Id "x" respawning too fast: disabled for 5 minutes

Hi, recently i found that my server show the following error:-

Id "x" respawning too fast: disabled for 5 minutes

I noticed this message appeared after I removed the gdm package.
To solve the above error i just disable the x:5:respawn:/etc/X11/prefdm - nodaemon

or you can set x:5:respawn:/etc/X11/prefdm - /dev/null

to test please insert telinit q to re-read the inifile

the errror message will stop.

done.

Configure SMTP mail client on Centos

vim /etc/sysconfig/sendmail

modify line DAEMON=yes to DAEMON=no

save and close.


vim /etc/mail/submit.cf

modify line D{MTAhost}[127.0.0.1] to D{MTAhost}[your.smtp.ip.address]

restart sendmail service service sendmail restart

try send the email.

done.

Set proxy address

1. login with your username
2. edit .bash_profile
3. Insert following line:-
   http_proxy="http://yourproxyipaddress:proxyport"
   export http_proxy
4. Done and to try out, please insert this line "elinks yahoo.com"

Disk partitioning tips

check this out.. 

http://www.linuxsa.org.au/tips/disk-partitioning.html

totally will help you on this!!!

Acronis crontab

* 6 * * 1,2,3,4,5,6 /etc/init.d/acronis_agent restart

* 6 * * 1,2,3,4,5,6 /etc/init.d/acronis_mms restart

HA Cluster with Heartbeat on Centos

Dah lama gua nak share howto ni dengan orang lain.. tapi disebabkan gua ni ada penyakit malas so gua rasa baik gua share link yang ada dkt net ni..

Anyway, berikut adalah howto for HA with heartbeat on a two node which running apache service and serve the same contents dalam suata masa yang sama. harap dapat membantu lu orang semua.. ada ke yang follow blog gua? hahahaha hantu ada gua rasa...

Lu orang boleh refer howto pada link berikut ni.. simple as makan kacang.. goodluck!

http://www.howtoforge.com/high_availability_heartbeat_centos

Keep your linux box up to date

Gua noticed yang default version of yum-updatesd does not function reliably. So gua cari better solution to make sure centos box gua updated. So untuk memastikan server gua always on up to date gua lebih prefer guna kan cron.. Steps seperti berikut:-

1. Disable yum-updatesd:-

/sbin/chkconfig yum-updatesd off

2. Create yum.cron and make it executeble dan letakkan dia di folder /etc/cron.daily ataupun /etc/cron.weekly. Didalam file yum.cron itu masukan line seperti berikut:-

#!/bin/sh
/usr/bin/yum -R 120 -e 0 -d 0 -y update yum
/usr/bin/yum -R 10 -e -0 -d 0 -y update

Nagios..

aku baru lepas setup nagios untuk monitor printers dan servers aku di office. Later, aku akan add kan switch, router & segala IP device yang ada dalam nagios ni.

aku sebenarnya berangan nak buat DIY sensor yang boleh talk dgn nagios mcm ni http://www.finnie.org/2010/03/07/external-temperature-monitoring-with-linux/. tapi entah bila aku nak buat pun tatau.. howto setup aku akan add bila aku siap add switch

sila ignore server name aku yang tak ikot standard piawaian :P

SARG Problem

Error message:-

*** buffer overflow detected ***: /usr/bin/sarg terminated

past few week i have setup my sarg (squid addon) reporting module... unfortunately it cannot work until i found the solutions. below are the steps how to solve my sarg problem.

wget http://ufpr.dl.sourceforge.net/sourceforge/sarg/sarg-2.2.3.1.tar.gz

tar -xvzf sarg-2.2.3.1.tar.gz

cd sarg-2.2.3.1

./configure --enable-sysconfdir=/etc/sarg

make

make install

done!

Remove Squid footer completely

Removing the version number from the footer is very easy.

In squid.conf enable

httpd_suppress_version_string

But what if you want to remove the whole message.

Generated Thu, 08 Jun 2000 06:58:30 GMT by proxy1.proxy.com (Squid/2.6.STABLE1)

There is no configuration available to remove it but you can always edit the source file for that and recompile it. Don't worry its very easy. Easy because its really easy.

Just follow the following steps:

Go to squid source. /usr/src/squid/src

Backup the existing file errorpage.c cp ./errorpage.c ./errorpage.c.bkp

Remove errorpage.o rm errorpage.o

Edit the file errorpage.c vim errorpage.c

{

ERR_SQUID_SIGNATURE,

"\n<\BR clear=\"all\">\n"

"<\HR noshade size=\"1px\">\n"

"

\n"

"Generated %T by %h (%s)\n"

"

\n"

"<\/BODY><\/HTML>\n"

}

Remove the line "Generated %T by %h (%s)\n"

Save and exit :wq

Reconfigure squid with old options ./configure .........

Make clean make clean

Make make

Make all make all

Make install make install

Stop squid /usr/local/squid/sbin/squid -k shutdown

Start squid /usr/local/squid/sbin

Step by step installation of the Backup Exec Remote Agent for Linux and UNIX Servers (RALUS) on the Red Hat Linux

Problem

Step by step installation of the Backup Exec Remote Agent for Linux and UNIX Servers (RALUS) on the Red Hat Linux platform.

Solution

Follow these steps to install the Remote Agent for Linux and UNIX Servers on Red Hat Linux:

Note: RALUS is an additionally purchased option and is enabled by installing the RALUS serial numbers on the Backup Exec media server.

For Backup Exec 2010, there is no separate download available, RALUS is included on the DVD, and can be found in the "LinuxUnixMac" folder present at the root of the DVD for Backup Exec for 2010.

It is also advisable to check the RALUS compatibility with LINUX host before installation, To check the compatibility refer to:
http://support.veritas.com/rd/bews-compatibility.htm


To install the Remote Agent for Linux and UNIX Servers on the LINUX host:

1. On a LINUX host, download the installation files from the Symantec support site.

2. Connect to the target host using a terminal session or Log On locally with super user, root, or administrator privileges.

3. Extract the contents of the installation files that were downloaded in Step 1 using the following command Figure 1a below:

Note: Do not extract the RALUS installer files on a Windows system and copy the resulting files to the Linux/Unix host. Doing so will cause difficult to diagnose installation errors. It is important to copy the .gz file to the Linux/Unix host and extract the files there as shown below.

Note: This is a one step command to extract and untar the file.

tar zxvf filename.tar.gz

z = Gunzip(uncompress) it before extracting, used on file ending in .tar.gz or .tgz

x = Extract the contents of the TAR file

v = Verbose - display contents as it is tarring or extracting

f = Filename to follow

Note: If the file does not have ".gz" extension that means its already uncompressed and one has to just extract it using "tar xvf"command.

Figure 1a:


Or, in two commands as shown in Figure 1b below:

Figure 1b:




Note: This is a two step command to extract and untar the file.

gunzip filename.tar.gz

tar xvf filename.tar

4. Navigate to the Linux folder that was extracted in Step 3 as shown in Figure 2 below:

Figure 2:



5. At the command prompt, type: installralus and press as shown in Figure 3 below:

./installralus

Figure 3:


6. The installation screen appears: (Figure 4)

Figure 4:



Type the LINUX server IP address or Hostname and press Enter as shown in Figure above.

7. RALUS performs the initial system check as shown in Figure 5 below:

Figure 5


Press Enter to continue.

8. RALUS will check and install the following rpms on Linux server as shown in Figure 6 below:

Figure 6:


Press Enter to continue.

9. Installation requirement checks completed successfully as shown in Figure 7 below.

Figure 7:


10. To configure RALUS with user friendly configuration press "Y" (Figure 8)

Figure 8:


11. The installation utility will now ask a series of questions to configure RALUS (Figure 9)

Figure 9:


Press Enter to continue.

12. The installation utility will ask for the Media Server IP address or Hostname to display the remote agent as a selection in the media server's backup selection tree as shown in Figure 10 below.

Note: A host name can be used, however make sure that the Linux server can resolve the host name properly. Its recommended to add the Windows host entry in the /etc/hosts file on the Linux server.

Figure 10:


13. To display the remote agent on more than one media server choose "Y" and press Enter or Simply type "N" and press Enter to continue as shown. (Figure 11)

Figure 11:


14. Confirm the Media Server IP address or Hostname by typing "Y" and press Enter, else press "N" and re-type the IP or Hostname as shown. (Figure 12)

Figure 12:


15. The installation utility will now ask to create "beoper" group as shown. (Figure 13)

Figure 13:



Note: beoper is a group that is used by Remote Agent for Linux and Unix Servers to authenticate the Backup Exec logon account, as the members of this group are given permissions to back up and restore the Linux server.


Press Enter to continue.

16. If the beoper group is not found, the installation utility will ask to create one. (Figure 14)

Figure 14:



Type "Y" and press Enter.


17. Installation utility will now prompt to specify any specific Group ID. (Figure 15)

Figure 15:



Group ID: All Linux users have a user ID and a group ID and a unique numerical identification number called a userid (UID) and a groupid (GID) respectively. Groups can be assigned to logically tie users together for a common security, privilege and access purpose. Its recommended not to assign any Group ID.


Type "N" and press Enter.


18. Note the "beoper" group has been created successfully as shown. (Figure 16)

Figure 16:


19. Installation utility will now ask to add the user root to the beoper group (Figure 17)

Figure 17:


Type "Y" and press Enter.

User root has been successfully added to the beoper group.

20. Installation utility shows successful installation of RALUS. (Figure 18)

Read the information and press Enter.

Figure 18:


21. The RALUS configuration has also completed successfully as shown. (Figure 19)

Figure 19:


Read the information and press Enter.

22. Finally, Symantec Backup Exec Remote Agent for Linux and Unix Server has completely successfully. (Figure 20)

Figure 20:



23. Reboot the server.

24. Go to the Backup Exec media server and check the remote selections listed on the Backup tab. Expand the Unix icon: (Figure 21)

Figure 21:



Utility Commands:

Use the following commands to stop and start the RALUS service as shown: (Figure 22)

To Stop: /etc/init.d/VRTSralus.init stop

To Start: /etc/init.d/VRTSralus.init start

Figure 22:


RALUS configuration file.

The ralus.cfg file can be edited for either troubleshooting or configuration purposes as shown.

The file is located in the following location: /etc/VRTSralus/ralus.cfg

Config file details:

SOFTWARE\VERITAS\Backup Exec\Agent Browser\TcpIp\AdvertisementPort=6101 Advertising port

Software\VERITAS\Backup Exec\Engine\Agents\Advertising Interval Minutes=60 To change time interval

Software\VERITAS\Backup Exec\Engine\Agents\Agent Directory List 1=10.0.0.2 To add media server(s)

Software\VERITAS\Backup Exec\Engine\Logging\RANT NDMP Debug Level=0 To debug set the value to 1

Software\VERITAS\Backup Exec\Engine\RALUS\Encoder=

Software\VERITAS\Backup Exec\Engine\RALUS\SystemExclude1=/dev/*.*

Software\VERITAS\Backup Exec\Engine\RALUS\SystemExclude2=/proc/*.*

Software\VERITAS\Backup Exec\Engine\RALUS\SystemExclude3=/mnt/nss/pools/

Software\VERITAS\Backup Exec\Engine\RALUS\SystemExclude4=/mnt/nss/.pools/

Software\VERITAS\Backup Exec\Engine\RALUS\SystemExclude5=/sys/*.*

Lupa root password

Aku rasa ramai org dah tahu mcm mana nak reset root dari grub. Tapi tak salah kalau aku nak share lagi dgn org lain yang masih belum tahu dan buat golongan pelupa (mcm aku).

Bagi siapa yang ada masalah lupa root password dan pelupa mcm aku jangan panik.. utk solve problem anda cuma beberapa steps sahaja sudah boleh selesai. Untuk menukar password root anda dikehendaki boot single user mode. Tapi itu pun kalau grub anda tak diset dgn password (bagus practise set grub password for security purpose).

Langkah-langkah:-

1. Boot sistem dan ketika anda melihat paparan berikut, tekan butang apa saja

2. Pada paparan berikut, tekan e

3. Selepas anda menekan butang [e] anda akan disajikan dengan paparan seperti dibawah.

3. select baris dengan vmlinuz di dalamnya dan tekan [e[. Layar berikutnya akan kelihatan seperti di bawah ini

4. type single seperti dibawah ini dan kemudian tekan enter.

4. GRUB akan boot single user mode Linux. Setelah selesai loading, anda akan disajikan dengan prompt shell seperti berikut:

5. Sekarang anda boleh menukar password root dengan menaip 'passwd root'

Anda akan diminta untuk ulang taip password untuk pengesahan. Apabila anda telah selesai, password akan berubah. Anda kemudiannya boleh reboot dengan menaip reboot pada prompt, kemudian anda boleh log in ke root seperti biasa.

HTTP time protocol

Hal berlaku disebabkan aku tak dpt nak sync semua time pada server2 yang ada di opis.. cek2 rupanya port 123 tcp/udp close... untuk rujukan yang tidak tahu tu.. port 123 ialah port utk NTP (Network Time Protocol).. mungkin ada sesetengah organisasi yang tak aware sangat issue time syncronization ni.. itu lantak depa laa.. but untuk aku masa adalah emas.. so rumusan dan andaian yang aku buat untuk budak2 network ni yang selalu port 123 NTP ni adalah seperti dibawah:-

- Mereka tidak tahu sedikit pun pasal NTP
- Mereka tidak tahu bagaimana pentingnya NTP
- Atau sebenarnya sudah ada local NTP server yang aku tak pernah tahu selama ni.. dimana aku kena sync dari server tersebut.. ianya sangat masuk akal untuk memiliki sebuah local NTP server.. tapi sepanjang aku kerja dkt malaysia ni... aku tak pernah jumpa company yang ada local NTP server... if banks, telcos, govs & MNC tu logic ada..

Dalam hal apapun, eloklah if korang bertanya kepada network team support jugak... (bertanya tak rugikan.. jika mereka sombong.. mereka yang bodoh..)

Jika diorang tak melayan permintaan kalian, aku cadangkan kalian cuba HTTP TIME PROTOCOL atas firerwall (outbound).. tapi diingatkan ia mungkin tidak setepat tho ntpd. setidak-tidaknya waktu dan tarikh anda tidak laa terlalu berbeza sgt kan?

Anda juga boleh mendapatkan HTP dari repositori.. selamat berjaya

fw.proxy scripts

#!/bin/sh
# squid server IP
SQUID_SERVER="192.168.1.1"
# Interface connected to Internet
INTERNET="eth0"
# Interface connected to LAN
LAN_IN="eth1"
# Squid port
SQUID_PORT="3128"
# DO NOT MODIFY BELOW
# Clean old firewall
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
# Load IPTABLES modules for NAT and IP conntrack support
modprobe ip_conntrack
modprobe ip_conntrack_ftp
# For win xp ftp client
#modprobe ip_nat_ftp
echo 1 > /proc/sys/net/ipv4/ip_forward
# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
# Unlimited access to loop back
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow UDP, DNS and Passive FTP
iptables -A INPUT -i $INTERNET -m state --state ESTABLISHED,RELATED -j ACCEPT
# set this system as a router for Rest of LAN
iptables --table nat --append POSTROUTING --out-interface $INTERNET -j MASQUERADE
iptables --append FORWARD --in-interface $LAN_IN -j ACCEPT
# unlimited access to LAN
iptables -A INPUT -i $LAN_IN -j ACCEPT
iptables -A OUTPUT -o $LAN_IN -j ACCEPT
# DNAT port 80 request comming from LAN systems to squid 3128 ($SQUID_PORT) aka transparent proxy
iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j DNAT --to $SQUID_SERVER:$SQUID_PORT
# if it is same system
iptables -t nat -A PREROUTING -i $INTERNET -p tcp --dport 80 -j REDIRECT --to-port $SQUID_PORT
# DROP everything and Log it
iptables -A INPUT -j LOG
iptables -A INPUT -j DROP

Squid hostname error

[root@sawi squid]# less /var/log/squid/squid.out
[root@sawi squid]# vim squid.conf
[root@sawi squid]# service squid start
init_cache_dir /var/spool/squid... /etc/init.d/squid: line 62: 13530 Aborted $SQUID -z -F -D >> /var/log/squid/squid.out 2>&1
Starting squid: /etc/init.d/squid: line 42: 13532 Aborted $SQUID $SQUID_OPTS >> /var/log/squid/squid.out 2>&1
[FAILED]
---------------------------------------------------------------------
#add below line for above error

visible_hostname [your_hostname]

Update PHP 5.3.1 on Centos 5.2

# Standard PHP version didalam Centos 5.2 agak ketinggalan dan untuk update menggunakan yum secara terus didapati mirror download yang sedia ada tidak melayan sebarang versi php yang terkini. Jadi dengan cara lain saya telah mengemaskini dahulu repositary yum dan baru laa saya melakukan update.

[root@ketutu ~]# wget http://download.fedora.redhat.com/pub/epel/5/i386/epel-release-5-3.noarch.rpm
--2010-02-03 14:37:45-- http://download.fedora.redhat.com/pub/epel/5/i386/epel-release-5-3.noarch.rpm
Resolving download.fedora.redhat.com... 209.132.183.67
Connecting to download.fedora.redhat.com|209.132.183.67|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 11989 (12K) [application/x-rpm]
Saving to: `epel-release-5-3.noarch.rpm'

100%[===========================================>] 11,989 27.3K/s in 0.4s

2010-02-03 14:37:48 (27.3 KB/s) - `epel-release-5-3.noarch.rpm' saved [11989/11989]

[root@ketutu ~]# wget http://rpms.famillecollet.com/enterprise/remi-release-5.rpm
--2010-02-03 14:38:01-- http://rpms.famillecollet.com/enterprise/remi-release-5.rpm
Resolving rpms.famillecollet.com... 88.191.60.189
Connecting to rpms.famillecollet.com|88.191.60.189|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 4855 (4.7K) [application/x-rpm]
Saving to: `remi-release-5.rpm'

100%[===========================================>] 4,855 20.5K/s in 0.2s

2010-02-03 14:38:03 (20.5 KB/s) - `remi-release-5.rpm' saved [4855/4855]

[root@ketutu ~]# rpm -Uvh remi-release-5*.rpm epel-release-5*.rpm
warning: remi-release-5.rpm: Header V4 DSA signature: NOKEY, key ID 00f97f56
warning: epel-release-5-3.noarch.rpm: Header V3 DSA signature: NOKEY, key ID 217521f6
Preparing... ########################################### [100%]
1:epel-release ########################################### [ 50%]
2:remi-release ########################################### [100%]
[root@ketutu ~]# yum --enablerepo=remi update php
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* addons: centos.maulvi.net
* base: centos.maulvi.net
* epel: ftp.jaist.ac.jp
* extras: centos.maulvi.net
* remi: iut-info.univ-reims.fr
* updates: centos.maulvi.net
epel | 3.4 kB 00:00
epel/primary_db | 2.3 MB 00:13
remi | 2.6 kB 00:00
remi/primary_db | 185 kB 00:01
Setting up Update Process
Resolving Dependencies
--> Running transaction check
---> Package php.i386 0:5.3.1-1.el5.remi set to be updated
--> Processing Dependency: php-cli = 5.3.1-1.el5.remi for package: php
--> Processing Dependency: php-common = 5.3.1-1.el5.remi for package: php
--> Running transaction check
---> Package php-cli.i386 0:5.3.1-1.el5.remi set to be updated
--> Processing Dependency: libedit.so.0 for package: php-cli
--> Processing Dependency: php-common = 5.1.6-24.el5_4.5 for package: php-ldap
---> Package php-common.i386 0:5.3.1-1.el5.remi set to be updated
--> Running transaction check
---> Package libedit.i386 0:2.11-2.20080712cvs.el5 set to be updated
---> Package php-ldap.i386 0:5.3.1-1.el5.remi set to be updated
--> Finished Dependency Resolution

Dependencies Resolved

===============================================================
Package Arch Version Repository Size
===============================================================Updating:
php i386 5.3.1-1.el5.remi remi 1.3 M
Installing for dependencies:
libedit i386 2.11-2.20080712cvs.el5 epel 79 k
Updating for dependencies:
php-cli i386 5.3.1-1.el5.remi remi 2.5 M
php-common i386 5.3.1-1.el5.remi remi 945 k
php-ldap i386 5.3.1-1.el5.remi remi 50 k

Transaction Summary
===============================================================
Install 1 Package(s)
Update 4 Package(s)
Remove 0 Package(s)

Total download size: 4.9 M
Is this ok [y/N]: y
Downloading Packages:
(1/5): php-ldap-5.3.1-1.el5.remi.i386.rpm | 50 kB 00:00
(2/5): libedit-2.11-2.20080712cvs.el5.i386.rpm | 79 kB 00:00
(3/5): php-common-5.3.1-1.el5.remi.i386.rpm | 945 kB 00:06
(4/5): php-5.3.1-1.el5.remi.i386.rpm | 1.3 MB 00:09
(5/5): php-cli-5.3.1-1.el5.remi.i386.rpm | 2.5 MB 00:18
------------------------------------------------------------------------------
Total 131 kB/s | 4.9 MB 00:38
warning: rpmts_HdrFromFdno: Header V3 DSA signature: NOKEY, key ID 00f97f56
remi/gpgkey | 1.3 kB 00:00
Importing GPG key 0x00F97F56 "Remi Collet " from /etc/pki/rpm-gpg/RPM-GPG-KEY-remi
Is this ok [y/N]: y
warning: rpmts_HdrFromFdno: Header V3 DSA signature: NOKEY, key ID 217521f6
epel/gpgkey | 1.7 kB 00:00
Importing GPG key 0x217521F6 "Fedora EPEL " from /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL
Is this ok [y/N]: y
Running rpm_check_debug
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction

WARNING : This php-* RPM are not official Fedora build and
overrides the official ones. Don't file bugs on Fedora Project.

Use dedicated forums http://forums.famillecollet.com/

Updating : php-common 1/9
Installing : libedit 2/9
Updating : php-cli 3/9
Updating : php 4/9
Updating : php-ldap 5/9
Cleanup : php-common 6/9
Cleanup : php-cli 7/9
Cleanup : php 8/9
Cleanup : php-ldap 9/9

Dependency Installed:
libedit.i386 0:2.11-2.20080712cvs.el5

Updated:
php.i386 0:5.3.1-1.el5.remi

Dependency Updated:
php-cli.i386 0:5.3.1-1.el5.remi php-common.i386 0:5.3.1-1.el5.remi php-ldap.i386 0:5.3.1-1.el5.remi

Complete!
[root@ketutu ~]# php -v
PHP 5.3.1 (cli) (built: Nov 20 2009 17:51:14)
Copyright (c) 1997-2009 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2009 Zend Technologies
[root@ketutu ~]# service httpd restart

Auto reboot if kernel panic

## Secara defaultnya linux tidak akan reboot sekiranya berlaku kernel panic. Jika untuk reboot linux sekiranya berlaku kernel panic ikut langkah2 dibawah:

vim /etc/sysctl.conf

## kemudian masukkan baris dibawah kedalam config file yang sedia ada.

kernel.panic = 15

DNS with Bind9

Video howto yang menarik untuk dikongsikan bersama teruratama sekali untuk kalangan beginners macam saya. Selama ini ramai yang mengatakan bahawa steps untuk konfigur DNS server adalah sukar. Ianya mungkin kerana langkah instalasinya ada melibatkan beberapa fail dan ia telah menyebabkan kekeliruan.. Jadi diharapkan video ini dapat membantu dan menerangkan lebih jelas cara-cara dan langkah-langkah utk instalasi DNS server

Memeriksa proses yang tidak sepatutnya

## Fikirkan apa akan terjadi sekiranya box anda diserang penggodam yang tidak diingin dan mereka telah running beberapa application yang boleh memperlahankan proses CPU anda. Senario ini juga sering berlaku di mana2 server, terutama sekali yang sering menjadi sasaran penggodam adalah web server hosting..

## Jadi untuk mengenal pasti service yang tidak di run oleh anda. Maka masukkan arahan serperti dibawah:

[root@ketutu ~]# ps aux | grep -v 'whoami'
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.0 2140 632 ? Ss Nov23 0:01 init [5]
root 2 0.0 0.0 0 0 ? S Nov23 0:00 [migration/0]
root 3 0.0 0.0 0 0 ? SN Nov23 0:00 [ksoftirqd/0]
root 4 0.0 0.0 0 0 ? S Nov23 0:00 [watchdog/0]
root 5 0.0 0.0 0 0 ? S Nov23 0:00 [migration/1]
root 6 0.0 0.0 0 0 ? SN Nov23 0:00 [ksoftirqd/1]
root 7 0.0 0.0 0 0 ? S Nov23 0:00 [watchdog/1]
root 8 0.0 0.0 0 0 ? S< Nov23 0:00 [events/0]
root 9 0.0 0.0 0 0 ? S< Nov23 0:00 [events/1]
root 10 0.0 0.0 0 0 ? S< Nov23 0:00 [khelper]

## Cara arahan diatas mungkin akan memeningkan kepala anda untuk memeriksa satu persatu senarai proses yang sedang running. Untuk menjadi lebih bijak, kenapa tidak list 10 senarai yang prosesnya membazir sahaja..


[root@ketutu ~]# ps aux --sort=%cpu | grep -m 11 -v 'whoami'
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 4 0.0 0.0 0 0 ? S Nov23 0:00 [watchdog/0]
root 6 0.0 0.0 0 0 ? SN Nov23 0:00 [ksoftirqd/1]
root 7 0.0 0.0 0 0 ? S Nov23 0:00 [watchdog/1]
root 8 0.0 0.0 0 0 ? S< Nov23 0:00 [events/0]
root 9 0.0 0.0 0 0 ? S< Nov23 0:00 [events/1]
root 10 0.0 0.0 0 0 ? S< Nov23 0:00 [khelper]
root 11 0.0 0.0 0 0 ? S< Nov23 0:00 [kthread]
root 51 0.0 0.0 0 0 ? S< Nov23 0:00 [kblockd/0]
root 52 0.0 0.0 0 0 ? S< Nov23 0:00 [kblockd/1]
root 53 0.0 0.0 0 0 ? S< Nov23 0:00 [kacpid]

Menangkis brute force dengan iptables

Oct 6 08:11:10 jeruk sshd(pam_unix)[21960]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.167.49.106
Oct 6 08:11:15 jeruk sshd(pam_unix)[21963]: check pass; user unknown
Oct 6 08:11:15 jeruk sshd(pam_unix)[21963]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.167.49.106
Oct 6 08:11:20 jeruk sshd(pam_unix)[21966]: check pass; user unknown
Oct 6 08:11:20 jeruk sshd(pam_unix)[21966]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.167.49.106
Oct 6 08:11:25 jeruk sshd(pam_unix)[21968]: check pass; user unknown
Oct 6 08:11:25 jeruk sshd(pam_unix)[21968]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.167.49.106
Oct 6 08:11:30 jeruk sshd(pam_unix)[21971]: check pass; user unknown
Oct 6 08:11:30 jeruk sshd(pam_unix)[21971]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.167.49.106
Oct 6 08:11:33 jeruk kernel: Blocked: IN=eth1 OUT= MAC=00:10:18:2f:78:31:00:d0:d0:36:d3:42:08:00 SRC=61.167.49.106 DST=60.52.204.6 LEN=60 TOS=0x00 PREC=0x00 TTL=47 ID=34905 DF PROTO=TCP SPT=37951 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0

serangan diatas telah berjaya ditangkis dan diletakkan didalam senarai hitam.. maka kepada sesiapa penjahat yang telah gagal menceroboh kebun saya anda bakal berdepan dengan masalah. berikut adalah comand iptables bagi menangkis si penjahat2 dia alam maya ini.

/sbin/iptables -N SSH
/sbin/iptables -N SSH_BLACKLIST
/sbin/iptables -A SSH_BLACKLIST -m recent --name SSH_COUNTER --set -j LOG --log-level warn --log-prefix "Blocked: "
/sbin/iptables -A SSH_BLACKLIST -j REJECT
/sbin/iptables -A SSH -m recent --name SSH_COUNTER --update --seconds 300 -j REJECT
/sbin/iptables -A SSH -m recent --name SSH --rcheck --seconds 60 --hitcount 5 -j SSH_BLACKLIST
/sbin/iptables -A SSH -m recent --name SSH --rcheck --seconds 2 -j LOG --log-level warn --log-prefix "Added: "
/sbin/iptables -A SSH -m recent --name SSH --update --seconds 2 -j REJECT
/sbin/iptables -A SSH -m recent --name SSH_COUNTER --remove -j LOG --log-level warn --log-prefix "Removed: "
/sbin/iptables -A SSH -m recent --name SSH --set -j ACCEPT
/sbin/iptables -A INPUT -m state --state NEW -p tcp -m tcp --dport 22 -j SSH