managed server

If your server or website has already been compromised and your server is sending out malicious HTTP requests like scans, brute force attempts, etc. You can detect and log the outgoing packets and find out which user caused the problem by adding the following iptables rule. This rule will log any packet that leaves your server and targets port 80. It also logs the user id so you can identify which user initiated the request. To avoid flooding, we limit the number of logs to 5 per minute. You can increase or decrease this number if you need to fine tune. iptables -I OUTPUT -p tcp -m tcp --dport 80 -j LOG --log-uid -m limit --limit = 5 /minute --log-prefix BITNINJA After running this command, you have to monitor the kernel log for any captured packets. You can see the kernel logs with this command: dmesg -T Note On some older versions of dmesg the -T option is not supported. In this case you can simply run dmesg. An example of packets made by root. (UID=0 GID=0) ...

Introduction For the Debian based system Did you know that you can assign more that one IP address to a single physical network interface? This technique is quite useful, for example when working with Apache and virtual hosts, as it allows you to access same Apache server by using two different IP addresses. Temporary virtual network interface ifconfig check network interface name and then add Replace enp2s0 as per your network interface name sudo ifconfig enp2s0:0 219.91.251.164 Making the Interface permanent These interfaces are temporary that means it will not last after reboot so to make it persistent we need to add it in sudo vi /etc/network/interfaces iface eth0:0 inet static address 219.91.251.164 netmask 255.0.0.0 broadcast 123.255.255.255 For redhat based system From the above output we can see that currently we have configured eth0 network interface only. Next, we are going to locate a corresponding network interface configuration file fo...