How to install maldet in linux server !

Maldet also known as Linux Malware Detect virus scanner for Linux.

Go to the below path:

    cd /usr/local/src/

Download the tar file using the below link:

    wget http://www.rfxn.com/downloads/maldetect-current.tar.gz

Extract the file using the below command:

    tar -xzf maldetect-current.tar.gz

go to the maldet folder:

    cd maldetect-*

Now, run the below command to install maldet:

    sh ./install.sh or sudo sh ./install.sh

It will give below output:

    Linux Malware Detect v1.3.4
    (C) 1999-2010, R-fx Networks
    (C) 2010, Ryan MacDonald
    inotifywait (C) 2007, Rohan McGovern
    This program may be freely redistributed under the terms of the GNU GPL

    installation completed to /usr/local/maldetect
    config file: /usr/local/maldetect/conf.maldet
    exec file: /usr/local/maldetect/maldet
    exec link: /usr/local/sbin/maldet
    cron.daily: /etc/cron.daily/maldet

    maldet(32517): {sigup} performing signature update check…
    maldet(32517): {sigup} local signature set is version 2010051510029
    maldet(32517): {sigup} latest signature set already installed

    

To update the maldet use the below commands:

    maldet –update-ver

    maldet –update[/i]

To scan the files:

    maldet -a /home/username/

It will scan all the files and provide you the output:



To scan all user uder public_html paths under /home*/ this can be done with:

    root@server[~]# maldet –scan-all /home?/?/public_html

To scan the same path but the content that has been created/modified in the last 5 days:

    root@server[~]# maldet –scan-recent /home?/?/public_html 5

To scan but forget to turn on the quarantine option, you could quarantine all malware results from a previous scan with:

    root@server[~]# maldet –quarantine SCANID

If you wanted to attempt a clean on all malware results from a previous scan that did not have the feature enabled, you would do with:

    root@server[~]# maldet –clean SCANID

If you had a file that was quarantined from a false positive or that you simply want to restore (i.e: you manually cleaned it), you can use the following:

    root@server[~]# maldet –restore config.php.2384
    root@server[~]# maldet –restore /usr/local/maldetect/quarantine/config.php.2384

 

Unsuspending Bandwidth Limit Exceeded user/domain

Hello,

If domain is giving the error of "Bandwidth Limit Exceeded" you can unsuspend it from WHM or terminal as well.

From WHM :

To bring the website back online or un-suspend the bandwidth exceed-er, use the option
WHM >> Account Functions >> Unsuspend Bandwidth Exceeders >> click “Proceed”.

This will reset the bandwidth usage to zero for the account. To increase the bandwidth limit for the account, use the option

WHM >> Account Information >> “View Bandwidth Usage”

From Shell :

vi /var/cpanel/users/USERNAME
change BWLIMIT (Increase the value)
/scripts/updateuserdomains
cd /var/cpanel/bwlimited/

remove the files related to that user or domain 
OR
rename the fies with suffix _bk
e.g.; 
user_bk
domainname.com_bk
www.domainname.com_bk

This will bring the website back online..

How to reset bandwidth for a domain in WHM/CPANEL using Shell !!!

You can follow below steps to reset bandwidth of a Domain in cpanel server through Shell :

************************************************

    ssh to your server
    cd /var/cpanel/bandwidth.cache/
    vi domainname.com and/or vi username
    replace contents with 0
    save and quit

************************************************

How insecure is SNMP protocol !!

SNMP itself does not define which information (which variables) a managed system should offer. Rather, SNMP uses an extensible design, where the available information is defined by management information bases (MIBs). MIBs describe the structure of the management data of a device subsystem; they use a hierarchical namespace containing object identifiers (OID).

SNMP is based on the manager/agent model consisting of an SNMP manager, an SNMP agent, a database of management information, managed SNMP devices and the network protocol.SNMP was derived from its predecessor SGMP (Simple Gateway Management Protocol) and was intended to be replaced by a solution based on the CMIS/CMIP (Common Management Information Service/Protocol) architecture. This long-term solution, however, never received the widespread acceptance of SNMP.

SNMP traps obviously contain information specific to the SNMP protocol such as Enterprise ID, Generic Trap and Specific Trap. Since SNMP is a UDP-based protocol and messages can therefore be lost, SNMP traps should be avoided where events can be received through other mechanisms such as log file encapsulation.

Summary:

• Not very secure
• SNMP version 2 is addressing this
• Extended security is possible with current protocol (example: DES and MD5)
• Does not reduce its power for monitoring

How insecure is SNMP protocol !!

SNMP itself does not define which information (which variables) a managed system should offer. Rather, SNMP uses an extensible design, where the available information is defined by management information bases (MIBs). MIBs describe the structure of the management data of a device subsystem; they use a hierarchical namespace containing object identifiers (OID).

SNMP is based on the manager/agent model consisting of an SNMP manager, an SNMP agent, a database of management information, managed SNMP devices and the network protocol.SNMP was derived from its predecessor SGMP (Simple Gateway Management Protocol) and was intended to be replaced by a solution based on the CMIS/CMIP (Common Management Information Service/Protocol) architecture. This long-term solution, however, never received the widespread acceptance of SNMP.

SNMP traps obviously contain information specific to the SNMP protocol such as Enterprise ID, Generic Trap and Specific Trap. Since SNMP is a UDP-based protocol and messages can therefore be lost, SNMP traps should be avoided where events can be received through other mechanisms such as log file encapsulation.

Summary:

• Not very secure
• SNMP version 2 is addressing this
• Extended security is possible with current protocol (example: DES and MD5)
• Does not reduce its power for monitoring