Blog Posts

We connect to our server via SSH (PuTTY)

We run the following command,

nano /etc/mailips

A blank black page may appear; we may first need to make a few settings in WHM panel,

We make our settings from the WHM panel as
shown in the image,

When we return
to our SSH screen, we run the command again. We type the IP address we want to set as shown in the image, press ctrl-x-y, and save,

In this section, we can also assign a separate mail IP address for each site, so each site we assigned will send outgoing mail from a different IP
address,

Maldet is a malware detection software for Linux. This free software allows you to detect malicious software on your server. For more detailed information about Linux Malware Detect written
by R-fx Networks, visit http://www.rfxn.com/projects/linux-malware-detect/. Without further delay, let me provide you with information about the installation and usage of the program.

Installation

It is sufficient to run the following commands for
installation.

wget http://www.rfxn.com/downloads/maldetect-current.tar.gz

tar zxvf maldetect-current.tar.gz

cd maldetect-*

sh install.sh

After the installation is completed successfully with these commands, a warning is necessary before
moving on to usage examples. Linux Malware Detect (maldet) consumes a significant amount of I/O on your hard disk during scanning. This can cause serious performance issues on slow or heavily loaded hard disks.

Usage

maldet –help will print all maldet
parameters to the screen.

Let’s do a sample command to scan a website that has been hacked or infected with a backdoor. If the cPanel user of the sample domain netinternet.com.tr on a cPanel server is netinter;

maldet -a

  /home/netinter/public_html

you can start a malware scan of the relevant web page’s files with this command. When you start the scan, maldet shows you the number of files.

maldet(9174): {scan} 653⁄14045 files scanned: 0 hits 0

  cleaned

In this example taken while the process is ongoing, you can see that only 653 of the 14045 files have been scanned so far. If harmful content is found it will be shown in the hits field, and if content is cleaned it will be
shown in the cleaned field.

When the scan is complete, maldet will print codes to the screen for reporting and cleaning. Examples are below.

maldet(9174): {scan} scan completed on /root/: files 14045, malware hits 1, cleaned

  hits

The above line tells us that 1 piece of harmful content was detected.

maldet(9709): {scan} scan report saved, to view run: maldet –report 081513-2051.9709

The above line tells us that we need to type the maldet
–report 081513-2051.9709 command in our console to see the report, name, and other information about the harmful content. The numerical value in this command is automatically generated by the system for each scan.

maldet(9709): {scan}

  quarantine is disabled! set quar_hits=1 in conf.maldet or to quarantine results run: maldet -q 081513-2051.9709

The above line tells us that we need to run the maldet -q 081513-2051.9709 command from the console to clean, delete, or quarantine all the
files in the report.

After this example, we will also provide information about some maldet settings.

maldet –report list

command prints the scan operations you have previously performed to the screen.

maldet

  –monitor

command continuously performs scanning operations (e.g., maldet –monitor /home continuously scans files uploaded to the /home directory; to stop it, use the maldet -k command; since this operation continues running in the background, it can
cause very serious performance issues on slow or heavily loaded hard disks.)

maldet -a /home/?/public_html

The question mark in the command replaces the asterisk and allows you to scan the public_html folders inside all folders within the
/home folder. This way, you will have performed a malware scan on your entire server by scanning fewer files more quickly.

maldet -b : Runs long scan operations in the background. This way you can start a scan and close the SSH

  connection. (e.g., maldet -b -a /home/)


maldet -u : Updates the Maldet virus database.

maldet -r : Scans only files added or changed on a specific day. (e.g., maldet -r /home/?/public_html 2 scans files from the last 2 days.)

maldet –restore : Restores

  cleaned or quarantined files. If the software is damaged during virus cleaning, restore can be done with the scan number. (e.g., maldet –restore 081513-2051.9709)

maldet -p : Deletes all quarantined files, logs, and open sessions.

It is also
possible to customize the Maldet software by opening the conf file and editing the information inside it.

nano -w /usr/local/maldetect/conf.maldet

If you type the directory and command written above into the console as-is using the nano
editor, you can edit the maldet conf file. When editing the configuration file and running maldet in monitor mode, it allows you to configure it to send you emails about viruses it finds, automatically quarantine them, and change processing details related to
scanning.

On cPanel servers, if you wish, you can also ensure that accounts with viruses are automatically suspended by setting the quar_susp value in the configuration file to 1.

We log into our Customer Panel with the information sent to our email address,

We click on the Services - All Services tab from the tabs
on the left side to list our services,

We click on the View Details tab of the Service whose password we want to change,

From this section we can change our Password,

From the previous tab we can log into our Panel via cPanel / Plesk Panel,

There are necessary tools on many control panels to take a MySQL backup, and taking a MySQL backup is quite simple. In this article, we will provide you with information about how to take a
MySQL backup via command.

In cPanel, MySQL databases are located in the /var/lib/mysql directory. To take a backup of any site, you first need to navigate to this directory. First, we navigate to the directory where the databases are located with the following
commands.

cd /var/lib/mysql


ll

To take a MySQL backup with a command, you will need the server’s MySQL password. We print this password to the screen with the following command.

cat /root/.my.cnf

After
printing our password to the screen, we can now take our MySQL backup. You need to apply the following command for this operation.

mysqldump -u root -p veritabanı > yedek.sql

When you run the command, it will ask for a password. After
copying and pasting the MySQL password we printed to the screen, we confirm with the Enter key. After confirmation, it will start processing and the command line will become inactive. After taking the MySQL backup, the command line will become active again. After the
process is complete, you can list the contents again with the ll command and see the backup you took as yedek.sql.

Restoring a Backup

If you have a previously taken MySQL backup and want to import it, you need to use the following
commands. Since the server MySQL password is required during the backup restore process, we first print our password to the screen and then proceed.

cat /root/.my.cnf


Password on Screen

mysql -u root -p veritabanı <

  yedek.sql

After applying the command, we again enter our password and confirm with the Enter key and wait for the process to finish. After the process is complete, the database will have been imported.

Nameserver (NS) are name servers used to query your domain name and determine which server your site will run on. When you redirect to the nameserver addresses provided by the
hosting company from the company where you purchased your domain name, your site will operate on whichever server the domain Nameserver (NS) addresses point to. Nameserver (NS) addresses query based on the IP addresses next to them and find whichever server that IP
address belongs to.

For example; you can install software on more than one server for the same domain name. However, your site runs from whichever server your domain name’s NS addresses point to. The data on the other server has no
effect.

For the hosting or reseller services you will receive from our company, you should redirect your domain name servers as follows.

ns1.ni.net.tr

ns2.ni.net.tr

If you
want to use your own domain name servers in your reseller service, the IP addresses you need to assign to your nameserver addresses should be as follows;

ns1.alanadi.com > 95.173.189.2

ns2.alanadi.com >
95.173.190.2

Nameserver (NS) are name servers that will be used to query your domain name. When you redirect to the nameserver addresses provided by the
hosting company from the company where you purchased your domain name, your site will operate on whichever server the domain Nameserver (NS) addresses point to. Nameserver (NS) addresses query based on the IP addresses next to them and find whichever server that IP
address belongs to.

For example; you can install software on more than one server for the same domain name. However, your site runs from whichever server your domain name’s NS addresses point to. The data on the other server has no effect.

For the Hosting
or Reseller services you will receive from our company, you need to redirect your domain name servers as follows;

ns1.ni.net.tr

ns2.ni.net.tr

If you want to use your own domain name servers in your reseller service,
the IP addresses you need to assign to your nameserver addresses should be as follows;

ns1.alanadi.com > 95.173.189.2

ns2.alanadi.com > 95.173.190.2

What is DNS (Domain Name System)?

DNS is the system used to convert internet domain names to IP addresses and IP addresses to domain names. DNS servers enable the
resolution of URL (Uniform Resource Locator) or FQDN (Fully Qualified Domain Name) addresses to IP addresses. This way, instead of memorizing IP addresses, we use more memorable host addresses, i.e., domain addresses.

DNS, nameservers (name servers) and DNS
resolvers are the most important components that make up the DNS system. Converting domain names to IP addresses is made possible by DNS resolvers. Netinternet’s data center contains 4 IPv4 and IPv6 enabled DNS resolver servers, and these servers are only used on
servers within the data center.

IPv4 DNS Resolver

159.253.34.4

159.253.34.5

IPv6 DNS Resolver

2a03:2100::4
2a03:2100::5

Changing DNS Resolver on Linux Operating Systems

The
file path you need to edit to change DNS resolver addresses on Linux operating systems: /etc/resolv.conf

After opening the file with any editor installed on your operating system, you need to update the information by writing nameserver at the beginning for each
DNS resolver.

Changing DNS Resolver on Windows Operating System

To change DNS resolver addresses on Windows operating systems, go to the properties of the active network connection via “Network Connections”, click on
“Internet Protocol Version 4” and press the properties button. On the screen that appears (like the right window in the image below), you can define DNS resolver servers.

Netstat is a console command that can provide detailed information about network connections, routing table, interface statistics, and similar network connection information.

The
netstat command is used with various parameters. These parameters and their meanings are as follows:

-a : Prints all TCP and UDP connections to the screen. -e : Displays statistics of incoming and outgoing packet counts. -n : Displays all connections
numerically. -o : Lists all connections by PID number and application name. -p : Prints the application and PID numbers used by connections to the screen. -s : Prints statistical data according to rules to the screen. -r : Displays the contents of the IP routing
table.

Meanings of Connection States in Netstat Output

ESTABLISHED : The socket connection has been established. SYN_SENT : The socket is trying to establish a connection. SYN_RECV : A connection request has arrived from the network. FIN_WAIT1 : The
socket has been closed, the connection is about to be terminated. FIN_WAIT2 : The connection has been terminated. The socket is waiting for the other end to terminate the connection. TIME_WAIT : The socket is waiting to receive packets that may arrive after it closes.
CLOSED : The socket is not in use. CLOSE_WAIT : The other end has closed the connection. The socket is waiting to close. LAST_ACK : The other end has terminated the connection and closed the socket. Waiting for confirmation. LISTEN : The socket is in listening mode
for incoming connections. CLOSING : Local and remote sockets have been closed but have not sent all their data. Sockets do not close until all data has been sent.

Some Example Commands to Get Netstat Output via SSH

Lists All TCP and UDP
Connections

netstat -ntu

Prints SYN_SENT and SYN_RECV connection states among all TCP and UDP connections to the screen. You can change the part after grep to your preference and see other connections on the screen.

netstat -ntu | grep
SYN

Prints only ESTABLISHED connections to the screen.

netstat -ntu | grep ESTABLISHED

The following command sorts the entire IP list including values printed with the ffff table from smallest to largest. You can also add grep to the command to list
by connection state.

netstat -ntu | awk ‘ {print $5} ’ | awk ‘ {sub(“::ffff:”,“”);print} ’ | cut -f1 -d ‘:’ | sort | uniq -c | sort -n | grep -v -e server -e Address 127.0.0.1 -e 0.0.0.0

Netstat is a console command that can provide detailed information about network connections, routing table, interface statistics, and similar network connection information.

The netstat command is
used with various parameters. These parameters and their meanings are as follows.

-a : Prints all TCP and UDP connections to the screen.

-e : Displays statistics of incoming and outgoing packet
counts.

-n : Displays all connections numerically.

-o : Lists all connections by PID number and application name.

-p : Prints the application and PID numbers used by connections to the
screen.

-s : Prints statistical data according to rules to the screen.

-r : Displays the contents of the IP routing table.

The meanings of connection states in the Netstat output are as
follows.

ESTABLISHED : The socket connection has been established.

SYN_SENT : The socket is trying to establish a connection.

SYN_RECV : A connection request has arrived from the
network.

FIN_WAIT1 : The socket has been closed, the connection is about to be terminated.

FIN_WAIT2 : The connection has been terminated. The socket is waiting for the other end to terminate the
connection.

TIME_WAIT : The socket is waiting to receive packets that may arrive after it closes.

CLOSED : The socket is not in use.

CLOSE_WAIT : The other end has closed the connection. The socket
is waiting to close.

LAST_ACK : The other end has terminated the connection and closed the socket. Waiting for confirmation.

LISTEN : The socket is in listening mode for incoming connections.

CLOSING
: Local and remote sockets have been closed but have not sent all their data.

Some Example Commands to Get Netstat Output via SSH

Lists All TCP and UDP Connections.

netstat -ntu

Prints
SYN_SENT and SYN_RECV connection states among all TCP and UDP connections to the screen. You can change the part after grep to your preference and see other connections on the screen.

netstat -ntu | grep SYN

Prints only
ESTABLISHED connections to the screen.

netstat -ntu | grep ESTABLISHED

The following command sorts the entire IP list including values printed with the ffff table from smallest to
largest. You can also add grep to the command to list by connection state.

netstat -ntu | awk ‘ {print $5} ’ | awk ‘ {sub(“::ffff:”,“”);print} ’ | cut -f1 -d ‘:’ | sort | uniq -c | sort -n | grep -v -e server -e Address

  127.0.0.1 -e 0.0.0.0