Tcpdump command to monitor the SMTP activity from a IP or range of IP.
The tcpdump is a useful utility to monitor the network activity in the server.
You can monitor the SMTP activity to find out the mail account used by spammer.
tcpdump -i eth0 -n src 192.168.1.4 \or dst 192.168.1.4 -w smtp.tcpdump -s 2048
The above command will monitor the SMTP activity from the IP address 192.168.1.4 and will log to the file smtp.tcpdump.
Please use the following command to monitor a range of IP
tcpdump -i eth0 -n src net 219.91.0.0/16 \or dst net 219.91.0.0/16 -w smtp.tcpdump -s 2048
The above command will monitor the range of IP starting with 219.91. You can use less or Wireshark to analyze the dump file. You need to replace the network device with your network device EG : venet0:0 in a VPS.
How to uninstall apf in linux machine
You can use the following steps to uninstall apf in a linux machine:
Stop the apf service running in the server.
$ /etc/rc.d/init.d/apf stop
Remove the apf files from the server.
$ rm -Rf /etc/apf
$ rm -Rf /etc/rc.d/init.d/apf
$ rm -Rf /var/log/apf_log
$ rm -Rf /var/log/apfados_log
$ rm -Rf /usr/local/sbin/apf
Disable apf in the run levels.
$ /sbin/chkconfig –level 345 apf off
Open up and remove this line:
$ vi /etc/cron.daily/fw
/etc/rc.d/init.d/apf restart >> /dev/null 2>&1
ip_conntrack and APF issue
A server is limited to a certain number of TCP/IP connections that it can keep track of.
ip_conntrack is a module which has the limit set in its conntrack database. If the table exceeds this limit, even the legitimate packets will be dropped.
We usually tweak this parameter in the sysctl.conf file.
But if you have APF installed, even if you set the sysctl parameter, APF will reset the conntrack value, since APF configuration file has conntrack value set to 34576 by default. [SYSCTL_CONNTRACK="34576"].
So in servers having APF, you would need to increase the above parameter and then restart APF.
RSYNC to backup your home DIR from your OLD server to New
Login to your new cPanel server as root user.
rsync -vrplogDtH –exclude=virtfs/ –progress -e ssh root@old-server-ip-address:/home/ /home/
Basic Requirements for cpgsd
* gcc
* Perl 5+
* OpenSSL (including headers, usually in a separate package called something like openssl-devel or ssl-dev)
* Net::SSLeay perl module
* IO::Socket::SSL perl module
* IPC::Run perl module
