First of all, Happy New Year to all the reader as This is the Very First Post for this Year.

Enabling IPTables Modules

Today I will going to explain How to install and configure CSF on a VPS. As VPS is a Virtual Server which shares the resources from the Host server including Kernel Modules, before installation of any firewall on Linux VPS make sure to have some required modules enabled on the host server. Following is the List of modules which required on the host server.

ipt_MASQUERADE
ipt_helper
ipt_SAME
ipt_REDIRECT
ipt_state
ipt_TCPMSS
ipt_LOG
ipt_TOS
tun
iptable_nat
ipt_length
ipt_tcpmss
iptable_mangle
ipt_limit
ipt_tos
iptable_filter
ipt_helper
ipt_tos
ipt_ttl
ipt_REJECT

You can check the modules which are loaded on Host Server using command “lsmod” and if you get following for x_tables the you have all the modules configured otherwise you can enable them using “modprobe” command

x_tables               19204  21 iptable_nat,xt_limit,xt_multiport,ipt_tos,ipt_TOS,ipt_REJECT,ipt_TCPMSS,xt_tcpmss,ipt_ttl,ipt_LOG,xt_length,xt_conntrack,xt_state,xt_helper,ipt_REDIRECT,ipt_recent,ipt_owner,ip_tables,ip6t_REJECT,xt_tcpudp,ip6_tables

You can copy and paste the following commands to enable all the required IPTables modules

modprobe ipt_MASQUERADE
modprobe ipt_helper
modprobe ipt_SAME
modprobe ipt_REDIRECT
modprobe ipt_state
modprobe ipt_TCPMSS
modprobe ipt_LOG
modprobe ipt_TOS
modprobe tun
modprobe iptable_nat
modprobe ipt_length
modprobe ipt_tcpmss
modprobe iptable_mangle
modprobe ipt_limit
modprobe ipt_tos
modprobe iptable_filter
modprobe ipt_helper
modprobe ipt_tos
modprobe ipt_ttl
modprobe ipt_REJECT

Enable Firewall Modules for VPS

Once the IPtables modules are enabled on Host server, execute following command from the shell (of HW Node) to enable modules for the VPS.

vzctl set VEID --iptables ipt_REJECT --iptables ipt_tos --iptables ipt_TOS --iptables ipt_LOG --iptables ip_conntrack --iptables ipt_limit --iptables ipt_multiport --iptables iptable_filter --iptables iptable_mangle --iptables ipt_TCPMSS --iptables ipt_tcpmss --iptables ipt_ttl --iptables ipt_length --iptables ipt_state --iptables iptable_nat --iptables ip_nat_ftp --save

Or you can open VPS Configuration file i.e. /etc/vz/conf/VEID.conf and paste following in the last line of the file

IPTABLES="iptable_filter iptable_mangle ipt_limit ipt_multiport ipt_tos ipt_TOS ipt_REJECT ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_LOG ipt_length ip_conntrack ip_conntrack_ftp ip_conntrack_irc ipt_conntrack ipt_state ipt_helper iptable_nat ip_nat_ftp ip_nat_irc"

Here, VEID is the VPS ID of the Server

In Next Part, I will tell how to install and configure CSF on different Control Panels. You can check the Next Part here

Default firewall for Linux i.e. iptables is depends upon many kernel modules without which a server can’t be secured properly. Also the firewall configurations will give many errors while configuring it. So, it is required to have proper kernel modules enabled for a Server.

In case of a VPS, Virtually Hosted server which shared resources and kernel of Host server it’s not possible to compile/enable kernel related modules for a VPS from it. So, to run iptables properly a VPS too have proper kernel modules enabled which can be enabled from the host server. Normally a Virtuozzo OR OpenVZ based kernel only support following iptables modules

ipt_MASQUERADE
ipt_helper
ipt_SAME
ipt_REDIRECT
ipt_state
ipt_TCPMSS
ipt_LOG
ipt_TOS
iptable_nat
ipt_length
ipt_tcpmss
iptable_mangle
ipt_limit
ipt_tos
iptable_filter
ipt_helper
ipt_tos
ipt_ttl
ipt_REJECT

ENABLE MODULES ON HOST SERVER

To enable these modules for a VPS you will first have to enable these modules on the host server using command modprobe . So, just copy and paste the following commands on the Shell of HOST SERVER

modprobe ipt_MASQUERADE
modprobe ipt_helper
modprobe ipt_SAME
modprobe ipt_REDIRECT
modprobe ipt_state
modprobe ipt_TCPMSS
modprobe ipt_LOG
modprobe ipt_TOS
modprobe iptable_nat
modprobe ipt_length
modprobe ipt_tcpmss
modprobe iptable_mangle
modprobe ipt_limit
modprobe ipt_tos
modprobe iptable_filter
modprobe ipt_helper
modprobe ipt_tos
modprobe ipt_ttl
modprobe ipt_REJECT

Now make sure that all these modules are enabled on the server using command “lsmod“.

ENABLE MODULES FOR VPS

Now the above mentioned modules can be enabled for a VPS using two ways i.e. by using command OR by adding rules manually.

1) By Command:

Execute following command from the host server to enable all the modules for the VPS

vzctl set VEID --iptables ipt_REJECT --iptables ipt_tos --iptables ipt_TOS --iptables ipt_LOG --iptables ip_conntrack --iptables ipt_limit --iptables ipt_multiport --iptables iptable_filter --iptables iptable_mangle --iptables ipt_TCPMSS --iptables ipt_tcpmss --iptables ipt_ttl --iptables ipt_length --iptables ipt_state --iptables iptable_nat --iptables ip_nat_ftp --save

2) Adding Rules manually:

Open the VPS configuration file which exists at /etc/vz/conf/veid.conf and paste following in the last line of the file.

IPTABLES="iptable_filter iptable_mangle ipt_limit ipt_multiport ipt_tos ipt_TOS ipt_REJECT ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_LOG ipt_length ip_conntrack ip_conntrack_ftp ip_conntrack_irc ipt_conntrack ipt_state ipt_helper iptable_nat ip_nat_ftp ip_nat_irc"

After adding rules reboot the VPS to apply/enable the modules.

After installation of Atmail Webmail Client, while restarting Apache it throws following Syntax Error:

First we will have to check where atmail is installed. We can do that by querying the RPM files using option “rpm -ql“

The above output shows that the files are created in “/etc/psa-webmail/” directory instead of “/etc/psa/webmail/“

So, copy the file to relevant directory as in the conf file of httpd service

After that we were able to start the httpd service successfully.

Sometime when you have enabled many YUM Repositories like local repository, rpmforge, ATrpms for your server and it’s quite difficult to manage packages where you want that the package which you want to install too be searched on Local Repository first, then to CentOS Base, update and if it doens’t find the package here it will go for any other Third Party Repositories.

This Task can be done by setting up Priority for the Yum Repositories. Following are the steps to set Priorities for YUM Repositories

1) Install yum-priorities

The yum-priorities is used to enforce ordered protection of repositories, by giving priorities to repositories. Packages from repositories with a lower priority will never be used to upgrade packages that were installed from a repository with a higher priority. The priorities are also in effect when a new package is installed – if a package is in more than one repository, it will be installed from the repository with the highest priority. This plugin is particularly useful for anyone who uses one or more third-party repositories, as these repositories may update system files, which can potentially compromise the stability of your CentOS installation. This Package can be installed using following YUM Command.

**using option -y with yum will allow yum to install package with taking permission from user.

2) Applying Priorities

Priorities for a Repository need to be added in .repo file. Following is the syntax for setting Priority

Here [NUM] will be the Priority. The Repository with higher priority will be used for installing any package. e.g. if you want your local repository should have highest priority than you can set highest priority for the same like below

All other repositories will have lesser value as compared to Local Repository.

Recently while restarting DNS service on Cpanel VPS it shows following errors:

[root@support ~]# /etc/init.d/named start
Starting named: /usr/sbin/named: error while loading shared libraries: libdns.so.22: cannot open shared object file: No such file or directory
[FAILED]

[root@support ~]# /etc/init.d/named start
Starting named: /usr/sbin/named: error while loading shared libraries: libisc.so.11: cannot open shared object file: No such file or directory
[FAILED]

We have checked and found that the OS template [CentOS 5.3] has been update to [CentOS 5.4] due to will all the binaries of the VPS has been updated as well. For temporary work around I have copied the libdns.so and libisc.so to libdns.so.22 and libisc.so.11.

[root@support ~]# cd /usr/lib
[root@support lib]# cp libdns.so libdns.so.22
[root@support lib]# cp libisc.so libisc.so.11

After that we were able to restart named server

[root@support lib]# service named restart
Stopping named:                                            [FAILED]
Starting named:                                             [  OK  ]
[root@support lib]#

If you have installed Linux (CentOS, Fedora etc.) on your System which doesn’t have internet connections in that case it’s very difficult to install packages i.e. everytime you will have to insert OS DVD and need to install packages or even if you copy all the RPMS to local system you will have to face the dependencies problems. To fix this problem, we can create a local reposiorty of the RPMS which we have copied into the Local System. following are the steps to create a local repository

1) Copy all the RPMS from the DVD to a particular folder lets say /root/os/RPMS

2) Install createrepo RPM from /root/os/RPMS directory using rpm command

3) Now, we will have to create repo of the directory in which we have coied the RPMS. Following is the command to create the repo

[root@server ~] createrepo /root/os/RPMS

Once the above command gets completed you will find repodata directory in /root/os/RPMS folder

4) configuing YUM to work with local repository. Create a new file in /etc/yum.repo.d/ or open /etc/yum.conf and paste following

[local repo]
name = OS $release - MyLocalRepo
baseurl = file:///root/os/RPMS/
enabled=1
gpgcheck=0

Now Try to install any package using YUM

Sometime whenever a user tries to take backup from Virtuozzo Power Panel or Parallels Power panel it gets failed and action logs shows following Error

“#307 Message processing was terminated because timeout was reached waiting for a response“

The above error shows that the timeout limit which is set in the Virtuozzo Configuration for backup has been reached and the backup was not completed during that time frame. To increase Virtuozzo backup Timeout limit

1) Open file “/etc/sysconfig/vzagent/vzagent.conf“

2) Search For key word “backup” and Change it

FROM:
< timeouts >
< backup >3600< / backup >
< search >3600< / search >
< / timeouts >
TO:
< timeouts >
< backup >18000< / backup >
< search >3600< / search >
< / timeouts >

By deafult the limit which is set is 3600 seconds which is 1 Hour; Change it to the limit as per your requirement, here I have set it 18000 seconds which is near about 5 hours.

3) To apply this setting, restart service VE on the Host server. Service VE can be restarted using command “vzctl restart 1” (This will restart vzagent on the host)

Now try to take backup from “Virtuozzo Power Panel or Parallels Power panel”

While deleting one domain from Plesk it was throwing following error

When we checked the domain on server (from shell) we have found that all physical Address (/var/www/vhost/domain.com) of the domain has been deleted but still Plesk shows the domain.

Following are the steps to remove the domain from Plesk manually.

1) Connect the server using SSH

2) Login into MySQL Prompt as Plesk admin

3) Delete the DNS Zone of the domain

You can verify if any records still persists using following commands

4) Now delete the Domain from Domains table which will remove it from Plesk Domains List

Verify it using select Command.

NOTE: PLEASE Make Sure To Verify The DOMAIN NAME before you make any changes as it might delete some other domain. Also the changes made are irreversible.