, 2:31 AM exim on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/29/07, 2:41 AM exim on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/29/07, 2:50 AM exim on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/29/07, 3:00 AM exim on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/29/07, 3:09 AM exim on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/29/07, 3:40 AM exim on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/29/07, 3:50 AM exim on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/29/07, 3:59 AM exim on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/29/07, 7:09 AM exim on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/29/07, 7:19 AM exim on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/29/07, 7:28 AM exim on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 9/29/07, 7:37 AM exim on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 10/7/07, 11:41 PM cpsrvd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 11/8/07, 12:42 AM cpsrvd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 11/19/07, 12:37 PM exim on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 11/21/07, 12:43 AM cpsrvd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 11/22/07, 12:44 AM cpsrvd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 11/23/07, 12:42 AM cpsrvd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 11/25/07, 11:32 AM cpsrvd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 11/25/07, 11:44 AM pop on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 11/25/07, 12:06 PM spamd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 11/29/07, 12:41 AM cpsrvd on host.xxxxxx.net failed
This morning, I received a total of 17 failure notices over the span of 2h19m, as follows:
cpanel @ host.xxxxxx.net 12/12/07, 3:26 AM clamd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 12/12/07, 3:36 AM clamd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 12/12/07, 3:44 AM clamd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 12/12/07, 3:53 AM clamd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 12/12/07, 4:02 AM clamd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 12/12/07, 4:11 AM clamd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 12/12/07, 4:19 AM clamd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 12/12/07, 4:28 AM clamd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 12/12/07, 4:36 AM clamd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 12/12/07, 4:45 AM clamd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 12/12/07, 4:53 AM clamd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 12/12/07, 5:02 AM clamd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 12/12/07, 5:11 AM clamd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 12/12/07, 5:19 AM clamd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 12/12/07, 5:28 AM clamd on host.xxxxxx.net failed
cpanel @ host.xxxxxx.net 12/12/07, 5:36 AM clamd on host.xxxxxx.net failed
cpanel@ host.xxxxxx.net 12/12/07, 5:45 AM clamd on host.xxxxxx.net failed
(Note that our real host name has been replaced above with "xxxxxx" to prevent possible spamming.)
I would appreciate any comments from experienced VPS customers or technicians, as to whether these incidences are considered normal with all VPS accounts, or if they might be indicative of a more severe problem with our web host's (Liquid Web) server.
As I mentioned on 11/29/07, "I use cPanel in my web browser to administer the site from a Macintosh computer running OS 9.2.2. I have never used SSH, and have also never read any raw logs. If I did, I'm not sure what they would tell me about this, anyway."
In the course of reading a number of posts in another WHT thread, there seems to be little agreement on the possible causes. Some have suggested that (1.) there may be "no space left on the device"; (2.) we may be "out of Semaphores" (I have no idea what those are!); (3.) we may be "out of RAM"; (4.) "/tmp is full"; or that (5.) "something is wrong with /tmp permission."
When I inquired in 2006 to Liquid Web's technical support about these recurrent failures, I was told that they are normal with this sort of hosting account. We pay them a hosting fee with the expectation of receiving an accurate diagnosis, but it would be very helpful to receive some impartial, third-party input.
root@server [/usr/bin]# ffmpeg -i DSCN0377.avi -vcodec libx264 -b 2048k -bt 2048k -acodec libfaac -ab 128k -f mp4 TEST1.mp4
FFmpeg version SVN-r19290, Copyright (c) 2000-2009 Fabrice Bellard, et al.
configuration: --enable-libmp3lame --enable-libvorbis --enable-shared --enable-libx264 --enable-libxvid --enable-libfaac --enable-libfaad --enable-gpl --enable-nonfree --enable-pthreads
libavutil 50. 3. 0 / 50. 3. 0
libavcodec 52.32. 0 / 52.32. 0
libavformat 52.36. 0 / 52.36. 0
libavdevice 52. 2. 0 / 52. 2. 0
libswscale 0. 7. 1 / 0. 7. 1
built on Jun 29 2009 20:47:56, gcc: 4.1.2 20080704 (Red Hat 4.1.2-44)
Input #0, avi, from 'DSCN0377.avi': ....
This is regarding WHMCS
Suddenly POP piping stopped working. When I try to execute it manually from bash I get,
root@gui3 [/home/intranet/public_html]# php -q /home/intranet/public_html/pipe/pop.php
<b>POP Import Log</b><br>Date: 10/09/2009 09:52:00<hr>Host: mail.***********.br<br>Email: suporte@***********.br<br>Email Count: 845<hr>Segmentation fault
root@gui3 [/home/intranet/public_html]#
Ive tried to recompile PHP and updated it to the latest PHP cPanel version (5.2.10). But the error is the same.
Ive contacted WHMCS support and they only told me to recompile PHP.
Something just went wrong with my server today
login as: teddy
password: xxxxxxxx
[teddy@server1 ~]$ sudo su -
Segmentation fault
[teddy@server1 ~]$ df
Bus error
[teddy@server1 ~]$ crontab -l
Segmentation fault
My website seems to be showing me lots of PHP & SQL errors.
For example, my live-chat shows me:
Warning: session_start() [function.session-start]: open(/tmp/sess_8aa74272d583973018e8f0805a796df2, O_RDWR) failed: Read-only file system (30) in /home/polar/domains/.../auth.php on line 20
I'm getting this error message when logwatch run,
--------------------- Kernel Begin ------------------------
WARNING: Segmentation Faults in these executables
httpd : 9 Time(s)
---------------------- Kernel End ------------------------- "
Have recompile apache twice, but it doesn't help.
I'm running this,
root@host [~]# php -v
PHP 4.4.6 (cli) (built: May 15 2007 12:54:50)
Copyright (c) 1997-2007 The PHP Group
Zend Engine v1.3.0, Copyright (c) 1998-2004 Zend Technologies
with Zend Extension Manager v1.0.10, Copyright (c) 2003-2006, by Zend Technologies
with Zend Optimizer v3.0.1, Copyright (c) 1998-2006, by Zend Technologies
and this is my server,
Processor: Dual Xeon E5310 Quad Core (Clovertown)
Memory: 4GB DDR Registered ECC
Hd1: Dual 73GB SCSI / Hardware Raid 1
I have had this segmentation problem since the first day I got my server.
Need advice what to do about this?
Friend of mine was talking about upgrade to php version 5, but I'm not sure thats the way to do it. Having about 40 accounts/domains and I'm not sure that web sites will work with php 5.
-bash-3.00# service named restart
Stopping named: [ OK ]
Starting named: /etc/init.d/named: line 46: 14206 Segmentation fault
Using Plesk 8 on a vps / linux
/var/log/messages shows no errors but zones loaded after vps reboot.
A dedicated server client of mine was telling me that his mysql was corrupted frequently and when his admin tried to upgrade his php and mysql he faced segmentation error. His admin was saying that this was a RAM problem.
View 6 Replies View RelatedMy server currently has some problems with DNS/mail, which i can't seem to fix myself. My colocation host offered to help me by giving him root access, but i don't know him very well yet. Is there some kind of script/logtool so i can track everything he did on the server? I don't want him snooping around through my webfiles and databases...
View 13 Replies View RelatedTrying to enable xcache on my cpanel, centos server (suphp *not* enabled)
Followed this guideline
[url]
Xcache shows up in php -m output, however I get this output as well
Code:
root@server [/tmp]# php -v
PHP 5.2.8 (cli) (built: Jan 5 2009 16:23:03)
Copyright (c) 1997-2008 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2008 Zend Technologies
with the ionCube PHP Loader v3.1.34, Copyright (c) 2002-2009, by ionCube Ltd., and
with Zend Extension Manager v1.2.2, Copyright (c) 2003-2007, by Zend Technologies
with Zend Optimizer v3.3.3, Copyright (c) 1998-2007, by Zend Technologies
Segmentation fault (core dumped)
In the /usr/local/lib/php.ini file I had this portion setup before the Zend portion...
Code:
[xcache-common]
extension = xcache.so
[xcache.admin]
xcache.admin.auth = On
xcache.admin.user = ""
xcache.admin.pass = ""
[xcache]
; ini only settings, all the values here is default unless explained
; select low level shm/allocator scheme implemenation
xcache.shm_scheme = "mmap"
; to disable: xcache.size=0
; to enable : xcache.size=64M etc (any size > 0) and your system mmap allows
xcache.size = 128M
; set to cpu count (cat /proc/cpuinfo |grep -c processor)
xcache.count = 4
; just a hash hints, you can always store count(items) > slots
xcache.slots = 8K
; ttl of the cache item, 0=forever
xcache.ttl = 0
; interval of gc scanning expired items, 0=no scan, other values is in seconds
xcache.gc_interval = 0
; same as aboves but for variable cache
xcache.var_size = 0M
xcache.var_count = 1
xcache.var_slots = 8K
; default ttl
xcache.var_ttl = 0
xcache.var_maxttl = 0
xcache.var_gc_interval = 300
xcache.test = Off
; N/A for /dev/zero
xcache.readonly_protection = Off
; for *nix, xcache.mmap_path is a file path, not directory.
; Use something like "/tmp/xcache" if you want to turn on ReadonlyProtection
; 2 group of php won't share the same /tmp/xcache
; for win32, xcache.mmap_path=anonymous map name, not file path
xcache.mmap_path = "/dev/zero"
; leave it blank(disabled) or "/tmp/phpcore/"
; make sure it's writable by php (without checking open_basedir)
xcache.coredump_directory = ""
; per request settings
xcache.cacher = On
xcache.stat = On
xcache.optimizer = Off
[xcache.coverager]
; per request settings
; enable coverage data collecting for xcache.coveragedump_directory and xcache_coverager_start/stop/get/clean() functions (will hurt executing performance)
xcache.coverager = Off
; ini only settings
; make sure it's readable (care open_basedir) by coverage viewer script
; requires xcache.coverager=On
xcache.coveragedump_directory = ""
[Zend]
zend_extension_manager.optimizer=/usr/local/Zend/lib/Optimizer-3.3.3
zend_extension_manager.optimizer_ts=/usr/local/Zend/lib/Optimizer_TS-3.3.3
zend_optimizer.version=3.3.3
extension=pdo.so
extension=pdo_sqlite.so
extension=sqlite.so
extension=pdo_mysql.so
allow_url_include = On
; Memcache Section
extension = memcache.so
memcache.allow_failover = 0
When I search for "zend_extension" this is the result:
Code:
; Directory in which the loadable extensions (modules) reside.
extension_dir = "/usr/local/lib/php/extensions/no-debug-non-zts-20060613"
zend_extension="/usr/local/IonCube/ioncube_loader_lin_5.2.so"
zend_extension_ts="/usr/local/IonCube/ioncube_loader_lin_5.2_ts.so"
zend_extension="/usr/local/lib/php/extensions/no-debug-non-zts-20060613/xcache.so"
If I move the xcache line to the first line, before the ioncube one, I get this error:
root@server [/usr/local/lib/php/extensions/no-debug-non-zts-20060613]# php -m
Segmentation fault (core dumped)
Quote:
root@server [/usr/local/lib/php/extensions/no-debug-non-zts-20060613]# ls -lh
total 290M
drwxr-xr-x 2 root root 4.0K May 11 11:48 ./
drwxr-xr-x 5 root root 4.0K Sep 17 2007 ../
-rw------- 1 root root 144M May 11 11:48 core.9588
-rw------- 1 root root 144M May 11 11:48 core.9592
-rwxr-xr-x 1 root root 495K Jan 5 16:34 eaccelerator.so*
-rw-r--r-- 1 root root 3.1K Jan 5 22:04 error_log
-rwxr-xr-x 1 root root 142K Sep 17 2007 mailparse.so*
-rwxr-xr-x 1 root root 313K Jan 5 20:43 memcache.so*
-rwxr-xr-x 1 root root 124K Jan 5 16:23 pdo_mysql.so*
-rwxr-xr-x 1 root root 265K Jan 5 16:23 pdo.so*
-rwxr-xr-x 1 root root 1.4M Jan 5 16:23 pdo_sqlite.so*
-rwxr-xr-x 1 root root 989K Jan 5 16:23 sqlite.so*
-rwxr-xr-x 1 root root 323K May 11 11:31 xcache.so*
My config:
PHP 5.2.8
Zend Opt 3.3.3
suphp disabled
Apache 2.2
We are having major problems on one of our servers.
We were running general commands like 'grep' and then this error message came up:
[root@~]# cat /etc/userdomains | grep test
Segmentation fault (core dumped)
[root@~]#
Then it went down and has not come back up online.
I'm small hosting provider. On one dedicated server I have around 100 cPanel accounts.
That server is under constant, although not powerful DoS attack.
Since my company domain is not targeted on another server I believe that it is not me but one of my customers that attack is against.
Is there a way, tool, service provider than can help me pin down which account is being hit?
All accounts are on server main shared IP.
Would spreading them on another IPs help? Or would I still see attacks only on main shared IP?
I'd like to know, is there any way to know about hosting provider, if we have only ip address of the server. i.e.
66.63.181.74 - this is the ip address of my website server, how can i trace the service provider who is giving this hosting service?
I have a few shred hosting servers I run. One of them keeps getting listed on CBL. It is very frustrating. Does anyone have an tools, tips, or tricks on finding the compromised?
So far I have confirmed that a script is using PHP to send mail out bypassing the MTA. It is faking the HELO and impersonating a well known ISP.
I used a combination of tshark and netstat. tshark can show me the HELO and EHLO. When I see the wrong entry I cross check that with netstat to see what. So Netstat only shows that it was PHP not the script path.
Here are the commands I'm running:
Code:
nohup netstat -c -p -n -e | grep -i ":25" > /var/log/monitor/netstat-smtp.log &
nohup tshark -f "port 25 and src host XX.XX.XX.XX" > /var/log/monitor/tshark-smtp.log &
Then I grep for what I'm looking for:
grep -i "HELO" /var/log/monitor/tshark-smtp.log
Is there a way to get Netstat to show the script path or complete command that is establishing the connection? Currently these scripts are eating up memory to a point that other process or getting killed off.
I also tried to force all mail through the MTA, but When I enable SMTP_BLOCK in my firewall config I get and error:
*WARNING* Cannot use SMTP_BLOCK on this VPS as the Monolithic kernel does not support the iptables module ipt_owner - SMTP_BLOCK disabled.
If there is a better way I'm game. Maybe some IDS that can tell me more of what is going on with the server?
I am currently developing a web application on a WAMP server. Once complete my client will have some in-house "programmers" make changes to the code as they are needed.
My client wants to track all changes made to the source files (ie- who made the change, when it was made, what files were modified, and what specific lines were added/removed/modified). Also, the program must run on the server and not the programmers computers.
I've searched high and low and only found a couple programs that scratch the surface of what they want.