How to redirect http requests to https on Debian Linux with Apache Web Server?

[dfads params=’groups=-1′]

Do the following to redirect http requests to https running on Debian Linux with Apache Web Server.

File : /etc/apache2/ports.conf

[code]
NameVirtualHost *:80
Listen 80
[/code]

File : /etc/apache2/sites-availabe/default

[code]
<VirtualHost *:80>
ServerName www.example.com
Redirect / https://www.example.com/
</VirtualHost>

<VirtualHost *:443>
ServerName www.example.com
# … SSL configuration goes here
</VirtualHost>
[/code]

Restart Apache Webserver

[code]
/etc/init.d/apache2 restart
[/code]

[dfads params=’groups=-1′]

Installing and Configuring Commercial SSL on Debian Linux

[dfads params=’groups=-1′]

Note: Please note that commercial SSL certificates require a unique IP address for SSL-enabled sites.

a. Enable SSL for Apache and make a directory named “ssl” inside “/etc/apache2/”

[code]
a2enmod ssl
mkdir /etc/apache2/ssl
[/code]

b. Create a Certificate Signing Request

[code]
cd /etc/apache2/ssl
openssl req -new -days 365 -nodes -keyout www.mydomain.com.key -out www.mydomain.com.csr
[/code]

The above command will create a certificate signing request (CSR) for the site which you’d like to use with SSL. Leave the challenge password blank.
Execute the following command to protect the key:

[code]
chmod 400 /etc/apache2/ssl/www.mydomain.com.key
[/code]

Files for your domain will be created in /etc/apache2/ssl. You may now submit the file ending in .csr to a commercial SSL provider for signing. You will receive a signed file after the CA signs the request. Save this file as /etc/apache2/ssl/www.mydomain.com.crt.
Execute the following command to protect the signed certificate:

[code]
chmod 400 /etc/apache2/ssl/www.mydomain.com.crt
[/code]

[dfads params=’groups=-1′]

c. Get the CA Root Certificate
You’ll need to get the root certificate for the CA that you paid to sign your certificate. You may obtain the root certs for various providers from these sites:
Verisign
Thawte
Globalsign
Comodo
For example, if we downloaded a root cert for Verisign, we would save it to /etc/apache2/ssl/verisign.cer.
d. Configure Apache to use the Signed SSL Certificate.
We’ll add an entry to /etc/apache2/ports.conf for the IP address you’ll be using to host your SSL-enabled site.
File excerpt:/etc/apache2/ports.conf

[code]
NameVirtualHost 12.34.56.78:443
Listen 443
[/code]

Replace the above IP address with your dedicated IP Address. Next, we edit the VirtualHost Configuration file i.e. /etc/apache2/sites-available/default in our case.

[code]
<Virtualhost 10.10.10.109:443>
SSLEngine On SSLCertificateFile /etc/apache2/ssl/www.mydomain.com.crt
SSLCertificateKeyFile /etc/apache2/ssl/www.mydomain.com.key
SSLCACertificateFile /etc/apache2/ssl/verisign.cer

ServerAdmin info@mydomain.com
ServerName www.mydomain.com
DocumentRoot /var/www/
ErrorLog /var/log/apache2/error.log
CustomLog /var/log/apache2/access.log combined
</Vritaulhost>
[/code]

NOTE: You can edit your existing Virtualhost Configuration file (Virtualhost *:80) by adding the above attributes within the Virtualhost tag.

e. Restart Apache:

[code]
/etc/init.d/apache2 restart
[/code]

f. Congratulations, you’ve installed a commercial SSL certificate! You can visit your site with SSL enabled. i.e. https://mydomain.com OR https://localhost/your_website/

[Source: https://library.linode.com/web-servers/apache/ssl-guides/debian-5-lenny]

[dfads params=’groups=-1′]

Upload Max Filesize PHP Configuration

[dfads params=’groups=-1′]

I have installed Apache2, PHP5.5 & MySQL5 independently on my Debian 7.3 OS. I hosted my drupal site on my Dedicated Server. I faced problem to upload files greater than 2MB from the CMS of the Site. After exploring the Internet I found the solution. Here’s the steps:

1. Edit /etc/php5/cgi/php.ini file.

2. Add the following line of code:

[php]upload_max_filesize = 10M[/php]

Make sure that you are not editing /etc/php5/php.ini file

[dfads params=’groups=-1′]

Solution to Url Encoded Slashes (%2F) Problem in Apache

[dfads params=’groups=-1′]

I was working on Drupal 6. I had to troubleshoot a site that has a problem in its link. The ugly URL looks like this: http://rcportblair.ignou.ac.in/admin/build/employee/search/result/none/0/none/%252F1

The last argument in the link i.e. %252F is a forward slash automatically added by the Drupal engine which was creating problem while generating result. There are many ways to handle these urls. One way is listed below:

<VirtualHost *:80>
    AllowEncodedSlashes On
</VirtualHost>

This directive may be set in server config file (e.g. httpd.conf OR /etc/apache2/sites-available/default) and may appear inside <VirtualHost> containers to affect certain websites. Using it in .htaccess files is not allowed.

[dfads params=’groups=-1′]

Clean URLs in CodeIgniter and Drupal for Debian based Dedicated Servers

[dfads params=’groups=-1′]

Initially, when my projects were in CodeIgniter I struggled to find out the solutions for Clean URLs. Now, I am working on Drupal CMS and the process for activating Clean URLs are similar as in CodeIgniter.

1. The first step is to add the following code in your .htaccess file.

<IfModule mod_rewrite.c> RewriteEngine on

# Rewrite URLs of the form 'x' to the form 'index.php?q=x'.
RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule ^(.*)$ project_dir/index.php?q=$1 [L,QSA] </IfModule>

2. Next, for Debian Linux OS edit /etc/apache2/sites-available/default file and add the following script.
<Directory "/var/www/project_dir/"> RewriteEngine on RewriteBase / RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule ^(.*)$ project_dir/index.php?q=$1 [L,QSA] </Directory>

3. If you are using CodeIgniter, the above two steps are done but for Drupal sites, visit the following link from your Drupal CMS Admin: http://your_site/admin/settings/clean-urls. Select the Enabled radio button & click on save.

Congratulations, You have activated Clean URLs for your websites.

[dfads params=’groups=-1′]

Apache is running a threaded MPM, but your PHP Module is not compiled to be threadsafe. You need to recompile PHP.

[dfads params=’groups=-1′]

After installing Apache2, MySQL & PHP on Debian wheezy 7.1, I tried to reboot the apache server. It showed me the following error.
Starting web server: apache2[Fri Dec 27 11:29:16 2013] [crit] Apache is running a threaded MPM, but your PHP Module is not compiled to be threadsafe. You need to recompile PHP. Pre-configuration failed Action 'start' failed. The Apache error log may have more information. failed!

So I searched through the internet to recomplie the PHP Source. But none of the tutorials were best and feasible.

Finally, after long try I found the command below that helped me to run the apache and PHP along.
apt-get install apache2-mpm-prefork

[dfads params=’groups=-1′]

Restrict SSH Access by IP Address on Linux

[dfads params=’groups=-1′]

Here is how to restrict SSH access to certain IP addresses on and off your home LAN.

Edit the /etc/hosts.allow file to include these lines, assuming your home LAN is on the 192.168.4.x nonrouting IP block, and your work address is on the routing 1.1.1.x
IP block: Remember to add the period on the end of each incomplete IP number.
If you have another complete IP address or range, add a space and that range on the end.

# allow ssh login from home LAN and work LAN
sshd,sshdfwd-X11: 192.168.4. 1.1.1.x.

Edit your /etc/hosts.deny file to include this line:
sshd,sshdfwd-X11:ALL
These lines refuse SSH connections from anyone not in the IP address blocks listed.

Log out and then try logging back in to test your configuration. Good luck!

[dfads params=’groups=-1′]

Exporting & Importing individual MySQL table command line

[dfads params=’groups=-1′]

Exporting Table

The following command syntax will export individual MySQL table from the Database:

$ mysqldump -u root -p db_name tbl_name > sql_script.sql

Importing Table

The follwoing command syntax will import individual MySQL table to the Database:

$ mysql -u root -p db_name < sql_script.sql

Both of the above command will prompt password for the root user.

[dfads params=’groups=-1′]

How to detect a DOS / DDOS Attack on your Linux Server?

[dfads params=’groups=-1′]

While researching through website traffic problems, the first thing that came in my mind is DoS / DDoS attacks. So, I started to study about it.

What is DoS / DDoS attack?

(Wiki Answer) : In computing, a denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a machine or network resource unavailable to its intended users. Although the means to carry out, motives for, and targets of a DoS attack may vary, it generally consists of efforts to temporarily or indefinitely interrupt or suspend services of a host connected to the Internet.

How to check if your Linux server is under DDOS Attack?

netstat -anp |grep ‘tcp\|udp’ | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort –n

This command will show you the list of IP’s which have logged in is maximum number of connections to your server. It becomes more complex if the attacker use fewer connections with more number of attacking IP’s.

[dfads params=’groups=-1′]

We can check active connections to the server using the following command:

netstat -n | grep :80 |wc –l

The above command will show the active connections that are open to your server. The result may vary but if it shows connections more than 500, then you will be definitely having problems.

netstat -n | grep :80 | grep SYN |wc –l

If the result of the above command is 100 or above then you are having problems with sync attack.

Once you get an idea of the ip attacking your server, you can easily block it. Fire the following command to block specific IP:

route add ipaddress reject

Fire the following command to check whether that IP is blocked or not:

route -n |grep IPaddress

You can also block a IP with iptables on the server by using the following command.

iptables -A INPUT 1 -s IPADRESS -j DROP/REJECT

service iptables restart

service iptables save

After firing the above command, KILL all httpd connection and than restart httpd service by using following command:

killall -KILL httpd/apache2

[dfads params=’groups=-1′]

[Updated 12-12-2013]

In order to delete the route entry, fire the following command.

ip route delete ipaddress

[Source : https://kb.hivelocity.net/how-to-check-if-your-linux-server-is-under-ddos-attack/]

How to update mysql root password in mysql?

[dfads params=’groups=-1′]

The Following five steps will help you to update your mysql root password in mysql:

Step # 1: Stop the MySQL server process.

Step # 2: Start the MySQL (mysqld) server/daemon process with the –skip-grant-tables option so that it will not prompt for a password.

Step # 3: Connect to the MySQL server as the root user.

Step # 4: Set a new root password.

Step # 5: Exit and restart the MySQL server.

Here are the commands you need to type for each step (log in as the root user):

Step # 1 : Stop the MySQL service:

# /etc/init.d/mysql stop

Output:

Stopping MySQL database server: mysqld.

Step # 2: Start the MySQL server w/o password:

# mysqld_safe –skip-grant-tables &

Output:

[1] 5988
Starting mysqld daemon with databases from /var/lib/mysql
mysqld_safe[6025]: started

Step # 3: Connect to the MySQL server using the MySQL client:

# mysql -u root

Output:

Welcome to the MySQL monitor. Commands end with ; or g.
Your MySQL connection id is 1 to server version: 4.1.15-Debian_1-log

Type ‘help;’ or ‘h’ for help. Type ‘c’ to clear the buffer.

mysql>

Step # 4: Set a new MySQL root user password:

mysql> use mysql;
mysql> update user set password=PASSWORD(“NEW-ROOT-PASSWORD”) where User=’root’;
mysql> flush privileges;
mysql> quit

Step # 5: Stop the MySQL server:

# /etc/init.d/mysql stop

Output:

Stopping MySQL database server: mysqld
STOPPING server from pid file /var/run/mysqld/mysqld.pid
mysqld_safe[6186]: ended

[1]+ Done mysqld_safe –skip-grant-tables

Start the MySQL server and test it:

# /etc/init.d/mysql start
# mysql -u root -p

[dfads params=’groups=-1′]