enabling wireless in fedora

Image via Wikipedia

Enabling wireless connection in Lenovo G550 with OS fedora 16

Today i have enabled wireless in my Lenovo G550. Please note down the steps for enabling this.

[root@localhost src]# lspci
04:00.0 Network controller: Broadcom Corporation BCM4312 802.11b/g LP-PHY (rev 01)

[root@localhost src]# dmesg | grep 04:00.0
[ 0.167848] pci 0000:04:00.0: [14e4:4315] type 0 class 0x000280

From this we can identify PCI-ID for my broadcom hardware is 14e4:4315

For enabling we need to install wget and b43-fwcutter

# yum install b43-fwcutter

#[root@localhost src] export FIRMWARE_INSTALL_DIR="/lib/firmware"

#[root@localhost src] wget http://www.lwfinger.com/b43-firmware/broadcom-wl-5.100.138.tar.bz2

#[root@localhost src]# tar xjf broadcom-wl-5.100.138.tar.bz2

#[root@localhost src]# b43-fwcutter -w "$FIRMWARE_INSTALL_DIR" broadcom-wl-5.100.138/linux/wl_apsta.o

Thats it my broadcom wireless got recognised in the fedora .....:-)

LFD process ignore file

Sometime you will be logged out from your jailshell ssh without displaying any errors on your Putty.

This may be due to lfd is killing your jailshell process.

lfd[623238]: *User Processing* PID:622892 Kill:1 User:ajeesh Time:92 EXE:/home/virtfs/ajeesh/bin/bash CMD:-jailshell

We can fix this issue using the following steps:

1. Login to your whm > Plugins > ConfigServer Security&Firewall
2. csf.pignore, process tracking
edit and needs to update these rules.
exe:/home/virtfs/ajeesh/bin/bash
user:ajeesh
cmd:jailshell

Apache tweaking

Apache tweaking

1. Compilation

* Apache is modular based software, we can compile module into apache either statistically or dynamically(DSO)load only required modules
* In DSO we can compile when the server built time or latter by using "apxs"
* Statically compiling Apache will increase memory performance.

2. use good MPM

*MPM can be loaded into the server at any time. MPM is responsible for binding the netwok ports, accepting request, send chindren to handle the request.
* two types of MPM we have in apache 1. Worker 2. prefork
* Worker :- This is **multi-thread**,fast,less memory consumer. Which makes multiple thread in a single child process
dis: faulty threas can affect all the thread in that child process.
* prefork :- This is **muti-child** process, each child handle one connection at a time, this MPM is good for single and double processor server.
dis: memory utilization is high, high chance to crshing children

3. DNS Lookup
*using for hostname logging instead of IP address, enabling this reduce the speed of the apache ,If you want to resolve IP address use "Logresolve"
*By default " HostnameLookups Off " in apache
* use IP address in "Allow from " and "Deny from" if you use hostname there will be a double dns check

4. AllowOverride

*not set " AllowOverride None " , because this will check all .htaccess file . So this is good to enable for the required directory alone.

4. SymLinksIfOwnerMatch
* need to avoid this, otherwise apache needs to make another system call to verify the owner

But for securing it is good to enable symlink protection at kernel level. In cpanel once we enable SymLinksIfOwnerMatch does not come in affect and hackers easily hack the accounts and use symlink to root directory.

5. MaxClient
* Maximum simultanious request can handle by the web-server. If we put this to a low value will cause more unused resources on your server and if we increase this to a high value which will eat your resources and increase the response time for the requests made into the web-server.
equation for the best MaxClient=RAM dedicated to your web-server/Maxchild process , child process sizecan be find out using " ps -ylC httpd --sort:rss "

6. MaxSpareServers , MinSpareServers , StartServers -> prfork : MinSpareThreads , MaxSpareThreads -> worker
*Max and Min means number of child processes keep alive while waiting for a request
* Apache can spawn 32 child process per second.
* startserver means the number of child process can create at the start up, If there are lots of request and apache is restarting frequently then set a high value for this

7. MaxRequestsPerChild
*Means the number of request that to a individual child server process handle.(maximum number of requests a server process serves)
*MaxRequestsPerChild set to some thousand , by defauld this is set as "0" so the child process never expire.

8. KeepAlive and KeepAliveTimeout
* Means multiple request send to the same tcp connection, if we set this to "Off" separate tcp connection is needed.
*KeepAliveTimeout means wait time for the next request.Good to set value between 4-7 second.

9. Compression
* We can enable compression using mod_deflate module or gzip. There is no other software required for the client side.

ServerLimit = MaxClients / ThreadsPerChild
MaxClients = ServerLimit x ThreadsPerChild

16G-32G of RAM
MaxKeepAliveRequests 150
KeepAliveTimeout 5

StartServers 20
MinSpareServers 20
MaxSpareServers 40
ServerLimit 450
MaxClients 450
MaxRequestsPerChild 1000

ifmodule worker.c
ServerLimit 18
StartServers 8
MinSpareThreads 25
MaxSpareThreads 75
ThreadsPerChild 25
MaxClients 450
MaxRequestsPerChild 1000
ifmodule
Timeout 30
2G-8G of RAM
MaxKeepAliveRequests 150
KeepAliveTimeout 5
ifmodule prefork.c
StartServers 20
MinSpareServers 20
MaxSpareServers 40
ServerLimit 350
MaxClients 350
MaxRequestsPerChild 1000
ifmodule
ifmodule worker.c
ServerLimit 14
StartServers 4
MinSpareThreads 25
MaxSpareThreads 75
ThreadsPerChild 25
MaxClients 350
MaxRequestsPerChild 1000
ifmodule
Timeout 30

VPS (Xen/OpenVZ) less than 1G RAM
KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 1
ifmodule prefork.c
MinSpareServers 5
MaxSpareServers 10
StartServers 5
MaxClients 150
MaxRequestsPerChild 300
ifmodule
ifmodule worker.c
ServerLimit 16
StartServers 2
MinSpareThreads 25
MaxSpareThreads 75
ThreadsPerChild 25
MaxClients 150
MaxRequestsPerChild 500

DDOS

DOS Attack

1.DOS (Denial Of service)
* Mostly a SYN based attack ( One way hand shaking)
* Attack is from a particular Ip so we can easily blocked in our software firewall

2. DDOS (Distributed Denial Of Service)

* from Different Geo location attack.
* Fullway hand shake attack , Full request , That is SYN and ACK based
* half tcp connection

A. Need to dected is there is a DDOS
B. How much strong it is
C.Precautions
i. application Level (Ie in the Web server configuration file) We can write a script for the Geo location Ips to block, Set 404 error
ii. System Level. ( Kernel Firewall)
iii. Network Level( Null routing)
Useful commands for DDOS detection
1. pptime
2. free -m
3. ps , example ps aux | grep wc -l

If you the attack is from a particular country you can deny all the connection from that country in your csf firewall.

useful commands:
1. tcpdump -i igb1 -nnn -c 10 dst port 80 host
this is for freebsd cmd where "igb1" is the netwok interface name
2. time tcpdump -i igb1 -nnn -c 1000 dst port 80 host 192.168.0.5 | tail
3. tail -1000 /var/log/nginx_aceess.log | awk '{print $1}' | sort | uniq -c | sort -b -k1 -n | tail
4. netstat -n | awk '{ print $5 }' | cut -d ":" -f 1 | grep "[1-9]" | sort | uniq -c | sort -n

5. awk '{print $5}' /proc/net/ip_conntrack|sort |uniq -c |sort -rn |head -25 | column -t

6. netstat -nt | grep :80 | wc -l

7. tcpdump -A dst 192.168.1.14 -s 500 | grep -i refer

8. tcpdump -i eth0 -vvv -nn -s 1700 -w ddos

~]# tcpdump -nn -vv -r ddos | awk '{print $18}' | awk -F\. '{print $1"."$2"."$3"."$4}' | sort | uniq -c | sort -rn | head -25

9. root@ajeesh [~]# /usr/local/apache/bin/apachectl fullstatus

cpanel apache conf edit

Once you have edited your apache configuration in cpanel server you need to execute the following commands to update the new values to your apche configuration file permanently.

ajeesh@tech2:~$ /usr/local/cpanel/bin/apache_conf_distiller --update

This is useful some times your https link/ document root needs to change regularly on the server. But please execute this command with your own risk on the live servers.

WHMCS : CURL Error: 7 - couldn't connect to host

Setup > General settings > Security > API IP Access Restriction

I added both the IP's to the list. The main IP for the reseller account 10.10.10.10 was to be added onto the API list.

http://docs.whmcs.com/ResellerClub#CURL_Error:_7_-_couldn.27t_connect_to_host

However, this did not fix the issue.

The second fix was to check the settings for the server.

Setup > Products & Services > Servers > "Select the server" and click on edit settings button

Check whether all the settings are entered correctly and also check the settings for Secure access.

Check "Enable ssl mode for all connections"

This fixed the issue.

Skype installation

skype installation in Linux

recently i have installed skype on my fedora machine. please note my installation steps;

1. created a yum repository

[root@server1 ~]# cd /etc/yum.repos.d/
[root@server1 yum.repos.d]# cat skype.repo
[skype]
name=Skype Repository
baseurl=http://download.skype.com/linux/repos/fedora/updates/i586/
gpgkey=http://www.skype.com/products/skype/linux/rpm-public-key.asc


[root@server1 yum.repos.d]# yum --nogpgcheck install skype
Dependencies Resolved

==============================================================================================
Package Arch Version Repository Size
==============================================================================================
Installing:
skype i586 2.1.0.81-fc10 skype 19 M

Transaction Summary
==============================================================================================
Install 1 Package(s)
Upgrade 0 Package(s)

Total download size: 19 M
Is this ok [y/N]: y
Downloading Packages:
Setting up and reading Presto delta metadata
Processing delta metadata
Package(s) data still to download: 19 M
Transaction Test Succeeded
Running Transaction
Installing : skype-2.1.0.81-fc10.i586 1/1

Installed:
skype.i586 0:2.1.0.81-fc10

Complete!
=======================================

23-05-2013:


MicroSoft released Skype 4.2 version for Linux users

yum remove skype skype-bin
yum install alsa-lib.i686 libXv.i686 libXScrnSaver.i686 qt.i686 qt-x11.i686 pulseaudio-libs.i686 pulseaudio-libs-glib2.i686 alsa-plugins-pulseaudio.i686 qtwebkit.i686
cd /usr/local/src/
wget http://download.skype.com/linux/skype-4.2.0.11-fedora.i586.rpm
rpm -ivh skype-4.2.0.11-fedora.i586.rpm