Check your server for openDNS relay (DNS recursion)

You can check your dedicated/vps server for open dns relay by following below methods. It tells you if your server allows dns recursion or not. Follow these steps:

Login to your server via ssh with root login details

Execute following commands:

dig @yourServerIP google.com

if it returns ANSWER:0 that means there is no recursion allowed on the server. Otherwise recursion is allowed on the server.

I.E:

;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 37803
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

Above output shows NO RECURSION (ANSWER: 0)

Get real IP address of visitor for Cloudflare nGinx solution

When you have setup your web sites on cloudflare, every visitor who visits your web site passes through cloudflare network so that his real IP gets changed into cloudflare’s IP address, in short cloudflare acts as proxy server for your web server.
For apache web server, cloudflare has already provided a module which can be installed to get real ip address of visitor.

Here it is :

https://support.cloudflare.com/hc/en-us/sections/200038166-How-do-I-restore-original-visitor-IP-to-my-server-logs-

Well they do not provide any module for nGinx, however it is built in function in nGinx server. You can enable it by adding following below code into your nginx.conf

Follow below steps:

Find nginx.conf file if you do not know the exact location from SSH:

# locate nginx.conf

Add below code in nginx.conf under http section:

set_real_ip_from   204.93.240.0/24;
set_real_ip_from   204.93.177.0/24;
set_real_ip_from   199.27.128.0/21;
set_real_ip_from   173.245.48.0/20;
set_real_ip_from   103.22.200.0/22;
set_real_ip_from   141.101.64.0/18;
set_real_ip_from   108.162.192.0/18;
real_ip_header     CF-Connecting-IP;

Now save changes and restart your nginx server

service nginx restart

That is all, now you will be able to get real ip address of the visitor.

Comments are welcome.

How to disable DNS recursion on kloxo

Here is the quick code to disable DNS recursion on kloxo based server:

Login to SSH with root credential

Find the “named” configuration file:

# locate named.conf

For chrooted system:

Output : /var/named/chroot/etc/named.conf

Edit the file named.conf

# nano /var/named/chroot/etc/named.conf

In updated Kloxo following is the options file:

# nano /var/named/chroot/etc/global.options.named.conf

Add following code at the end of named.conf file and save changes by CTRL+O:

options {allow-recursion {127.0.0.1; };};

Exit from text editor (For nano)

CTRL+X

Restart named services:

service named restart

That is all : )

Free Websites monitoring system

Websterz Web Solution has introduced free websites monitoring system, it is very powerful and simple monitoring tool which sends alert to your email address whenever your websites are out of reach.

Following basic features are included:

  • Unlimited web sites addition.
  • Get free email alert instantly.
  • Monitor http, smtp, mysql or any other port.
  • View recent logs of monitoring.
  • Add/Edit/Remove monitors.
  • 1 min interval for status check.
  • Simple but powerful monitoring system
  • User friendly and simple control panel.

Click here to signup free now

libkeyutils.so.1: cannot open shared object file: no such file or directory on centos 6 x64 – Resolution

Today one of my VPS customer got following error : libkeyutils.so.1: cannot open shared object file: no such file or directory on centos 6

He was not able to login to SSH, SSHD server kept on denying with the message : connection to ssh refused.

While inspecting his VPS from node panel i came to know the server is hacked and hacker removed/changed libkeyutils.so.1 and libkeyutils.so.1.3 both are not present in lib64 directory, hacker just deleted them.
Please note these files are necessary files and are responsible for any connections inbound/outbound, so if they are not present or corrupted your server cannot connect to other computers.

Following is the solution to this issue :

Login to your main node (SSH), or your VPS by SSH console provided by your VPS provider.

Now go to /lib64 directory to check if libkeyutils.so.1 and libkeyutils.so.1.3 files are there or not. If files are there just delete them, the file libkeyutils.so.1 is symbolic link to libkeyutils.so.1.3 file. You should delete both of them by :

rm -f /lib64/libkeyutils.so.1 /lib64/libkeyutils.so.1.3

Now you would need to download RPM for libkeyutils.so.1 from centos web site:

wget ftp://ftp.muug.mb.ca/mirror/centos/6.4/os/x86_64/Packages/keyutils-libs-1.4-4.el6.x86_64.rpm

Please note, this is the step you might need assistance from your VPS provider, just ask them to place this RPM in your /lib64 directory as you cannot download it. Wget also does not work without libkeyutils.so.1 file.

Once the RPM package is downloaded, you would need to execute following command in lib64 directory:

rpm -ivh --replacefiles --replacepkgs keyutils-libs-1.4-4.el6.x86_64.rpm

This will replace package library files as well as other files, and now restart SSH by:

service sshd restart

and reboot your server:

reboot

Suggestion: Install config server firewall immediately once you get back the SSH access, your VPS will not get hack again, it takes only 2 minutes:

http://configserver.com/free/csf/install.txt