General

chkrootkit v0.47 released

chkrootkit 0.47 is now available!  This version includes:  * chkproc.c    - some bug fixes, thanks to Lantz Moore    - use of getpriority() to identify LKMs, thanks to      Yjesus(unhide) and Slider/Flimbo (skdet)    - new rootkit detected:       - Enye LKM  * chkrootkit    - new test:       - crontab    - new rootkits/worms detected:       - Enye LKM       - Lupper.Worm       - shv5    - more ports added to the bindshell test    - some minor bug fixeschkrootkit is a tool to locally check for signs of a rootkit.  Moreinformation about chkrootkit and rootkits can be found athttp://www.chkrootkit.org/.

New rkhunter v1.2.9

The rkhunter developer has finally released a long awaited update:

  • This release added support for RHEL WS/AS/ES 3 Taroon update 8, Fedora Core 5, and SuSE 10. Checks were added for packet capturing applications and processes using deleted files. The netstat check was enabled for AIX and the backdoor check was enabled for SunOS. Logfile specification and checks were added.

http://rkhunter.sourceforge.net/Unfortunately, it looks like they still don’t support the most popular OS’s md5sums, i.e. RHEv4/CentOSv4To upgrade:

/bin/rm -Rf rkhunter*wget http://surfnet.dl.sourceforge.net/sourceforge/rkhunter/rkhunter-1.2.9.tar.gztar -xzf rkhunter-*cd rkhunter-*./installer.sh cd ../bin/rm -Rf rkhunter*rkhunter –updaterkhunter -c –skip-keypress

New csf v1.31

I have released another new versiob of csf with the following changes:

  • Removed some redundant code from csf
  • Display error in csf if IP already in allow/deny file
  • Stopped install.sh from overwriting email templates
  • Added email notification for login tracking including a new email template tracking.txt
  • Added mod_security apache module IP blocking in lfd

Upgrade either through WHM or follow upgrade.txt in the tarball.

New csf v1.2

I’ve released a new version of csf with the following changes:

Fixed uninstall script to remove lfd from chkservdFixed lfd so that checks were not made on options where a log file is sharedFixed lfd stop/start to dis/enable chkservd optionAdded upgrade feature to WHM when a new version of csf is available

Follow the upgrade.txt file within the csf tarball – the last time you’ll need to do this manually if you use the new WHM upgrade feature 😉

EV1 and The Planet Announce Merger

Wow.I’m sure the forums will be a hive of activity with this news:

DALLAS, TX — Everyones Internet (EV1) and The Planet, two leading providers of dedicated hosting, announced today that they have merged.

New mod_security v1.9.3

A new version of mod_security has been released with the following changes:

10/4/2006 1.9.3—————

New Service: Server Recovery

As many of you may be aware we have always provided a cPanel server recovery service when asked. We have now formalised this service for anyone who needs it should they have OS disk problems:

  • Root compromise – if your server gets hacked and is therefore no longer trustworthy
  • OS disk failing – if the OS disk is starting to log errors indicating an immenent drive failure
  • OS corruption – if the file system is becoming corrupt
  • OS upgrade – if you want to upgrade from an old unsupported OS to a new one
  • Corrupt kernel – if you’ve upgraded the kernel and it has rendered the server unbootable of any kernel
  • Any situation which leaves your main OS disk unbootable

More details on the Server Recovery Service page.

Why you should use :fail: – addendum

I have added the following to the Why you should use :fail: page on our site:

Causes emails that will never be delivered onto the exim mail queue because checks such as sender verification are still carried out when processing such emails and if they cannot complete they will stay on the exim mail queue and repeatedly reprocess the email until it is finally discarded (usually 4+ days). This can cause very large mail queues full of spam which is repeatedly processed causing severe performance degradation

Moving to IMAP and away from Microsoft

Well, with the advent of courier-imap and multi-session login for IMAP now available we’ve decided to move our sales@waytotheweb.com joint mailbox from POP3 access using Public ShareFolder to using an IMAP account on our local server. I’ve moved over to Thunderbird and am enjoying using it. There are some important functions from Outlook that I miss, especially having it remember frequently used folders to move mail items to, though there is a workaround. I am enjoying being able to view emails in the format they arrived in rather than the bastardised format that Outlook stores email – it still amazes me how an email client can both store email bodies in a different format to which they were delivered and to also ruin email headers to make them next to useless. Unfortunately, Outlook is a well featured email client, but I’m not sad to see the back of it.The move was important to us. We keep all email, going back to before 1998 when we started this business and so it needs to be a robust solution. The main gotcha was that courier-imap doesn’t like you using either a slash or a dot in folder names, which meant for a lot of renaming for some parts of our folder structure. Other than that, the only real issue with Thunderbird/IMAP is the somewhat flaky new email detection, but I’m getting used to it 😉