1-800-HOSTING Blog » linux

PHP Script Tips and Resources

David Tooke — Mon, 01 Feb 2010 17:30:41 +0000

PHP is a language absolutely made for websites. PHP code can be inserted into an html page to enable dynamic creation. Many content management systems like Drupal, Joomla, and osCommerce use PHP together with MySQL to build webpages.

You can use PHP to detect crawling activity, rotate images/banners, and process forms. Here is an example of code that will email you whenever Google crawler Googlebot visits your page by detecting the useragent. You could expand the code to include other crawlers, add date and time stamp, and validate the IP to exclude impostors. I left that stuff out for simplicity and because you can get that info from your webstats/logs. Just copy and paste this code in your web page to try it out. Note that the page may have to end with .php file extension to work, it depends on how your web server is setup.

if(eregi(“Googlebot”,$_SERVER['HTTP_USER_AGENT'])){

//put your email address below
$address=youname@yourdomain.com;
$subject=”Google visited “.$_SERVER[’HTTP_HOST’];
$message=”Googlebot visited today.”;
mail($address, $subject, $message);
}
?>

Here is an example of how to display random images in a web page, it will pick one of the three banners each time the page loads. You could easily add more cases here or change the img src line to make this a random text function.

$randomimage = Rand (1,3) ;

//put your image name at bannerx
switch ($randomimage)
{
case 1:
“banner1″;
break;

case 2:
“banner2″;
break;

case 3:
“banner3″;
break;
}

echo ‘’;

?>

Another cool thing you can do is filter form data to by blocking bad words, banning ip addresses, and setting a timer with a cookie. There is nothing worse than having your website form spammed. You can get the visitor’s IP address with a built in php function and then check it against a list of bad IP addresses you have stored in a list called an array. You can modify this to include words by replacing the IP addresses with words. This is useful if there is a relatively small number of abusers. In the case of larger numbers, blocking at the server level using iptables or a firewall may work better for you.

Here is the code for blocking IPs and you can add more IPs to the array if needed:

$banned_ip_addresses = array(‘4.2.5.5′, ‘64.43.67.19′, ‘207.22.32.152′);

if(in_array($_SERVER['REMOTE_ADDR'], $banned_ip_addresses))
{
echo “You are banned.”;
} else {
continue with form processing…
}

If you are having problems with abusive surfers filling out your forms with constantly changing ip addresses, you can stop them by adding a cookie. A cookie is a small piece of code sent to the user’s pc to identify them. Note that not all browsers will accept cookies, but most will. Once the cookie is set, you check for the existence of it in your form processing. Here is an example:

//this sets time to 7200 seconds, 2 hours
setcookie(“userx”, “cookie1″, time()+7200);
?>

Then add the code below to find out if this person has been on your page before:

if (isset($_COOKIE1["userx"])){
echo “You have already filled out this form recently”;

} else {
continue with form processing…
}
?>

There is a plethora of PHP support websites on the Internet. My longtime favorite is PHP Freaks Forum where you can post technical questions and read responses. Another good one is the Digital Point PHP Forum. If you are looking for scripts then visit Hotscripts, where you will find many, some free and some paid. Also check out Free Scripts Directory, Script Repository, and PHP Resource Index. They have scripts for: counters, auctions, voting, calculators, searching, support ticketing, etc.

PHP works fine on both Linux and Windows systems. If you have a Linux box then chances are good that it is already installed; if not, visit php.net to download it. PHP is not standard on Windows but it can be installed. If you need technical support we can help you with installing or upgrading.

PHP is very powerful. In an upcoming post I will explain how to speed it up using accelerators, pull data from a database, write it to a webpage, and add functionality using extensions.

A Little Security Goes a LOOOONG Way

Ben Fogt — Thu, 03 Dec 2009 16:46:09 +0000

Security is only as secure as your weakest link. It’s tough to imagine and believe, but in this business you just have to suck it up and believe it. You can have 50 hardware and software firewalls, but if you have 3 year old exploitable php email form code, you’re as good as a DMZ server with no password. People go to school for security. There is no doubt that it’s a complex realm, but truth be told, it doesn’t have to be. We’ve all read “Secure Your Password” or Change Port” but I don’t think people really take it for what it’s worth. If you are like my parents and hate the idea of passwords and using them, let me be the first to tell you, you are in the wrong business. We have caught a lot of our customers with simple passwords and unfortunately it is after they have received three abuse complaints about IRC hack attempts. A few minor changes really will help and go a long way!

Don’t take it lightly when you see reminders to use a more complex password. I’m not saying you should use a 50 alpha numeric password, but a nice 8-digit password with at least one Uppercase, Number, and Symbol. If you’re not creative enough, there are plenty of random password generators out there. Brute forcing passwords is an old, but still used hack attempt these days and isn’t even the most popular way hackers get into servers.

The biggest step you can take to help protect your server is changing your default RDP/SSH ports, even your FTP and other program ports. I think a lot of admins don’t do this because they fear it’s a complex step. It’s not! For windows, it’s as simple as using regedit (OOOO SCARY!!, calm down and just be careful) Do the following for windows 2003:

Start->Run-> type regedit

Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

In the right Pane, look for PortNumber

Simply change the port number to whatever you want. Usually I keep my birth date in my port number changes. e.g. 3371 (Not my real birth date, but you get the point.)

When you reconnect to the server just make sure you append the port number. e.g. xx.xx.xxx.xxx:3371

In Linux, it’s even simpler. All you need to do is edit the sshd_config. To do this you do the following:

Use your favorite text editor and edit /etc/ssh/sshd_config

At the very top of the config is your current port 22

#Port 22
#Protocol 2,1
Protocol 2
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

Simply uncomment by removing the ‘#’ and choose a new port. Idea, let’s go with the birth date method. e.g. 2271. So it will now look like:

Port 2271
#Protocol 2,1
Protocol 2
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

Now all you have to do is restart ssh (this process is different depending on your distro, just google restart ssh) To connect from another client using the new IP, do:

ssh -p 2271 root@xx.xx.xxx.xxx

Lastly, using a firewall really does help. The built in windows firewall works. It’s simple, basic and easy to use. Just make sure before you enable it to add your new RDP port. If you forget, you know where to reach us. The same goes with IPTABLES in Linux.

You might be surprised, but the majority of successful hack attempts are done through poor or outdated code. It’s the long lived battle of the programmer v. web-dude, but belief in what I said above will mean nothing if your code is vulnerable. The same goes with using your windows server to surf the web. DO NOT SURF THE INTERNET WITH YOUR WINDOWS SERVER. You are asking for trouble by doing so. Remote desktop has a file transfer program built into it for a reason.

In short,

-Use a more complex password

-Change your default ports

-Add a firewall

-Don’t use your server like a workstation to browse the web and download files.

Hope this helps.

Drupal – Free Website Building Tool

David Tooke — Tue, 01 Dec 2009 17:56:08 +0000

The Drupal content management system is software that makes it easy to build a great looking website. With Drupal, you can create pages using templates and easily add content using the admin control panel. In my opinion, it is a good choice for all types of sites such as blogs, portals, corporate or government sites.

Drupal is based on a system of templates where you can use the built-in ones or make your own. It has some cool features built in such as chat forums, rss, video and podcasting options. Currently, there are thousands of websites using Drupal such as Spread Firefox, The White house, and The Onion. There are many more listed on Drupal Sites. Drupal is an open source software package licensed under the GNU GPL and runs great on a Linux server with Apache, PHP, and MySQL. We here at 1-800-Hosting are Drupal friendly and can help with installation as well as well hosting technical support like unix file permissions, phpinfo(), mod_security, php file size and memory limits.

The best thing I like about Drupal is that it can be extended with third party modules in order to add functions. You can add search, instant messenger, cron, voting, image browsing, slideshow, google analytics, e-commerce, and chat room. If you’re looking for an easy way to get a website up and running without the hassles of back-end development, take a look at Drupal. It can make building a site a little easier without getting lost in the interweb fray.

Linux Tip: Setting up key-based authentication.

Jonathan Kelley — Wed, 11 Nov 2009 21:05:06 +0000

In this post I’ll explain how to use key-based SSH authentication in Linux.

This can be used either for non-password based authentication for scripts or other utilities, or for extra security when paired with a pass phrase key.

We’ll need to generate a key-pair, a public-key and a private-key. The public-key will be placed on the server, and you will log in with your private-key. You will need to enter a passphrase for security (or leave blank for password-less auth.)

First generate the key:

ssh-keygen -t rsa -b 1024 -C “your-email-address”

This will create a 1024 bit key using RSA in your current directory. You will need to transfer it to the server you wish to authenticate with by some means, you can use SCP if you have an SCP client like this:

scp -p id_rsa.pub user@server:~/

Then log in to the remote server, and put the file in the authorized_keys for the user you want to authenticate with.

mkdir ~/.ssh
chmod 700 ~/.ssh
cat ~/id_rsa.pub >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
mv id_rsa.pub ~/.ssh

Sometimes you may have to delete the public key file on the local machine to be able to log in, e.g.

rm rsa.pub

Once you’re done, try to log in to the remote host, and if everything was done right, you should be in!

Linux: Low memory – feature or a bug?

Jonathan Kelley — Tue, 09 Jun 2009 19:27:53 +0000

Linux actually handles RAM differently than Windows, and this can cause confusion to an administrator in charge of a system. Customers sometimes contact us with worries of low ram, memory leaks and other problems wondering why their system is constantly low on RAM. Case in point: A dedicated customer once ordered two RAM upgrades before opening up to us about his concern with memory leaks. We were finally able to share with him that he had plenty!

Imagine, Apache has been having some strange issues with faults and sigterms mentioned in log files. Today your boss is upset because it happened during a live product demo and the site went down while some major investors were checking it out. You’ve been tasked not-so-lightly with finding out why. You try some things, then check the memory usage.

[root@why-so-plagued-for-ram.local ~]# free -m

total       used       free

Mem:          3289       3126        162

-/+ buffers/cache:        567       2721

Swap:         1027          0       1027

You may think you’ve pinned the problem! Merely 162 megabytes of RAM available can certainly cause problems. Come mid-day, that will be exhausted! However, a closer inspection shows you have 2721 megabytes free memory. See the -/+ buffers/cache part? That’s cached memory, that is actually available usable system memory. You’ve got plenty!

What is -/+ buffers/cache?

Linux uses buffers/cache for disk caching (possibly other functions as well) to help your overall system performance. This makes I/O operations and other functions the kernel uses go quicker. The kernel figures if there’s RAM to use, why not use it? (Why not?)

If a program were to start that needs the memory, the buffer is dynamically re-sized to exclude the memory needed by the application. It’s harmless, interferes with programs in no way, and helps your system do other operations faster via the speed of your memory. What’s not to love?

As for those Apache issues, hopefully you’ll figure them out before your boss has another incident! At least you’ve solved the issue with the memory. It’s not a bug, leak, or coding issue: it’s a feature.

I’d like to credit Vidar at Linux Ate My Ram! for addressing this issue for the internet community at large, and for being the inspiration of this posting. [He has also written source code to prove this theory should anyone want to experiment.]

Linux Shell Insights: Volume 2

Jonathan Kelley — Tue, 26 May 2009 23:40:14 +0000

My last volume Linux Shell Insights: Volume 1 had some talk on the social plane about it so here’s Volume 2. Enjoy.

Here are a few more one-liners. I also call for the assistance of our audience; if anyone has more reliable or efficient methods to accomplish the ends in this article, get involved and comment!

Obtain your internet IP
There are two ways to do this (both below.) This can be useful in bash scripts that require your IP address. It’s useful in a dynamic IP environment when handling dynamic DNS in some fashion; though can be useful in a variety of scripts in which NAT may exist making eth0 unreliable for this information.

shell# wget -O – -q checkip.dyndns.org | grep -o “[[:digit:].]+”

You can also use curl if it’s your tool-of-choice.

shell# curl -s http://checkip.dydns.org/ | grep -o “[[:digit:].]+”

If you’ve got a static IP that is directly connected to the internet; it’s best to just scrape the information out of ifconfig.

shell# /sbin/ifconfig eth0 | grep inet | grep -o “[[:digit:].]+” | head -n 1
Get Distribution Information/Version
From time to time we get support tickets or calls asking “What distribution of Linux am I running?”. Here’s a way to ascertain this under most modern Linux distributions we offer.

Most Linux distributions follow the “Linux Standard Base” and have a file in /etc matching *release. You can take a look by running:

shell# cat /etc/*release

This does the same thing if you find it easier to remember.

shell# lsb_release –all

NOTE: You may have to cat the file /etc/debian_version on some Debian releases.
Shortcut to list all system users
I stumbled upon this one by a typo once where you can get a peek of system users. This shouldn’t be considered authoritative, as /etc/passwd is your daddy; but it’s quick to verify the spelling of that strange developer who insists on the username supercalifragilistic_expialidocious.
Tested on: Debian, Redhat

shell# ~(HIT TAB TWICE HERE)
Lost Plesk Password
Here’s one of those gems that we keep close to our chest, but I’m willing to reveal it to you. If you misplace your Plesk Admin password, on UNIX it stores it in /etc/psa/.psa.shadow. This is a read-only file, changing the password here does not change it for Plesk. It’s a good way to jot your memory if you forget though.

shell# cat /etc/psa/.psa.shadow

Continue to keep an eye out for my next list!

Linux Shell Insights: Volume 1

Jonathan Kelley — Wed, 06 May 2009 20:57:43 +0000

Hello readers,

I thought I’d share some intriguing and useful one-liners that could make your life easier on the Linux/Unix shell environment. I hope to offer a regular multi-part series for those who are fans of the Linux platform.

View Physical Console via SSH
This will view the console (and makes assumption that the console is an 80 character screen.) It’s helpful to scrape error messages that are printed to the local console. Great for when you don’t have physical access to the server and need to see the terminal; we also find it useful here by eliminating unnecessary trips to the data center floor.

shell# sudo cat /dev/vcs1 | fold -w 80
Remove multiple RPM packages by a defined pattern
This is useful for remove all packages that are part of a common suite. This example would uninstall any package in the system with ‘php’ in the name. (Disclaimer: Check what packages contain the string prior to running this. Unpredictable results could remove system critical packages! I’d suggest this for advanced shell users only.)

shell# yum erase `yum list installed | grep ‘php’`
Reduce a file to zero bytes
I’m sure every administrator has needed to zero out a log file taking too much space; or clear a users mail spool. Many commands involve piping /dev/null to the file or similar. The following command is probably the easiest and quickest way that many users overlook.

shell# > file_to_wipe.txt
Look at the strings stored in RAM
This one is more for fun; though it could be used for security auditing. This command will access the system RAM and reveal text strings stored in memory. Don’t worry, this file is read-only by the kernel. You can usually find interesting data stored in memory with this command.

shell# sudo dd if=/dev/mem | cat | strings

That’s it for now; more in this series coming soon.

1-800-HOSTING Blog » linux

PHP Script Tips and Resources

Related Posts

A Little Security Goes a LOOOONG Way

Related Posts

Drupal – Free Website Building Tool

Related Posts

Linux Tip: Setting up key-based authentication.

Related Posts

Linux: Low memory – feature or a bug?

Related Posts

Linux Shell Insights: Volume 2

Related Posts

Linux Shell Insights: Volume 1

Related Posts