How to install Webhosting Guide

cd /usr/local/src/
wget http://ve.php.net/get/php-4.4.1.tar.gz/from/us2.php.net/mirror
tar -zxf php-4.4.1.tar.gz
cd php-4.4.1
up2date libpng-devel libjpeg-devel freetype-devel freetype libjpeg libpng

ln -s /usr/lib/libjpeg.so.62 /usr/lib/libjpeg.so
ln -s /usr/lib/libpng.so.3.1.2.2 /usr/lib/libpng.so

‘./configure’ ‘–host=i386-redhat-linux’ ‘–build=i386-redhat-linux’ ‘–target=i386-redhat-linux-gnu’ ‘–program-prefix=’ ‘–prefix=/usr’ ‘–exec-prefix=/usr’ ‘–bindir=/usr/bin’ ‘–sbindir=/usr/sbin’ ‘–sysconfdir=/etc’ ‘–datadir=/usr/share’ ‘–includedir=/usr/include’ ‘–libdir=/usr/lib’ ‘–libexecdir=/usr/libexec’ ‘–localstatedir=/var’ ‘–sharedstatedir=/usr/com’ ‘–mandir=/usr/share/man’ ‘–infodir=/usr/share/info’ ‘–cache-file=../config.cache’ ‘–with-config-file-path=/etc’ ‘–with-config-file-scan-dir=/etc/php.d’ ‘–enable-force-cgi-redirect’ ‘–disable-debug’ ‘–enable-pic’ ‘–disable-rpath’ ‘–enable-inline-optimization’ ‘–with-bz2′ ‘–with-db4=/usr’ ‘–with-curl=/usr’ ‘–with-dom=/usr’ ‘–with-exec-dir=/usr/bin’ ‘–with-png-dir=/usr’ ‘–with-gd’ ‘–enable-gd-native-ttf’ ‘–with-ttf’ ‘–with-gettext’ ‘–with-ncurses’ ‘–with-gmp’ ‘–with-iconv’ ‘–with-jpeg-dir=/usr’ ‘–with-openssl’ ‘–with-png’ ‘–with-pspell’ ‘–with-regex=system’ ‘–with-xml’ ‘–with-expat-dir=/usr’ ‘–with-zlib’ ‘–with-layout=GNU’ ‘–enable-bcmath’ ‘–enable-exif’ ‘–enable-ftp’ ‘–enable-magic-quotes’ ‘–enable-safe-mode’ ‘–enable-sockets’ ‘–enable-sysvsem’ ‘–enable-sysvshm’ ‘–enable-discard-path’ ‘–enable-track-vars’ ‘–enable-trans-sid’ ‘–enable-yp’ ‘–enable-wddx’ ‘–enable-mbstring’ ‘–enable-mbstr-enc-trans’ ‘–enable-mbregex’ ‘–without-oci8′ ‘–with-pear=/usr/share/pear’ ‘–with-kerberos=/usr/kerberos’ ‘–with-ldap=shared’ ‘–with-mysql=shared’ ‘–enable-memory-limit’ ‘–enable-bcmath’ ‘–enable-shmop’ ‘–enable-versioning’ ‘–enable-calendar’ ‘–enable-dbx’ ‘–enable-dio’ ‘–enable-mcal’ ‘–with-apxs2filter=/usr/sbin/apxs’

make

make install

No comments

One way to stop one of the more basic attacks on a server is mod_evasive.This how-to will walk though the process of installing and configuring mod_evasive. This apache module will help protect against people sending too many requests to the webserver in an attempt to flood it. If it detects too many connections the offending ip will be blocked from the accessing apache for This is especially useful when the server is continuously getting attacked. With this default configuration it will block the offending ip for 10 minutes. If it continues to try and flood mod_evasive will automatically add more time to this.

*Update* Feb 1 2005 - Now links to the latest version of mod_evasive from the old name of mod_dosevasive.

**NOTE** This module has been known to cause problems with frontpage server extensions. If you them you should not install this module or just be aware of the fact it might break them.

Follow this section for Apache 1.3.x.

—–command—–
cd /usr/local/src
wget http://www.zdziarski.com/projects/mod_evasive/mod_evasive_1.10.1.tar.gz
tar -zxf mod_evasive_1.10.1.tar.gz
cd mod_evasive
/usr/local/apache/bin/apxs -cia mod_evasive.c
—–command—–

 

Follow this section for Apache 2.0.x.
—–command—–
up2date -i httpd-devel
cd /usr/local/src
wget http://www.zdziarski.com/projects/mod_evasive/mod_evasive_1.10.1.tar.gz
tar -zxf mod_evasive_1.10.1.tar.gz
cd mod_evasive
/usr/sbin/apxs -cia mod_evasive20.c
—–command—–

If you are adding the is module to apache 1.3.x the following lines need to be added to the httpd.conf below the AddModule section.

DOSHashTableSize 3097
DOSPageCount 5
DOSSiteCount 100
DOSPageInterval 2
DOSSiteInterval 2
DOSBlockingPeriod 600
 

If you are using apache 2.0.x you need to scroll to below the LoadModule section in the httpd.conf and add the following:

DOSHashTableSize 3097
DOSPageCount 5
DOSSiteCount 100
DOSPageInterval 2
DOSSiteInterval 2
DOSBlockingPeriod 10
DOSBlockingPeriod 600
Exit and save out of the httpd.conf

Now it should be ready to go. Exit out of pico and restart apache.
—–command—–
service httpd restart
—–command—–

For now I have removed the mailing feature from my configuration. If you would like it you need to add “DOSEmailNotify root” in the IfModule section of your httpd.conf. If you are having trouble with mod_evasive emailing you then you probably need to make sure that the mail configuration is correct. By default the it is set to /bin/mail which you may have to sym-link to the correct mail binary. You can also edit the line containing the following: “#define MAILER “/bin/mail -t %s” in the source code to change which it is pointing to.

No comments

Apache 2 Install and Upgrade Guide

Apache 2 upgrade - Apache 2 installation
Note: This how-to has worked fine on plesk and cpanel servers and numerous tests. I cannot guarentee it will work on yours and cannot take responsibility for the outcome. I do not recommend running this how-to on an ensim server.

Note: Text in green are commands that should be run from the root shell

FRESH INSTALL - Apache 2 installation
This part of the how-to is for a clean install only, for upgrades please scroll down.
Make a copy of your current httpd.conf incase you need to roll-back

cp /usr/local/apache/conf/httpd.conf /usr/local/apache/conf/httpd.conf_back

Download The Apache Tar.Gz File
wget http://www.tux.org/pub/net/apache/d…d-2.0.47.tar.gz

Extract The File To Your Server
tar -xz -f httpd*

Move Into The Extracted Folder
cd httpd*

Run The Configuration File, (The bits following ./configure were custom wrote by me, you may customise these how you wish)
./configure –prefix=/usr/local/apache –with-php –with-mysql –with-susexec –enable-mods-shared=all –disable-info

Run The Make File
make

Run The Install Make File
make install

Apache 2.0 is now installed on your system
The four lines below are certain security measures that can be taken to hide the identity of apache. *These are optional*

Edit The http.conf File
pico -w /usr/local/apache/conf/httpd.conf

Disable Apache Signatures (Security)
Locate ServerSignature and change to off

Add the line below, after ServerSignature off
ServerTokens ProductOnly

Save httpd.conf
CTRL + X then “Y” then “enter” without the “’s

Start Your New Apache
/usr/local/apache/bin/apachectl start

Your sites should now be working.
Please scroll down to the bottom of the page, after performing the commands above

Apache 2 Upgrade - Upgrading Apache
Make a copy of your current httpd.conf incase you need to roll-back
cp /usr/local/apache/conf/httpd.conf /usr/local/apache/conf/httpd.conf_back

Download The Apache Tar.Gz File
wget http://www.tux.org/pub/net/apache/d…d-2.0.47.tar.gz

Extract The File To Your Server
tar -xz -f httpd*

Move Into The Extracted Folder
cd httpd*

Run The Configuration File
./config.nice

Run The Make File
make

Run The Install Make File
make install

Start Apache
/usr/local/apache/bin/apachectl restart

All done, you should now have a successfully upgraded/installed apache configuration.

No comments

How to install mod_security for Apache

What is mod_security?
ModSecurity is an open source intrusion detection and prevention engine for web applications. It operates embedded into the web server, acting as a powerful umbrella - shielding applications from attacks. ModSecurity supports both branches of the Apache web server.

Rfx Networks Recommended:
“mod_security is great and I encourage it be used by everyone; it does have the potential to break some web applications but so far iv seen very few issues to say the least. Likewise it is easy to fix any applications that may break with the granular filter rules that can be setup to either deny or allow certain content. Overall mod_security is a needed addition to apache, providing a layer of security yet unseen for apache. I highly encourage you read the reference document on the modsecurity.org site (under documentation) to better understand each directive and the role it plays in protecting your server and sites.”

Requirements:
Apache Web Server 1.3x or 2.x

Note: We have confirmed this security addon works with Cpanel based servers.

How to install?
1. Login to your server through SSH and su to the root user.

2. First your going to start out by grabbing the latest version of mod_security
wget http://www.modsecurity.org/download/mod_security-1.7.4.tar.gz

3. Next we untar the archive and cd into the directory:
tar zxvf mod_security-1.7.4.tar.gz
cd mod_security-1.7.4/

4. Now you need to determine which version of apache you use:
APACHE 1.3.x users
cd apache1/
APACHE 2.x users
cd apache2/

5. Lets Compile the module now:
/usr/local/apache/bin/apxs -cia mod_security.c

6. Ok, now its time to edit the httpd conf file. First we will make a backup just incase something goes wrong:
cp /usr/local/apache/conf/httpd.conf /usr/local/apache/conf/httpd.conf.backup

7. Now that we have backed it all up, we can edit the httpd.conf. Replace pico with nano depending on what you have
pico /usr/local/apache/conf/httpd.conf

8. Lets look for something in the config, do this by holding control and pressing W and you are going to search for

(altho any of the IfModules would work fine)

9. Now add this

SecFilterEngine On

SecServerSignature “Apache”
SecFilterCheckUnicodeEncoding Off
SecAuditEngine RelevantOnly
SecAuditLog logs/audit_log
SecFilterScanPOST On

SecFilterDefaultAction “deny,log,status:403″

SecFilterSelective REQUEST_METHOD “^POST$” chain
SecFilterSelective HTTP_Content-Length “^$”

SecFilterSelective HTTP_Transfer-Encoding “!^$”

SecFilterSelective ARG_PHPSESSID “!^[0-9a-z]*$”
SecFilterSelective COOKIE_PHPSESSID “!^[0-9a-z]*$”
SecFilter “../”

SecFilter “viewtopic\.php\?” chain
SecFilter “chr\(([0-9]{1,3})\)” “deny,log”

SecFilterSelective THE_REQUEST “wget ”
SecFilterSelective THE_REQUEST “lynx ”
SecFilterSelective THE_REQUEST “scp ”
SecFilterSelective THE_REQUEST “ftp ”
SecFilterSelective THE_REQUEST “cvs ”
SecFilterSelective THE_REQUEST “rcp ”
SecFilterSelective THE_REQUEST “curl ”
SecFilterSelective THE_REQUEST “telnet ”
SecFilterSelective THE_REQUEST “ssh ”
SecFilterSelective THE_REQUEST “echo ”
SecFilterSelective THE_REQUEST “links -dump ”
SecFilterSelective THE_REQUEST “links -dump-charset ”
SecFilterSelective THE_REQUEST “links -dump-width ”
SecFilterSelective THE_REQUEST “links http:// ”
SecFilterSelective THE_REQUEST “links ftp:// ”
SecFilterSelective THE_REQUEST “links -source ”
SecFilterSelective THE_REQUEST “mkdir ”
SecFilterSelective THE_REQUEST “cd /tmp ”
SecFilterSelective THE_REQUEST “cd /var/tmp ”
SecFilterSelective THE_REQUEST “cd /etc/httpd/proxy ”
SecFilterSelective THE_REQUEST “/config.php?v=1&DIR ”
SecFilterSelective THE_REQUEST “/../../ ”
SecFilterSelective THE_REQUEST “&highlight=%2527%252E ”
SecFilterSelective THE_REQUEST “changedir=%2Ftmp%2F.php ”

# Very crude filters to prevent SQL injection attacks
SecFilter “delete[[:space:]]+from”
SecFilter “insert[[:space:]]+into”
SecFilter “select.+from”

# Weaker XSS protection but allows common HTML tags
SecFilter “<[[:space:]]*script"

# Prevent XSS atacks (HTML/Javascript injection)
SecFilter “<(.|n)+>”

10. Save the file Ctrl + X then Y

11. Restart Apache

/etc/rc.d/init.d/httpd stop
/etc/rc.d/init.d/httpd start

You’ve successfully installed mod_security!

No comments