I have seen people getting really active on twitter, especially those dealing with servers and webhosting. I thought of writing a simple Server monitoring script that can monitor the services and update via Twitter.

You can download the script from http://sourceforge.net/projects/servtweet

Installation

Installation is pretty easy. The first thing you need an extra Twitter account for monitoring. Once it is created you can continue with the steps.

1. cd /usr/local/src/
2. Download the tar file from http://sourceforge.net/projects/servtweet/
3. tar -zxf servtweet.tar.gz
4. cd servtweet/
5. sh install.sh
6. Enter the Details Requested by the script.
7. Done, Just follow the twitter account, you will be getting tweets from the server in case of
Load Spikes
Apache Failure
DNS Failure
SMTP/POP Failure

Happy Twitting.

NOTE: Contact me if there is any bugs !!

Adding chrooted FTP users outside of Plesk is very easy.

Create the user with the home directory as the root of what they can access
Give the user a password
Make their primary group psacln
Add them to the psaserv group as well
# useradd username -d /path/to/home/directory/
# echo “password” | passwd username –stdin
Changing password for user username.
passwd: all authentication tokens updated successfully.
# usermod -g psacln username
# usermod -G psaserv username

Last day I was working in a server with heavy ddos, nothing seems to be working. I tried tweaking kernel parameters and also installed mod_evasive but no luck. At last I gave a try with CSF, and it worked !!

You just need to configure two csf directives, thats it.

The two directives are PORTFLOOD and SYNFLOOD.

SYNFLOOD

SYNFLOOD is disabled by default. If you are not receiving any sort of attack, there is no need to enable it. If you are expecting an attack, enable it and set the rules a bit strict, like

SYNFLOOD = “1″

SYNFLOOD_RATE = “30/s”

SYNFLOOD_BURST = “10″

i.e. if 30 connections are received from an IP/sec for 10 times, block it. Make sure don’t keep it too strict if you are not receiving an attack else it will generate false positives and will block legit connections.

PORTFLOOD

PORTFLOOD = 80;tcp;100;5,22;tcp;5;300

ie, If an IP makes 100 connections in 5 sec to port 80 (tcp), then it will be blocked from the server and if 5 connections in 300 sec to 22 port.

PORTFLOOD = 80;tcp;100;5,22;tcp;5;300

ie, If an IP makes 100 connections in 5 sec to port 80 (tcp), then it will be blocked from the server and if 5 connections in 300 sec to 22 port.