PROBLEM:

You get following or error while Rebuilding RPM database:
=======
[root@www root]# rpm –rebuilddb
rpmdb: unable to join the environment
error: db4 error(11) from dbenv->open: Resource temporarily unavailable
error: cannot open Packages index
=======
SOLUTION:

Try This:
=======
[root@www root]# rm -f /var/lib/rpm/__db*
[root@www root]# echo “%__dbi_cdb   create private cdb mpool mp_mmapsize=16Mb mp_size=1Mb” > /etc/rpm/macros
[root@www root]# rpm –rebuilddb
=======
PLEASE NOTE: This Fix Is Only For RedHat OS

You can use following this steps for installing Clamv Antivirus.

———————————————————–

HOWTO install and configure ClamAV (clamd) on a Red Hat or Fedora system running amavisd-new.

Absolutely no warranty. Use entirely at your own risk.

Thankfully, Dag Wieers at http://dag.wieers.com/packages/clamav/ has the packages we need. Here I illustrate installing version 0.87 on a RH9 i386 box. Modify the six lines below as needed for the current version of ClamAV, your version of OS and your architecture. We need to download and install ‘clamav-db’, ‘clamav’ and ‘clamd’ (in that order). Hopefully, you will not have any problems with dependencies.

cd /usr/local/src
Download the latest version of Clamv(clamd-0, clamav-0, clamav-db-0 ):

wget http://dag.wieers.com/packages/clam…rh9.rf.i386.rpm
wget http://dag.wieers.com/packages/clam…rh9.rf.i386.rpm
wget http://dag.wieers.com/packages/clam…rh9.rf.i386.rpm

If you have a previous version of ClamAV on your system, you will first need to remove it (in reverse order of installation), for example:
rpm -e clamd-0.86.2
rpm -e clamav-0.86.2
rpm -e clamav-db-0.86.2

The system will save copies of your config files. You may choose to use the old clamd.conf, or reconfigure the new one (preferred). Remember to add the clamav user to the amavisd user’s group as described below. Now you can install (and configure) the new version:
rpm -Uvh clamav-db-0.87-1.0.rh9.rf.i386.rpm
rpm -Uvh clamav-0.87-1.0.rh9.rf.i386.rpm
rpm -Uvh clamd-0.87-1.0.rh9.rf.i386.rpm

We may want to make a couple of modifications to the supplied clamd.conf:
If you would like to use the default TCPSocket method of communication, then you do not necessarily need to make changes to the supplied clamd.conf. The default in our Dag Wieers clamd.conf is ‘TCPSocket 3310′ and ‘TCPAddr 127.0.0.1′. Simply skip to the next section.

If you would like to use the LocalSocket method, then:
vi /etc/clamd.conf
Uncomment ‘LocalSocket /var/run/clamav/clamd.sock’
Comment out ‘TCPSocket 3310′

Save and exit. Here we use LocalSocket instead of TCPSocket. These settings cannot be used together.

One key to getting clamd and amavisd-new to work with each other is to add the user ‘clamav’ to the ‘amavis’ (or ‘vscan’) group. Doing so magically resolves file permission issues (one cause of the the dreaded “Can’t connect to UNIX socket” or “Can’t connect to INET socket”). The following instructions assume your amavisd-new group is called ‘amavis’:
Let’s add the ‘clamav’ user to the ‘amavis’ group; modify if your group is ‘vscan’ or some other name:

gpasswd -a clamav amavis

You can test your efforts by issuing the command: groups clamav

Now we need to prepare amavisd-new to use clamd. The other key to getting the two programs to work together is to insure the value after ‘CONTSCAN’ in amavisd.conf is the same as the ‘LocalSocket’ (or TCPSocket) setting in clamd.conf. In our case this would be ‘/var/run/clamav/clamd.sock’ which is the file that the two programs use to talk to each other (the Unix socket). If using TCPSocket / TCPAddr, the value would be ‘127.0.0.1:3310′.
vi /etc/amavisd.conf

To enable virus scanning, comment out: @bypass_virus_checks_acl = qw( . );

You may need to uncomment the ClamAV section:

['Clam Antivirus-clamd',
\&ask_daemon, ["CONTSCAN {}\n", '/var/amavis/clamd'],
qr/\bOK$/, qr/\bFOUND$/,
qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],

If you choose to use LocalSocket as opposed to TCPSocket:
Notice the value after CONTSCAN in this example above is currently ‘/var/amavis/clamd’
Edit this to reflect what our LocalSocket is set to, which in our case is:
‘/var/run/clamav/clamd.sock’

If you choose to use TCPSocket instead of LocalSocket, edit the value after CONTSCAN like so:

['Clam Antivirus-clamd',
\&ask_daemon, ["CONTSCAN {}\n", '127.0.0.1:3310'],
qr/\bOK$/, qr/\bFOUND$/,
qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],

You should take a look at these items in amavisd.conf and modify them to meet your needs (my personal settings are shown):
$final_virus_destiny = D_DISCARD;
$virus_admin = “postmaster\@$mydomain”;
$virus_quarantine_to = “virii\@$mydomain”; # I created a new mailbox to accommodate this.
$mailfrom_notify_admin = “postmaster\@$mydomain”;
$mailfrom_notify_recip = “postmaster\@$mydomain”;
$mailfrom_notify_spamadmin = “postmaster\@$mydomain”;
$hdrfrom_notify_sender = “amavisd-new <postmaster>”;

Before proceeding, obtain the eicar test virus from http://www.eicar.com/anti_virus_test_file.htm and prepare your email client to send an email containing the “virus” through the system. I suggest downloading eicar.com.txt, renaming it to eicar.txt and then attaching it to the email.
Start clamd using the command:
clamd

Run freshclam using the command:
freshclam

Stop amavisd-new:
amavisd stop

Start up amavisd-new in debug mode:
amavisd debug

Now test the system by sending the email containing the eicar test virus through the system. You should see:
Clam Antivirus-clamd: Connecting to socket
and:
INFECTED (Eicar-Test-Signature)

If all goes well, stop debug mode with [Ctrl]+c and restart amavisd-new:
amavisd start

The RPMs I installed only update the database once each day (/etc/cron.daily/freshclam), If this is the case for you I suggest adding a new file to /etc/cron.d that runs freshclam once each hour. We will call the file ‘freshclam’.
vi /etc/cron.d/freshclam

And insert the following:
MM * * * * clamav [ -x /usr/bin/freshclam ] && /usr/bin/freshclam –quiet

Replace MM with a number between 1 and 59. It is best not to use the digit “0″

I suggest you check the health of your new ClamAV installation by reading /var/log/clamav/clamd.log and /var/log/clamav/freshclam.log. It is a good idea to insure the daily freshclam cron job and the hourly freshclam cron job do not run at exactly the same time.

http://www200.pair.com/mecham/spam/…hat-amavis.html

Let me know if there is any more information about it.

Login to the server and execute

cd /usr/local/src

wget http://www.zdziarski.com/projects/mod_evasive/mod_evasive_1.10.1.tar.gz

tar -zxvf mod_evasive_1.10.1.tar.gz
cd mod_evasive

For apache 2.0.x

/usr/sbin/apxs -cia mod_evasive20.c

Then add add this too httpd.conf

<IfModule mod_evasive20.c>
DOSHashTableSize 3097
DOSPageCount 6
DOSSiteCount 100
DOSPageInterval 2
DOSSiteInterval 2
DOSBlockingPeriod 600
</IfModule>

For apache 1.3.x

/usr/local/apache/bin/apxs -cia mod_evasive.c

Then add this too httpd.conf

<IfModule mod_evasive.c>
DOSHashTableSize 3097
DOSPageCount 6
DOSSiteCount 100
DOSPageInterval 2
DOSSiteInterval 2
DOSBlockingPeriod 600
</IfModule>

Now just restart apache and the installation is complete.

/etc/init.d/httpd restart

Rkhunter is a very useful tool that is used to check for trojans, rootkits, and other security problems. This tutorial will touch on installing and setting up a daily report for rkhunter.
Installing:

wget -c http://downloads.rootkit.nl/rkhunter-1.2.7.tar.gz
tar -zxvf rkhunter-1.2.7.tar.gz
cd rkhunter-1.2.7.tar.gz
./installer.sh

Now you can run a test scan with the following command:

/usr/local/bin/rkhunter -c
How to setup a daily scan report?

pico /etc/cron.daily/rkhunter.sh

add the following replacing your email address:

#!/bin/bash
(/usr/local/bin/rkhunter -c –cronjob 2>&1 | mail -s “Daily Rkhunter Scan Report” email@domain.com)

chmod +x /etc/cron.daily/rkhunter.sh
I just got a false positive!! What do i do?

False positives are warnings which indicates there is a problem, but aren’t really a problem. Example: some Linux distro updated a few common used binaries like `ls` and `ps`. You (as a good sysadmin) update the new packages and run (ofcourse) daily Rootkit Hunter. Rootkit Hunter isn’t yet aware of these new files and while scanning it resports some “bad” files. In this case we have a false positive. You could always have your datacenter or a system administrator check out the server to verify that it is not compromised.

Following are the steps to install mod_bandwidth

1. Login to your server via SSH as root.

2. Type: mkdir /root/mod_bw

3. Type: cd /root/mod_bw

4. Type: wget ftp://ftp.cohprog.com/pub/apache/module/1.3.0/mod_bandwidth.c

5. Type: /usr/local/apache/bin/apxs -c /root/mod_bw/mod_bandwidth.c -o /usr/local/apache/libexec/mod_bandwidth.so

6. Type: mkdir /usr/local/apache/bw_limit

7. Type: mkdir /usr/local/apache/bw_limit/link

8. Type: mkdir /usr/local/apache/bw_limit/master

9. Type: pico -w /etc/httpd/conf/httpd.conf

10. Locate the following Line: LoadModule rewrite_module libexec/mod_rewrite.so

11. Before the above line add this:
LoadModule bandwidth_module libexec/mod_bandwidth.so

12. Now locate this line: AddModule mod_env.c

13. Before the above line add this:
AddModule mod_bandwidth.c

14. Now locate this line: # Document types.

15. Before the above line add this:
BandWidthDataDir “/usr/local/apache/bw_limit”
BandWidthModule On

16. To enable mod_bandwidth on a virtual host locate the virtual host entry for the specified domain/acount you wish to limit. Just before the line add the following:
BandWidthModule On
BandWidth all 512

The 512 can be replaced with whatever rate you wish to limit the acount too.

17. Save the file and exit.
CTRL-X then Y then enter.

18. Type: service httpd restart

19. Type: cd /usr/sbin

20. Type: wget ftp://ftp.cohprog.com/pub/apache/module/cleanlink.pl

What is cleanlink?
Cleanlink is a deamon that is used to clean links created by mod_bandwidth when they aren’t removed properly by the server. (When a httpd process doesn’t terminate the usual way.)

21. Type: chmod 755 cleanlink.pl

22. Type: pico -w cleanlink.pl

23. Change $LINKDIR to the following:
$LINKDIR=”/usr/local/apache/bw_limit/link”;

24. Save the file and exit.
CTRL-X then Y then enter.

25. Type: perl cleanlink.pl

26. Type: pico -w /etc/rc.d/rc.local

27. Scroll down to the very end of the file and add the following:
# The following line Launches CleanLink for Mod_Bandwidth
perl /usr/sbin/cleanlink.pl

28. Save the file and exit.
CTRL-X then Y then enter.

mod_bandwidth has many options. If you wish to modify mod_bandwidth and enable more options please visit the documentation available by the programmer here: http://www.cohprog.com/v3/bandwidth/doc-en.html

To install eAccelerator on a Server just follow the following steps:

1) Login as root in SSH

2) Run the following commands in the following order:

cd /

mkdir ea

cd ea

wget http://jaist.dl.sourceforge.net/sourceforge/eaccelerator/eaccelerator-0.9.3.tar.gz

tar xvzf eaccelerator-0.9.3.tar.gz

cd eaccelerator-0.9.3

export PHP_PREFIX=”/usr”

$PHP_PREFIX/bin/phpize

./configure –enable-eaccelerator=shared –with-php-config=$PHP_PREFIX/bin/php-config

make

make install

3) Edit php.ini – usually it’s /etc/php.ini or /usr/local/lib/php.ini

Find this:

;Windows Extensions

Above this, comment out or remove the PHPA or mmcache lines if you have them. Replace them with this:

To install as a ZEND extension:

zend_extension=”/ea/eaccelerator-0.9.3/modules/eaccelerator.so”
eaccelerator.shm_size=”16″
eaccelerator.cache_dir=”/tmp/eaccelerator”
eaccelerator.enable=”1″
eaccelerator.optimizer=”1″
eaccelerator.check_mtime=”1″
eaccelerator.debug=”0″
eaccelerator.filter=”"
eaccelerator.shm_max=”0″
eaccelerator.shm_ttl=”0″
eaccelerator.shm_prune_period=”0″
eaccelerator.shm_only=”0″
eaccelerator.compress=”1″
eaccelerator.compress_level=”9″

OR to install as a PHP extension:

extension=”/ea/eaccelerator-0.9.3/modules/eaccelerator.so”
eaccelerator.shm_size=”16″
eaccelerator.cache_dir=”/tmp/eaccelerator”
eaccelerator.enable=”1″
eaccelerator.optimizer=”1″
eaccelerator.check_mtime=”1″
eaccelerator.debug=”0″
eaccelerator.filter=”"
eaccelerator.shm_max=”0″
eaccelerator.shm_ttl=”0″
eaccelerator.shm_prune_period=”0″
eaccelerator.shm_only=”0″
eaccelerator.compress=”1″
eaccelerator.compress_level=”9″

4) Create the cache directory by doing the following at the command line

mkdir /tmp/eaccelerator

chmod 0777 /tmp/eaccelerator

5) Restart Apache

service httpd restart.

If there is a problem with any folder under any site starting it’s name with ‘dev’, It gives Internal Server Error…. while accessing any scripts inside it. This problem is mainly caused by ‘mod_security’. You will have to check if ‘mod_security’ is enebled on the server, If so you will have to disable it in order to get those scripts running.

Many times we have to transfer big files. But due to bad network or bad connection transfer time outs when transferring such a big file.

To override this, you can split this file into small size files, transfer it and then join it again.

Here are the steps for it.

Make sure you have root privilages to do this.

1) Login to the shell where the file is stored.

2) Run the command
split –bytes=sizeoffileyouwanttosplit filename
(split –bytes=1000M backup.tar.gz)

3) Copy the files to destination.

4) Join them once again using the command.
echo file1 << file2.

Run the Following command on the Linux Server to find out how many connetions are connected to the Server:

netstat -ntu | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n