apt get life

Life around technology

You are here: Home / Archives for Linux

Linux servers – using ClamAV to find malware

by

ClamAV is an open source anti-virus program that can be run from the command line, making it incredibly useful for locating any viruses and malware on Linux based servers. Recently someone I’ve previously worked with reported that they’d had reports of abuse originating form one of their servers. Given the quantity of sites, it was difficult to locate any potential vulnerabilities.

1
grep -RPl --include=*.{php,txt} "(passthru|shell_exec|system|phpinfo|base64_decode|chmod|mkdir|fopen|fclose|readfile) *\(" /var/www/

 

Blindly grepping for potentially malicious strings such as “base64_decode” and “exec” was getting tired fast, as these can be legitimately used for some applications. I stumbled across reports that ClamAV works well for locating potential threats

Shell
1
nice -n 19 clamscan ./ -r -i | grep " FOUND" >> possible_exploits.txt

You can then review these files as you see fit, editing the file to remove ones that are false positives. I then run a command to delete the infected files:

1
while read f; do rm $f ; done<$possible_exploits.txt

 

AWSTATS on Debian generating lots of emails

by

On Debian, when you install AWSTATS, it automatically adds a crontab to update the data every 10 minutes. If you’ve not configured your awstats config files correctly, every time the cronjob runs it will generate an error in /var/mail

In order to solve this, or have AWSTATS update on your own schedule simply edit the crontab file it installs to /etc/cron.d/awstats

You should find this line in the file:

1
*/10 * * * * www-data [ -x /usr/share/awstats/tools/update.sh ] && /usr/share/awstats/tools/update.sh

I commented it out with a “#”, incase I wanted to use it later. Alternatively you can delete the file or change the crontab to update whenever you want it to operate.

Fixing Slow SquirrelMail

by

Fixing slow SquirrelMail version 1.4.15.

If you’ve got a large inbox and you’re using SquirrelMail to view it, you may notice page loading times are poor using the default configuration. There is a simple fix that will allow SquirrelMail to load emails using multiple threads and server sorting which means that the performance will improve significantly when accessing your email via a web browser.

Edit your config/config.php file:

1
nano /etc/squirrelmail/config.php

find the lines:

1
2
$allow_thread_sort = false;
$allow_server_sort = false;

and change them to:

1
2
$allow_thread_sort = true;
$allow_server_sort = true;

You need to restart your web server (assuming apache):

1
/etc/init.d/apache2 restart

And then login to your web mail page. With any luck you’ll have noticed a significant performance boost. For further performance tuning information see the SquirrelMail website guide at: http://www.squirrelmail.org/docs/admin/admin-6.html

Recommended starter hosting providers for 2014

by

These are my recommended hosting providers of 2014, all of whom offer Linux machines running Ubuntu or Debian:
Linode offer a wide range of VPS solutions in multiple locations. They have a good community behind them with some great tutorials. Their control panel makes things easy to manage too. There are pay-more additions like load balancers so if you think you’re going to grow your sites quickly or get lots of traffic it’s worth going with them as a more mature hosting provider.

Digital Ocean have been making a big name for themselves in the past year. Their machines are much faster than a traditional VPS as they’re an SSD only hosting provider, so no old spinning disks to slow things down. They have a wide range of tutorials and Q&A sections on their site which are growing rapidly. The web interface is easy to use, but I’m not too keen on the spin-up process yet as they insist on providing you a password via email.

Bytemark offer a cloud platform similar to both Linode and Digital Ocean. They’re a smaller team based in the UK and the platform is still maturing, but Bytemark are always my first port of call for hosting services. They sponsor many open source events and projects, and even offer hosting to the Debian project.

Speed up Apache Websites with Expires Headers

by

Page speed can be a big issue for site owners, developers and systems administrators alike. There are many things you can do at an application level to improve performance, but that takes a long time to review, write, test and implement. What about the quick gains, the things you can do quite easily that will improve performance? Well it turns out that you can speed up an Apache based webserver by simply enabling a module: expires headers.

Expires headers are part of the the computer code that gets exchanged when you access a page. You browser requests a page by sending a request to it, and the server responds with information indicating what it is that has been returned. As part of this response there’s a section called “Expires”. This indicates when the content that has been accessed on the website is going to “expire”. To understand this a bit better, you need to know that when a website’s content is loaded, it’s downloaded to your computer to be rendered in your browser. Once the site is on your screen, if expires headers are not set, each time you load the site it’s going to be downloaded again. This is a performace hit to you, your internet connection and your computer. Expires headers tell the computer to store content temporarily (“Cache” the content) on your computer. When you visit the site again in 5 minutes, if expires headers are set correctly, you’ll only download part of the information on the page.

So what should be cached? Well, here’s what content types I tend to set expires headers on:

  • Images (jpg, png, gif)
  • CSS
  • Javascript
  • content such as mp3, mov, mp4 and others that don’t change regularly

How do you do it? You can Speed up websites that operate on Apache using mod_expires. This is really simple to setup and configure if you know how to configure sites on the command line.

Enable the module

1
a2enmod expires

Edit the configuration file. This can be done in either /etc/apache2/sites-enabled/mysite.conf or /etc/apache2/mods-enabled/expires.conf. The virtualhost configuration file will enable it for a single site, the mods-enabled configuration file will enable it for all sites. Choose one and edit it with a command line text editor like nano. Enter the following:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
          ExpiresActive on
 
          ExpiresByType image/jpg "access plus 30 days"
          ExpiresByType image/png "access plus 30 days"
          ExpiresByType image/gif "access plus 30 days"
          ExpiresByType image/jpeg "access plus 30 days"
 
          ExpiresByType text/css "access plus 7 days"
 
          ExpiresByType image/x-icon "access plus 1 month"
 
          ExpiresByType application/pdf "access plus 1 day"
          ExpiresByType audio/x-wav "access plus 1 month"
          ExpiresByType audio/mpeg "access plus 1 month"
          ExpiresByType video/mpeg "access plus 1 month"
          ExpiresByType video/mp4 "access plus 1 month"
          ExpiresByType video/quicktime "access plus 1 month"
          ExpiresByType video/x-ms-wmv "access plus 1 month"
          ExpiresByType application/x-shockwave-flash "access 1 month"
 
          ExpiresByType text/javascript "access plus 1 week"
          ExpiresByType application/x-javascript "access plus 1 week"
          ExpiresByType application/javascript "access plus 1 week"

Now restart or reload apache to apply the configuration

1
service apache2 restart

You can see from the code that the expires time has been set by content type. Each is different, depending on how often it’s expected to change and how big the file types are going to be. For example – a movie file is unlikely to change frequently, but is likely to be large, so if it’s got an expires header telling the browser to store it locally for up to 1 month after the date on which it was first accessed it. This makes the site faster to load. Now when someone loads a site on your server, it will store content after the initial page load and reduce subsequent loading time.

 

For further information on improving page speed you can check out Yahoo’s excellent article here: https://developer.yahoo.com/performance/rules.html

Why not checkout the Firefox and Chrome plugin “YSlow” which checks a range of potential speed issues and offers solutions:

Google also has some useful tools and guides which can be found here: https://developers.google.com/speed/

Moz also has a brief article on the subject here: http://moz.com/blog/15-tips-to-speed-up-your-website