Change outbound connections IP for Mail

Hello admins, the server will start to send the Spam mails due to malicious code or compromised mailbox. In that case, our outgoing IP address will get blocked by several spam filters including Gmail and other mail services.

In this case, we have to wait for a long time to get whitelisted or have to pay to be whitelisted. But if you have secondary IP addresses for your server, we can do this trick to send emails and let the main IP to whitelist automatically.

This means we will change to outbound connections from the main IP to the secondary IP address.

Important: Before proceeding with this, make sure that you have fixed the compromised code or application or mailbox. Else, your secondary IP address will also get blocked on Spam filters.

Default IP for outgoing connections can be set using ‘ip’ utility.

First of all, check how routing is configured on the server:

You can check this by the following command: -

# /sbin/ip route

159.8.30.64/28 dev bond1 proto kernel scope link src 159.8.30.66

10.105.124.128/26 dev bond0 proto kernel scope link src 10.105.124.130

169.254.0.0/16 dev bond0 scope link metric 1006

169.254.0.0/16 dev bond1 scope link metric 1007

10.0.0.0/8 via 10.105.124.129 dev bond0

default via 159.8.30.65 dev bond1

If no ‘src’ listed in ‘ip’ output for the default route, then the main IP on the interface is used for outgoing connections. You can change it using:

# /sbin/ip route change default via 159.8.30.65 dev bond1 src 5.153.43.25

Now:

# /sbin/ip route

192.168.50.0/24 dev eth1 proto kernel scope link src 192.168.50.53

169.254.0.0/16 dev eth1 scope link

default via 192.168.50.254 dev eth1 src 192.168.50.100

Note: be careful, if you set the wrong IP as the source, you lose the connection to the server.

Find and clear log files in Linux

Objective:

Find and clear the files with extension of *.log, usually log files.

Commands:

find . -type f -iname *.log -exec tee {} \; </dev/null

This command will find the files with extension of 'log' and empty that file. Which means file will be there and data of that file will be cleared.

If you are using cPanel, there will be a directory called "virtfs", in that case you can use following command.

find /home -type f -iname *.log -not -path "./virtfs/*" -exec tee {} \; </dev/null

Please note, in WHM / cPanel server, this will clear logs including created by server.

So, If you need to do this manually for specific file, you can simply use any of following commands,

# > file.name

# :> file.name

# true > file.name

# echo "" > file.name

# echo  > file.name

# dd if=/dev/null of=logfile

# dd if=/dev/null > logfile

Still there are several methods to clear it.

Connect MS-SQL Database on PHP under Ubuntu-18.04

I can see that several tutorials available over Internet for "Connecting Ms SQL by PHP code on Ubuntu 18.04", But as much as I saw, non of the mention about a small thing that plays important role in this. Here it is,

Let's see how to configure,

Requirements:
1. MS SQL 2017 STD (I've tested with 2014 Express too, It's working fine.)
2. Apache2 with PHP 7.2 (I'm not sure about previous versions, but as per my search, it'll work well on other versions too.)

1. Steps to install Microsoft ODBC Driver for SQL on Ubuntu:

sudo su -l

curl https://packages.microsoft.com/keys/microsoft.asc | apt-key add - 

#Change OS version based on yours, 16.04 or 18.04 as per your need.

curl https://packages.microsoft.com/config/ubuntu/18.04/prod.list > /etc/apt/sources.list.d/mssql-release.list

apt update
apt -y install msodbcsql17
apt -y install unixodbc-dev mssql-tools

Detailed steps for other operating systems and versions are located at,
https://docs.microsoft.com/en-us/sql/connect/odbc/linux-mac/installing-the-microsoft-odbc-driver-for-sql-server?view=sql-server-2017

2. Installing and configuring sqlsrv and pdo_sqlsrv for PHP

apt -y install php-pear php-dev
pecl install sqlsrv
pecl install pdo_sqlsrv

echo "extension=sqlsrv.so" > /etc/php/7.2/mods-available/sqlsrv.ini
echo "extension=pdo_sqlsrv.so" > /etc/php/7.2/mods-available/pdo_sqlsrv.ini

#This may vary based on php version and loaded php conf.
ln -s /etc/php/7.2/mods-available/sqlsrv.ini /etc/php/7.2/apache2/conf.d/20-sqlsrv.ini
ln -s /etc/php/7.2/mods-available/pdo_sqlsrv.ini /etc/php/7.2/apache2/conf.d/20-pdo_sqlsrv.ini

3. Checking connection to the SQL Server with sqlcmd:

#Configuring sqlcmd on profile,

echo 'export PATH="$PATH:/opt/mssql-tools/bin"' >> ~/.bash_profile
echo 'export PATH="$PATH:/opt/mssql-tools/bin"' >> ~/.bashrc
source ~/.bashrc

# Structure for sqlcmd connection test,

sqlcmd -S {ServerNmae\InstanceName} -U {UserName} -P {Password}

example:
sqlcmd -S MYSQLSERVER\SQL2017STD -U kumar_test_usr -P MySeurePassword

But, It doesn't work for me and throws error like,

Sqlcmd: Error: Microsoft ODBC Driver 17 for SQL Server : Login timeout expired.
Sqlcmd: Error: Microsoft ODBC Driver 17 for SQL Server : TCP Provider: Error code 0x2AF9.
Sqlcmd: Error: Microsoft ODBC Driver 17 for SQL Server : A network-related or instance-specific error has occurred while establishing a connection to SQL Server. Server is not found or not accessible. Check if instance name is correct and if SQL Server is configured to allow remote connections. For more information see SQL Server Books Online..

After some investigations, I found that the problem with port of the SQL server and Named Instance.

The default port of the SQL server (1433) doesn't work here. You should have to mention port of the SQL

So, First you have to find the port, which is located at your SQL Server Configuration Manager

SQL Server Network Configuration -> Protocol for SQL2017STD {This will be your Instance Name}

TCP/IP - > Right click and Enable it, If it's disabled.
TCP/IP - > Right click and go to Properties, Under the IP Address tab, Go to the end, Check out the Port mentioned in TCP Dynamic Ports or you can specify your port on TCP Port.

We going to use this port for connection.

As we are using Named Instance, we should mention "\\" instead of "\" in connection string, the final command will be like as mentioned below,

sqlcmd -S MYSQLSERVER\\SQL2017STD, 55042 -U kumar_test_usr -P MySeurePassword

If you are not have access to find the port, you can use nmap to find it,

4. Checking connection to the SQL Server with php:

PHP code for check the connection,

<?php
$serverName = "MYSQLSERVER\\SQL2017STD, 55042";
$connectionInfo = array( "Database"=>"kumar_test_delete", "UID"=>"kumar_test_usr", "PWD"=>"MySeurePassword");
$conn = sqlsrv_connect( $serverName, $connectionInfo);

if( $conn ) {
     echo "Connection established.<br />";
}else{
     echo "Connection could not be established.<br />";
     die( print_r( sqlsrv_errors(), true));
}
?>

disable_functions with Easy Apache 4 and PHP-FPM

Recently I've faced the issue about disable_functions !!!

I need to use 'shell_exec' for one of application with PHP.

By default php will disable some functions with php.ini file with "disable_functions" line.

It will look like,

disable_functions = "exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source"

If you wanna use these functions, you have to remove that function name from disable_functions line on php.ini.

Let's take a look on configurations,

I logged on my WHM and went to "Home »Software »MultiPHP INI Editor", By choosing my php version, I can see the file. Shockingly, disable_functions is empty. If it's empty, then how the function is getting disabled. And verified my php.ini file path. It's too respond same that "disable_functions" with empty value.

So I used phpinfo() in side website and checked. It's showing disable_function is active with 'shell_exec'.

So who is that enabling "disable_functions" field with 'shell_exec'.

Everything fine before upgrading to EA4 with PHP-FPM. So he must be doing these changes.

Yes, once I turn off PHP-FPM for the website. It's working. It's simple solution for single website. But, How to do this globally ? Will update shortly !!!

Edit crontab with VIM

How to change crontab editor from NANO to VIM ?

Usually google searches give following method, But it didn't work for me,

export EDITOR=/usr/bin/vim

crontab -e

or

EDITOR=vim crontab -e

At same time, following is working fine for me.

export VISUAL=/usr/bin/vim

crontab -e

VISUAL=vim crontab -e

cPanel MultiPHP Manager with PHP-FPM

We all know, cPanel is one of best server admin panel. It's best thing is Easy Apache. It is user friendly GUI platform for managing Apache and PHP in WHM panel. cPanel is going to withdraw support for EasyApache 3 (EA3) and asking every user to upgrade EA4.

Recently I've upgraded it, It's too simple process, you can do this with their official tutorial.

But, after upgraded and if you are enabled and using PHP-FPM (FastCGI Process Manager), you may face some slowdown on websites or you may face frequent "This site can't be reached" error message on browser.

This is happens due to max_children size may exceed. That means, the default value of max_children is set to 5 on PHP-FPM. You can trace this issue with below command,

root@server [~]#egrep 'example.*max_children' /opt/cpanel/ea-php56/root/usr/var/log/php-fpm/error.log

the above commend will help to find specific website, where example is domain name without extension and ea-php56 is php version, where it may ea-php70 or ea-php72 or any other based on your php version.

This will give result as mentioned bellow,
[18-Sep-2018 05:34:58] WARNING: [pool example_com] server reached max_children setting (5), consider raising it
[18-Sep-2018 08:28:00] WARNING: [pool example_com] server reached max_children setting (5), consider raising it
[18-Sep-2018 08:44:26] WARNING: [pool example_com] server reached max_children setting (5), consider raising it
[18-Sep-2018 08:44:55] WARNING: [pool example_com] server reached max_children setting (5), consider raising it
[18-Sep-2018 09:31:40] WARNING: [pool example_com] server reached max_children setting (5), consider raising it
[18-Sep-2018 09:57:16] WARNING: [pool example_com] server reached max_children setting (5), consider raising it

If you get result as mentioned above, you may need to adjust max_children value on bellow steps.

WHM Home > Software > MultiPHP Manager

If you are not sure about website name, you can use below command to get all results,

root@server [~]#egrep 'consider raising it' /opt/cpanel/ea-php56/root/usr/var/log/php-fpm/error.log

Finding multiple folders in Linux with single command

Finding multiple folders with single commend on Linux is not a big deal.

I wanna know all temp / tmp and cache folders in websites, that are configured with WHM to exclude from the backup. Here is the command for that,


find /home/*/public_html \( -type d -iname "cache" -or -iname "tmp" -or -iname "temp" \)

To know size of these folders,

find /home/*/public_html \( -type d -iname "cache" -or -iname "tmp" -or -iname "temp" \) -exec du -sh {} \;

Finding files with in date range

Here is the command for find files that was modifed between 1st July 2018 to 20th July 2018 with it's details,

find . -type f -name "*.php" -newermt 2018-07-01 ! -newermt 2018-07-21 -exec ls -l {} \;

Please note, you have to mention next date of till date.

Shell script for read line from text file

My need:


Read line from the text file by shell script and append few text before and after the line.

Script:

#!/bin/bash
file="/root/scource.txt"
while IFS= read -r line
do
                echo -e "        <User>"
                echo -e "            <Path>$line</Path>"
                echo -e "        </User>"
done <"$file"

cat source.txt

/home/kumar
/home/moulee
/home/admin

Output:
<User>
  <Path>/home/kumar</Path>
</User>
<User>
  <Path>/home/moulee</Path>
</User>
<User>
  <Path>/home/admin </Path>
</User>

Copy all Incoming Outgoing Emails - Employee monitor

How can we monitor employee's email conversations ?

If we are running company, It's too impotent to monitoring employee's email conversations which is traveled by company domain name. If you are using WHM with Exim mail server, it's too easy.

Let's consider "domain.com" is your company domain, you have 50's of mail IDs. You are having a mail ID "monitor@domain.com" and you need to archive / monitor all your mails incoming and outgoing mails to "monitor@domain.com".

To do this, you must have access to server with ssh (root access) and WHM (root access).

1. "/usr/local/cpanel/etc/exim/sysfilter/options" is path where you can store all custom filters.

#cd /usr/local/cpanel/etc/exim/sysfilter/options

2. Create a empty file for store your filter rules. You can create as much of filter as you want, so create a file with understandable name with domain name, replace domain_com to your company domain name.

#vim incoming_outgoing_domain_com

3. Copy paste bellow code to this file and replace "domain.com" to your company domain name and "monitor@domain.com" to your mail that you created for archive all mails,

For incoming mails only,

if ("$h_to:, $h_cc:, $h_bcc" contains "domain.com")
then
     unseen deliver "monitor@domain.com"
endif

For outgoing mails only,

if $sender_address: contains "domain.com"
then
     unseen deliver "monitor@domain.com"
endif

For incoming and outgoing mails,

if ("$h_to:, $h_cc:, $h_bcc" contains "domain.com")
   or ("$sender_address:" contains "domain.com")
then
   unseen deliver "monitor@domain.com"
endif

Note: Forwarding to other domains, outside server won't work.

Device eth0 does not seem to be present, delaying initialization - Virtual Box Error - CentOS 6.6

Hello everyone,

Today I've faced an error on Virtual Box with CentOS 6.6 today, If you are frequently use virtual machines, you'll see these kind of errors. Let's explain my situation.

I've installed and used CentOS 6.6 for python before 2 months, later I've deleted it's account (not files) from Virtual Box because of no frequent use. Today I need to test something on that server. So I've created account and pointed this virtual machine to newly created account.

Once server up, logged to server and tried to ping for check the network. Network not succeeded, when I check IP with ifconfig, I can see only loopback network. "service network restart" says "Device eth0 does not seem to be present, delaying initialization".

Okay, What is solution now ?

Reason for this issue: When we install guest OS with virtual box, It'll assign mac address to it's guest OS's device. But in our case, we have installed guest OS already and it already assigned some mac address. When we create account again and merge guest OS with it, we will get conflict with 2 different mac address. One was created during original installation of guest OS, another one is created during recreate of virtualbox guest OS account.

To fix this,

Login to OS, remove the file as mentioned bellow, which have old mac address.

# rm /etc/udev/rules.d/70-persistent-net.rules

Reboot server, so that new fill will be generated again,

# reboot

Now open the file,
# cat /etc/udev/rules.d/70-persistent-net.rules

It'll look as mentioned bellow,

# This file was automatically generated by the /lib/udev/write_net_rules
# program, run by the persistent-net-generator.rules rules file.
#
# You can modify it, as long as you keep each rule on a single
# line, and change only the value of the NAME= key.

# PCI device 0x8086:0x100e (e1000)
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="08:00:17:ef:c5:08", ATTR{type}=="1", KERNEL=="eth*", NAME="eth0"

Note down the ATTR{address}

open following file

# vim /etc/sysconfig/network-scripts/ifcfg-eth0

Replace mac address which you copied to HWADDR
Remove line with UUID

Now restart the network service,

# service network restart

That's It. Now you can able access network on guest OS.

Increase WordPress URL Length

Hello Guys,

I'm back here after a long period. Today I would like to share the simple trick for WordPress Blogging. If you need to increase URL length in wordpress sites, do following things.

1. On page "wp-includes/formatting.php" find the following line and change the value that mention as Bold

function sanitize_title_with_dashes

$title = utf8_uri_encode($title, 300);

2. In database, find the table and change the value of table field.
wp_post => post_name => varchar 300

============================

Drawback of this setup

Whenever WordPress release update and you update your website, the default setting will be over write.

But, It won't affect the custom URL that you have assigned to the post. So that old URLs may not work until you do the same URL length increasing process.

Installing PHP 5.6 on Ubuntu Server 14.04.4 LTS

Hello Beginners,

Hopefully most of the Sys Admin kids won't consider about LTS (Long Term Support) or EOL (End Of Life) on product.

Every product have it's version and its end of life, you can see about EOL of php by following link.

http://php.net/supported-versions.php
http://php.net/eol.php

As same Ubuntu have

https://wiki.ubuntu.com/LTS

Okay now, why we discuss about it,
Ubuntu 14.04.4 LTS is latest product of Ubuntu which have Long Term Support, PHP 5.5 is php version support by Ubuntu 14.04.4 LTS, that means php in it's EOL. So it's good to install Ubuntu 14.04.4 with PHP 5.6

Normal repo of Ubuntu don't have PHP 5.6, so we can do following steps to install PHP.

$sudo add-apt-repository ppa:ondrej/php5-5.6
$sudo apt-get update
$sudo apt-get install php5
$php5 -v

That's it.

Enabling Modules in PHP5 & Apache2 @ Ubuntu 14.04.4 LTS

Usually beginners of LAMP administrator having trouble to installing and enabling modules of PHP and Apache2

In older days we can do this by config page or by linking modules location to PHP or Apache module enable location, but we can do same with following comments easily, Please note this is advisable if you using Ubuntu repository to install packages.

Enabling module for Apache2

$sudo a2enmod module_name

Ex.

$sudo a2enmod rewrite

Enabling module for PHP5

$sudo php5enmod module_name

Ex.
$sudo php5enmod mcrypt

Postfix mail log with Subject line - Parallel Plesk Panel

We need mail subject in our Logs when we manage several domains with lots of mail IDs for better mail troubleshooting,

For postfix, normally don't have setting for mail log with subject line. But we have do it with simple trick on postfix configuration. Just follow bellow steps, It wont affect any off your mail services, but your log storage will increase some amount.

1. Open your postfix config file with your favoret text editor, mine always vim

vim /etc/postfix/main.cf

2. Find bellow line and un comment it, if commented.

header_checks = regexp:/etc/postfix/header_checks

3. Open file /etc/postfix/header_checks with your editor

vim /etc/postfix/header_checks

4. Add bellow line and save,

/^Subject:/     INFO

5. Restart postfix

service postfix restart

Send mail from your webmail and verify log by following comment. 

tail -f /var/log/maillog | grep Subject

For Plesk,

tail -f /usr/local/psa/var/log/maillog | grep Subject

Note " | grep Subject" used to filter only subject line, you can remove it as per your needs

Import Plesk mails to WHM cPanel mails - vice versa

Before start to the solution, I'll explain my situation,

I've 2 servers with Parallels Plesk - 11.5.30 and WHM - 11.50. Plesk have Postfix mail server and WHM have exim mail server.

My task is to migrate a domain example.com from Plesk installed server to WHM installed server.

Now I've moved files to new server, But how can I move mails from Plesk to WHM. It's really hard thing to do, because both have different mail server.

After lot of reference, I can see that horde will help on this.

Okay, Let's see what is Horde, It is a webmail client, slimier to squirrelmail, roundcube mail etc. It is used to check our mails on server with web interface.

So how it help us to import mails that located in server with Plesk control panel to server with WHM control panel.

Trick

1. How to Enable Horde web-mail on plesk.

Login in to your Plesk control panel, click "Tools & Settings" on left menu, click "Updates and Upgrades" under Panel, new window will open, click Add/Remove Components, on list under "Plesk webmails support" select "Horde web-mail support", if not selected and click remove another one. It'll take few min to install.

2. In WHM control panel, we don't have to do much work because by default there is option to choose our web-mail client.

3. Login in to Horde Web-mail client on plesk server, Right click Inbox, click Export. It'll ask to download file, use default option and click ok.

4. MBOX file will be downloaded.

5. Login to web-mail on WHM server, as same Right click and choose Import. It'll ask for mbox file, choose downloaded file.

6. It'll take few some time based on your mails count and size.

That's it.

Advantages:
It's very quick method to import, no need any configuration changes.

Disadvantages:
It's too hard if we have large amount of mail boxes.

How to overcome from CM Security lock

Hello guys,

It's really crazy thing that my friend faced.

He is having android smartphone with Kit-Kat version. For security, he have installed CM Security, while he play with it, he locked his screen. Forget pattern option also didn't work for him.

He called me and said about his problem, there are some solutions in this case. Most of them ask to do Hard reset. It's good option, if you don't have any important files in phone. Because this option will do factory reset.

Suddenly remembered about a great option on Android OS, Safe-Mode. It will disable all 3rd party applications and login to you phone.

So he just reboot his phone with safemode, removed that application. After that his mobile was work fine. Same trick will work for all 3rd party security applications.

Note these things,

1. This application should installed by you. That means 3rd party.
2. You are unable to overcome from encrypted files, you'll face serious damage on this.
3. This wont work if you locked with Android default security option.

How to do safemode booting on Android,

Just 3 seconds login press power button, you'll "PowerOff menu". Now long touch "PowerOff". It'll ask you to reboot with Safemode.

That's it, enjoy the trick.

Do not hack others phone with this, it's illegal, more than that, you'll loose their trust on you.

Using multiple skype accounts at a time in single system

It's official trick provided by Skype team to run multiple Skype accounts at a time.

Open Run Window by press Windows key + R,

copy paste following line based on your your OS arch

For 32bit OS
"C:\Program Files\Skype\Phone\Skype.exe" /secondary

For 64bit OS
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /secondary

hit enter, Skype application will open

If you’ve changed the installation path for Skype, you need to enter full path for the Skype.exe file.

This will work only on Windows Operating System with desktop installation of Skype.

Clearing RAM cache and SWAP memory in Linux

If your server get hanged, RAM cache is one of the major reason,. It happens frequently on web server when we are under attack or web developer dosen't consider about performance of application. Miss configuration of servers like mysql and apache is one of the main reason.

We can see ram cache amount on htop, which is user friendly monitoring tool for Linux servers. Because of it we may loss some connections and it's interaction with server. We can do this by our own risk.

What is RAM cache ?

It is a portion of memory made of high-speed static RAM (SRAM) instead of the slower and cheaper dynamic RAM (DRAM) used for main memory. Memory caching is effective because most programs access the same data or instructions over and over.

To clear cache :

free -m && sync && echo 3 > /proc/sys/vm/drop_caches && free -m

To clear pagecache change value of echo to 1 on about commend, to clear dentries and inodes change value of echo to 2 on about commend, echo 3 will clear all of three pagecache, dentries and inodes.

To clear swap:

Up-to I know that there is no straight way to this, But we can do it by disable and enable the swap, We can do this by following command,

To turn off : swapoff -a
To turn on : swapon -a 

Finding malware codes on web pages

It is beginners trick, not advised for administrators.

Lot's of tools are available on Linux to find the malware codes injected on server. But most of them not detect the page with url encoded. Because it's php functionality. Mostly of this happens when developer or administrator not aware problem when we providing 777 permissions to pages on web servers. In these cases simple java-script injection will make server to get down.

We can disable this function, urldecode but unfortunately it's bad idea on shared hosting and most of frameworks using url encode and decode. In this case, we can do some manual work for figure-out codes by following commend.

find . -iname '*php' | xargs grep 'urldecode' -sl

This will list the files that have urldecode. We can check page and remove code.