cPanel
DNS Cache Poisoning Test
by dino on Aug.13, 2008, under Basics, Command Line, DirectAdmin, Plesk, Uncategorized, WebMin, cPanel
Q. How do I verify that my ISP or my own recursive resolvers are free from DNS cache poisoning bug that is promised full disclosure of the flaw by Dan on August 7 at the Black Hat conference? How do I test my dns server for DNS cache pollution or DNS Cache Poisoning bug?
A. DNS cache poisoning (also known as DNS cache pollution) is a maliciously created or unintended situation that provides data to a Domain Name Server that did not originate from authoritative DNS sources. It occur if DNS “spoofing attack” has been encountered. An attacker will send malicious data / non-secure data in response to a DNS query. For example dns query for www.linuxbabu.net can be redirected to www.redhat.com.
how do I find out if my DNS server is open to such attack or not?
Visit Dan Kaminsky java script page to check your DNS
You can also use following command dig command, enter:$ dig +short @{name-server-ip} porttest.dns-oarc.net txtSample output:
$ dig +short @ns1.example.com porttest.dns-oarc.net txt
$ dig +short @208.67.222.222 porttest.dns-oarc.net txt
z.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.pt.dns-oarc.net.
"208.67.222.222 is GOOD: 26 queries in 0.1 seconds from 26 ports with std dev 17746.18"
Another test,$ dig +short @125.22.47.125 porttest.dns-oarc.net txtOutput:
z.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.pt.dns-oarc.net.
"125.22.47.139 is POOR: 42 queries in 8.4 seconds from 1 ports with std dev 0.00"
FIX :
Run yum updateyum updateOpen named.conf file and comment out following two lines:query-source port 53;Make sure recursion is limited to your LAN only. Set ACL. Restart bind to take effect:
query-source-v6 port 53;rndc reload
service named restart
Problems with LWP and access to https URL’s : 500 read failed: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
by dino on Jul.30, 2008, under cPanel
then you’ve probably got LWP v5.811 installed which breaks SSL connections! The author fixed the problem he created after about two days with v5.812 but the damage was done on many servers. cPanel have put a hold back on cpan module updates for LWP to v5.810 but if your servers already upgraded LWP then you’ll need to either upgrade it manually from the cpan source to v5.812 or downgrade to v5.810.
tar -xzf libwww-perl-5.810.tar.gz
cd libwww-perl-5.810
perl Makefile.PL
make
(take the default options unless you want to additional binaries installed)
make install
OR
Easier Way is to upgrade using cpan
Upgrading LWP:
CPAN: File::HomeDir loaded ok (v0.80)
Exiting subroutine via last at /usr/lib/perl5/5.8.8/CPAN.pm line 1450.
cpan>upgrade LWP
HowTo :: make scripts available to all clients on your server
by dino on Jul.21, 2008, under cPanel
If you have Perl /cgi or Php scripts and you want to make them available to all clients on your server , add an Alias in
/etc/httpd/conf/httpd.conf
file pointing to a shared directory owned by root:wheel. This is how the cPanel achieves this with their cgi-sys shared scripts in /usr/local/cpanel/cgi-sys/
cPanel : WARNING: RVSiteBuilder recommend PHP maximum execution
by dino on Jul.21, 2008, under cPanel
RVSiteBuilder warning messages under WHM :
WARNING !!
WARNING: RVSiteBuilder recommend PHP maximum execution time of each script , in 180 seconds or above.
HELP: Edit /usr/local/cpanel/3rdparty/etc/php.ini and change “max_execution_time=180″ or above, and restart cPanel service (/usr/local/cpanel/startup).
WARNING: RVSiteBuilder recommend maximum size of POST data 105M or above.
HELP: Edit /usr/local/cpanel/3rdparty/etc/php.ini and change “post_max_size=105M” or above, and restart cPanel service (/usr/local/cpanel/startup).
WARNING: RVSiteBuilder recommend maximum allowed size for uploaded files that PHP will accept 100M or above.
HELP: Edit /usr/local/cpanel/3rdparty/etc/php.ini and change “upload_max_filesize=100M” or above, and restart cPanel service (/usr/local/cpanel/startup).
Solution :
Execute using root logins :
perl /var/cpanel/rvglobalsoft/rvsitebuilder/panelmenus/cpanel/scripts/autofixphpini.pl
Restart cPanel :
/usr/local/cpanel/startup
If again you see the warnings after cPanel restart, manually change the values for PHP under WHM >> Tweak Settings.
PHP PHP max execution time for cPanel PHP execution in seconds (default 90) PHP Max Post Size for cPanel PHP in Megabytes (default 55M) cPanel PHP Register Globals (Off [unchecked] is recommended for security reasons) PHP Max Upload Size for cPanel PHP in Megabytes (default 50M) Loader to use for internal cPanel PHP (Use oldsourceguardian for version 1.x and 2.x) none ioncube
sourceguardian
oldsourceguardian
This fixes your issue.
