If you don't have any password generating tools/commands like pwgen and makepasswd, you can follow the steps given below to create a command to generate passwords. These step enables a new command genpasswd for you.

   $ cd
 ~$ vi .bashrc

Append the following code in the .bashrc file

#-----------------------------------------------------------------------------------------------------

genpasswd() {
        local l=$1
        local n=$2
        [ "$l" == "" ] && l=16
        [ "$n" == "" ] && n=1

        while [ $n -gt 0 ]
        do
                tr -dc A-Za-z0-9_ < /dev/urandom | head -c ${l} | xargs
                n=$[$n-1]
        done
}

#------------------------------------------------------------------------------------------------------
save and quit from the file

~$ source .bashrc
   To executes the content of .bashrc, ie, to reload .bashrc.

Now the genpasswd command is available in your terminal.

General format of genpasswd command is as follows

$ genpasswd <number_of_character>  <no_of_passwords>

Examples:-

1.If you want to generate a random password with 12 character,
    $ genpasswd 12
2.By default,
   $ genpasswd
    Generate a random password with 16 character.
3.If you want to generate 5 passwords with 11 character each,
   $ genpasswd 11 5



Note:- You can use one of the following code instead of tr -dc A-Za-z0-9_ < /dev/urandom | head -c ${l} | xargs in genpasswd() function.

1. date | md5sum | head -c ${l} | xargs
2. openssl rand -base64 128 | head -c ${l} | xargs
3. strings /dev/urandom | tr -dc .~?_A-Z-a-z-0-9 | head -c ${l} | xargs

Most of the HardWare related information can be extracted from /proc file system.

# cat /proc/meminfo
    To display memory information of the system.

• See also # free 
• See also # slabtop

# cat /proc/cpuinfo
   To display cpu information of the system.

• See also # top

# cat /proc/cmdline
    This file shows the parameters passed to the kernel at the time it is started.

# cat /proc/crypto

    Lists all installed cryptographic ciphers used by the Linux kernel.

# cat /proc/devices
    Displays the various character and block devices currently configure.

# cat /proc/loadavg

   0.07  0.05  0.05  1/243  5431

    Provides the load average in regard to both the CPU and IO over time. The first three columns measure CPU and IO utilization of the last one, five, and 15 minute periods. The fourth column shows the number of currently running processes and the total number of processes. The last column displays the last process ID used. Load average refers to the number of processes waiting for a CPU share.

• See also # uptime
• See also # top

# cat /proc/swaps
   This file measures swap space and its utilization.

• See also # swapon -s
• See also # swapoff

# cat /proc/uptime
    This file contains information detailing how long the system has been on since its last restart.

• See also # uptime

# cat /proc/version
   This file specifies the version of the Linux kernel, the version of gcc used to compile the kernel, and the time of kernel compilation. It also contains the kernel compiler's user name (in parentheses).

• See also # uname -a
• See also # arch

# cat /proc/mounts
   This file provides a list of all mounts in use by the system.

• See also # mount   

 # ps -aux
     To list all the processes in the system.

Note:- To list the processes in sorted order.
From inside top you can try the following:

• Press SHIFT+f
• Press the Letter corresponding to %MEM
• Press ENTER

The above trick will order the processes with descending order memory usage.

SHIFT+m ------->Ordering with memory usage

SHIFT+u-------->select particular user processes.

etc... 

Qmail - qmqtool

                      Qmail is the mail client that comes with the Plesk control panel. Qmail has its strengths and weaknesses, one drawback is there’s no easy built in way to view the messages in the mail queue. qmqtool is a qmail queue manipulation program geared towards the viewing and safe modification of the contents in a qmail queue. This tool is very useful for working on mail queues and debugging problems.

# cd /usr/local/src/
    To setInstallation directory.

# wget http://jeremy.kister.net/code/qmqtool/files/qmqtool-1.14.tgz
    To download source file of qmqtool.

# tar -zxvf qmqtool-1.14.tgz 
    To extracted the tar file to compile.

# cd qmqtool-1.14 

# ./configure --perl=/usr/bin/perl --qmaildir=/var/qmail 

# make && make install
    To configure and install qmqtool.

# /usr/local/script/qmqtool --help
   To list all the available options with qmqtool.

Plesk control panel uses qmail as a mail server. Following are some of the qmail commands for Plesk server.

# /var/qmail/bin/qmail-qstat
   To check the mail queue in plesk from command line.

# /var/qmail/bin/qmail-qread
   To examine the queue with qmail-qread.

From the qmail-qread command you get the message’s id, a number followed by '#' symbol. Let one of the id is '1234' . Now you can find the file holding the email in /var/qmail/queue with “find “command.

# find /var/qmail/queue -iname 1234

   The find result will be like the following..,

   /var/qmail/queue/remote/22/1234

   /var/qmail/queue/mess/22/1234

   /var/qmail/queue/info/22/1234

From the mail header you get the IP address, the following command will display the mail header of  1234.

# cat /var/qmail/queue/mess/22/1234

You can analyse the To, From and Subject to determine whether an email is spam or not. The site given below contains the normal spamming content in e-mails. But spamming contents are changed day by day. Mostly they are sales or adds related.
http://spamspamgoaway.com/spam-subjects.php


Issue the following command and analyse the result to find the spam.

# egrep -ir "(Subject|To|From)" /var/qmail/queue/mess/

You can find a large number of particular pattern in the command result which caused spam. Let the content be like this "Start earning 15 minutes from now". You can delete all the spam mails containing the above content by issuing the fillowing command
# /usr/local/script/qmqtool -d -f "Start earning 15 minutes from now"

After that verify the spamming mails were removed or not by checking the result of,
# egrep -ir "(Subject|To|From)" /var/qmail/queue/mess/

Note:- If qmqtool is not in your server, you should install it. The following link will help you to install qmqtool.

http://linuxadmintips4u.blogspot.in/2012/08/qmail-install-and-compile-qmqtool.html

cPHulk Brute Force Protection

          cPHulk Brute Force Protection prevents malicious forces from trying to access your server’s services by guessing the login password for that service. While browsing the whm many time local machine ip blocked in the cphulkd database and we are not able to browse the WHM, to unlock the WHM access refer to the following steps to whitelist the ip from the cphulkd blacklist database.


BackEnd or Terminal

Login in the shell as a root user and run the commands.

# mysql

   >USE cphulkd
   >SHOW tables;
   >BACKUP TABLE  brutes TO  ‘/root/cphulk.log’;
   >SELECT * FROM brutes WHERE  IP=’[IP Address]‘;
   >DELETE  FROM  brutes WHERE  IP=’IP Address’;
   >quit;

 Replace “IP Address” as per your local machine ip address to resolve the issue.

============================================================
To delete all the brute force entries of blocked IPs,

mysql> delete from brutes;
mysql> delete from logins;

============================================================

FrontEnd

Login to WHM, then
Main >> Security Center >> cPHulk Brute Force Protection

Select tab

• White/Black List Management

You can Whitelist or Blacklist an IP there.
There is an option to enable/disable  cPHulk protection.

Note:- To disable cPHulk through backend. ie, via terminal

# /usr/local/cpanel/bin/cphulk_pam_ctl --disable

If the shell access is disabled then refer to the following syntax to disable the cphuld.

https://server-ip-address:2087/scripts2/doautofixer?autofix=disable_cphulkd

Crontab Failure Emails


The emails vary in subject line but include:

/bin/sh: 1 : ambiguous redirect - Cron <root@host> /usr/local/cpanel/bin/dcpumon >/dev/null 2>&1

/bin/sh: 1 : ambiguous redirect - Cron <root@host> /usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1

/bin/sh: 1 : ambiguous redirect - Cron <root@host> /usr/local/cpanel/scripts/cpremotetaskadmin > /dev/null 2>&1


Cause:

root's crontab at /var/spool/cron/root was modified outside Linux at some point and corrupted for the line endings.

Problem Test:

Run the following conmmand.

# file /var/spool/cron/root

The output should be like this if there is no error with the file: /var/spool/cron/root: ASCII text

If you are getting an output like the folowing, the file is modified with some unsupported terminators.

/var/spool/cron/root: ASCII text, with CRLF, LF line terminators

Solution:

# strings /var/spool/cron/root > /var/spool/cron/root.tmp
# mv /var/spool/cron/root.tmp /var/spool/cron/root

Here, strings command convert the characters in the file into unix readable format. So all the unsupported characters will be supported by unix.

Run the following command to test the problem is soved,
# file /var/spool/cron/root

/var/spool/cron/root: ASCII text

If you are getting the above output, the problem of getting cron failure emails solved.

Note:- The problem can occur with any crontab files. So, if you have any problem with any other crontab files, you can solve then by the above method.
You can also use
# dos2unix -b /var/spool/cron/root
instead of strings command

# w
  Shows who all are currently logged in and where they are logged in from. It also shows the load average of the server.

# who
  It also shows who is logged in.

# netstat
  Shows all current network connections.

# netstat -an
  Shows all connections to the server, the source and destination ips and ports.

# netstat -ntul
  Shows all the listening sockets.

# route -n
  Shows routing table for all ips bound to the server.

# top
  Shows live system processes in a formatted table, memory information, uptime and other useful info.

# top -u root
  Show processes running by user root only.

# nslookup  <domain_name>
  Query your default domain name server (DNS) for an Internet name (or IP number).

# traceroute <IP or domain_name>
  Displays each host that a packet travels through as it tries to reach its destination. This command is only run by root user.

# tracepath <IP or domain_name>
  To trace the route of a packet to the <IP or domain_name>. This command can run by any user. When compare to traceroute, tracepath has only limited options.

# ifconfig -a
  Display info of all the network interfaces on the server.

# ifconfig eth0 down
  This will take eth0 (assuming the device exists) down, it won’t be able to receive or send anything until you put the device back “up” again.

# ifconfig eth0 up
  This would take eth0 up and available to receive or send packets.

# ping <IP or domain_name>
  ping sends an ICMP ECHO_REQUEST packet to the specified host. It provides a very quick way to see if a machine is up and connected to the network.

# hostname
  Show the system's host name

# findsmb
  Used to list info about machines that respond to SMB name queries. findsmb with noargument would find all machines possible. You can also specify a particular subnet to localize search.

# host <domain_name>
  Performs a simple lookup of an internet address using DNS.

# dig <domain_name>
  The “domain information groper” is a DNS look up tool. This looks up information about <domain_name> in the DNS.

# dig -x <IP>
  Looks up the address and returns the associated domain name.

# dig -t MX <domain_name>
  TO show MX records of <domain_name>

# dig -t ANY <domain_name>
  To view all the record types (A, MX, NS, etc.).

# dig @<dnsserver_name>  <domain_name>
  By default dig uses the DNS servers defined in your /etc/resolv.conf file. We can use a different DNS server to perform the query, specify it in the command line.

# whois <domain_name>
  Used to look up the contact information from the “whois” databases. Also reports IP address and name server of domain as well as creation and expiration dates.

# ftp <IP>  [port]
  File transfer protocol. Transfers files to another host (insecure).

# telnet <hostname>
  Allows to remotely login to a computer. telnet does not encrypt the information it sends. Everything is sent in plain text, even passwords.

# telnet <hostname> [port]
  To connect to a host on a certain port. We can easily check wheter a specifc port on a server is listening or not, using telnet command.

# ssh <user_name>@<IP or domain_name> -p [port]
  Allows to remotely connect to <IP or domain_name> via [port]. Unlike telnet, all the information in this session are encrypted.

# scp -r <user_name>@<IP or domain_name>:<source_file_path> <local_file_path>
  With the scp (secure copy) command you can easily copy from and to a remote computer or between remote computers.