Currently, I’m working on a hardened server using mod_chroot, mod_security and the suhosin extension. I was installing an app that was using fsockopen to check for updates (it’s open source package). Everytime, I would check for updates, I would get an unexpected error displayed to me. Hoping to find more information I took a look… Continue reading PHP’s fsockopen() in mod_chroot

This article is about getting saslauthd working in a chroot’d postfix, but I’ll explain how I got here to start with. I was working on a Gentoo box that has been a slight nightmare for me (actually, complete nightmare). It was built outside of Gentoo portage (basically image’d from another Gentoo box). Because of this,… Continue reading How to get saslauthd to work in postfix chroot environment

During the recent upgrade to 2.6.19 kernel, I ran into a problem with SATA drives. Looks like these options have been brought into a new area of the .config. Not a problem, simple search in the Gentoo forums pointed me in the area where they’re located and I was quickly back in action. But, it… Continue reading Fallback kernel on panic with grub

Today’s major problem was bandwidth. On one of my servers, there is a vhost that is beginning to consume a good chunk of bandwidth on a daily basis. I have daily reports sent to me showing the monthly total of bandwidth used on a per vhost basis. This is handy to see if any of… Continue reading Controlling bandwidth usage with mod_cband or mod_bw on Apache2

Ok. I figured out what the problem was with the preprocessors. Looks like there is a USE flag that needs to be set to bring in the dynamicpreprocessors (+dynamicplugin). Here are the USE flags that I have set: net-analyzer/snort-2.6.1.2 USE="dynamicplugin mysql -flexresp -flexresp2 -gre -inline -linux-smp-stats -odbc -perfprofiling -postgres -prelude -react (-selinux) -sguil -snortsam -timestats"

Today, I needed to upgrade my snort 2.4 install to 2.6. I heard that it’s heavy on the memory usage.. so I wanted to tread softly here. After doing the initial install, I noticed that snort continually complained about preprocessors (ie: ftp_telnet, frag2, smtp, dcerpc and dns). Not sure why it’s not wanting these. I’ll… Continue reading Snort upgrade from 2.4 to 2.6

So I’ve been getting a ton of Stock SPAM which is driving me nuts. The SPAM has been scoring real low, so it get’s through my default cutoff level of 3. I’m currently using a nice virtualmail setup consisting of postfix, courier-imapd, spamassassin, clamd and amavisd-new tying it all together. The setup has been running… Continue reading Spamassassin and stopping stock/investment SPAM

This article discusses how to use Snort and SnortSam to create a intrusion prevention system. Normally Snort is referenced as a IDS Intrusion Detection System, but you can use snort to actually stop attacks on the server. Snort is a very popular application which uses rules to monitor network traffic. If alerts are triggered they… Continue reading Creating a Intrusion Prevention System (IPS) using Snort and SnortSam

This how-to describes a process of creating a tmpfs and swap file system on your existing server, after the partition table has been written. I’ll start off with a little history first. I was presented with a production server where there was only a / root partition and 500MB of swap allocated. We need to… Continue reading Creating tmpfs and swap space after partitions have already been written.

Yesterday, I started the upgrade from mysql-4.1.21 to mysql-5.0.26. I was a little gun-shy and hesitant since the last upgrade from 4.0 to 4.1 caused all sorts of problems with charset, etc. This upgrade was pleasantly easy and pain free. There is a Gentoo MySQL upgrade guide that will be handy for upgrades that involve… Continue reading MySQL Upgrade from 4.1 to 5.0 Done.. and a success!