Cpanel

Cpanel – my server admin tool of choice for hosting many sites – here’s the stuff that I’ve discovered.

Cpanel / Linux – Apachetop for seeing what your server is really serving

By in apache, Cpanel, Server Tags: , , ,

apachetop

Apache is great and so is Cpanel, but when you need to find out what is using resources or causing a low-down the tools can be limited, Apachetop helps by providing real-time analysis.

One of the most useful methods is to look at the raw apache logs, however if you’ve got a very busy site, or a server with dozens (or more) of domains then apachetop might help.

Cpanel note

If you are using cpanel I recommend you get the domain logs combined, instructions here (there are other methods any will work).

Centos

Instructions for installing below are on CentOS, however you can install it on most Linux distributions.

EPEL

First of all enable EPEL, this gives you access to 3rd party repo’s not directly maintained by Centos (so insert the usual trust issue message here).

To do this just run the following – if this doesn’t work have a quick google for epel-release rpm and find the one for your version of Centos

yum install epel-release

Note installing this rpm will remove your cache files for yum, so the next command make take a few more minutes than you are used to

install apachetop

yum install apachetop

That’s it!

Using apachetop

Run it and pipe the log file to it – it reads from that point onwards – press space to refresh the stats more often than the default.

apachetop -f /usr/local/apache/logs/vhost-access_log

Tips

When running press ? to get some help.  I tend to use d to cycle through the stats, of particular interest to me is the host view, this shows the number of hits and transfer for a host, so if you have a badly behaving one it stands out.  Another view shows the referrers, very useful if a site has had some publicity and is getting a lot of traffic.

Generally I recommend leaving it at least 5 minutes to gather some stats  – this then gives you enough time to evaluate the results.

Have fun and happy debugging!

Cpanel – combine apache logs

By in Cpanel, Server, Uncategorized Tags: , ,

ectf16_500_flog

Default location of logs

By default cpanel puts it’s log files in /usr/local/apache/domlogs/DOMAIN – these are split up by domain, however it can be difficult when troubleshooting to find out where the problem might lie.

Combined logs

Combining the logs can be done by a bash script, however it’s consuming and not realtime.  The trick is to edit the configuration to create a new apache log, this will hold all the information.  Just remember to configure your log-rotate too (another post in the future).

Edit your vhost.default file

The latest version of apache is 2.4 at this time, edit the file /var/cpanel/templates/apache2_4/vhost.default

Add the following just before the </Virtualhost> at the bottom

LogFormat “%V %a %l %u %t \”%r\” %s %b \”%{Referer}i\” \”%{User-agent}i\”” vcommon
CustomLog /usr/local/apache/logs/vhost-access_log vcommon

In order to keep the configuration you need to rebuild the conf

/scripts/verify_vhosts_includes

/scripts/rebuidlthttpdconf

/sbin/service httpd restart

This gets it all working.

If you want to track SSL accesses you need to edit the ssl vhost.default configuration.  I opted not to as there is usually a limited number of SSL sites and they stand out more on normal monitoring.

Password protecting a directory with .htaccess and wordpress

By in Computing, Cpanel, Server, Wordpress Tags: , , ,

I’ve come across this problem a number of times, of course each time I think “this will be fixed next time”.  Unfortunately it’s not the case.  What’s the problem then?

You have a directory that you want to password protect, lets call it “secrets”.  It resides in /home/mysite/public_html/secrets/ on the server.  Now fortunately you are using a hosting control panel like cpanel and you’ve password protected directories before (if not then have a hunt on this site or on google!).

Before you activate the protection you can view the contents fine, so you activate protection – driven by a .htaccess file… and then rather than being asked for your username and password, you get a 404 or a 403 message from wordpress “Sorry the page you are looking for cannot be found”.

Intrepid system administrators hunt through error logs, and sure enough the access log is recording a 404… however the error log is recording something different.

Permission denied: /home/mysite/public_html/secret/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable

This error message has had a number of solutions in the past, including the infamous “reinstall frontpage extensions”, except these are long gone – not supported and never will be again, please don’t go installing them just to get past this problem! – It will end in tears.

Instead you just need to add a couple of lines to the wordpress .htaccess file in the root of your site (e.g. /home/mysite/public_html/.htacess). Go to the file and just before the main WordPress part

#BEGIN wordpress – add the following

ErrorDocument 401 /%{REQUEST_URI}/errors.html
ErrorDocument 403 /%{REQUEST_URI}/errors.html

This should set the site to working, now why does this work?

Simply put wordpress is often run with a pretty url mode (permalinks) where the addresses for posts are made to look more pretty.  When you request your secret directory the server tries to access it, looks at the .htaccess file and promptly tries to do a redirect, this invariably ends up at a page wordpress cannot access – this doesn’t happen without the .htaccess as wordpress allows access to existing real files, but the htaccess security says the file doesn’t exist until the password is entered and so it intercepted.

It’s all a bit confusing, however adding these lines essentially means wordpress can get out of the way when those errors occur, 401 and 403 are authorisation required or failure codes, so wordpress will ignore and the htaccess can safely challenge your.

 

Hopefully this will help if you come across this problem.

How to enable mod_deflate for all sites (entire server) in cPanel/WHM

By in Cpanel, Server Tags: , , , , ,

Mod Deflate is essential nowadays for sites, it speeds up the transfer of html pages & other files (such as stylesheets) by compressing them first. Now that servers today are so powerful there is very little reason not to use this, especailly since so many “speed up” tests will not pass without this being enabled.

However whilst you can enable it site-by-site, however for shared hosts with many sites this is not the best way, but you can enable it globally.

  1. First ensure it’s installed, you can do this by using EasyApache and ensuring that mod_deflate is selected (it may be already),once apache has been compiled deflate is now enabled.
  2. If you want to enable the functionality site-by-site then in each sites control panel a new option is now available.  under Software/Services the user can now choose to optimise their website, this essentially allows deflate to be turned on and off.
  3. If you want to do this globally (why not it cuts bandwidth and keeps your users happier) then  simply follow the following:
  • Under Services Configuration / Apache Configuration / Include Editor / Post Virtual Include
  • Select All Versions (no point in not doing all versions)
  • Paste the following into the file and then click Update.
<IfModule mod_deflate.c>
SetOutputFilter DEFLATE
<IfModule mod_setenvif.c>
# Don’t compress images its a bit pointless
SetEnvIfNoCase Request_URI .(?:gif|jpe?g|png)$ no-gzip dont-vary
</IfModule>
<IfModule mod_headers.c>
# Make sure proxies don’t deliver the wrong content
Header append Vary User-Agent env=!dont-vary
</IfModule>
#maximum compression - why not we have spare cpu
DeflateCompressionLevel 9
</IfModule>

Webmail not working in Cpanel

By in Cpanel Tags: , , , , ,

Had a problem earlier this week, webmail couldn’t always send e-mail.  It was coming back with the following error:

SMTP Error: SMTP error: Connection failed: Failed to connect socket: Connection timed out.

After reading a few things  I turned on the SMTP tweak..  things appeared to work for a few hours, then it started failing again.

Searching online said to trying telnet on the command line – so did that, connected to port 25 – all fine… hmm odd – tried webmail again – failed…..

After a more indepth search I found a forum which gave me a hint – apparently other people have had the same problem when using the firewall for cpanel – CSF.  CSF is definately one of the best firewalls around for linux and works really well with Cpanel – however every now and again the amount of options can cause you to miss out something obvious:

# If SMTP_BLOCK is enabled but you want to allow local connections to port 25
# on the server (e.g. for webmail or web scripts) then enable this option to
# allow outgoing SMTP connections to 127.0.0.1
SMTP_ALLOWLOCAL = 0

The SMTP_ALLOWLOCAL set to 0 stops webmail etc… not sure when this appeared (the server has been working fine for about 4 months) but change it to 1 – restart CSF and there we go it’s working fine 🙂

Migrating Cpanel accounts to new Cpanel Server – by command line.

By in Cpanel, Server Tags: , , ,

Cpanel is a good system for administrating a server with many sites on it, i’ve used ensim, webmin and a couple of others in years gone by (Plesk and parallels were disasters for me!).  However occasionally something that you think should work just doesn’t and for no obvious reason.

The Cpanel system has a feature to migrate accounts from another server – be it Cpanel or another webhosting panel – this often works, recently though I’ve had a problem with using it for Cpanel to Cpanel where it would connect but fail to transfer the backup file.

Fortunately it’s really easy to use the commandline with cpanel and you can do it manually (actually it’s easier than the wizard!)

On the server you are migrating from just type (while logged in as root!)

/scripts/pkgacct username

This will create a tar.gz in the /home directory on the server – just copy this to the new server (it could take a while – it has everything from the account you are copying).

On the destination server just type in

/scripts/restorepkg username

This creates (or overwrites the account!) on the server – and your done!.  But what if you have a dedicated IP (due to SSL?)

Easy just use this instead

/scripts/restorepkg –ip=y username

This gives it the next free dedicated IP address (make sure you have one free!)

And that’s it – it is honestly easier than the wizard which requires you to add more info to establish the transfer link.

One thing to note is that you should ensure that the versions of cpanel are as near as you can get – otherwise it might fail or do things a little weird.