cPanel Installation

CPanel installation is quite easy:

1) Login to the server with root access

2) wget http://layer1.cpanel.net/latest

3)sh latest

After this slow down your back on chair comfortably as the installation will take 30-45 min. You can watach the installation if any error occured.

CSF Installlation on cPanel Server

Installation is quite straightforward:

Login as the root user to SSH and run the following commands.
rm -fv csf.tgz
wget http://www.configserver.com/free/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh

If you would like to disable APF+BFD (which you will need to do if you have
them installed otherwise they will conflict horribly):
sh disable_apf_bfd.sh
That's it. You can then configure csf and lfd in WHM, or edit the files
directly in /etc/csf/*

Installation Completed
Don't forget to:
1. Configure the TCP_IN, TCP_OUT, UDP_IN and UDP_OUT options in the csf configuration to suite your server
2. Restart csf and lfd
3. Set TESTING to 0 once you're happy with the firewall
csf is preconfigured to work on a cPanel server with all the standard cPanel
ports open. It also auto-configures your SSH port if it's non-standard on
installation.
You should ensure that kernel logging daemon (klogd) is enabled. Typically, VPS
servers have this disabled and you should check /etc/init.d/syslog and make
sure that any klogd lines are not commented out. If you change the file,
remember to restart syslog.
Now - login to your cPanel server's WHM as root and go to the bottom left menu. If already logged in then reload the page. In Plugins - you will see:  ConfigServer Security&Firewall
The firewall is STOPPED by default - it is not running. We need to configured it, and then take it out of Test Mode.

Click on Firewall Configuration

ETH_DEVICE =: Set this to eth+

TCP_IN/TCP_OUT/UDP_IN/UDP_OUT = : These are the ports you want to leave open for your server to operate. If you change the default SSH port make sure to add it here. Also add any other services you might have running such as Shoutcast or game servers. By default most of the ports used should already be configured.


MONOLITHIC_KERNEL = : 0 Only change this to 1 if your firewall will not start - otherwise leave it as it.


LF_DSHIELD = 0: Change this option to 86400. This is an automatic updated list of known attacking IPs. Enabling this will stop them from being able to connect to your server.

Spam Protection AlertsIf you want to add some spam protection, CSF can help. Look in the configuraiton for the following:

LF_SCRIPT_ALERT = 0 change this to 1. This will send an email alert to the system administrator when the limit configured below is reached within an hour.

LF_SCRIPT_LIMIT = 100 change this to 250. This will alert you when any scripts sends out 250 email messages in an hour.


Configuration Complete - AlmostScroll down to the bottom and click on Change to save the settings. Then click Restart csf+lfd

You should see a big page of ACCEPT and near the bottom you should see:

csf: TESTING mode is enabled - don't forget to disable it in the configuration
Starting lfd:[  OK  ]
Click on Return

Now TEST all your services to make sure everything is working - SSH, FTP, http. After you do a few quick tests go back into the Firewall Configuration page.
TESTING = 1 change this to 0 and click Change at the bottom. Then Restart csf+lfd


That's it, the firewall is successfully installed and running!!
Firewall Status: Running - you should see this on the main CSF page in WHM.

Catching spammer on cpanel server

If mass mailing or spamming is going on cPanel server then you can trace the spammer with follwoing commands:

1 ) pidof exim

2) Belwo command will show you the no of emails sent by perticular domain:

exim -bp | exiqsumm | more

3)

exim -bpr | grep "<*@*>" | awk '{print $4}'|grep -v "<>" | sort | uniq -c | sort -n

That will show you the maximum no of email currently in the mail queue have from or to the email address in the mail queue with exact figure.

4)

exim -bpr | grep "<*@*>" | awk '{print $4}'|grep -v "<>" |awk -F "@" '{ print $2}' | sort | uniq -c | sort -n

That will show you the maximum no of email currently in the mail queue have for the domain or from the domain with number.

5)

Check if any php script is causing the mass mailing with

cd /var/spool/exim/input

egrep "X-PHP-Script" * -R

Just cat the ID that you get and you will be able to check which script is here causing problem for you.

Exim Server Commands

How to check emails in mail queue?

exim -bpc

How to check full status of exim server?

eximstats -nr -ne /var/log/exim_mainlog

How to check exim pids running?

pidof exim

 

How to check frozen emails?

 exim -bpr | grep frozen | wc -l

How to delete frozen emails?

exiqgrep -z -i | xargs exim -Mrm

How to check mails sent per domain?

exim -bp | exiqsumm | more

   

Security Logs

Authentication attempts:

Location : /var/log/secure

Description : Logs all daemons which requires PAM Authentication.


Tracking all Bad Logins and Logouts:

Location : /var/log/btmp

Description : Log of all attempted bad logins to the system. Accessed via the lastb command..

Tracking all Logins and Logouts:

Location : /var/log/wtmp

Description : The wtmp file records all logins and logouts.


Last Logins:

Location : /var/log/lastlog

Description : Database times of previous user logins. The lastlog file is a database which contains info on the last login of each user.


WebDav or WebDisk Log :

Location : /usr/local/cpanel/logs/cpdavd_error_log

Description : The cpdavd daemon is "WebDav" (better known as "WebDisk") which was introduced in cPanel 11 to allow users to mount their home directory on their personal computer, always having access to the files and content...


Cphulkd Logs:

Location : /usr/local/cpanel/logs/cphulkd_errors.log

Description : cPHulk Brute Force Protection prevents malicious forces from trying to access your server's services by guessing the login password for that service....
It blacklists IPs that it thinks are trying to run a brute force attack.


Failure Logging:

Location : /var/log/faillog

Description : Faillog formats the contents of the failure log from /var/log/faillog database. It also can be used for maintains failure counters and limits. Run faillog without arguments display only list of user faillog records who have ever had a login failure.


Startup/Boot, Kernel & Hardware error messages :

Location : /var/log/dmesg

Description : dmesg is a "window" into the kernels ring-buffer. It's a message buffer of the kernel. The content of this file is referred to by the dmesg command. It shows bootlog and the hardware errors..

Mysql Logs

MySQL General Information and Errors :

Location : /var/lib/mysql/$(hostname).err

Description : This path could vary, but is generally located in /var/lib/mysql. Could also be located at /var/log/mysqld.log

Mysql Slow Queries:

Location : /var/log/mysql-slow.log

 Description : These logs are only available if slow logs queries are enabled in my.cnf as well this   path cold vary but generally located in /var/log/

FTP Logs

FTP Logins and General Errors:

Location : /var/log/messages

Description : General information and login attempts are logged here..


FTP Transactions logging:

Location : /var/log/xferlog or /var/log/messages

Description : Is a symbolic link in most cases to /usr/local/apache/domlogs/ftpxferlog, which contains a history of the transactions made by FTP users...

Exim Logs

Message Reception and Delivery:

Location : /var/log/exim_mainlog or /var/log/exim/mainlog

Description : Receives an entry every time a message is received or delivered.


Exim ACLs/Policies based RejectLog :

Location : /var/log/exim_rejectlog

Description : An entry is written to this log every time a message is rejected based on either ACLs or other policies eg: aliases configured to :fail


Unexpected or Fatal Errors:

Location : /var/log/exim_paniclog

Description : Logs any entries exim doesn’t know how to handle. It's generally a really bad thing when log entries are being written here, and they should be properly investigated..


IMAP/POP/SpamAssassin General Logging and Errors:

Location : /var/log/maillog & /var/log/messages

Description : The IMAP, POP, and SpamAssassin services all log here. This includes all general logging information (login attempts, transactions, spam scoring), along with fatal errors.

Apache Logs

General Error and Auditing Logs:

Location : /usr/local/apache/logs/error_log

Description : All exceptions caught by httpd along with standard error output from CGI applications are logged here..
The first place you should look when httpd crashes or you incur errors when accessing website.


Apache SuExec Logs:

Location : /usr/local/apache/logs/suexec_log

Description : Auditing information reported by suexec each time a CGI application is executed. Useful for debugging internal server errors, with no relevant information being reported to the Apache error_log, check here for potential suexec policy violations...


Domain Access Logs:

Location : /usr/local/apache/domlogs/domain.com

Description : General access log file for each domain configured with cPanel.


Apache Access Logs:

Location : /usr/local/apache/logs/access_log

Description : Complete web server access log records all requests processed by the server.

cPanel-WHM Logs

cPanel/WHM Initial Installation Errors:

Location : /var/log/cpanel*install*

Description : These log files contain cPanel installation logs & should be referenced first for any issues resulting from new cPanel installations..

Cpanel/WHM Service Status Logs:

Location : /var/log/chkservd.log

Description :The service monitoring demon (chkservd) logs all service checks here. Failed service are represented with a [-] and active services are represented by [+]. 

Cpanel/WHM Accounting Logs:

Location : /var/cpanel/accounting.log

Description : Contains a list of accounting functions performed through WHM, including account removal and creation.. 

cPanel error logs:

Location : /usr/local/cpanel/logs/error_log

Description : cPanel logs any error it incurs here. This should be checked when you encounter errors or strange behavior in cPanel/WHM... 

cPanel License Error Logs:

Location : /usr/local/cpanel/logs/license_log

Description : All license update attempts are logged here. If you run into any errors related to license when logging in, check here. 

Stats Daemon Logs:

Location : /usr/local/cpanel/logs/stats_log

Description : The stats daemon (cpanellogd) logs the output from all stats generators (Awstats, Webalizer, Analog) here. 

Client Information, Requested URL Logs:

Location : /usr/local/cpanel/logs/access_log

Description : General information related to access cPanel requests is logged here. 

cPanel/WHM Update Logs:

Location : /var/cpanel/updatelogs/update-[TIMESTAMP].log

Description : Contains all output from each cPanel update [upcp]. It's named with the timestamp at which the upcp process was initiated.. 

Bandwidth Logs:

Location : /var/cpanel/bandwidth

          Description : Files contain a list of the bandwidth history for each account. Each named after their respective user. 

Tailwatchd [New]:

Location : /usr/local/cpanel/logs/tailwatchd_log

Description : Logs for daemon configuired under tailwatchd ie. cPBandwd, Eximstats, Antirelayd. 

How to Change SSH port on cPanel Server

As far as security concern its a good deal to change the SSH port of your server, simply you need to follow the steps:

1) SSH to the server with root login

2) You need to make sure that the port you are going to assgin is opened at firwall (in case of CSF, APF):

CSF :
#pico /etc/csf/csf.conf

search for the line : TCP_IN

add the port

APF:
#pico /etc/apf/apf.conf

search for the line : TCP_IN

add the port

3) Now save the changes .

4) You need to change the ssh port in sshd_config File

# pico /etc/ssh/sshd_config

search for Port 22

Uncommnet the line and replace the port and save the file

5) Now it needs to restart ssh service

#/etc/init.d/sshd restart

Note :  Dont close your current ssh seesion until you confirm that you are able to login to the server wtih new port in another ssh session.


Thast's

How to configure remoe backup through WHM

You can specify how often backups occur and where backups are placed - either on the same server or on a separate backup drive. You can also specify the specific parts of the backup process that are enabled.

The following describes backup interval options available to you through WHM:

• Daily - cPanel and WHM performs separate daily, weekly, and monthly backups.
• Weekly - cPanel and WHM performs separate weekly and monthly backups.
• Monthly - cPanel and WHM performs only monthly backups.

1. When the page loads, set the following:

• Backup Status - Turns the automatic backup function on or off. You have the following options available to you:
   
• Enabled
• Disabled
• Restore Only - Allows site restoration from old backups to occur, but does not create new backups.
   
• Backup Interval - Specify the interval used by the backup process. (Note: Selecting Daily Backup with give you monthly and weekly as well unless you choose not to retain them in the "Backup Retention" setting below. Selecting Weekly backup will give you monthly as well unless you choose not to retain them in the "Backup Retention" setting below.) You have the following options available to you:
   
• Daily
• Weekly
• Monthly
   
• Backup Retention - See "Note:" in the "Backup Interval" setting above.
   
• Days to run backup - Click on the check boxes associated with the days of the week you want to run backups. You can choose all seven days or select only the days specific to your needs.
   
• Remount/Unmount backup drive - Mounts and unmounts the backup drive when a backup is created. This requires a separate drive mount to operate. (Note: requires a separate drive/coda/nfs mount.) Your choices include:
   
• Enabled
• Disabled
   
• Bail out if the backup drive cannot be mounted - Stops the backup if the drive can not be mounted. Recommended if the Remount/Unmount backup drive option is enabled. Your choices include:
   
• Enabled
• Disabled
   
• Incremental Backup - Backup process only copies what has changed since the last backup. This creates a much smaller backup file, but changes are gradual and the backup files are not compressed. Not compatible w/ftp backups. Your choices include:
   
• Enabled
• Disabled
   
• Backup Accounts - Backup process copies all account information for your customers. Your choices include:
   
• Enabled
• Disabled
   
• Backup Config Files - Includes config files in the backup process. Your choices include:
   
• Enabled
• Disabled
   
• SQL Databases - Includes MySQL databases in the backup process. You can choose to backup up databases in separate accounts, the master MySQL directory, or both. Your choices include:
   
• Per Accounts Only
• Per Accounts and Entire
• Mysql Dir
• Mysql Dir Only
   
• Backup Raw Access Logs - Includes the Apache raw access logs in the backup. Your choices include:
   
• Enabled
• Disabled
   
• Backup Type - Select what type of backup you need. Your choices include:
   
• Remote Ftp Server (Accounts Only)
• Standard
   
• FTP Backup Host (Remote Ftp Backup Only) - Enter the domain name of the FTP backup host in the text box provided (only required if Remote FTP Server is enabled). (If the FTP port is different on remoteFTP server, then you need to metnion it EX : 192.168.1.2 : 2021 where 2021 is the ftp port) 
• FTP Backup User (Remote Ftp Backup Only) - Enter the user name to use on the FTP backup host in the text box provided (only required if Remote FTP Server is enabled).
   
• FTP Backup Pass(Remote Ftp Backup Only) - Enter the password to use on the FTP backup host in the text box provided (only required if Remote FTP Server is enabled).
   
• Ftp Backup Directory/Path - [optional, a directory called cpbackup in the ftp account's directory root will be used if none specified examples: /home/fred/cpbackup,/backup/cpbackup,/files/cpbackup] (Remote Ftp Backup Only)
   
• Use Passive mode for Ftp transfers - (required if you are behind a firewall or ftp backups fail) Your choices include:
   
• Enabled
• Disabled
   
• Backup Destination - Enter the location of backups in the text box provided. This should be a dir/NFS/coda mount with at least twice the space of all your /home* partitions.
  
  WARNING: Do not set this to your /home directory.
   
• Select Specific Users - Click on the "Select >>" button to select user accounts you want these configuration settings to apply. A new window will open listing two columns containing the following:
   
• Backup User - The username of the account.
• Domain - The domain of the account.
  
  By default, all check boxes are checked. If you do not want these backup configuration settings to apply to a particular user or account, click on the associated check box.
  
  When you have finished selecting the users you want the backup configuration settings to apply, click on the "Save" button at the bottom of the new pop-up window.

2. When you are finished configuring the settings above, click on the "Save" button.

3. You should a confirmation statement similar to the following:

"Backup Configuration Saved!"

How to disable root login on cPanel server

For security purpose you may disable direct root login and create another ssh user with the privileges, simply you need to follow the steps:

Note : Don't close your current session until you confirm that the with the changes you have made, the server is accessible in another ssh session

1) Create a user say : webadmin

# useradd webadmin

2 ) Set password for webadmin

# passwd webadmin

3) In case of cPanel, you need to add this user to  'wheel group'

WHM >> Security Center >> “Manage Wheel Group Users”

Now the user has been granted su previlages, you need to disable the root login for that you will need to login to the server at shell (command prompt)

1) Edit the SSHD configuration file ‘sshd_config’:

pico /etc/ssh/sshd_config

2) Search the line

PermitRootLogin yes
and change it to
PermitRootLogin no

Once you are complete with the above changes, save the file and exit. You will have to restart the sshd service for the changes to take effect.

# /etc/init.d/sshd restart

Now, you will have to SSH to your server as user ‘webadmin’ and then su to root as follows:

login as: webadmin
webadmin@xx.xx.xx.xx’s password: <webadmin pass here>
[admin@server ~]$ su -
password: <root password here>
[root@server ~]#

Thats't

How To Resolve : Updating cPanel license...Done. Update Failed!

If you are getting this error while updating cPanel license then you need to open a support ticket to cPanel.

-----------------------------------------------------
root@server [~]# /usr/local/cpanel/cpkeyclt
Updating cPanel license...Done. Update Failed!
Building global cache for cpanel...Done
root@server[~]#
-----------------------------------------------------

/home disk space audit on cpanel server

If /home is getting full then you can check for few things:

1) Check if there are suspended accounts if so then check your suspension policy and terminate the accounts by sending notification to the clients.

2) You may also check the users who are using disk space in GB's. List out those users and check exact what data they are storing? sometimes there are core files which takes more space, you may delete those core files.

3) Check if there are backup (archive) files under users home directory, notify the users to download such archive files.

I hope these tricks will be helpful to clear /home 

How to backup Mysql Databases in Cpanel?

Mysql databases can be backed up by following steps 

• 1. Login to cPanel interface >>> Files >>> Backups >>> 
• 2. Underneath where it says "Download a SQL DB Backup", click on the database name that you wish to backup
• 3. Select a place and filename for you to save on to your local computer
• 4. Do NOT attempt to open this file with Winzip.

You have now successfully backed up your Mysql database with Cpanel.
There are other ways to accomplish this task, such as doing a dump from
PhpMyadmin, or doing a dump from the command line, but the cpanel
method is quick and easy.

How to optimize a MySQL database using phpMyAdmin?

It is always a good idea to keep your databases' tables optimized.

Fortunately, making this optimization is quite easy when using the phpMyAdmin tool available in cPanel.

To perform the optimization, log in to your phpMyAdmin and select the database whose tables you wish to optimize.

A list with all the database's tables will appear. Tick the tables you wish to optimize, or simply click [Check All] to select all tables.

From the [With selected:] drop-down menu choose Optimize table. This will execute the OPTIMIZE TABLE SQL query on the selected tables and they will be updated and optimized.

How can I retrieve the raw Apache access logs for my site?

You can retrieve the Raw Access Logs for your site(s) by logging in your cPanel and following the link "Raw Access Logs".

The Error log for your site is kept separately from the Access logs. It can be found by logging in Cpanel and following the link "Error Log"

Webmail Access in cPanel

You can easily access your WebMail interface by just visiting: http://www.yourdomain.com/webmail, where 'yourdomain.com' is your actual domain name. If this is not working for you, it might be possible that your ISP is blocking the access to non-standard ports accessed through SSL connection. In this case, please use: http://webmail.servername.com, where 'servername.com' should be the name of your server

Please use the full e-mail account username to login to the webmail interface or when setting your e-mail client software. Example: user@yourdomain.com instead of user.
Once you login, you can choose between three webmail clients: Horde, SquirrelMail and RoundCube. It is up to you to choose which one you like better.

If you login to your webmail through the Webmail icon on your cPanel main page, you will be logged in with the default system email account.

Please do not use the default email account, because very often emails send from the system email accounts are going to the Junk folders.

In order to use your email you have to create another email account with the same or different username.
To login to one of your added accounts from your cPanel, you should go to Email Accounts and then click the Access Webmail icon next to the account you wish to access. Then you should type in the password corresponding to the account and click on [Login].

How to send e-mail messages via webmail?

You can easily send email messages via the webmail client you have chosen. Just find the [New message] button in Horde, the [Compose] button in Squirrelmail or the [Create a New Message] button in RoundCube and you will be able to start writing your message.

Make sure to SAVE your message if it is too long or you want to write it for a longer period of time. The web mail program may drop the connection and you might lose your email.

Email Functions in cPanle

The Mail area functions allow a user to do many different tasks with email accounts. This includes creating email accounts, removing accounts, forwarding email, etc. The following part of this documentation will familiarize you with the Email Manager features.

E-Mail Options in CPanel

• Email Accounts - allows you to create e-mail accounts, define passwords and quotas for them. You can separately manage the e-mail accounts for a chosen domain.
• WebMail - cPanel webmail allows you to access the webmail programs (Horde, Squirrelmail and RoundCube) included in cPanel. You can read your emails through a web browser.
• SpamAssassin - is an automated email filtering system that attempts to identify spam messages based on the content of the email's headers and body.
• Forwarders - using e-mail forwarders will allow you to send copies of all your messages from one e-mail account to another. You can also send the messages from all the accounts with one domain to the corresponding ones with another domain.
• Auto Responders - setting auto responder emails.
• Default Address - this feature will "catch" all the mails that are sent to an invalid email address for your domain.
• User Level Filtering - here you can manage filters for each user. Each user's filter is processed after the main account filters.
• Account Level Filtering - allows you to manage the filters for the main account. There you can also test the existing filters.
• Import Addresses/Forwarders - allows you to import e-mail addresses or forwarders from Excel spreadsheet files (.xls) or comma-separated values sheet files (.csv).
• MX Entry - you can change the MX records for your domain and define on which server to deliver the messages.