LinuxBabu ...........

This is in continuation to the post which I missed adding.

To block xmlrpc.php attacks we have been using CSF firewall with custom rules as explained below :

nano -w /etc/csf/csf.conf

Replace

CUSTOM1_LOG = "/var/log/customlog"

with bellow :

CUSTOM1_LOG = "/usr/local/apache/domlogs/*/*"

add below custom script to

nano -w /usr/local/csf/bin/regex.custom.pm

# Block IP if more than 10 requests in 3600 for wp-login
if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] "\w*(?:GET|POST) \/wp-login\.php.*" /)) {
return ("WP Login Attack",$1,"WPLOGIN","10","80,443","1");
}

# Block IP if more than 10 requests in 3600 for xml-rpc
if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] "\w*(?:GET|POST) \/xmlrpc\.php.*" /)) {
return ("WP XMLPRC Attack",$1,"XMLRPC","10","80,443","1");
}

restart csf / lfd :

csf -r
service lfd restart

You will start seeing logs as below :

 server02 lfd[3737725]: (WPLOGIN) WP Login Attack X.X.X.X (US/United States/-): 10 in the last 3600 secs - Blocked in csf [LF_CUSTOMTRIGGER]

WHM Logins shows error :: plugin error - Analytics: plugin not found

New error has been seen while login to WHM :

plugin error – Analytics: plugin not found

Error logs shows no error.

Here is the fix :

rpm -e --nodeps --justdb cpanel-analytics

yum --disablerepo="*" --enablerepo="cpanel-plugins" install cpanel-analytics

Norton for a long time used to show clients site as blacklisted, I registered for https://safeweb.norton.com/ and sent a review request........ days passed by with no reply.

Scanned site at sitecheck.sucuri.net which too showed clean but blacklisted at Norton.  

Later found a quick solution on Norton forums :

Submit category change request with WebPulse:

https://sitereview.symantec.com/#/

 Please enter a valid URL for the review process -
 > valid URL for review -
 https://ecoinsee.org/
 > Filtering Service - select 'Norton Safe Web'-
 > Your suggested category - 'Select a Category'-
 > Comments - add 'Safe Web Orange Caution with 0 Threats'-


After few hours I see the site now clean.


https://safeweb.norton.com/report/show?url=ecoinsee.org

Today I found a cPanel CentOS 7 server with empty log files :

-rw------- 1 root root 0 Aug 18 05:57 cron
-rw------- 1 root root 0 Aug 18 05:57 maillog
-rw------- 1 root root 0 Aug 18 05:57 messages
-rw------- 1 root root 0 Aug 18 05:57 secure

Found a quick solution :

rm -f /var/lib/rsyslog/imjournal.state

service rsyslog restart

Server reboot and service restarts did not help however the above worked..

Voila the logs started working…….

While upgrading OpenVZ server I got an error as below :

====
--> Finished Dependency Resolution
Error: Package: 10:qemu-kvm-vz-2.9.0-16.3.vz7.8.x86_64 (factory)
Requires: libspice-server.so.1(SPICE_SERVER_0.12.5)(64bit)
You could try using --skip-broken to work around the problem
** Found 1 pre-existing rpmdb problem(s), 'yum check' output follows:
grub2-theme-openvz-1.4-1.vl7.noarch has installed conflicts grub2-theme-openvz: grub2-theme-openvz-1.4-1.vl7.noarch
====

This is a known bug and has been patched by OpenVZ Team and below is the fix :

Update vzlinux-release
yum update vzlinux-release
Enable virtuozzolinux-factory repo – edit /etc/yum.repos.d/vzlinux.repo or launch
yum-config-manager --enable virtuozzolinux-factory
Actually launch “yum update”
yum update

This fixes the bug. 🙂

Reference : https://bugs.openvz.org/browse/OVZ-6924