Author: ashishpsk

WHM: Install SSL certificate for Hostname

Initially, to install the Let’s Encrypt provider, we run the following command: Once we install the Let’s Encrypt provider, we change the auto SSL provider to Let’s Encrypt from Comodo. To do so, we log in to WHMand go to Manage AutoSSL. Install Self-Signed Certificate to Hostname. 1) Here, we log in to WHM as

Read more

Cleanup a /var/log/journal

We can delete everything inside of /var/log/journal/* but do not delete the directory itself. You can also query journalctl to find out how much disk space it’s consuming: You can control the size of this directory using this parameter in your You can force a log rotation: You might need to restart the logging service to force a log

Read more

Detecting access breaches:

Check who is logged in (and where from) w, the hacker might be logged in and working as you speak. Take note of the usernames used and their IP location. Most likely if they’ve gotten this far, they’ve gained root access. Do NOT try to kick them out just yet! You don’t know how much access they

Read more

Find the files that have been changed in the last 24 hours

To find all files modified in the last 24 hours (last full day) in a particular specific directory and its sub-directories: The - before 1 is important – it means anything changed one day or less ago. A + before 1would instead mean anything changed at least one day ago, while having nothing before the 1would have meant it was changed exacted one

Read more

How do I get the path of a process in Linux

On Linux, the symlink /proc/<pid>/exe has the path of the executable. Use the command readlink -f /proc/<pid>/exe to get the value. You can find the exe easily by these ways: pwdx <PID> gave me the location of the symbolic link so I could find the logs and stop the process in proper way This command will fetch the process path

Read more

12 Critical Linux Log Files You Must be Monitoring

The log files generated in a Linux environment can typically be classified into four different categories: Application Logs Event Logs Service Logs System Logs /var/log/messages This log file contains generic system activity logs.It is mainly used to store informational and non-critical system messages.In Debian-based systems, /var/log/syslog directory serves the same purpose. /var/log/auth.log All authentication-related events

Read more

Detecting outbound attacks:

Check outbound connections: If you only want outbound tcp connections, I think you can use That will show all connections whose destination is not your localhost. You can add your internal ip, say netstat -nputw should do the trick. Add c for continuous updating. To capture the RAW packets This will capture all the raw packets,

Read more

Detecting inbound attacks:

Server running slow – this is an obvious sign you might getting hacked. Especially if you haven’t changed anything else on the site and traffic is still the same. Check for high server (CPU) load grep processor /proc/cpuinfo | wc -l. Unnecessary if your webhosting control panel already has a GUI for this. Anything at or above

Read more

Identify the Bad Process

I have a process named “stealth” that has infected my server (slamming my CPU) To get a list of all current active connections, you can use the netstatcommand: With the -a parameter, we tell the command to show all connections(including the LISTENING ones), instead of only those who are connected. The -n parameter shows the different port numbers used Now, to find out

Read more

How to check MySQL database and table sizes

To check the sizes of all of your databases, at the mysql> prompt type the following command: To check the sizes of all of the tables in a specific database, at the mysql> prompt, type the following command. Replace database_name with the name of the database that you want to check: To View The MySQL/MariaDB Database Size In Linux: Use the

Read more