Google Online Security Blog: Gradually sunsetting SHA-1

Google Online Security Blog: Gradually sunsetting SHA-1

Linux process management

It is always a good practice to find out/categorize processes running on a server based on their cpu and memory (RAM) usage. We can terminate/kill the unwanted processes causing high cpu load or memory consumption.

Here I use the process management application 'ps':

To view all running processes on the system we use

[root@server ~]# ps -aux

These options tell ps to show processes owned by all users (regardless of their terminal association) in a user-friendly format.

a - All processes except both session leaders and processes not associated with a terminal

u - Select by effective user ID (EUID) or name

x - also show processes not attached to a terminal

0 - User defined format

Top 10 cpu consuming processes

 [root@server ~]# ps axo stat,ruser,%cpu,comm,pid,euser | sort -nr | head -n 10

stat - status of the process

ruser - real user

%cpu - percentage of cpu utilized by process.

comm - command

Top 10 memory consuming processes

[root@server ~]# ps axo stat,ruser,%mem,comm,pid,euser | sort -nr | head -n 10

Useful Links -

http://www.cyberciti.biz/faq/show-all-running-processes-in-linux/

http://www.binarytides.com/linux-ps-command/

https://www.digitalocean.com/community/tutorials/how-to-use-ps-kill-and-nice-to-manage-processes-in-linux

PhpMyAdmin and Memcache

I have come across this issue several times on a cpanel server.
Cannot start session without errors in phpMyAdmin

I found that we could only temporarily fixed this issue. Phpmyadmin has to work with sessions in files and it is not developed to work with memcache. So to avoid problems edit the file: libraries/session.inc.php


1. Include this line at the top of the file:

ini_set(‘session.save_path’, “/tmp/”);

2. Uncomment line (line around 74)

ini_set(‘session.save_handler’, ‘files’);

How to block email from a specific address on a cPanel/WHM or other web server using Exim

With EXIM, you can setup filters that can perform a large number of tasks, like blocking message, or blind copying messages to other email addresses.  In this case, I’m going to create a filter to cause an email coming from a specific sender to fail (the email address I use to send the email in PHP). What you’ll want to do is find your System Filter File for EXIM.  In WHM, you can find this file listed in your EXIM Configuration Editor about half way down the page. Once you’ve located the file, log into SSH and edit the file.

pico /path/to/your/file

Then enter the following filter into the file and save it:

if first_delivery
and ( ("$h_from:" contains "emailtoblock@mydomain.com")
)
then fail
endif

If you’d like a copy of the email sent to you after the message fails so you can make sure it is correctly formatted, just add one line:

if first_delivery
and ( ("$h_from:" contains "emailtoblock@mydomain.com")
)
then
unseen deliver "youremail@yourdomain.com"
fail
endif

I suggest you read up more about EXIM filtering for more advanced functions. Where I Learned This: I found the solution the Imthiaz Blog and the Exim Documentation.

Exim Configuration Manager:basic editor

There will be a warning in Filter configuration File: /etc/cpanel_exim_system_filter

Exim filter
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#  cPanel System Filter for EXIM                                                                                #
#  VERSION = 2.0                                                                                                #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!DO NOT MODIFY THIS FILE DIRECTLY!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!      #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#   Direct modifications to the /etc/cpanel_exim_system_filter file will be lost when the configuration is      #
#   next rebuilt. To have modifications retained, please use one of the following options:                      #
#                                                                                                               #
#    1)                                                                                                         #
#      * Place each sysfilter block you wish to include in a unique file at:                                    #
#            /usr/local/cpanel/etc/exim/sysfilter/options/                                                      #
#      * Enable or disable the custom block in WHM using:                                                       #
#          Service Configuration => Exim Configuration Manager => Filters => Custom Filter: [your unique file]  #
#                                                                                                               #
#    2)                                                                                                         #
#      * Create a custom sysfilter file in /etc/                                                                #
#      * Change the location of the sysfilter file in WHM using:                                                #
#          Service Configuration => Exim Configuration Manager => Filters => System Filter File                 #
#                                                                                                               #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!DO NOT MODIFY THIS FILE DIRECTLY!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!      #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#                                                                                                               #
#  Only process once                                                                                            #
#                                                                                                               #
# # # # # # # # # # # # # # # # # # # # #

So I created this simple php file on /usr/local/cpanel/etc/exim/sysfilter/options and it was visible in the WHM filter.

SPI (SaaS, PaaS, IaaS) model in cloud

SaaS

Cloud application services or “Software as a Service” (SaaS) are probably the most popular form of cloud computing and are easy to use. SaaS uses the Web to deliver applications that are managed by a third-party vendor and whose interface is accessed on the clients’ side. Most SaaS applications can be run directly from a Web browser, without any downloads or installations required. SaaS eliminates the need to install and run applications on individual computers. With SaaS, it’s easy for enterprises to streamline their maintenance and support, because everything can be managed by vendors: applications, runtime, data, middleware, O/S, virtualization, servers, storage, and networking. Gmail is one famous example of an SaaS mail provider.

PaaS

The most complex of the three, cloud platform services or “Platform as a Service” (PaaS) deliver computational resources through a platform. What developers gain with PaaS is a framework they can build upon to develop or customize applications. PaaS makes the development, testing, and deployment of applications quick, simple, and cost-effective, eliminating the need to buy the underlying layers of hardware and software. One comparison between SaaS vs. PaaS has to do with what aspects must be managed by users, rather than providers: With PaaS, vendors still manage runtime, middleware, O/S, virtualization, servers, storage, and networking, but users manage applications and data.
PaaS provides the computing infrastructure, the hardware, and the platforms that are installed on top of the hardware. Similar to the way that you might create macros in Excel, PaaS allows you to create applications using software components that are controlled by a third-party vendor. PaaS is highly scalable , and users don’t have to worry about platform upgrades or having their site go down during maintenance. Users who benefit most from PaaS include companies who want to increase the effectiveness and interactivity of a large staff. For the needs of larger companies and independent software vendors, Apprenda is one provider of a private cloud PaaS for .NET and Java business-application development and deployment.


IaaS

Cloud infrastructure services, known as “Infrastructure as a Service” (IaaS), deliver computer infrastructure (such as a platform virtualization environment), storage, and networking. Instead of having to purchase software, servers, or network equipment, users can buy these as a fully outsourced service that is usually billed according to the amount of resources consumed. Basically, in exchange for a rental fee, a third party allows you to install a virtual server on their IT infrastructure. Compared to SaaS and PaaS, IaaS users are responsible for managing more: applications, data, runtime, middleware, and O/S. Vendors still manage virtualization, servers, hard drives, storage, and networking. What users gain with IaaS is infrastructure on top of which they can install any required platforms. Users are responsible for updating these if new versions are released.

See some explaining diagrams:

Classification of Cloud service providers

How to generate a CSR on a Linux server

This article will discuss how to create a CSR (Certificate Signing Request) for an SSL in Linux. This is necessary if you are submitting a request for an SSL with another provider.

• SSH into the Linux server. If you are unsure of how to SSH, please see how to SSH on Windows | Mac .
• At the command prompt, type the following and hit Return. Change the bit length (2048) to the appropriate bit length for the SSL issuer. Typically 2048 is sufficient.

openssl req -nodes -newkey rsa:2048 -keyout domain.key -out domain.csr




Updated on 18 September 2014 - use sha2 algorithm as there has been a major security breach for sha1




openssl req -new -newkey rsa:2048 -nodes -sha256 -out domain.csr -keyout domain.key


To check CSR details:

openssl req -noout -text -in domain.csr




Fill out the requested information below. For the State, use the full name not an abbreviation. The Organization Name should be a publicly verifiable name (such as is listed on bank statements, bills, taxes, etc). The common name is the domain for which the SSL is being issued. For example, if you’re ordering an SSL for domain.com, then the name would be domain.com. If you’re ordering an SSL for www.domain.com, then the name would be www.domain.com.

You may chose to leave the email address and challenge password blank by simply hitting return when prompted.

Generating a 2048 bit RSA private key
………..+++
………………………..+++
writing new private key to ‘domain.key’
—–
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [GB]:US
State or Province Name (full name) [Berkshire]:Newark
Locality Name (eg, city) [Newbury]:Delaware
Organization Name (eg, company) [My Company Ltd]:My Company Name
Organizational Unit Name (eg, section) []:Security
Common Name (eg, your name or your server’s hostname) []:www.domain.com
Email Address []:
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

• Once the form is filled out, two files will be created in the directory in which the command was run. The filedomain.csr has the CSR for the SSL which will need to provide to the SSL issuer. It will look similar to the following:

—–BEGIN CERTIFICATE REQUEST—–
MIICvDCCAaQCAQAwdzELMAkGA1UEBhMCVVMxDzANBgNVBAgTBk5ld2FyazERMA8G
A1UEBxMIRGVsYXdhcmUxGDAWBgNVBAoTD015IENvbXBhbnkgTmFtZTERMA8GA1UE
CxMIU2VjdXJpdHkxFzAVBgNVBAMTDnd3dy5kb21haW4uY29tMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6tL9PpRMD4JeB4jZkIXGT5k4AGpGf/FTSNfn
ENuADQFCco0E+w+HqcAYtDBHzTSuU76B6TYWURRnNLHmwX+f7GytD4tBhmDia3OQ
ffKNAZqI5uusU+Tt5qpW2qjLBeX6/jD/u5Fh75s3XIKJ5XdW5yiztOk/4LAqffx9
rR4bZac4k9nBBci6gCIK615vj+1H2wAe9t5bem/EW6bxEH1nMjenI/5siVsdtRMO
qk+6l7EqkJeGslsXcu9xsqKakAfia266xQvU24P6YCWvFvLUDr5SAvAfbO+zIGWZ
/3boR75C1NyiSopJDnXlwZ0HXNRWHBUys7ED4lEIeaQpMtTXgQIDAQABoAAwDQYJ
KoZIhvcNAQEFBQADggEBAEY/wFSLWOt1S2bTt72l68K5pt0oaBaY0HX6DgPYUeP2
OR5JX5G7Cb4eVGDBWuDtVxxN2YrzzgD6ASj9pL0mzkYuFaRy3uUo0ZedzdPXgVX2
r+5OdjrewPpIgL2i91EB/JytAdgr5fVKQpaZntFu7DJHBVpcGrEN0Kan/OGg2ZU0
08yhyoejXtY1i8YUwPpoqD126N0xczYclMg/BaSME5R3Vbcr3i5Ruz0ByjoQtKSt
1Z8CWIiZNH1WhB2fy8Z2ARCsM1g2Xh43TqjRDhIIFU/dbDqmFHhvivxv2bzB9cbi
ureFe4oU8af7K9w4EbSzKgcqBOwNwnQy7DpcmIHXB4s=
—–END CERTIFICATE REQUEST—–

• The file domain.key has the key for the SSL which will you will need once the SSL is issued. The certificate, once issued, must match the key in order for the SSL to be installed. It will look similar to the following:

—–BEGIN RSA PRIVATE KEY—–
MIIEpQIBAAKCAQEA6tL9PpRMD4JeB4jZkIXGT5k4AGpGf/FTSNfnENuADQFCco0E
+w+HqcAYtDBHzTSuU76B6TYWURRnNLHmwX+f7GytD4tBhmDia3OQffKNAZqI5uus
U+Tt5qpW2qjLBeX6/jD/u5Fh75s3XIKJ5XdW5yiztOk/4LAqffx9rR4bZac4k9nB
Bci6gCIK615vj+1H2wAe9t5bem/EW6bxEH1nMjenI/5siVsdtRMOqk+6l7EqkJeG
slsXcu9xsqKakAfia266xQvU24P6YCWvFvLUDr5SAvAfbO+zIGWZ/3boR75C1Nyi
SopJDnXlwZ0HXNRWHBUys7ED4lEIeaQpMtTXgQIDAQABAoIBABTrAqAmebgP9uxY
5niXUhkZHwH6dZlEGBUvFmhMBVYjPJYTtdPfiEg40nqKqnq/LKBNIilyJf7HAIKT
LmkiQ06+R5RQ5V9hFgpYWxC9II56A6P+bnVyuTaJCf+kdaFq4Tbvinhc9QpxGzdk
cYA9Z0JkP83n0UbkqoRaj59yRSKC3TosSWCQ8TVTxWU8U36mTpCUIFvcgbQGIKph
irj8briWCM9xiErSESYP77WQxERvoW6brKD9jZ/BNmTMuQ+akOa8BxqP6LOx/bob
jqrmxsDkcmjzMXS8SCG3FkJk2K1Tam8aCqQHMBjbUFJByjIDnT237sue7qFmyQFJ
T2izt6ECgYEA95LBuszZS+cM3I/7mxRIPWoKb4ao881xNlYUvwboDMRAIFAlRNfV
c7Qjlt5TeVwlIvrYdL0L0d92FrXbh7lGcK2yOKFW4OrrlKySqXSto7c2LWy2DJkm
Hs9NO6ZDB/6X78UU4tVvFS5m/AA9J27Pk8lq/p4OuTki4yH3b3mLqJ0CgYEA8tEk
f2NeYk7YMm9Oc4fBlAF2CfJRwGf7GqwbT9Us04AWgv3XlohJaibGWJjVrHBCirAY
jxQsKhF2zjnxs9gWZ5k2PqvczTF2vs025tSimxbBcUOhMUNEaSr6ugTfjFkbdcTG
Wx/HyxH8cbYOYWKrbJSQknh8N+DO+N/y2yMt+zUCgYEAunZ+EwNWZiSPO0/2YMbV
4euMEJOLjJSfQB11YqsA+xyUb8HtT/x/d7WlWGv60tzj24Syorn/vQJhHpm5zm9s
7lDkemKJ3L0S0ddoXtjSLww+cdf/BV4TqADaWqLOuaa3KI93O6ElGP7p8cL8TEbZ
cKWzQDIrRLYT4J4kjoEs/sECgYEA6Qv575m7mLb7oUxbC18cV6UfWWSNOhGSW4Mb
o3+CSmwBLy/ansunSo50h8wIKDyGYP2qVIiT6rxgPoY2iNm4hy3xdi0U+oui4HWt
X9ZtSlSIzOCP8OwS2K07fxX2SImtZVa62fKimzBkDe8h1i4RQWFFcI7bCfZmL08h
k1ksZJECgYEAmQ73FoPsGv/uynBXVJWk3j7yDLNNHzbL9bIs5dQ9157RhInWRsNX
TvUdnukuB4hkaxvINz9mXn/2kJtsi/D5oWfrPKA1Gyzze9Rmr260p4ciy3q9YvBc
Issaav6wkaLRG9EtTU27ptda5ovYMLYE5OcrtDTtvaxFVaTRhzO9GWw=
—-END RSA PRIVATE KEY—-

 

''another skype instance may exist''

You want to login to skype but you cant because you receive the following error:
"'another skype instance may exist'"
This seems to be a common problem with skype and ubuntu.

Solution:

1] Open the terminal
2] cd into the folder /home/users/username/.Skype by typing the command
#cd /home/users/username/.Skype
#ls

You may see 3 files : shared.lck, shared.xml and skype_account

3] Move the folder skype_account to skype_account1
#mv skype_account skype_account1

4] Revert it back
#cp -arv  skype_account1 skype_account

Restart the skype and login!!!!

Does this work?
Leave me a comment.