James Dooley's Wiki - User contributions [en]

Denied DNS Requests

2017-06-06T13:06:30Z

Smsldoo:

[[Category:One Liners]]
==Overview==
Find denied queries against DNS, good for finding sites that are no longer hosted or do not have valid DNS records.

==Get top denied domains==
<syntaxhighlight lang='bash'>
cat /var/log/messages | grep named | grep denied | cut -d "'" -f2 | cut -d "/" -f1 | sort | uniq -ci | sort -nr | head
</syntaxhighlight>

==Get all denied domains==
<source lang='bash'>
cat /var/log/messages | grep named | grep denied | cut -d "'" -f2 | cut -d "/" -f1 | sort | uniq -ci | sort -nr > /root/denied_dns.txt
</source>

==Create dummy zone for a single domain==
<source lang='bash'>
/scripts/add_dns --domain $domain --ip 127.0.0.1
</source>

==Create dummy zone for the top 10 domains==

This will create a zone file using cPanels add_dns script and point it to 127.0.0.1 for the top 10 domains.

<source lang='bash'>
cp -r /var/named /var/named.bak
for domain in $(head /root/denied_dns.txt | awk '{print $2}' | sed 's/www\.//'); do echo "Adding $domain"; /scripts/add_dns --domain $domain --ip 127.0.0.1; done
</source>

Denied DNS Requests

2017-04-04T17:12:37Z

Smsldoo:

[[Category:One Liners]]
==Overview==
Find denied queries against DNS, good for finding sites that are no longer hosted or do not have valid DNS records.

==Get top denied domains==
<syntaxhighlight lang='bash'>
cat /var/log/messages | grep named | grep denied | cut -d "'" -f2 | cut -d "/" -f1 | sort | uniq -ci | sort -nr | head
</syntaxhighlight>

==Get all denied domains==
<source lang='bash'>
cat /var/log/messages | grep named | grep denied | cut -d "'" -f2 | cut -d "/" -f1 | sort | uniq -ci | sort -nr > /root/denied_dns.txt
</source>

==Create dummy zone for top 10 domains==

This will create a zone file using cPanels add_dns script and point it to 127.0.0.1 for the top 10 domains.

<source lang='bash'>
cp -r /var/named /var/named.bak
for domain in $(head /root/denied_dns.txt | awk '{print $2}' | sed 's/www\.//'); do echo "Adding $domain"; /scripts/add_dns --domain $domain --ip 127.0.0.1; done
</source>

Template:Conditional

2015-09-08T15:07:36Z

Smsldoo:

<div class='conditional_container' style='padding: 0 0 0 30px; border-top-left-radius: 30px; border-bottom-left-radius: 30px; background: repeat-y;'>
<div class='conditional_header' style='padding: 0 0 0 10px; border: 3px solid blue; background: rgba(0,0,255,.1);'>
If condition 1:
</div>
{{mbox|type=step|msg=Do something|text=
Things to do for this step

Other things to do for this step
}}
{{mbox|type=step|msg=Do something else|text=
Things to do for this step

Other things to do for this step
}}
<div class='conditional_header' style='padding: 0 0 0 10px; border: 3px solid blue; background: rgba(0,0,255,.1);'>
If condition 2:
</div>
{{mbox|type=step|msg=Do something|text=
Things to do for this step

Other things to do for this step
}}
{{mbox|type=step|msg=Do something else|text=
Things to do for this step

Other things to do for this step
}}</div>

Template:Conditional

2015-09-08T15:05:39Z

Smsldoo:

<div class='conditional_container' style='padding: 0 0 0 30px; border-top-left-radius: 30px; border-bottom-left-radius: 30px; background: repeat-y;'>
<div class='conditional_header' style='padding: 0 0 0 10px; border: 3px solid blue; background: rgba(0,0,255,.1);'>
If condition 1:
</div>
{{mbox|type=step|msg=Do something|text=
Things to do for this step

Other things to do for this step
}}
<div class='conditional_header' style='padding: 0 0 0 10px; border: 3px solid blue; background: rgba(0,0,255,.1);'>
If condition 2:
</div>
{{mbox|type=step|msg=Do something else|text=
Things to do for this step

Other things to do for this step
}}
</div>

Template:Conditional

2015-09-08T15:02:32Z

Smsldoo:

<div class='conditional_container' style='padding: 0 0 0 30px; border-top-left-radius: 30px; border-bottom-left-radius: 30px; background: repeat-y;'>
<div class='conditional_header' style='border: 3px solid blue; background: rgba(0,0,255,.1);'>
If condition 1:
</div>
{{mbox|type=step|msg=Do something|text=
Things to do for this step

Other things to do for this step
}}
<div class='conditional_header' style='border: 3px solid blue; background: rgba(0,0,255,.1);'>
If condition 2:
</div>
{{mbox|type=step|msg=Do something else|text=
Things to do for this step

Other things to do for this step
}}
</div>

Template:Conditional

2015-09-08T14:56:26Z

Smsldoo:

File:Conditional line.png

2015-09-08T14:46:34Z

Smsldoo: Smsldoo uploaded a new version of "File:Conditional line.png"

Template:Conditional

2015-09-08T14:43:30Z

Smsldoo:

Template:Conditional

2015-09-08T14:43:09Z

Smsldoo:

Template:Conditional

2015-09-08T14:39:49Z

Smsldoo:

Template:Conditional

2015-09-08T14:16:16Z

Smsldoo:

Template:Conditional

2015-09-08T13:55:31Z

Smsldoo: Created page with "<div style='padding: 0 25px 0 0; border: ridge 5px; background: url("/images/7/72/Conditional_line.png") repeat-y;'> Test </div>"

File:Conditional line.png

2015-09-08T13:52:48Z

Smsldoo:

Template:NavFrame

2015-04-08T13:22:52Z

Smsldoo:

<includeonly>
<div class="NavFrame {{{frameClass|}}}" style="{{{frameStyle|}}}">
<div class="NavHead {{{headClass|}}}" style="{{{headStyle|}}}">{{{head|}}}</div>
<div class="NavContent {{{contentClass|}}}" style="{{{contentStyle|}}}">
{{{content|}}}
</div>
</div>
</includeonly>
<noinclude>
== Usage ==
General usage layout is:
<pre>
{{NavFrame
|head=Text displayed in the header
|content=Text displayed in the content area
Multiple lines are allowed.
|collapse Automatically collapse the content area
|[frame|head|content]Class= CSS class for a specific element
|[frame|head|content]Style= CSS style for a specific element
}}
</pre>

==Example==
<pre>
{{NavFrame
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.
}}
</pre>
{{NavFrame
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.
}}

===Collapsed===
<pre>
{{NavFrame
|frameClass=collapsed
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.
}}
</pre>
{{NavFrame
|frameClass=collapsed
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.

}}
</noinclude>

Template:NavFrame

2015-04-08T13:19:53Z

Smsldoo:

<includeonly>
<div class="NavFrame {{#ifeq:{{{collapse|}}}|{{{collapse|-}}}|nocollapse|collapsed}} {{{frameClass|}}}" style="{{{frameStyle|}}}">
<div class="NavHead {{{headClass|}}}" style="{{{headStyle|}}}">{{{head|}}}</div>
<div class="NavContent {{{contentClass|}}}" style="{{{contentStyle|}}}">
{{{content|}}}
</div>
</div>
</includeonly>
<noinclude>
== Usage ==
General usage layout is:
<pre>
{{NavFrame
|head=Text displayed in the header
|content=Text displayed in the content area
Multiple lines are allowed.
|collapse Automatically collapse the content area
|[frame|head|content]Class= CSS class for a specific element
|[frame|head|content]Style= CSS style for a specific element
}}
</pre>

==Example==
<pre>
{{NavFrame
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.
}}
</pre>
{{NavFrame
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.
}}

===Collapsed===
<pre>
{{NavFrame
|collapse
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.
}}
</pre>
{{NavFrame
|collapse
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.

}}
</noinclude>

Template:NavFrame

2015-04-08T13:18:19Z

Smsldoo:

<includeonly>
<div class="NavFrame {{#if:{{{collapse|}}}|nocollapse|collapsed}} {{{frameClass|}}}" style="{{{frameStyle|}}}">
<div class="NavHead {{{headClass|}}}" style="{{{headStyle|}}}">{{{head|}}}</div>
<div class="NavContent {{{contentClass|}}}" style="{{{contentStyle|}}}">
{{{content|}}}
</div>
</div>
</includeonly>
<noinclude>
== Usage ==
General usage layout is:
<pre>
{{NavFrame
|head=Text displayed in the header
|content=Text displayed in the content area
Multiple lines are allowed.
|collapse Automatically collapse the content area
|[frame|head|content]Class= CSS class for a specific element
|[frame|head|content]Style= CSS style for a specific element
}}
</pre>

==Example==
<pre>
{{NavFrame
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.
}}
</pre>
{{NavFrame
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.
}}

===Collapsed===
<pre>
{{NavFrame
|collapse
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.
}}
</pre>
{{NavFrame
|collapse
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.

}}
</noinclude>

Template:NavFrame

2015-04-08T13:15:03Z

Smsldoo:

<includeonly>
<div class="NavFrame {{#if:{{{collapse}}}|nocollapse|collapsed}} {{{frameClass|}}}" style="{{{frameStyle|}}}">
<div class="NavHead {{{headClass|}}}" style="{{{headStyle|}}}">{{{head|}}}</div>
<div class="NavContent {{{contentClass|}}}" style="{{{contentStyle|}}}">
{{{content|}}}
</div>
</div>
</includeonly>
<noinclude>
== Usage ==
General usage layout is:
<pre>
{{NavFrame
|head=Text displayed in the header
|content=Text displayed in the content area
Multiple lines are allowed.
|collapse Automatically collapse the content area
|[frame|head|content]Class= CSS class for a specific element
|[frame|head|content]Style= CSS style for a specific element
}}
</pre>

==Example==
<pre>
{{NavFrame
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.
}}
</pre>
{{NavFrame
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.
}}

===Collapsed===
<pre>
{{NavFrame
|collapse
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.
}}
</pre>
{{NavFrame
|collapse
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.

}}
</noinclude>

Template:NavFrame

2015-04-08T13:14:24Z

Smsldoo:

<includeonly>
<div class="NavFrame {{#if:{{{collapse}}}|nocollapse|collapsed}} {{{frameClass|}}}" style="{{{frameStyle|}}}">
<div class="NavHead {{{headClass|}}}" style="{{{headStyle|}}}">{{{head|}}}</div>
<div class="NavContent {{{contentClass|}}}" style="{{{contentStyle|}}}">
{{{content|}}}
</div>
</div>
</includeonly>
<noinclude>
== Usage ==
General usage layout is:
<pre>
{{NavFrame
|head=Text displayed in the header
|content=Text displayed in the content area
Multiple lines are allowed.
|collapse Automatically collapse the content area
|[frame|head|content]Class= CSS class for a specific element
|[frame|head|content]Style= CSS style for a specific element
}}
</pre>

==Example==
<pre>
{{NavFrame
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.
}}
</pre>
{{NavFrame
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.
}}

===Collapsed===
<pre>
{{NavFrame
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.
|collapse
}}
</pre>
{{NavFrame
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.
|collapse
}}
</noinclude>

MediaWiki:Common.css

2015-04-08T13:11:37Z

Smsldoo:

/* CSS placed here will be applied to all skins */

.mbox_default {
padding: 0 0 0 25px;
border: ridge 5px;
}

.mbox_warning {
border-color: red;
}

.mbox_caution {
border-color: yellow;
}

.mbox_info {
border-color: blue;
}

.mbox_centos{
border-color: gold;
}

.mbox_ubuntu{
border-color: #DD4814;
}
* Standard Navigationsleisten, aka box hiding thingy
from .de. Documentation at [[Wikipedia:NavFrame]]. */
div.NavFrame {
margin: 0;
padding: 4px;
border: 1px solid #aaa;
text-align: center;
border-collapse: collapse;
font-size: 95%;
}
div.NavFrame + div.NavFrame {
border-top-style: none;
border-top-style: hidden;
}
div.NavPic {
background-color: #fff;
margin: 0;
padding: 2px;
/* @noflip */
float: left;
}
div.NavFrame div.NavHead {
height: 1.6em;
font-weight: bold;
background-color: #ccf;
position: relative;
}
div.NavFrame p,
div.NavFrame div.NavContent,
div.NavFrame div.NavContent p {
font-size: 100%;
}
div.NavEnd {
margin: 0;
padding: 0;
line-height: 1px;
clear: both;
}
a.NavToggle {
position: absolute;
top: 0;
/* @noflip */
right: 3px;
font-weight: normal;
font-size: 90%;
}

MediaWiki:Common.js

2015-04-08T13:11:16Z

Smsldoo: Created page with "/* Any JavaScript here will be loaded for all users on every page load. */ /** * Dynamic Navigation Bars. See Wikipedia:NavFrame * * Based on script from en.wikipedia...."

/* Any JavaScript here will be loaded for all users on every page load. */
/**
* Dynamic Navigation Bars. See [[Wikipedia:NavFrame]]
*
* Based on script from en.wikipedia.org, 2008-09-15.
*
* @source www.mediawiki.org/wiki/MediaWiki:Gadget-NavFrame.js
* @maintainer Helder.wiki, 2012–2013
* @maintainer Krinkle, 2013
*/
( function () {

// Set up the words in your language
var collapseCaption = 'hide';
var expandCaption = 'show';

var navigationBarHide = '[' + collapseCaption + ']';
var navigationBarShow = '[' + expandCaption + ']';

/**
* Shows and hides content and picture (if available) of navigation bars.
*
* @param {number} indexNavigationBar The index of navigation bar to be toggled
* @param {jQuery.Event} e Event object
*/
function toggleNavigationBar( indexNavigationBar, e ) {
var navChild,
navToggle = document.getElementById( 'NavToggle' + indexNavigationBar ),
navFrame = document.getElementById( 'NavFrame' + indexNavigationBar );

// Prevent browser from jumping to href "#"
e.preventDefault();

if ( !navFrame || !navToggle ) {
return false;
}

// If shown now
if ( navToggle.firstChild.data == navigationBarHide ) {
for ( navChild = navFrame.firstChild; navChild != null; navChild = navChild.nextSibling ) {
if ( hasClass( navChild, 'NavPic' ) ) {
navChild.style.display = 'none';
}
if ( hasClass( navChild, 'NavContent' ) ) {
navChild.style.display = 'none';
}
}
navToggle.firstChild.data = navigationBarShow;

// If hidden now
} else if ( navToggle.firstChild.data == navigationBarShow ) {
for ( navChild = navFrame.firstChild; navChild != null; navChild = navChild.nextSibling ) {
if ( $( navChild ).hasClass( 'NavPic' ) || $( navChild ).hasClass( 'NavContent' ) ) {
navChild.style.display = 'block';
}
}
navToggle.firstChild.data = navigationBarHide;
}
}

/**
* Adds show/hide-button to navigation bars.
*
* @param {jQuery} $content
*/
function createNavigationBarToggleButton( $content ) {
var i, j, navFrame, navToggle, navToggleText, navChild,
indexNavigationBar = 0,
navFrames = $content.find( 'div.NavFrame' ).toArray();

// Iterate over all (new) nav frames
for ( i = 0; i < navFrames.length; i++ ) {
navFrame = navFrames[i];
// If found a navigation bar
indexNavigationBar++;
navToggle = document.createElement( 'a' );
navToggle.className = 'NavToggle';
navToggle.setAttribute( 'id', 'NavToggle' + indexNavigationBar );
navToggle.setAttribute( 'href', '#' );
$( navToggle ).on( 'click', $.proxy( toggleNavigationBar, null, indexNavigationBar ) );

navToggleText = document.createTextNode( navigationBarHide );
for ( navChild = navFrame.firstChild; navChild != null; navChild = navChild.nextSibling ) {
if ( $( navChild ).hasClass( 'NavPic' ) || $( navChild ).hasClass( 'NavContent' ) ) {
if ( navChild.style.display == 'none' ) {
navToggleText = document.createTextNode( navigationBarShow );
break;
}
}
}

navToggle.appendChild( navToggleText );
// Find the NavHead and attach the toggle link (Must be this complicated because Moz's firstChild handling is borked)
for ( j = 0; j < navFrame.childNodes.length; j++ ) {
if ( $( navFrame.childNodes[j] ).hasClass( 'NavHead' ) ) {
navFrame.childNodes[j].appendChild( navToggle );
}
}
navFrame.setAttribute( 'id', 'NavFrame' + indexNavigationBar );
}
}

mw.hook( 'wikipage.content' ).add( createNavigationBarToggleButton );

}());

Template:NavFrame

2015-04-08T13:08:43Z

Smsldoo: Created page with "<includeonly> <div class="NavFrame {{#if:{{{collapse}}}||collapsed}} {{{frameClass|}}}" style="{{{frameStyle|}}}"> <div class="NavHead {{{headClass|}}}" style="{{{headStyle|..."

<includeonly>
<div class="NavFrame {{#if:{{{collapse}}}||collapsed}} {{{frameClass|}}}" style="{{{frameStyle|}}}">
<div class="NavHead {{{headClass|}}}" style="{{{headStyle|}}}">{{{head|}}}</div>
<div class="NavContent {{{contentClass|}}}" style="{{{contentStyle|}}}">
{{{content|}}}
</div>
</div>
</includeonly>
<noinclude>
== Usage ==
General usage layout is:
<pre>
{{NavFrame
|head=Text displayed in the header
|content=Text displayed in the content area
Multiple lines are allowed.
|collapse Automatically collapse the content area
|[frame|head|content]Class= CSS class for a specific element
|[frame|head|content]Style= CSS style for a specific element
}}
</pre>

==Example==
<pre>
{{NavFrame
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.
}}
</pre>
{{NavFrame
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.
}}

===Collapsed===
<pre>
{{NavFrame
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.
|collapse
}}
</pre>
{{NavFrame
|head=Text displayed in the header
|content=Text displayed in the content area

Multiple lines are allowed.
|collapse
}}
</noinclude>

Add Apache Bytes

2015-03-06T16:14:38Z

Smsldoo:

[[Category:One Liners]]
==Overview==

This one liner is designed to add up the apache send or receive byte size for a specific time period and return the IPs that use the most.

==Script==

<source lang='bash'>
daterange='06/Mar/2015:09'; \
domlog='/usr/local/apache/domlogs/petitesy/petitesymphony.com'; \
for ip in $(grep $daterange $domlog | awk '{print $1}' | sort | uniq |sort); \
do grep $daterange $domlog | grep $ip | awk "{total+=\$10}END{printf \"%15s: %'d\n\", \"$ip\", total}"; \
done | sort -n -k 2 | tail
</source>

==What to change==
daterange; Date range is the partial date you would like to search for.
For example 06/Mar/2015:09 will match the 9th hour of March 6th 2015.
06/Mar/2015:09:20 will match 9:20 on March 6th 2015.

domlog; This is the specific domlog file you would like to look at. Technically you can set this to a wild card, but the awk will need to be adjusted to take in to account the file name.

If you have a custom domlog setup with received bytes in its own column you can change the command to add up that column instead:

<source lang='bash'>
daterange='06/Mar/2015:09'; \
domlog='/usr/local/apache/domlogs/petitesy/petitesymphony.com'; \
for ip in $(grep $daterange $domlog | awk '{print $1}' | sort | uniq |sort); \
do grep $daterange $domlog | grep $ip | awk "{total+=\$6}END{printf \"%15s: %'d\n\", \"$ip\", total}"; \
done | sort -n -k 2 | tail
</source>

Obviously this depends on what column you are wanting to add up.

Add Apache Bytes

2015-03-06T16:02:49Z

Smsldoo:

[[Category:One Liners]]
==Overview==

This one liner is designed to add up the apache send or receive byte size for a specific time period and return the IPs that use the most.

==Script==

<source lang='bash'>
daterange='06/Mar/2015:09'; \
domlog='/usr/local/apache/domlogs/petitesy/petitesymphony.com'; \
for ip in $(grep $daterange $domlog | awk '{print $1}' | sort | uniq |sort); \
do grep $daterange $domlog | grep $ip | awk "{total+=\$10}END{printf \"%15s: %'d\n\", \"$ip\", total}"; \
done | sort -n -k 2 | tail
</source>

==What to change==
daterange; Date range is the partial date you would like to search for.
For example 06/Mar/2015:09 will match the 9th hour of March 6th 2015.
06/Mar/2015:09:20 will match 9:20 on March 6th 2015.

domlog; This is the specific domlog file you would like to look at. Technically you can set this to a wild card, but the awk will need to be adjusted to take in to account the file name.

If you have a custom domlog setup with received bytes in its own column you can change the command to add up that column instead:

<source lang='bash'>
daterange='06/Mar/2015:09'; \
domlog='/usr/local/apache/domlogs/petitesy/petitesymphony.com'; \
for ip in $(grep $daterange $domlog | awk '{print $1}' | sort | uniq |sort); \
do grep $daterange $domlog | grep $ip | awk "{total+=\$7}END{printf \"%15s: %'d\n\", \"$ip\", total}"; \
done | sort -n -k 2 | tail
</source>

Obviously this depends on what column you are wanting to add up.

Add Apache Bytes

2015-03-06T15:58:27Z

Smsldoo: Created page with "Category:One Liners ==Overview== This one liner is designed to add up the apache send or receive byte size for a specific time period and return the IPs that use the most..."

[[Category:One Liners]]
==Overview==

This one liner is designed to add up the apache send or receive byte size for a specific time period and return the IPs that use the most.

==Script==

<source lang='bash'>
daterange='06/Mar/2015:09'; \
domlog='/usr/local/apache/domlogs/petitesy/petitesymphony.com'; \
for ip in $(grep $daterange $domlog | awk '{print $1}' | sort | uniq |sort); \
do grep $daterange $domlog | grep $ip | awk "{total+=\$10}END{printf \"%15s: %'d\n\", $ip, total}"; \
done | sort -n -k 2 | tail
</source>

==What to change==
daterange; Date range is the partial date you would like to search for.
For example 06/Mar/2015:09 will match the 9th hour of March 6th 2015.
06/Mar/2015:09:20 will match 9:20 on March 6th 2015.

domlog; This is the specific domlog file you would like to look at. Technically you can set this to a wild card, but the awk will need to be adjusted to take in to account the file name.

If you have a custom domlog setup with received bytes in its own column you can change the command to add up that column instead:

<source lang='bash'>
daterange='06/Mar/2015:09'; \
domlog='/usr/local/apache/domlogs/petitesy/petitesymphony.com'; \
for ip in $(grep $daterange $domlog | awk '{print $1}' | sort | uniq |sort); \
do grep $daterange $domlog | grep $ip | awk "{total+=\$7}END{printf \"%15s: %'d\n\", $ip, total}"; \
done | sort -n -k 2 | tail
</source>

Obviously this depends on what column you are wanting to add up.

Count*.gif? detection and removal

2014-12-09T19:32:47Z

Smsldoo:

[[Category:Misc]]
==Overview==

Lots of script fu to find infected files with tracking codes.

Detects php and htm* files that show known signatures.

Code to clean up infected php and htm* files.

==Script==

===Combined Search===
<source lang='bash'>find /home*/ -type f -name "*.htm*" -print0 -o -type f -name "*.php" -print0 | xargs -0 grep -l "airschk\|teameter\|milkcounter\|countimg.gif\|countbk.gif" >> malware_hits.txt</source>

===HTML===
====Detect infected files====
<source lang='bash'>find -type f -name "*htm*" -print0 | xargs -0 grep -l "airschk\|teameter\|milkcounter\|countimg.gif\|countbk.gif" >> malware_hits.txt</source>

====Get detected string====
<source lang='bash'>grep "airschk\|teameter\|milkcounter\|countimg.gif\|countbk.gif" `head -1 malware_hits.txt`</source>

The output will need to be cleaned up to just the DIV tags and change /'s to \/

====Replace delete code====
<source lang='bash'>OIFS=$IFS;IFS=$'\n';for i in $(cat malware_hits.txt); do sed -i 's/<!CODE!>//g' $i; done;IFS=$OIFS</source>

===PHP===
====Detect infected files (ignore backups)====
<source lang='bash'>find -type f -name "*php" -print0 | xargs -0 grep -l "airschk\|teameter\|milkcounter\|countimg.gif\|countbk.gif" | grep -v "air.bak" >> malware_hits.txt</source>

====Backup and wipe infected code====
<source lang='bash'>OIFS=$IFS;IFS=$'\n';for i in $(cat malware_hits.txt); do mv $i $i.air.bak;s_line="1";e_line=$(egrep -nri "^\?><(\?php|html)" $i.air.bak | head -n1 | cut -d':' -f1); ne_line=$(( $e_line - 1 )); sed -e "${s_line},${ne_line}d" -e "$e_line s/^\?>//" $i.air.bak > $i; chown `pwd | cut -d "/" -f3`. $i; done;IFS=$OIFS</source>

====Alternate code if using common tags====
<source lang='bash'>OIFS=$IFS;IFS=$'\n';for i in $(cat malware_hits.txt); do mv $i $i.air.bak; sed '/\/\/{{/,/\/\/}}/d' $i.air.bak > $i; chown `pwd | cut -d "/" -f3`. $i; done;IFS=$OIFS</source>

====Additional method to delete code====
This method works if the code is on a single line and has normal code also on the line:
<source lang='bash'>
OIFS=$IFS;IFS=$'\n';for i in $(cat malware_hits.txt); do cp $i $i.mal.bak; sed -i "s/<script>eval[^\!]*\!-- uy7gdr5332rkmn -->//g" $i; done;IFS=$OIFS
</source>

====Restore all backups in case of fire====
<source lang='bash'>OIFS=$IFS;IFS=$'\n';for i in $(cat malware_hits.txt); do mv -f $i.air.bak $i; done;IFS=$OIFS</source>

====Delete backups====
<source lang='bash'>find -type f -name "*air.bak" -exec rm -f {} \;</source>
==What to change==
===<!CODE!>===
This needs to be changed with the uniq code signature. This changes per site and per script kiddie.

Test

2014-10-19T18:35:20Z

Smsldoo:

{{code
|style="border-size: 5px;"
|<syntaxhighlight lang=bash>
rm -rf $DIRECTORY
</syntaxhighlight>
|<syntaxhighlight lang=bash>
rm -rf /
</syntaxhighlight>
}}

{{Mbox
|type=warning
|msg= Warning Message
}}
{{Mbox
|type=caution
|msg= Caution Message
}}
{{Mbox
|type=info
|msg= Info Message
}}
{{Mbox
|type=centos
|msg= CentOS Message
}}
{{Mbox
|type=ubuntu
|msg= Ubuntu Message
}}
{{Mbox
|type=warning
|msg= Warning Message
|small=1
}}
{{Mbox
|type=caution
|msg= Caution Message
|small=1
}}
{{Mbox
|type=info
|msg= Info Message
|small=1
}}
{{Mbox
|type=centos
|msg= CentOS Message
|small=1
}}
{{Mbox
|type=ubuntu
|msg= Ubuntu Message
|small=1
}}
{{Mbox
|type=warning
|image=none
|msg= Warning Message
|small=1
}}
{{Mbox
|type=caution
|image=none
|msg= Caution Message
|small=1
}}
{{Mbox
|type=info
|image=none
|msg= Info Message
|small=1
}}
{{Mbox
|type=centos
|image=none
|msg= CentOS Message
|small=1
}}
{{Mbox
|type=ubuntu
|image=none
|msg= Ubuntu Message
|small=1
}}

{{Mbox
|type=step
|msg=if this works I will be afraid
|text= very very very afraid
{{mbox|small=1|type=warning|msg=What have I done}}
}}

{{Mbox|type=centos|text=
Test Test Test
{{Mbox|type=centos|text=
Test Test Test
{{Mbox|type=centos|text=
Test Test Test
}}
}}
}}

Ministat

2014-08-09T11:41:54Z

Smsldoo:

[[Category:Scripts]]
==Overview==
Down and dirty mini status viewer. Makes it easy to monitor several different sections of a server at the same time.

Useful for monitoring a server that is having problems.

The main concept is to minify the output of several sections in to a small terminal window, useful for monitoring a server when it is having problems or could at some point.

Auto adjusts output based on size of the terminal.

==Script==

<source lang='bash'>
#!/bin/bash
function checkmysql {
cmdmysql=`mysql --batch -e 'show processlist;' | grep -v "Id" | cut -f6,5,4,8 | sed -e 's/\t/ /g' | sort -nr --key=3 | sed -e 's/ /\|/' -e 's/ /\|/' -e 's/ /\|/' | awk -v termwidth="$termwidth" 'BEGIN {FS="|"}; {termwidth=termwidth - 39; query=$4; query=substr("'"${query}"'",1,termwidth) }; { printf "%-3s%-17s%7-s%-" termwidth "s%-1s",$3,$1,$2,$4,query; print ""; }' | sed '/^$/d' `
if [[ $cmdmysql != "" ]]
then
wcmysql=`echo "$cmdmysql" | wc -l`
else
wcmysql=0
fi
return
}
function checkapache {
if [ -d "/var/cpanel" ]
then
cmdapache=`service httpd status 2>&1 | sed -n '/requests\/sec/,/Scoreboard/p' | sed 'N;$!P;$!D;$d' | grep "requests/sec" -A 999`
else
cmdapache=`lynx --dump http://localhost/server-status 2>&1 | sed -n '/requests\/sec/,/Scoreboard/p' | sed 'N;$!P;$!D;$d' | grep "requests/sec" -A 999`
fi
if [[ $cmdapache != "" ]]
then
wcapache=`echo "$cmdapache" | wc -l`
else
wcapache=0
fi
return
}
function calclines {
nline=`tput lines | awk '{print int(($1 - 14) / 3)}'`
aline=`echo $nline 3 | awk '{print $1 + $2}'`
if [ $nline -gt $wcmysql ]
then
nline=`echo $nline $wcmysql | awk '{print $1 * 2 - $2}'`
fi
return
}
function addseperator {
printf "%$(tput cols)s\n"|tr ' ' '='
return
}

termwidth=`tput cols`
cat /proc/loadavg
addseperator

checkmysql
checkapache
calclines

top -c -b -n 1 | grep -v "grep" | grep "PID" -A $nline
addseperator

free | grep -v "cache:"

if [ $wcmysql -gt 0 ]
then
addseperator
echo "$cmdmysql" | head -$nline
fi
if [ $wcapache -gt 0 ]
then
addseperator
echo "$cmdapache" | head -$aline
fi
</source>

==Usage==

Direct download and execution of script (auto mode) from ent.int server:

<code>[bash,n]wget http://scripts.ent.liquidweb.com/ministat -O ministat; watch sh ministat; rm -f ministat</code>

Direct download and execution of script (auto mode) from this server:

<code>[bash,n]wget http://svn.jamesdooley.us/svn/JDooley/Ministat/ministat.sh -O ministat; watch sh ministat; rm -f ministat</code>

==What to change==

MySQL Memory Usage Verbose

2014-07-08T18:25:57Z

Smsldoo:

[[Category:Misc]]
==Overview==

Perl script to calculate MySQL max memory allotment.

Modified original code to search for cPanel defaults.

This version also give a more verbose output then the original.

==Script==

<source lang='perl'>
#!/usr/bin/perl
#
# calculate mysqld memory consumption from my.cnf
# usage: mysql-memory-usage /path/to/my.cnf [/path/to/mysqld]
#
# $Id: mysql-memory-usage 228 2010-05-31 10:53:33Z schwenke $

my $mycnf= shift;
$mycnf= "/etc/my.cnf" unless $mycnf;
die "cannot read $mycnf\n" unless (-r $mycnf);

my $mysqld= shift;
unless ($mysqld) {
# find mysqld relative to mysql
$mysqld= `which mysqld` or $mysqld= `which mysql` or die;
chomp $mysqld;
$mysqld =~ s(bin/mysql$)(libexec/mysqld);
}
die "cannot execute $mysqld\n" unless (-x $mysqld);

# read configuration
my %conf;
open M, "$mysqld --defaults-file=$mycnf --help --verbose |" or die;
while (<M>) { # skip to parameter list
last if (/^\-{5,} \-{5,}$/o);
}
while (<M>) {
last if /^$/o;
my ($var, $val)= split;
$conf{$var}= $val;
}
close M;

# static memory consumption
my $static= $conf{'key_buffer_size'} + $conf{'query_cache_size'};
# has innodb
$static+= $conf{'innodb-buffer-pool-size'} + $conf{'innodb-log-buffer-size'}
+ $conf{'innodb-additional-mem-pool-size'} if (($conf{'innodb'} eq 'TRUE') or ($conf{'innodb'} eq 'ON'));
print "Static Memory Consumption\n";
printf " %-10s key_buffer_size\n", p($conf{'key_buffer_size'});
printf "+%-10s query_cache_size\n", p($conf{'query_cache_size'});
if (($conf{'innodb'} eq 'TRUE') or ($conf{'innodb'} eq 'on')) {
printf "+%-10s innodb-buffer-pool-size\n", p($conf{'innodb-buffer-pool-size'});
printf "+%-10s innodb-log-buffer-size\n", p($conf{'innodb-log-buffer-size'});
printf "+%-10s innodb-additional-mem-pool-size\n", p($conf{'innodb-additional-mem-pool-size'});
}
printf "%-5s Total Static Memory\n\n", p($static);

# per thread memory consumption
my $thread= $conf{'thread_stack'}
+ 2*$conf{'net_buffer_length'} + $conf{'read_buffer_size'}
+ $conf{'read_rnd_buffer_size'} + $conf{'sort_buffer_size'};
print "Per thread memory consumption\n";
printf " %-10s thread_stack\n", p($conf{'thread_stack'});
printf "+%-10s net_buffer_length 2x (%s)\n", p($conf{'net_buffer_length'}), p(2*$conf{'net_buffer_length'});
printf "+%-10s read_buffer_size\n", p($conf{'read_buffer_size'});
printf "+%-10s read_rnd_buffer_size\n", p($conf{'read_rnd_buffer_size'});
printf "+%-10s sort_buffer_size\n", p($conf{'sort_buffer_size'});
printf "%-5s Total Memory Per Thread\n\n", p($thread);

# writes binlog
$thread += $conf{'binlog_cache_size'} if ($conf{'log-bin'} ne '(No');
printf " %-10s binlog_cache_size\n\n", p($conf{'binlog_cache_size'}) if ($conf{'log-bin'} ne '(No');

# MyISAM repair thread(s)
my $repair= 0;
if ($conf{'myisam-recover'} ne 'OFF') {
$repair+= $conf{'myisam_repair_threads'} * $conf{'myisam_sort_buffer_size'};
print "MyISAM Repair Thread(s)\n";
printf " %-10s myisam_repair_threads\n", p($conf{'myisam_repair_threads'});
printf "*%-10s myisam_sort_buffer_size\n", p($conf{'myisam_sort_buffer_size'});
printf "%-5s Total MyISAM Repair Thread(s)\n\n", p($repair);
};

# Memory (HEAP) tables
my $heaptables= $conf{'max_heap_table_size'};

# temp. tables
my $tmptables= min($conf{'tmp_table_size'});

#
# show result
#
print "$mysqld will use at most:\n";
printf "%-10s for global stuff\n", p($static);
printf "%-10s per thread\n", p($thread);
printf "%-10s total (with %d active threads)\n", p($static + $conf{'max_connections'}*$thread), $conf{'max_connections'};
print "and additionally:\n";
printf "%-10s while recovering MyISAM tables\n", p($repair) if ($repair);
printf "%-10s for each HEAP table\n", p($heaptables);
printf "%-10s for each temporary table\n", p($tmptables);
exit 0;

sub min {
my ($a, $b)= @_;
return $a <$b ? $a : $b;
}

sub p {
my $n= shift;
my $prefix= 0;
while ($n >= 1024 && $prefix < 5) {
$n/= 1024;
$prefix++;
}
sprintf $prefix?"%.1f %s":"%d %s", $n, qw"Bytes KB MB GB TB"[$prefix];
}
</source>

==Usage==

Direct download and execution of script (auto mode)

<source lang='bash'>wget http://svn.jamesdooley.us/svn/JDooley/MySQLMemoryUsage/sqlmem-verbose.pl -O - | perl</source>

Default

<source lang='bash'>perl sqlmem-verbose.pl</source>

Defaults will use the cpanel default MySQL locations.

Specify paths

<source lang='bash'>perl sqlmem-verbose.pl [/path/to/my.cnf] [/path/to/mysqld]</source>

==Credits==

Original code created by:

Axel Schwenke:

http://forge.mysql.com/tools/tool.php?id=266

MySQL Memory Usage

2014-07-08T18:00:38Z

Smsldoo:

[[Category:Misc]]
==Overview==

Perl script to calculate MySQL max memory allotment.

Modified original code to search for cPanel defaults.

==Script==

<source lang='perl'>
#!/usr/bin/perl
#
# calculate mysqld memory consumption from my.cnf
# usage: mysql-memory-usage /path/to/my.cnf [/path/to/mysqld]
#
# $Id: mysql-memory-usage 228 2010-05-31 10:53:33Z schwenke $

my $mycnf= shift;
$mycnf= "/etc/my.cnf" unless $mycnf;
die "cannot read $mycnf\n" unless (-r $mycnf);

my $mysqld= shift;
unless ($mysqld) {
# find mysqld relative to mysql
$mysqld= `which mysqld` or $mysqld= `which mysql` or die;
chomp $mysqld;
$mysqld =~ s(bin/mysql$)(libexec/mysqld);
}
die "cannot execute $mysqld\n" unless (-x $mysqld);

# read configuration
my %conf;
open M, "$mysqld --defaults-file=$mycnf --help --verbose |" or die;
while (<M>) { # skip to parameter list
last if (/^\-{5,} \-{5,}$/o);
}
while (<M>) {
last if /^$/o;
my ($var, $val)= split;
$conf{$var}= $val;
}
close M;

# static memory consumption
my $static= $conf{'key_buffer_size'} + $conf{'query_cache_size'};
# has innodb
$static+= $conf{'innodb-buffer-pool-size'} + $conf{'innodb-log-buffer-size'}
+ $conf{'innodb-additional-mem-pool-size'} if (($conf{'innodb'} eq 'TRUE') or ($conf{'innodb'} eq 'ON'));

# per thread memory consumption
my $thread= $conf{'thread_stack'}
+ 2*$conf{'net_buffer_length'} + $conf{'read_buffer_size'}
+ $conf{'read_rnd_buffer_size'} + $conf{'sort_buffer_size'};

# writes binlog
$thread += $conf{'binlog_cache_size'} if ($conf{'log-bin'} ne '(No');

# MyISAM repair thread(s)
my $repair= 0;
$repair+= $conf{'myisam_repair_threads'} * $conf{'myisam_sort_buffer_size'}
if ($conf{'myisam-recover'} ne 'OFF');

# Memory (HEAP) tables
my $heaptables= $conf{'max_heap_table_size'};

# temp. tables
my $tmptables= min($conf{'tmp_table_size'}, $conf{'max_heap_table_size'});

#
# show result
#
print "$mysqld will use at most:\n";
printf "%-10s for global stuff\n", p($static);
printf "%-10s per thread\n", p($thread);
printf "%-10s total (with %d active threads)\n", p($static + $conf{'max_connections'}*$thread), $conf{'max_connections'};
print "and additionally:\n";
printf "%-10s while recovering MyISAM tables\n", p($repair) if ($repair);
printf "%-10s for each HEAP table\n", p($heaptables);
printf "%-10s for each temporary table\n", p($tmptables);
exit 0;

sub min {
my ($a, $b)= @_;
return $a <$b ? $a : $b;
}

sub p {
my $n= shift;
my $prefix= 0;
while ($n >= 1024 && $prefix < 5) {
$n/= 1024;
$prefix++;
}
sprintf $prefix?"%.1f %s":"%d %s", $n, qw"Bytes KB MB GB TB"[$prefix];
}
</source>

==Usage==

Direct download and execution of script (auto mode)

<source lang='bash'>wget http://svn.jamesdooley.us/svn/JDooley/MySQLMemoryUsage/sqlmem.pl -O - | perl</source>

Default

<source lang='bash'>perl sqlmem.pl</source>

Defaults will use the cpanel default MySQL locations.

Specify paths

<source lang='bash'>perl sqlmem.pl [/path/to/my.cnf] [/path/to/mysqld]</source>

==Credits==

Original code created by:

Axel Schwenke:

http://forge.mysql.com/tools/tool.php?id=266

CentOS 6 Minimum Template Changes

2014-06-12T14:35:14Z

Smsldoo:

[[Category:Knowledge]]
yum -y install vim wget unzip sendmail man rsync bc openssh-clients

ifcfg-eth* MACs

selinux
echo 0 >/selinux/enforce
vi /etc/selinux/config

fixed

----

Find and Replace in SQL database

2014-03-25T14:36:10Z

Smsldoo:

[[Category:Knowledge]]

If you need to find and replace a small portion of code (such as ~<username> to <url>) in a database you can use something like:

<source lang='sql'>
update [table_name] set [field_name] = replace([field_name],'[string_to_find]','[string_to_replace]');
</source>

Just make sure [field_name] is set correctly on both sides. Otherwise you may overwrite data.

Change default check mem function nagios

2014-03-25T14:35:47Z

Smsldoo:

[[Category:Knowledge]]
Code to change out the check_mem script in nagios to use check_mem.pl instead.
Right now values are hard coded, will continue to look in to getting this to accept values from nrpe.

==Code==

<source lang='bash'>
wget https://raw.github.com/justintime/nagios-plugins/master/check_mem/check_mem.pl -O /usr/local/nagios/libexec/check_mem.pl

chmod +x /usr/local/nagios/libexec/check_mem.pl

echo "command[check_mem]=/usr/local/nagios/libexec/check_mem.pl -w 15 -c 5 -f -C" >> /usr/local/nagios/etc/nrpe.cfg

service xinetd restart
</source>

Side Bar Color Fixer

2014-03-25T14:34:29Z

Smsldoo:

[[Category:GreaseMonkey]]
==Overview==
Changes the link colors to something more readable and removes link underlines.

Also shrunk the text down to fit inside the frame for Nate's sidebar.

Removed search boxes since nobody uses them anyway.

==Script==

<source lang='bash'>
// ==UserScript==
// @name HD Link Color
// @namespace http://jamesdooley.us
// @description Change HD Status Links to more visible colors
// @include https://hd.int.liquidweb.com/stats/acd/support/vertsearch.mhtml
// ==/UserScript==

GM_addStyle("A { color: #FFF; text-decoration: none}");
GM_addStyle(".numbers { float: right;}");
GM_addStyle(".header { font-size: 10px; }");
GM_addStyle(".stats { font-size: 10px; }");
GM_addStyle(".statsred { font-size: 10px; }");
GM_addStyle(".statsgreen { font-size: 10px; }");

tablerows = document.getElementsByTagName('tr');

for (i=9; i<=14; i++)
{
tablerows[i].style.display = "none";
}

document.getElementsByTagName('p')[0].style.display = "none";

</source>

==What to change==
To change the link color

color: <hex>

To enable link underlines remove

text-decoration: none

Not So Important

2014-03-25T14:34:13Z

Smsldoo:

[[Category:GreaseMonkey]]
==Overview==

Removes "Important" customer tickets from enterprise HD.

Only looks through ticket area of screen and hides the tr tag for elements that contain the important icon.

==Script==

<source lang='javascript'>
// ==UserScript==
// @name Not So Important
// @namespace http://jamesdooley.us
// @description Remove important tickets from HD view
// @include https://hd.int.liquidweb.com/priority/
// @include https://adminhd.liquidweb.com/priority/
// ==/UserScript==

var hdform = document.getElementsByTagName('form');
var trlist = hdform[3].getElementsByTagName('tr');

for (var i=0; i < trlist.length; i++) {
var imgele = trlist[i].getElementsByTagName('img')
if (imgele.length > 0) {
notsoimportant(imgele)
}
}

function notsoimportant (imgelement) {
if (imgelement[0].alt == "auth-importantpriority") {
var style = trlist[i].style
style.display = "none"
}
return true;
}
</source>

==What to change==

Less Detail

2014-03-25T14:33:54Z

Smsldoo:

[[Category:GreaseMonkey]]
==Overview==
Removes global daily stats from the page.

Shows only users in the userlist variable.

==Script==

<source lang='javascript'>
// ==UserScript==
// @name less-detail
// @namespace http://jamesdooley.us
// @description Removes extra junk from response chart and only shows enterprise staff.
// @include https://hd.int.liquidweb.com/stats/detail.mhtml
// ==/UserScript==

var userlist = new Array("jdooley","jscott","jschinkel","aauble","bking","jtaylor","mgearhart","nhubbard","awilliams","mjung","tholloway","jbeckmeyer","pcrandall","travisz","ssayers","mwineland");

document.getElementsByTagName('h3')[0].style.display = "none"
document.getElementsByTagName('table')[0].style.display = "none"

var trlist = document.getElementsByTagName('table')[1].getElementsByTagName('tr');

for (var i=1; i < trlist.length; i++) {
var uname = trlist[i].getElementsByTagName('td')[0].innerHTML
trlist[i].style.display = "none"
for (var u=0; u < userlist.length; u++) {
if (uname==userlist[u]) {
trlist[i].style.display = ""
}
}
}
</source>

==What to change==
userlist needs to be changed with the list of users you want to display.

HD Button Remove

2014-03-25T14:33:34Z

Smsldoo:

[[Category:GreaseMonkey]]
==Overview==

Cleans up HD keyword button clutter.

==Script==

<source lang='javascript'>
// ==UserScript==
// @name Button Remover
// @namespace http://jamesdooley.us
// @description Get rid of button clutter
// @include https://adminhd.liquidweb.com*/msgs/*
// @include https://hd.int.liquidweb.com*/msgs/*
// ==/UserScript==

//List of buttons by value to remove
var btnlist = new Array("besteffort","document_this","escalations","resolver-changed","storm","support_handoff","terminations");

var hdbutton = document.getElementsByTagName('button');
for (var i=0; i < hdbutton.length; i++) {
btnremove(hdbutton[i].getAttribute('value'))
}

function btnremove (btnvalue){
for (var b=0; b < btnlist.length; b++) {
if (btnvalue==btnlist[b]) {
var style = hdbutton[i].style;
style.display = 'none';
}
}
return false;
}
</source>

==What to change==

btnlist contains a list of buttons you wish to remove. The value is the text that is displayed on the button.

SwapClean

2014-03-25T14:33:07Z

Smsldoo:

[[Category:Scripts]]
==Overview==
Script that is run via cron every ~10 minutes. Main purpose is to clear any swap usage if the system has the enough free ram and load is below a set value.

==Script==

<source lang='bash'>
#!/bin/bash
#Swap Cleaner
#Watches swap usage
#If there is swapping going on and there is enough free (+cache) ram, then turn swap off and back on.
#Created by James Dooley
#Feature / Bug requests jdooley@lw

#User Assigned Variables

swapthresh=0 #Swap threshold for clearing swap. Will not clear until this value is hit. Good for servers that normally allocates small amounts of swap for some reason.
freethresh=0 #Real free (free+cached) - current swap threshold. Ensures that atleast x bytes are free before clearing.
loadthresh=0 #Load threshold, will not clear if above this value (unless 0)
logrotate=1000 #Max number of lines in the log file
####

function plog {
echo "[ `date` ][ $curswap; $curfree; $realload ] $1" >> /var/log/swapclean
if [ "`wc -l /var/log/swapclean | awk '{print $1}'`" -gt "$logrotate" ]
then
sed -i -e "1d" /var/log/swapclean
fi
return
}

function clearswap {
plog "Clearing swap"
touch /var/run/.swapoff
echo $$ > /var/run/.swapoff
/sbin/swapoff -a && /sbin/swapon -a
rm -f /var/run/.swapoff
plog "Swap Cleared"
return
}

function checkswap {

curswap=`free | fgrep "Swap:" | awk '{print $3}'`
curfree=`free | fgrep "buffers/cache:" | awk '{print $4}'`
realload=`cat /proc/loadavg | awk '{print $1}'`
curload=`echo "$realload * 100" | bc | sed 's/[.].*//'`
loadthresh=`echo "$loadthresh *100" | bc | sed 's/[.].*//'`
swapdif=`expr $curfree - $curswap`

if [ "$swapthresh" -lt "$curswap" ]
then
#Server has swapped and is above its threshold
if [ "$freethresh" -lt "$swapdif" ]
then
#Free - Swap is greater then freethresh
if [ "$curload" -lt "$loadthresh" -o "$loadthresh" -eq 0 ]
then
#Load is below threshold
if [ ! -e "/var/run/.swapoff" ]
then
clearswap
else
plog "Lock file found, swap may be already clearing"
opid=`cat /var/run/.swapoff`
if [ ! "`ps ax | grep $opid | grep ${0##*/}`" ]
then
plog "PID not active or not owned by swapclean, clearing pid file"
rm -f /var/run/.swapoff
clearswap
else
plog "Swap already being cleared, PID active"
fi
fi
else
plog "High load, waiting to clear swap"
fi
else
plog "Not enough free memory, waiting to clear swap"
fi
fi
return
}

function enablecron {
if [ -e "/etc/cron.d/swapclean.sh" ]
then
echo "Cron already enabled, use change to set new time"
else
echo "What time would you like to set the cron to"
echo "[IE: */10 * * * * ]"
read crontime;
if [ ! $crontime ]
then
crontime="*/10 * * * *"
fi
echo "SHELL=/bin/bash" > /etc/cron.d/swapclean.sh
echo "$crontime root $(readlink -f $0)" >> /etc/cron.d/swapclean.sh
chmod 0644 /etc/cron.d/swapclean.sh
echo "Cron enabled [$crontime root $(readlink -f $0)]"
return
fi
return
}

function disablecron {
if [ -e "/etc/cron.d/swapclean.sh" ]
then
rm -f /etc/cron.d/swapclean.sh
echo "Cron disabled"
else
echo "Cron not enabled"
fi
return
}

case $1 in
--cron)
case $2 in
on)
enablecron
;;
off)
disablecron
;;
change)
disablecron
enablecron
;;
esac
;;
--help)
echo "Check swap usage:"
echo " --cron [on, change, off]"
echo " on: Turns on cron job and asks for time"
echo " change: Changes the cron time"
echo " off: Turns off the cron job"
;;
*)
checkswap
;;
esac
</source>

==What to change==
===swapthresh===
This value allows swap to get to a certain level before looking to swap.

===freethresh===
This is the level of extra free ram the script will require before attempting to clean swap

===loadthresh===
This is the load level threshold at which the script will allow swap to be cleaned.

You will probably want to set this value to a sane number, otherwise an already stressed system may lock up.

===logrotate===
This is the number of lines that will be stored in the log file. When reached the top line will be deleted.

Mysql-dumpall

2014-03-25T14:32:43Z

Smsldoo:

[[category:Scripts]]
Script to dump all database tables as individual .sql files.
Can be set up as a cron for continuous dumps.

==Script==
<source lang='bash'>
#!/bin/bash
for d in $(mysql -e 'show databases;' | grep -v Database);
do for t in $(mysql $d -e 'show tables;' | grep -v Tables);
do mysqldump $d $t > /home/mysqldump/$d.$t.sql;
done;
done
</source>

==Usage==

Save on server and either run manually or set up cron job.

will need to create /home/mysqldump directory (or change the directory name).

Errornotify

2014-03-25T14:32:25Z

Smsldoo:

[[Category:Scripts]]
==Overview==
A simple script I wrote to email me a summery of apache error messages in the last 24 hours.

Cuts out uniq data such as IP addresses and unique_ids for modsec.

==Script==

<source lang='bash'>
#!/bin/bash

acctlist="jamesdoo;jamesdooley.us;james@jamesdooley.us devize;devize.us;james@jamesdooley.us"

servername="server1.infusedsites.com"
masteremail="server@infusedsites.com"

logperiod=`date +"%b %d"`
fulllogs=`grep "$logperiod" /usr/local/apache/logs/error_log`
modseclogs=`echo "$fulllogs" | grep "ModSec" | cut -d "]" -f2- | sort | cut -d "]" -f1,3- | rev | cut -d "[" -f2- | rev | sort | uniq -c | sort -nr`
remaininglogs=`echo "$fulllogs" | grep -v "ModSec" | cut -d "]" -f2- | sort | uniq -c | sort -nr`

function masterlogs {
echo -e "Daily Apache Error report for $servername \n\n\n" > email.txt
echo -e "\n\n====Error Messages====\n" >> email.txt
echo "$remaininglogs" | grep "\[error\]" >> email.txt
echo -e "\n\n====Warnings====\n" >> email.txt
echo "$remaininglogs" | grep "\[warn\]" >> email.txt
echo -e "\n\n====Notice====\n" >> email.txt
echo "$remaininglogs" | grep "\[notice\]" >> email.txt
echo -e "\n\n====ModSec====\n" >> email.txt
echo "$modseclogs" >> email.txt

cat email.txt | mail -s "Daily Apache Error Log Report" $masteremail
}

function processacctlogs {
user=`echo $1 | cut -d ";" -f1`
domain=`echo $1 | cut -d ";" -f2`
email=`echo $1 | cut -d ";" -f3`

domainlogs=`echo "$remaininglogs" | grep "$domain\|$user"`
domainmodsec=`echo "$modseclogs" | grep "$domain\|$user"`

echo -e "Daily Apache error report for $domain \n\n\n" > email.txt
echo -e "\n\n====Error Messages====\n" >> email.txt
echo "$domainlogs" | grep "\[error\]" >> email.txt
echo -e "\n\n====Warnings====\n" >> email.txt
echo "$domainlogs" | grep "\[warn\]" >> email.txt
echo -e "\n\n====Notice====\n" >> email.txt
echo "$domainlogs" | grep "\[notice\]" >> email.txt
echo -e "\n\n====ModSec====\n" >> email.txt
echo "$domainmodsec" >> email.txt

cat email.txt | mail -s "Daily Apache error log report for $domain" $email
}

masterlogs;
for account in $(echo $acctlist);
do
processacctlogs $account
done

rm -f email.txt
</source>

==What to change==

Disk Speed Test

2014-03-25T14:32:07Z

Smsldoo:

[[Category:Scripts]]
==Overview==

Runs hdparm -t, seeker and Nates dd script.

By default each test is run 3 times to get a good running average.

Outputs are cleaned up to provide usable information

For Nates dd test you will need to have the drive mounted and listed in fstab

==Script==

<source lang='bash'>
#!/bin/bash

testpath=`grep $1 /etc/fstab | awk '{print $2}'`
testcount=3

echo "Testing hdparm -t $1"
for i in `seq 1 $testcount`;
do
hdparm -t $1 | grep "Timing"
done

if [ `which seeker 2>/dev/null` ]
then
echo "Testing seeker $1"
for i in `seq 1 $testcount`;
do
seeker $1 | grep "Results"
done
else
echo "Seeker is not installed, please install from rpmforge: 'yum install seeker'"
fi

if [ `which pv 2>/dev/null` ]
then
echo "Testing DD pv"
echo "Write Test"
for i in `seq 1 $testcount`;
do
sync
dd if=/dev/zero bs=1M count=2048 2>/dev/null | dd of=$testpath/ddfile 2>&1 | grep copied
done
echo "Read Test"
for i in `seq 1 $testcount`;
do
sync
cat $testpath/ddfile | pv -trb -s 2G > /dev/null
done
rm -f $testpath/ddfile
else
echo "PV is not installed, please install 'yum install pv'"
fi
</source>

==Usage==
<source lang='bash'>
sh hdtest <drive path>
</source>

==What to change==

testcount This should be set to the number of times you want this test to run.

Bot Block

2014-03-25T14:31:45Z

Smsldoo:

[[Category:Scripts]]
==Overview==

==Script==
===Get Top User Agents===
Get a list of top user agents (bot nets will only have a few and there will be tons of hits)
<source lang='bash'>
tail -1000 <DOMLOGFILE> | cut -d '"' -f6 | sort | uniq -c | sort -n
</source>
or
<source lang='bash'>
cat <DOMLOGFILE> | cut -d '"' -f6 | sort | uniq -c | sort -n
</source>
===Block By User Agent===
Block those user agents
<source lang='bash'>

#!/bin/bash
loglines=1000
logperiod=`tail -$loglines <DOMLOG WITH FULL PATH>`
logrotate=10000
logdelete=100
useragents[0]='Opera/9.02 (Windows NT 5.1; U; ru)'
useragents[1]='Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)'
useragents[2]='Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1'

function plog {
echo "[ `date` ] $1" >> /var/log/botblock
if [ "`wc -l /var/log/botblock | awk '{print $1}'`" -gt "$logrotate" ]
then
sed -i -e "`echo $logdelete`d" /var/log/botblock
fi
return
}

function botblock {
touch /var/run/.botblock
echo $$ > /var/run/.botblock

agentlen=${#useragents[@]}

for (( u=0; u<${agentlen}; u++));
do
for i in $(echo "$logperiod" | grep "GET /" | grep "${useragents[$u]}" | cut -d " " -f1 | sort | uniq | sort)
do
plog "Attempting to block $i ${useragents[$u]}"
plog "`/usr/local/sbin/apf -d $i "RU Botnet IP (${useragents[$u]})" 2>&1`" ########APF FIREWALL
#plog "`/usr/sbin/csf -d $i "RU Botnet IP (${useragents[$u]})" 2>&1`" ########CSF FIREWALL
done
done
rm -f /var/run/.botblock
}

function checkbots {
if [ ! -e "/var/run/.botblock" ]
then
botblock
else
plog "Lock file found, script may be already running"
opid=`cat /var/run/.botblock`
if [ ! "`ps ax | grep $opid | grep ${0##*/}`" ]
then
plog "PID not active or not owned by script, clearing pid file"
rm -f /var/run/.botblock
botblock
else
plog "Script already running, PID active"
fi
fi
}

function enablecron {
if [ -e "/etc/cron.d/botblock.sh" ]
then
echo "Cron already enabled, use change to set new time"
else
echo "What time would you like to set the cron to"
echo "[IE: * * * * * ]"
read crontime;
if [ ! $crontime ]
then
crontime="* * * * *"
fi
echo "SHELL=/bin/bash" > /etc/cron.d/botblock.sh
echo "$crontime root $(readlink -f $0)" >> /etc/cron.d/botblock.sh
chmod 0644 /etc/cron.d/botblock.sh
echo "Cron enabled [$crontime root $(readlink -f $0)]"
return
fi
return
}

function disablecron {
if [ -e "/etc/cron.d/botblock.sh" ]
then
rm -f /etc/cron.d/botblock.sh
echo "Cron disabled"
else
echo "Cron not enabled"
fi
return
}

function scanlog {
if [ -e "$2" ]
then
tail -$loglines $2 | cut -d '"' -f6 | sort | uniq -c | sort -n
elif [ -e "/usr/local/apache/domlogs/$2" ]
then
tail -$loglines /usr/local/apache/domlogs/$2 | cut -d '"' -f6 | sort | uniq -c | sort -n
else
echo "$2 - Log file not found"
fi
return
}

function blockcount {
grep Botnet /etc/apf/deny_hosts.rules | cut -d "(" -f2-3 | sort | uniq -c | sort -n
return
}

function findcommon {
if [ -e "$2" ]
then
for i in $(tail -$loglines $2 | cut -d '"' -f6 | sort | uniq -c | sort -n); do echo "$i"; done | sort | uniq -c | sort -n | tail -40
elif [ -e "/usr/local/apache/domlogs/$2" ]
then
for i in $(tail -$loglines /usr/local/apache/domlogs/$2 | cut -d '"' -f6 | sort | uniq -c | sort -n); do echo "$i"; done | sort | uniq -c | sort -n | tail -40
else
echo "$2 - Log file not found"
fi
}

case $1 in
--cron)
case $2 in
on)
enablecron
;;
off)
disablecron
;;
change)
disablecron
enablecron
;;
esac
;;
--scanlog)
scanlog
;;
--blockcount)
blockcount
;;
--findcommon)
findcommon
;;
--help)
echo "Check for bots based on user agent and block in firewall:"
echo " --cron [on, change, off]"
echo " on: Turns on cron job and asks for time"
echo " change: Changes the cron time"
echo " off: Turns off the cron job"
echo ""
echo " --scanlog [domlog to scan]"
echo " Scan a log file and return user agents"
echo " --blockcount"
echo " Return number of current blocks per user agent"
echo " --findcommon [domlog to scan]"
echo " Find common keywords for blocking based on user agents"
;;
*)
checkbots
;;
esac

</source>

===Block By Agent Length===
<source lang='bash'>
#!/bin/bash
loglines=1000
logperiod=`tail -$loglines /usr/local/apache/domlogs/abzocke.derblog.net`
logrotate=10000
logdelete=100
#useragents[0]='Opera/9.02 (Windows NT 5.1; U; ru)'
#useragents[1]='Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)'
#useragents[2]='Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1'

function plog {
echo "[ `date` ] $1" >> /var/log/botblock
if [ "`wc -l /var/log/botblock | awk '{print $1}'`" -gt "$logrotate" ]
then
sed -i -e "`echo $logdelete`d" /var/log/botblock
fi
return
}

function botblock {
touch /var/run/.botblock
echo $$ > /var/run/.botblock

agentlen=${#useragents[@]}

# for (( u=0; u<${agentlen}; u++));
# do
# for i in $(echo "$logperiod" | grep "GET /" | grep "${useragents[$u]}" | cut -d " " -f1 | sort | uniq | sort)
# do
# plog "Attempting to block $i ${useragents[$u]}"
# plog "`/usr/local/sbin/apf -d $i "RU Botnet IP (${useragents[$u]})" 2>&1`"
# done
# done
for i in $(echo "$logperiod" | grep "GET / HTTP/1.1" | grep -E '"[a-zA-Z0-9]{10}"$' | awk '{ print $1 }')
do
plog "Attempting to block $i"
#plog "`/usr/local/sbin/apf -d $i Botnet 2>&1`"
plog "`/usr/sbin/csf -d $i Botnet 2>&1`"
done

rm -f /var/run/.botblock
}

function checkbots {
if [ ! -e "/var/run/.botblock" ]
then
botblock
else
plog "Lock file found, script may be already running"
opid=`cat /var/run/.botblock`
if [ ! "`ps ax | grep $opid | grep ${0##*/}`" ]
then
plog "PID not active or not owned by script, clearing pid file"
rm -f /var/run/.botblock
botblock
else
plog "Script already running, PID active"
fi
fi
}

function enablecron {
if [ -e "/etc/cron.d/botblock.sh" ]
then
echo "Cron already enabled, use change to set new time"
else
echo "What time would you like to set the cron to"
echo "[IE: * * * * * ]"
read crontime;
if [ ! $crontime ]
then
crontime="* * * * *"
fi
echo "SHELL=/bin/bash" > /etc/cron.d/botblock.sh
echo "$crontime root $(readlink -f $0)" >> /etc/cron.d/botblock.sh
chmod 0644 /etc/cron.d/botblock.sh
echo "Cron enabled [$crontime root $(readlink -f $0)]"
return
fi
return
}

function disablecron {
if [ -e "/etc/cron.d/botblock.sh" ]
then
rm -f /etc/cron.d/botblock.sh
echo "Cron disabled"
else
echo "Cron not enabled"
fi
return
}

function scanlog {
if [ -e "$2" ]
then
tail -$loglines $2 | cut -d '"' -f6 | sort | uniq -c | sort -n
elif [ -e "/usr/local/apache/domlogs/$2" ]
then
tail -$loglines /usr/local/apache/domlogs/$2 | cut -d '"' -f6 | sort | uniq -c | sort -n
else
echo "$2 - Log file not found"
fi
return
}

function blockcount {
grep Botnet /etc/apf/deny_hosts.rules | cut -d "(" -f2-3 | sort | uniq -c | sort -n
return
}

case $1 in
--cron)
case $2 in
on)
enablecron
;;
off)
disablecron
;;
change)
disablecron
enablecron
;;
esac
;;
--scanlog)
scanlog
;;
--blockcount)
blockcount
;;
--help)
echo "Check for bots based on user agent and block in firewall:"
echo " --cron [on, change, off]"
echo " on: Turns on cron job and asks for time"
echo " change: Changes the cron time"
echo " off: Turns off the cron job"
echo ""
echo " --scanlog [domlog to scan]"
echo " Scan a log file and return user agents"
echo " --blockcount"
echo " Return number of current blocks per user agent"
;;
*)
checkbots
;;
esac
</source>

==What to change==

Apache Restart

2014-03-25T14:30:59Z

Smsldoo:

[[Category:Scripts]]
==Overview==

Restarts apache if load gets above a certain threshold. Has logging and locking functionality.

==Script==

<source lang='bash'>
#!/bin/bash

#Load Threshold for doing a dump.
THRESH=20

#Number of lines to keep in log
LOGROTATE=1000

#Email Alerts
EMAILTO=""

function plog {

echo "[ `date` ][ $LOAD ] $1" >> /var/log/apacherestart
if [ EMAILTO ]
then
echo "[ `date` ][ $LOAD ] $1"
fi

if [ "`wc -l /var/log/apacherestart | awk '{print $1}'`" -gt "$LOGROTATE" ]
then
sed -i -e "1d" /var/log/apacherestart
fi
return
}

function restartapache {
plog "Restarting Apache"
echo $$ > /var/run/.apacherestart
service httpd restart
rm -f /var/run/.apacherestart
plog "Apache Restart Completed"
return
}

function enablecron {
if [ -e "/etc/cron.d/apacherestart.sh" ]
then
echo "Cron already enabled, use change to set new time"
else
echo "What time would you like to set the cron to"
echo "[IE: */1 * * * * ]"
read crontime;
if [ ! $crontime ]
then
crontime="*/1 * * * *"
fi
echo "SHELL=/bin/bash" > /etc/cron.d/apacherestart.sh
if [ $EMAILTO ]
then
echo 'MAILTO="$MAILTO"' > /etc/cron.d/apacherestart.sh
fi
echo "$crontime root $(readlink -f $0)" >> /etc/cron.d/apacherestart.sh
chmod 0644 /etc/cron.d/apacherestart.sh
echo "Cron enabled [$crontime root $(readlink -f $0)]"
return
fi
return
}

function disablecron {
if [ -e "/etc/cron.d/apacherestart.sh" ]
then
rm -f /etc/cron.d/apacherestart.sh
echo "Cron disabled"
else
echo "Cron not enabled"
fi
return
}

function checkload {
LOAD=`cat /proc/loadavg | awk '{print $1}' | awk -F '.' '{print $1}'`

if [ $LOAD -gt $THRESH ]
then
if [ ! -e "/var/run/.apacherestart" ]
then
restartapache
else
opid=`cat /var/run/.apacherestart`
if [ ! "`ps ax | grep $opid | grep ${0##*/}`" ]
then
plog "Stale Lock File Removed"
rm -f /var/run/.apacherestart
restartapache
else
plog "Active Lock File Found"
fi
fi
fi
}

case $1 in
--cron)
case $2 in
on)
enablecron
;;
off)
disablecron
;;
change)
disablecron
enablecron
;;
esac
;;
--help)
echo "Apache Restart usage:"
echo " --cron [on, change, off]"
echo " on: Turns on cron job and asks for time"
echo " change: Changes the cron time"
echo " off: Turns off the cron job"
;;
*)
checkload
;;
esac
</source>

==What to change==

THRESH load threshold before trying to restart apache

LOGROTATE number of lines to keep in the log before rotating.

Adig

2014-03-25T14:30:34Z

Smsldoo:

[[Category:Scripts]]
==Overview==
Advanced dig script that queries default name server on your workstation, google, the liquidweb name server and name servers returned by dig (/registrar).

Good for finding differences being reported by different name servers.

Searching for main domain will return all record types (A,MX,TXT,NS,CNAME etc).

Searching for subdomain will generally only return CNAME and A records.

Color codes records for easier viewing.

'''This should not be installed on customer servers'''

==Installation==

<source lang='bash'>
wget http://scripts.ent.liquidweb.com/adig -O /usr/bin/adig && chmod +x /usr/bin/adig
</source>

==Usage==

<source lang='bash'>
adig site.com
</source>

==Script==

<source lang='bash'>
#!/bin/bash
OIFS=$IFS;IFS=$'\n'

function printresults {
#$1 Title
#$2 Message
echo -e "\t\e[01;32m=== $1 ===\e[0m"
for r in $(echo "$2")
do
echo -e "`colorresult $r`"
done
}

function colorresult {
rtype=`echo "$1" | awk '{print $4}'`
case $rtype in
A)
echo "\e[0;32m`echo "$1"`\e[0m"
;;
MX)
echo "\e[0;31m`echo "$1"`\e[0m"
;;
TXT)
echo "\e[0;34m`echo "$1"`\e[0m"
;;
NS)
echo "\e[0;36m`echo "$1"`\e[0m"
;;
CNAME)
echo "\e[0;35m`echo "$1"`\e[0m"
;;
*)
echo "$1"
;;
esac
}

function getdig {
#$1 domain
#$2 against
if [ -n "$2" ]
then
digresult=`dig $1 ANY +noall +answer @$2`
else
digresult=`dig $1 ANY +noall +answer`
fi
cleaned=`echo "$digresult" | grep -v "<<>>" | grep -ve "^;;" | sed "/^$/d" | sort -k 4`
echo "$cleaned"
}

function getdigns {
#$1 domain
digresult=`dig +noall +authority $1 | awk '{print $5}'`
cleaned=`echo "$digresult" | grep -v "<<>>" | grep -ve "^;;" | sed "/^$/d" | sort | sed "s/\.$//"`
echo "${cleaned,,}"
}

function printusage {
echo "Return dig results from several different name servers"
echo "Usage: adig DOMAIN"
}

if [ ! -n "$1" ]
then
printusage
exit
fi

printresults "Digging against resolv.conf" "`getdig $1`"
printresults "Digging against liquidweb.com" "`getdig $1 'ns.liquidweb.com'`"
printresults "Digging against google.com" "`getdig $1 '8.8.8.8'`"

for i in $(getdigns $1)
do
printresults "Digging against $i" "`getdig $1 $i`"
done

IFS=$OIFS
</source>

View Domlogs for top visitors

2014-03-25T14:30:03Z

Smsldoo:

[[Category:One Liners]]
==Overview==
Enter a partial date string to get top visitors during that period. Will also return site and all user agents that IP has used.
==Script==

===Standard===
<source lang='bash'>
echo "Date String [31/Mar/2011:13:4]"; read datestring; \
for i in $(grep $datestring /usr/local/apache/domlogs/*/* | awk {'print $1'} | sort | uniq -c | sort -n | sed -e 's/^[ \t]*//' | awk '{print $1 ":" $2}' | tail -10); \
do count=`echo $i | cut -d: -f1`; \
ip=`echo $i | cut -d: -f3`; \
domain=`echo $i | cut -d: -f2`; \
agent=`grep $datestring $domain | grep $ip | cut -d '"' -f6 | sort | uniq -c | sort -n | awk {'print "\n\t" $0'}` ; \
echo -e "$count $ip $domain $agent"; done
</source>

===Auto Date===
<source lang='bash'>
datestring=`date | awk '{print $3 "/" $2 "/" $6 ":" $4}' | sed 's/....$//'`; \
for i in $(grep $datestring /usr/local/apache/domlogs/*/* | awk {'print $1'} | sort | uniq -c | sort -n | sed -e 's/^[ \t]*//' | awk '{print $1 ":" $2}' | tail -10); \
do count=`echo $i | cut -d: -f1`; \
ip=`echo $i | cut -d: -f3`; \
domain=`echo $i | cut -d: -f2`; \
agent=`grep $datestring $domain | grep $ip | cut -d '"' -f6 | sort | uniq -c | sort -n | awk {'print "\n\t" $0'}` ; \
echo -e "$count $ip $domain $agent"; done
</source>

===Auto Date (Minus 10m)===
<source lang='bash'>
datestring=`date -d "10 min ago" | awk '{print $3 "/" $2 "/" $6 ":" $4}' | sed 's/....$//'`; \
for i in $(grep $datestring /usr/local/apache/domlogs/*/* | awk {'print $1'} | sort | uniq -c | sort -n | sed -e 's/^[ \t]*//' | awk '{print $1 ":" $2}' | tail -10); \
do count=`echo $i | cut -d: -f1`; \
ip=`echo $i | cut -d: -f3`; \
domain=`echo $i | cut -d: -f2`; \
agent=`grep $datestring $domain | grep $ip | cut -d '"' -f6 | sort | uniq -c | sort -n | awk {'print "\n\t" $0'}` ; \
echo -e "$count $ip $domain $agent"; done
</source>

===Single Domain===
<source lang='bash'>
echo "Date String [31/Mar/2011:13:4]"; read datestring; \
echo "File Name (with path)"; read logfile;\
for i in $(grep "$datestring" $logfile | awk {'print $1'} | sort | uniq -c | sort -n | sed -e 's/^[ \t]*//' | awk '{print $1 ":" $2}' | tail -10); \
do count=`echo $i | cut -d: -f1`; \
ip=`echo $i | cut -d: -f2`; \
agent=`grep $datestring $logfile | grep $ip | cut -d '"' -f6 | sort | uniq -c | sort -n | awk {'print "\n\t" $0'}` ; \
echo -e "$count $ip $domain $agent"; done
</source>

==What to change==

Datestring

The less information you put in to this the wider the search area.

31/Mar/2011:13:4 will return 13:40 - 13:49

31/Mar/2011:13 will return 13:00 - 13:59

Also the auto date (minus 10m) can be changed to go back a certain amount of time.

By default this still only shows a 10 minute period.

Top MySQL Slow Queries from log

2014-03-25T14:29:10Z

Smsldoo:

[[Category:One Liners]]
==Overview==
Sort the slow query log based on the query time and display the lines after it

==Script==
===Display 2 lines before/after Query_time===
<source lang='bash'>
slowlog=`grep log-slow-queries /etc/my.cnf | cut -d'=' -f2`; \
if [ -e "$slowlog" ]; then \
for i in $(grep -n Query_time $slowlog | sort -k3 -nr | head | cut -d: -f1); do line=`sed -n \`echo $i\`p $slowlog`; grep -B2 -A2 "$line" $slowlog;done; \
fi
</source>

===Display 2 lines before and 3 lines after Query_time | less===
<source lang='bash'>
slowlog=`grep log-slow-queries /etc/my.cnf | cut -d'=' -f2`; \
if [ -e "$slowlog" ]; then \
for i in $(grep -n Query_time $slowlog | sort -k3 -nr | head | cut -d: -f1); do line=`sed -n \`echo $i\`p $slowlog`; grep -B2 -A3 "$line" $slowlog;done \
fi | less
</source>

Process Usage Scripts

2014-03-25T14:28:51Z

Smsldoo:

[[Category:One Liners]]
==Overview==
Scripts to check total usage of running processes on server.

==Total Memory Usage==
<source lang='bash'>
for i in $(ps auxw | awk '{print $11}' | grep -v "\[" | sort | uniq | sort); do ps auxw | grep $i | awk '{total = total + $6}END{print total}' | xargs echo "$i " | awk '{print $2":"$1}'; done | sort -k 1 -nr
</source>

==Total Processor Usage==
<source lang='bash'>
for i in $(ps auxw | awk '{ print $11}' | grep -v "\[" | sort | uniq |sort); do ps auxw |grep $i|awk '{total=total+$3}END{print total}'|xargs echo "$i" | awk '{print $2":"$1}';done | sort -k 1 -nr
</source>

Mail Bandwidth Usage Per Email Account

2014-03-25T14:28:32Z

Smsldoo:

[[Category:One Liners]]
==Overview==
This script is set up to copy the current php.ini file to a users directory and block web users from being able to view it in .htaccess.

There are two versions of this script, one for SuPHP one without.

==Script==

<source lang='bash'>
for address in $(grep ${DOMAIN} maillog | grep pop3d| awk '{print $7}' | cut -d "=" -f2 | sed 's/,//' | sort | uniq);
do grep $address maillog* | grep `date +%b` | grep pop3d | grep LOGOUT | awk '{print $13}' | cut -d "=" -f2 | sed 's/,//' | awk '{total=total+$1}END{print total}' | xargs echo "$address: ";done | sort -k 2 -nr
</source>

==What to change==

${DOMAIN} will need to be changed for the domain name you want to search for

pop3d can be changed to look at imap instead.

Hacker Term Search

2014-03-25T14:27:43Z

Smsldoo:

[[Category:One Liners]]
==Overview==
Simple find statement coupled with a grep statement. Will return path of any file containing these terms.

==Script==

<source lang='bash'>
find /home*/ -type f -name "*.htm*" -print0 -o -type f -name "*.php" -print0 | xargs -0 grep -il "hacked by\|script kitten" >> /home/malware_hits.txt
</source>

==What to change==

Change the terms in the grep statement.

Hacked by is the most common, Kittens use the same terms on all of their pages. No need to be original.

Additional terms can be added if looking for a specific hacker group.

Get status of MalDet hits

2014-03-25T14:27:12Z

Smsldoo:

[[Category:One Liners]]
==Overview==
Get the status of files found in maldet scans. There are several different functions that can then be run.

==Script==
There are two main versions:

1) Look at only the last scan

2) Look at the entire log

===Last Scan Version===
<source lang='bash'>
cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | xargs ls -lah $i 2>/dev/null
</source>

===All Scans Version===
<source lang='bash'>
grep "malware hit" /usr/local/maldetect/event_log | grep "{hexstring}\|{md5hash}" | awk '{print $11}' | xargs ls -lah $i 2>/dev/null
</source>

==What to change==
Remove everything between the do and done

===Read Files===
<source lang='bash'>
cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | xargs vim 2>/dev/null
</source>

===Chmod 000===
<source lang='bash'>
cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | xargs chmod 000 2>/dev/null
</source>

===Remove===
<source lang='bash'>
cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | xargs rm -f 2>/dev/null
</source>

==Other uses==
===Check Directory Permissions===
<source lang='bash'>
cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | rev | cut -d "/" -f2- | rev | uniq | xargs ls -ldh 2>/dev/null
</source>

===Chmod 644 (images)===
<source lang='bash'>
cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | rev | cut -d "/" -f2- | rev | uniq | grep "image" | xargs chmod 0644
</source>

===Chmod 755 (other)===
<source lang='bash'>
cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | rev | cut -d "/" -f2- | rev | uniq | grep -v "image" | xargs chmod 0755
</source>

===Stop Script Execution (images)===
Careful with this one, they may have legitimate scripts in these directories =_=
<source lang='bash'>
for i in $(cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | rev | cut -d "/" -f2- | rev | uniq | grep -v "image"); \
do if [ ! -e $i/.htaccess] then; echo -e "Options None\nAddType text/plain .html .htm .shtml .php .php3 .phtml .phtm .pl .py .cgi\n" > $i/.htaccess; else; echo "$i already has .htaccess"; fi; done
</source>

==Scan Types==
===Scan All Users Full Home Directories===
<source lang='bash'>
maldet --update-ver; maldet --update; maldet -a /home?/?/
</source>
===Scan All Users Public_HTML Directories===
<source lang='bash'>
maldet --update-ver; maldet --update; maldet -a /home?/?/public_html
</source>

Find all backups for user

2014-03-25T14:25:44Z

Smsldoo:

[[Category:One Liners]]
==Overview==
Simple script to check /backup for cpanel backups with a user's name.

==Script==

<source lang='bash'>
find /backup -name <user> -exec ls -lah {} \;
</source>

==What to change==