What does this string do? I copy and paste it into my SSH Shell and i get ip addresses and numbers next to them.
Each number means one connection?
netstat -plan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -nk 1
As a personal project I've recently began thinking about setting up a CDN (sort of) with my various servers around the world. Basically, what it will do is.. From one 'management' point or portal (you can assume one physical server), each user can update/create their webpage there..
From that main node, it will have to replicate in REAL TIME:
a) userdir (public_html etc.)
b) mysql db's (circular mysql replication?)
c) Any updates to their apache.conf, php.ini etc..
Now I've been looking into several options.. drbd seems to be one that a lot of people suggest for the actual data sync, but I'm wary of implementing something like that outside of a local private LAN. I've also looked into rsync/unison which may work.. I'm just throwing this out there to see what people have tried and are using.
DNS will be handled by a GeoIP/Maxmind bind patch, and closest server will be given by my DNS servers. Closest 'mirror' of the user's site will be served via that hostname.
Anyone done this before or tried? The actual caching part of CDNs and etc. I'm thinking I could always just deal with via squid later, but for now the main guts is what I'm concerned with.
I have a dedicated server which I access via remote desktop.
The firewall is not enabled. What kind of security should I have on my server?
Ive read that if I enable Windows Firewall my remote desktop connection will be blocked & this will mean me having to contact the server company via phone etc.
Is there some sort of rating guide (or site) that compares/rates performance and reliability of web hosts.
I just signed up with namecheap and the first three days were great but now it seems to be going down hill.
I've seen other sites with lists but they seem to be advertiser biased.
I really hope I'm just going batty with sleep deprivation, because this is making no sense to me. Before I clobber my poor provider with management requests, I want to see if this is typical behavior or not. I am able to send messages through my SMTP server from my laptop without using any authentication at all. It doesn't matter whether I'm using a client (tested Mail.app and Mozilla Thunderbird) or whether I'm going in via telnet. A typical session might look like this (addresses obfuscated):
asdfasdfasdf:~ ###$ telnet mail.fakedomainname.com 25
Trying ##.##.##.## ...
Connected to mail.fakedomainname.com.
Escape character is '^]'.
220 fakedomainname.com ESMTP Exim 4.67 Wed, 30 Jan 2008 00:56:03 -0800
HELO [192.168.2.1]
250 fakedomainname.com Hello reverse.verizon.net [##.##.##.##]
MAIL FROM:<nonexistentuser@fakedomainname.com>
250 OK
RCPT TO:<myvalidaddress@gmail.com>
250 Accepted
DATA
354 Enter message, ending with "." on a line by itself
This should not work
.
250 OK id=1JK8kZ-0004Xx-7O
quit
221 fakedomainname.com closing connection
Connection closed by foreign host.
asdfasdfasdf:~ username$
I was expecting to see a "550 authentication required" message after it saw that "RCPT TO" wasn't a locally-hosted domain. I did confirm that the message was properly delivered to the intended Gmail address. So far, it looks like an open relay. But when
I use a third-party environment, such as the open relay checker at abuse.net, I am correctly seeing "550" messages at the appropriate places.
In other words, when anyone else does it, they get "550". When it do it from my laptop (from any client or telnet session), I'm clear to send. Just to add a little zest to the situation, when I did this same test 36 hours ago, I *was* getting "550" errors.
This doesn't seem right to me. However, my mail admin skill level is approximately zero, so I'm willing to accept that this is normal behavior and that I am overlooking the obvious.
I am setting up a niche recruitment website where people can put online CVs, upload PDf CVS and search for jobs. employers can post vacancies and search for potential employees. Would shared hosting be adequate for this (it has all the MYSQL databases necessary) I am just wondering what sort of demand this makes on servers. I currently have a 1and1 professional shared hosting package or do I need VPS?
View 4 Replies View Related<Updated and edited since the WHT crash>
I have had a VPS with Digital Linx since December 4, 2008. I am more than happy with the service I have received from them. At first, their order and billing system was a bit wonky, but now it is working just fine. I have dealt with support a few times, and they have been very quick to respond. Their MSN support person is online a LOT. At one point, there was a heavy load on the VPS. I msg'd support on MSN and they were already dealing with it. It was fixed in 5 minutes. They were also quick to set up TAP/TUN, and were really good when I said I was going to set up the VNC I am currently running.
They have added a number of good VPS images since, including 2 VNC images. With this, the offer more than most VPS providers. Their support people have always been very quick to respond, and their prices are very competitive. I am thrilled to get this level of support for the amount I pay.
I currently do not have any website hosted on that VPS. I am using it as a VNC server/remote office. But, just so you know, I am posting from it! I have reported my domainname/IP.
I highly recommend Digital Linx. They are one of the best value VPS companies I have dealt with, and I have dealt with a few.
Currently configuring my VPS, have been for a while now, and am relooking at the security I'll need on it. The VPS will be running something similar to a CMS/Forum site and won't be offering webhosting. Alot of the security measures around here are webhosting orientated. What security procedures does everyone suggest for my situation?
I've got APF, BFD and restricted root SSH access. Is there anything else?
Why servers are being run out of memory by the 'sort' command even when the logs are small? Here's what is currently on a site:
-rw-r--r-- 2 root root 22392143 Mar 26 11:40 access_log
-rw-r--r-- 2 root root 68018869 Mar 26 10:50 access_log.processed.1
-rw-r--r-- 3 root root 67671664 Mar 26 09:50 access_log.processed.2
-rw-r--r-- 1 root root 69908 Mar 26 10:50 access_log.stat
[Code] .....
After upgrading the panel from 10.4.4 to 11.5.30 Update #23, I am not able to sort domains based on the "Renewal Date" column. With 10.4.4, I was able to sort. Is there anyway I can do this on 11.5.30?
View 7 Replies View RelatedI like to create some service plans using the cli-tools, /usr/local/psa/bin/service_plan.I am able to create a service plan, but I'm unable to create a service plan inside a reseller plan. For example I cannot "tell" the service_plan script to add the created serviceplan to a reseller plan. Is it possible to create a serviceplan inside a reseller plan, using the cli?
View 4 Replies View Relatedi rent a server,and i also have a printer on my office, how can i connect my printer with my server,and remote print?
View 6 Replies View RelatedOn Linux, what is the command that can show me all of the files in subdirectories with Full Path? For ex, I am looking for something like;
./cgi-bin/library/templates/example.html
I tried ls -alR, but it only show me single file name with each divided section of subdirectories....Should I use some other command or build a script for this?
I am trying to run a script that will locate the process number and will change the iowait priority
This will display the process number :
ps -ef |grep rsync|grep -v grep | awk '{print $2}'
ionice runs like this:
ionice -c3 -p <process number>
Any way to combine these to change iowait priority of a process?
Having some trouble using grep and hoped someone might be able to help.
Running the following command to try and scan for an IP address match across a period of time in our access_logs:
grep '04/Feb/2007:21:*:*' /var/www/vhosts/*/statistics/logs/access_log.processed | grep
'216.2*.*.*'
This is returning all kinds of IP address results such as: 58.216.50.2 Can you suggest how I can tweak the grep command to search for the right IP addresses?
I want to scan precisely for IP addresses starting 216.2*.
We've been given the following information about spam, and want to track the source of it
down:
216.2x.x.x - email spam
So any ideas how I can scan these logfiles more precisely for the IP address I need?
I grepped an IP address on a domain log and it showed thousands of lines. How do I save this grep result to a txt file so I can send it to someone?
View 4 Replies View RelatedI have installed HotSaNIC and I get no output when I do a
cat /proc/stat |grep disk_io
I have also tried
grep disk_io /proc/stat
and still no response, is any one able to help or suggest anything..
I am using RH E 5.1 ..
netstat -tln shows my port 80 is listening.
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN
but netstat -an shows nothing about port 80
actually my web can not be accessed. it shows "Cannot find server or DNS Error " under Internet Explorer.
I am not shure if this is a configuration problem or it's bacause netstat has it's own way to display things.
Recently csf blocked an IP address for flooding.
My server ip address is something like 192.168.1.201.
The ip that csf blocked was 192.168.1.20.
That IP belongs to an other server that is not ours.
netstat was showing a lot of connections from 192.168.1.20 (the ip that is not ours) but the guys that manage the server with that ip (192.168.1.20) did not saw any connection from them to us. So I thought it's just a spoofed flood. But, the thing is I've blocked that ip and still connections were made.
My conclusion was that netstat was showing 192.168.1.20 "flooding" instead of 192.168.1.201. (the server was connectiong to itself).
iptraf also was showing the server was connecting to itself on the lo interface.
My questions are:
csf is based on netstat for tracking connections?
has anyone had ths type of problem before?
If netstat is showing something else isn't this a bad thing for all (a lot) the scripts that use netstat?
Netstat & APF cron job ...
View 7 Replies View RelatedMy site is under attack, when i run this command
[php]netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -[/php
it show
1 116.xxx
1 118.xxx
1 203.xx
1 222.xxx
1 Address
1 servers)
3 115.xxx
3 123.xxx
4 58.xxx
10 127.0.0.1
694
What 694 connections mean ? Why netstat don't list their IP ? How can i know which IP is attacking my site ?
what does the below command actually means I mean when we use it? and in which case it help us? and up to what value there is nothing to worry about? Waiting for detailed reply
netstat -alpn | grep :80 | awk '{print $4}' | cut -d: -f1 |sort |uniq -c
i got a new sever and was looking at few thing.
just ran netstat and saw this -bash: netstat: command not found
how can i correct it?
I'm new to server administration/security/troubleshooting, so I have included a lot of info here hoping it will help.
This started because a Linux VPS with CentOS and Exim crashed after only 3000 emails were sent (of 30000) total
I ran a netstat and several times I get three separate ips with the only difference being the last two digits and the port number:
86.104.230.29:59009
86.104.117.45:18065
89.37.137.157:41593
As far as I can tell they are from Romania, and there are several connections.
I have posted a lot of information below, if someone can take a look and give some ideas, it would be very much appreciated.
netstat:
Code:
tcp 0 0 mydomain.com:http 86.104.117.98:34060 SYN_RECV
tcp 0 0 mydomain.com:http 89.39.71.82:59022 SYN_RECV
tcp 0 0 mydomain.com:http 89.39.71.219:52276 SYN_RECV
tcp 0 0 mydomain.com:http 89.37.137.163:25383 SYN_RECV
tcp 0 0 mydomain.com:http 89.37.137.154:20794 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.230.235:39094 SYN_RECV
tcp 0 0 mydomain.com:http 89.37.137.127:61711 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.230.127:5748 SYN_RECV
tcp 0 0 mydomain.com:http 89.39.71.37:63424 SYN_RECV
tcp 0 0 mydomain.com:http 89.39.71.228:54121 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.230.226:39605 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.230.91:6446 SYN_RECV
tcp 0 0 mydomain.com:http 89.37.137.10:54841 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.230.100:22842 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.230.118:32674 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.117.80:16559 SYN_RECV
tcp 0 0 mydomain.com:http 89.37.137.64:47817 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.230.136:21718 SYN_RECV
tcp 0 0 mydomain.com:http 89.39.71.246:37288 SYN_RECV
tcp 0 0 mydomain.com:http 89.39.71.28:62119 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.117.190:4468 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.117.8:25247 SYN_RECV
tcp 0 0 mydomain.com:http 89.39.71.100:35503 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.230.199:20896 SYN_RECV
tcp 0 0 mydomain.com:http 89.39.71.237:saft SYN_RECV
tcp 0 0 mydomain.com:http 89.37.137.199:47952 SYN_RECV
tcp 0 0 mydomain.com:http 89.37.137.118:60561 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.117.181:10844 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.117.125:50584 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.117.253:17855 SYN_RECV
tcp 0 0 mydomain.com:http 89.39.71.10:25740 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.117.109:29528 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.117.62:47349 SYN_RECV
tcp 0 0 mydomain.com:http 89.37.137.55:4614 SYN_RECV
tcp 0 0 mydomain.com:http 89.37.137.226:22001 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.117.163:11790 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.230.44:8911 SYN_RECV
tcp 0 0 mydomain.com:http 89.39.71.46:telnets SYN_RECV
tcp 0 0 mydomain.com:http 89.37.137.190:27377 SYN_RECV
tcp 0 0 mydomain.com:http 89.39.71.181:34031 SYN_RECV
tcp 0 0 mydomain.com:http 89.39.71.19:41722 SYN_RECV
tcp 0 0 mydomain.com:http 89.37.137.100:57151 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.117.145:61402 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.117.53:52461 SYN_RECV
tcp 0 0 mydomain.com:http 89.37.137.26:42463 SYN_RECV
tcp 0 0 mydomain.com:http 89.37.137.217:35530 SYN_RECV
tcp 0 0 mydomain.com:http 89.37.137.35:63414 SYN_RECV
tcp 0 0 mydomain.com:http 89.39.71.154:56638 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.117.26:43972 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.117.172:6922 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.230.17:3683 SYN_RECV
tcp 0 0 mydomain.com:http 89.39.71.210:2397 SYN_RECV
tcp 0 0 mydomain.com:http 89.37.137.46:18754 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.230.244:4032 SYN_RECV
tcp 0 0 mydomain.com:http 89.37.137.235:8602 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.230.82:39495 SYN_RECV
tcp 0 0 mydomain.com:http 89.37.137.19:28848 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.230.163:47624 SYN_RECV
tcp 0 0 mydomain.com:http 89.37.137.8:2683 SYN_RECV
tcp 0 0 mydomain.com:http 89.39.71.55:43300 SYN_RECV
tcp 0 0 mydomain.com:http 89.37.137.37:1664 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.117.118:36892 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.117.17:7317 SYN_RECV
tcp 0 0 mydomain.com:http 89.37.137.109:56229 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.230.217:45257 SYN_RECV
tcp 0 0 mydomain.com:http 89.37.137.73:15278 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.230.64:14076 SYN_RECV
tcp 0 0 mydomain.com:http 86.104.117.116:14567 SYN_RECV
I've been happily banning ip's using the output from
netstat -plan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -nk 1
for over a year now, with iptables. However recently, after upgrading to apache 2.2, the connections in netstat get listed as ipv6. A row can look like this for example:
tcp6 0 0 ::ffff:12.123.123.123:80 ::ffff:12.123.12.:12382 ESTABLISHED-
(actual ip addresses changed)
As you can see, the remote ip address isn't complete, it's cut off, so the script used to sum up connections and insert into iptables isnt doing anything.
Maybe someone would be kind enough to enlighten me of the meaning of a netstat output. I know netstat is supposed to tell you the current active connections but would like some more details(what does each column mean?):
Code:
[root@]# netstat
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address Stat
I notice that often times I see my ISP's mail server connecting to domains I didin't even set up yet. Sometimes I see google(I guess indexing my sites). But in addition some times I see some scary foreign addresses like from nigeria or one really common one, one which I see pretty often when I run netstat is:
Quote:
tcp 0 0 mydomain.com:http [somehostname].amenworld.com:40867 TIME_WAIT
I can't seem to make any sense of it, what are they doing and why are they always "connected' to my server?
I could just be over reacting on some of this stuff but just curious about what this all means.
I saw this ad url webhost4life.com/linux199.asp on google. It's a $1.99 month deal with 2000gb of space, 20,000gb of bandwidth and unlimited domain names. Anyone used this service? I want to sign up but want to see if anyone used first to get some extra info.
View 8 Replies View RelatedHow much you pay of your VPS plan + what you will get of this monthly fee (linux/win, memory, bandwidht, disk etc)?
Please let us know also who is your VPS-provider.
I want to move my image gallery site from dreamhost to some higher host plan.
The volumedrive.com seems to be a good choice. But I don't know who uses their VPS plan.
My budget is 15-25$ / month. The disk is more than 30G (for hosting image files) and BW is more than 800G.
I run 4 Joomla sites and each sites get these amount of visitors per day.
Joomla 1- 1500 Per day
Joomla 2- 400 Per day
Joomla 3- 1300 Per Day
Joomla 4- 4000 Per day
Here are my current server spec
-256 MB RAM
-10GB Space
-200GB Premium Bandwidth (Level3/internap)
-cPanel/WHM full root access
I am very concerned about my page loading speed. Is the 256 MB Ram enough for these 4 Joomla sites or should I upgrade to a low end dedicated server with 1 GB Ram atleast?
I am searching hosting plans. I found 1&1 Beginner hosting plan for £2.99/year of
1and1Uk at dealsofuk.com.
I want your review about that site and the plan & facilities. Also suggest me any good hosting plan (if you have) in this price range and its facilities.