screenshot_from_2024-05-23_14-34-28.png - created

luke7858 (luke7858@undisclosed.example.com) — 2024-05-23T13:35:45+00:00

screenshot_from_2024-05-23_14-34-28.png - created

luke7858 (luke7858@undisclosed.example.com) — 2024-05-23T13:35:04+00:00

logo.png - created

luke7858 (luke7858@undisclosed.example.com) — 2020-01-02T13:53:50+00:00

logo.png - removed

luke7858 (luke7858@undisclosed.example.com) — 2020-01-02T13:51:51+00:00

home

luke7858 (luke7858@undisclosed.example.com) — 2019-12-13T15:31:57+00:00

Home Page Welcome This site has been designed to be used as a reference point, with useful commands and installation/configuration guides. You can simply use ctrl + f to search for a topic in this wiki or use the search bar in the top right hand corner

largest_files

luke7858 (luke7858@undisclosed.example.com) — 2018-10-26T09:36:48+00:00

Largest files in file system Quickly check the log file size: Quickly check the home directory of a user: ---------- NEW IMPROVED one-liner (also checked for open (Deleted) files). Change the “/” in filesystem=“/” to analyse another filesystem

compromise

luke7858 (luke7858@undisclosed.example.com) — 2018-10-12T12:58:18+00:00

Application Level Compromise When investigating a server it is EXTREMELY important to note the processes running on the device. A lot of application level compromises end up with a perl process masquerading as other processes. The best thing to do is give you an example:

sidebar

luke7858 (luke7858@undisclosed.example.com) — 2018-06-11T09:28:44+00:00

Troubleshooting * System * System Usage Summary * Process Investigation * Top 5 CPU Processes * Ram Usage Breakdown * Memory Hoggers * TCPDUMP * Web server * Apache Buddy * Apache Max Clients * php-fpm Investigating * php-fpm pal * fpm strace * Netstat * Connections to port * 'Site-down' Investigation * Log Summary * nginx server blocks (httpd -S equivalent) * HTTP Headers * mysql * mysql tuner * Process …

deleting_mail - created

luke7858 (luke7858@undisclosed.example.com) — 2018-06-11T09:27:54+00:00

Deleting Mail If your local mail is stored in single files like: /var/spool/mail/user Then you can use the mutt command to delete emails older than x number of days or months. Eg Once mutt has loaded, use the following set of commands, replacing 30d with the emails you with to delete older than

firewallcmd - created

luke7858 (luke7858@undisclosed.example.com) — 2018-06-04T11:06:02+00:00

Firewalld / Firewallcmd Whitelisting IP for a specific port using rich rules in firewalld

apache_configuration_centos

luke7858 (luke7858@undisclosed.example.com) — 2018-04-26T11:18:14+00:00

Configuration File: Apache 2.4 Pre-fork configuration The default location for the settings in apache 2.4 are: /etc/httpd/conf.modules.d/00-mpm.conf Note: If ServerLimit is lower then MaxRequestWorkers then you will get the following error: [root@apache ~]# httpd -t AH00180: WARNING: MaxRequestWorkers of 500 exceeds ServerLimit value of 256 servers, decreasing MaxRequestWorkers to 256. To increase, please see the ServerLimit directive. Syntax OK

du_vs_ls - created

luke7858 (luke7858@undisclosed.example.com) — 2018-04-20T07:39:23+00:00

du vs ls Why is ls and du showing different sizes? When there is a difference in sizes between the two commands it means that the file is a sparse file: TL;DR ls is reporting the allocated size du is reporting the space actually used Sparse File

sparsefile.png - created

luke7858 (luke7858@undisclosed.example.com) — 2018-04-20T07:38:51+00:00

single-transaction - created

luke7858 (luke7858@undisclosed.example.com) — 2018-04-10T13:27:33+00:00

--single-transaction --single-transaction This option sends a START TRANSACTION SQL statement to the server before dumping data. It is useful only with transactional tables such as InnoDB, because then it dumps the consistent state of the database at the time when BEGIN was issued without blocking any applications.

sni

luke7858 (luke7858@undisclosed.example.com) — 2018-04-03T17:38:47+00:00

SNI (Server Name Indication) Previously you required a new IP address every time you wanted to add an SSL domain. This meant each virtual host was bound to an individual IP and all encrypted traffic for that IP would be served by the vhost bound to the port

tcp - created

luke7858 (luke7858@undisclosed.example.com) — 2018-04-03T17:05:00+00:00

Transmission Control Protocol (TCP) Quick Overview of TCP TCP communication guarantees packet delivery and is suited for applications that require high reliability. TCP is used by: * HTTP * HTTPs * FTP * SMTP * Telnet TCP rearranges all of the packates in a specific order (sequence).

selinux_decision_process.png - created

luke7858 (luke7858@undisclosed.example.com) — 2015-09-21T06:56:55+00:00