I dont know if this has been asked before. Anyway what I want to accomplish is I want an email be sent to my email address everytime someone connects to my SSH. I want an email sent regardless it was a successful or failed login. Is there a step by step tutorial for this.
Where is this email configurable? I have seen this email alert notification in the logs numerous times but have yet to receive any alert emails from CSF/LFD.
I have many domains and webservers. so it's hard to monitor everything usually. i heard there are some websites and softwares to do this.
does windows 2003 have anything default like this ? or can anyone suggest the application for my windows 2003 server? which sends alerts if any error is going on my server?
Also there any other websites which is doing this monitoring? because i have some shared accounts and i want to monitor it too.
this is way better, my server goes up for 10-20 minutes then I have to hit restart from the virtouzzo, becuase the server simply goes dead. nothing loads..
how can I know which site on my vps is causing trouble and how to fix it?
I am getting on every 10 minutes mails like that from my server every one has different ports
Quote:
This is an automated alert generated from *********. This alert is to notify the addressed users of new server sockets. New server sockets can indicate server-software that has been started on your host, or otherwise be an indication to malicious activity. It is advised to review this alert and investigate if needed.
Following is a summary of new Internet Server Sockets: > tcp 0 0 ************:3262 0.0.0.0:* LISTEN
Quote:
This is an automated alert generated from *************. This alert is to notify the addressed users of new server sockets. New server sockets can indicate server-software that has been started on your host, or otherwise be an indication to malicious activity. It is advised to review this alert and investigate if needed.
Following is a summary of new Internet Server Sockets: > tcp 0 0 *************:53007 0.0.0.0:* LISTEN -
Quote:
This is an automated alert generated from *********. This alert is to notify the addressed users of new server sockets. New server sockets can indicate server-software that has been started on your host, or otherwise be an indication to malicious activity. It is advised to review this alert and investigate if needed.
Following is a summary of new Internet Server Sockets: > tcp 0 0 ***********:44543 0.0.0.0:* LISTEN
How can i find why this is coming? My managment company said me that a script is tryig to open a socket but we couldnt find the script. Is there any people here have like a similar issue or how can i find and solve this?
In less than 5 mins of account activation user named Paul McGrath, supposedly from NY. Allegedly using lolchurch.com domain (that domain was never forwarded to our server) and user just put a script called send.php and let it rip.
Good thing i was around and management looked at it within minutes (AcuNett).
So, watch for this user signing up and check account(if using that user name or similar domain or recent signups) for any such php page.
Now asks us for refund for suspending his site for spamming.. Asked for his driver license copy to first verify his address, so possibly i can report to paypal for possible fraud too or some online internet police maybe for fraud if there is such a police
Note to Mods. not sure where threads like these go to!
Quick edit: Now user trying to threaten us to give their refund cause they want it back for they spammed and deserve a refund for the same.
"Your servers were awful anyways, I maybe sent 500 emails? I'm gonna ask nicely before I actually do something about this, give me a refund."
he forgot 500 emails in less than 5 mins. does not look like not-spam. Anyways i go have some chat with the fraud, id does not match paypal payment id
[root@box ~]# cat /etc/grub.conf # grub.conf generated by anaconda # # Note that you do not have to rerun grub after making changes to this file # NOTICE: You have a /boot partition. This means that # all kernel and initrd paths are relative to /boot/, eg. # root (hd0,0) # kernel /vmlinuz-version ro root=/dev/sda5 # initrd /initrd-version.img #boot=/dev/sda default=0 timeout=5 splashimage=(hd0,0)/grub/splash.xpm.gz hiddenmenu title CentOS (2.6.18-92.1.22.el5) root (hd0,0) kernel /vmlinuz-2.6.18-92.1.22.el5 ro root=LABEL=/ initrd /initrd-2.6.18-92.1.22.el5.img [root@box ~]#
Gmail has a feature to detect email phishing and it marks them with a red header alert saying "Warning" This message may not be from whom......", I believe this red alert has nothing to do with spf record of that email, so how does it detect it as phishing email?
We have spf record and I sent an email from another server, when I received that emai the spf record was "softfail" but it does not have that red alert.
how i can secure vps from this kind of script and known when someone upload shell script. How do I set the alert so I get to know that someone has uploaded a script on the server
I've run "DNS report" test for one hosting in dnsstuff.com and got this warning (as some times before for other hosts:
--------------------- Fail: Open DNS server
ERROR: One or more of your nameservers reports that it is an open DNS server. This usually means that anyone in the world can query it for domains it is not authoritative for (it is possible that the DNS server advertises that it does recursive lookups when it does not, but that shouldn't happen). This can cause an excessive load on your DNS server. Also, it is strongly discouraged to have a DNS server be both authoritative for your domain and be recursive (even if it is not open), due to the potential for cache poisoning (with no recursion, there is no cache, and it is impossible to poison it). Also, the bad guys could use your DNS server as part of an attack, by forging their IP address. -----------------------
this is not a WHMCS vulnerability, & you are most likely not affected if you have used the Further Security Tutorials, given by WHMCS.
1.) What has happened?
A professional hacker, signs up as a client, & adds a shell script to your attachments/downloads folder. He gains complete access to your WHMCS admin, & changes your paypal & other gateway emails/accounts, to his emails/accounts.
2.) What to do? Check your attachments/downloads folders, for any such scripts. Use - [url]Furthur_Security_Steps to secure it.
Go to Payment Gateways, & check if the accounts are yours.
3.) How do I know so much about this? Our installation, was also hacked. But, this hacker made a mistake. He used his email account password, for signing up. I could get into his email, & see who has been hacked. I could also get into his PayPal & Egold, & refund all payments intended to go to LaceHost (me). I saw other host's payments too.
4.) Hacker has changed his modus operandi. He now changes the paypal, to some other host's paypal, instead of his. He also deleted tables from your database, may create a new administrator account, may modify other accounts, add affiliate commission etc.
5.) For more information on this hacker, Add me on IM - lacehost [dot] live1 [at] yahoo [dot] com
6.) How many have been hacked? According to what I saw in his PayPal, & his email, atleast 15 hosts have been hacked.
If your paypal has been changed to some other host's paypal, please do not blame them for hacking, we really do not need an inter-industry war here
I use CSF on a VPS with 512 RAM and 1024 Busrt and the other day I received the below notification. My hostsaid it was Mailman and since I don't use mailing lists the recommendationwas to disable it. So I did. I'm curious tho as to why this happened in the first place.
Time: Wed Mar 19 17:53:33 2008 1 Min Load Avg: 11.41 5 Min Load Avg: 6.37 15 Min Load Avg: 2.70 Running/Total Processes: 12/94 ...............
I got a VPS last night and right after I got my HyperVM login info. I tried to install Lxadmin (Kloxo) but I got the following error:
Alert: rebuild_failed_could_not_untar
Screenshot: [url]
I have tried many times to rebuild the VPS and Install lxadmin but I get the same error. I am not an expert working with VPS but if anyone here would like to help, please give me as many steps as possible so that I can do it. As of right now, I cannot SSH to my VPS, I can only access HyperVM.
I send a few emails today and got a phonecall that people did not get my email. So I went into WHM and viewed "Top Email Relayers" There I saw my emails.
I am using WHM 11.11.0 cPanel 11.15.0
So what are Email Relayers?
How can I get my mails out of there so they can be send?
I have found a bunch of articles to setup Sendmail as a mail relay, but none have been successful for me or the articles are very outdated. Anyone have a 'stupid-proof' set of current instructions on how setup Sendmail Pop before SMTP? This is a CentOS 4.5 Box with Sendmail 8.14.2/8.13.1 and Dovecot. Any successful guidance would be appreciated!
