UnixNewbie.org » Cheat Sheets

Iptables cheat sheet

Stephen — Tue, 17 Nov 2009 16:39:50 +0000

Iptables is a Linux kernel-level module allowing us to perform various networking manipulations (i.e. packet filtering) to achieve better network security.

Here are some iptables commands I have found useful. This list will be updated from time to time.

View all current iptables rules:

iptables -L -v

View all INPUT rules:

iptables -L INPUT -nv

How to block an IP address using iptables:

iptables -I INPUT -s "201.128.33.200" -j DROP

To block a range of IP addresses:

iptables -I INPUT -s "201.128.33.0/24" -j DROP

How to unblock an IP address:

iptables -D INPUT -s "201.128.33.200" -j DROP

How to block all connections to a port:
To block port 25:

iptables -A INPUT -p tcp --dport 25 -j DROP
iptables -A INPUT -p udp --dport 25 -j DROP

How to un-block:
To enable port 25:

iptables -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -p udp --dport 25 -j ACCEPT

To save all rules so that they are not lost in case of a server reboot:

/etc/init.d/iptables save

Exim Cheatsheet

Stephen — Mon, 09 Nov 2009 18:31:23 +0000

Exim is the widely used open source mail transfer agent. It is responsible for routing, delivering, and receiving email messages. Here are some of my favorite, useful exim commands via shell.

This command will show exim processes including the path to the script being utilized to send mail. Very useful in locating a spamming script:

ps -C exim -fH eww

This will show the route of the email address. It is useful when you try to diagnose email delivery problems:

exim -bt user@domain.com

To perform a SMTP testing session as if the mail comes from a particular host for testing filtering rules inside your server:

exim -bh ipaddresshere

This will show what exim is currently doing:

exiwhat

Mail server queue:

exim -bpc   // print the total number of emails currently in server queue.
exim -bp   // print mails in queue sorting by time, size,...
exim -bp | exiqsumm   // count, volume, oldest, newest, domain, and totals

To list exim’s configuration setting:

exim -bP

To start a queue run:

exim -q -v

To start a queue run for just local deliveries:

 exim -ql -v

To remove a message from the queue:

exim -Mrm

To freeze a message:

exim -Mf

To force delivery of a message:

exim -M

To remove all frozen messages:

exiqgrep -z -i | xargs exim -Mrm

To remove all messages older than 1 day (the number is in seconds):

exiqgrep -o 86400 -i | xargs exim -Mrm

To freeze all queued mail from a given sender:

exiqgrep -i -f user@domain.com | xargs exim -Mf

Message viewing:

exim -Mvh     // view message's headers
exim -Mvb     // view message's body
exim -Mvl     // view message's logs

Exiqgrep

At times, we will be required to search the mail queue for a particular message to help troubleshooting mail problems for our users. Here are some useful exiqgrep commands.

This will search the queue for messages coming from a specific sender:

exiqgrep -f user@domain.com

This will search the queue for messages from a specific recipient:

exiqgrep -r user@domain.com

This will display messages older than the specified number of seconds.

exiqgrep -o 86400    // more than a day old

This will display messages newer than the specified number of seconds.

exiqgrep -y 3600    // less than an hour old

Ubuntu LAMP cheat sheet

Stephen — Mon, 09 Nov 2009 14:45:34 +0000

LAMP: the server software bundle consists of Linux – Apache – MySQL – PHP; Linux: operating system; Apache: http server; MySQL: database software; PHP: scripting language

Location, configuration file:

Apache configuration file:

/etc/apache2/apache2.conf

PHP php.ini file:

/etc/php5/apache2/php.ini

MySQL configuration file:

/etc/mysql/my.cnf

Default (initial) web location:

/var/www

Web browser address:

http://localhost/

Restarting:

How to restart apache:

sudo /etc/init.d/apache2 restart

How to restart MySQL:

sudo /etc/init.d/mysql restart

Unix FIND command cheat sheet

Stephen — Sun, 08 Nov 2009 22:56:45 +0000

“find” is a Unix command allowing us to search for files within our Unix/Linux operating system. “find” can search for files based on name, type, size, modified date, etc… I often use “find” to locate bad files within a hacked system/account.

To search for files by name:

find dir -name keyword

dir: directory you want to search for files
keyword: the name of the file you want to search for
examples:
find /home/test -name “index.txt”
find /home -name “shell*” // find files beginging with “shell”

To search for files by modified date:

by the minute:

find dir -mmin time

by the hour:

find dir -mtime time

examples:
find /home -mmin -30 // find all files modified in the past 30 minutes
find /home -mmin +30 // find all files modified more than 30 minutes ago
find /home -mmin +30 -mmin -60 // find all files modified between 30 and 60 minutes ago
find /home -mtime -1 // find all files modified within the past 1-day (24 hours)
find /home -mtime -7 // find all files modified within the past 1-week (7 days)

RPM cheat sheet

Stephen — Fri, 06 Nov 2009 19:47:36 +0000

RPM is the package manager for the following Linux Operating Systems: RedHat, CentOS, Fedora and SUSE. Here, I noted down some useful commands to manage RPM packages. Please share if you know other useful RPM commands.

Install a package:

rpm -ivh package_name

Upgrade a package:

rpm -Uvh package_name

Uninstall a package:

rpm -ev package_name

Uninstall a package without checking for its dependencies:

rpm -ev --nodeps package_name

Display the version of the installed package:

rpm -q package_name

Display the name and version of all packages installed in the server:

rpm -qa

Display the packages got installed recently:

rpm -qa --last

To rebuild a corrupted RMP database:

rpm --rebuilddb

Screen cheat sheet

Stephen — Fri, 06 Nov 2009 16:45:04 +0000

Have you ever experienced a problem where your remote shell session got killed (for various reasons) in the middle of your crucial software compilations? Well it has happened to me several times ranging from getting killed in the middle of php compilations, easyapache, kernel , to a new cPanel installation 8O. Most of the time, it was due to bad internet connection. To combat with this, a friend suggested me a solution: to use Screen.

What is Screen?
Screen is a free Unix software. Under Screen, if your shell session gets disconnected, the screen session doesn’t go away. It will continue the compilations until completion. Sounds good

How to install screen under CentOS?

yum install screen

How to use Screen? Simply type:

screen

then you will be led into a new virtual shell terminal. After that, just work with your commands normally.

If my session got disconnected, how do I resume my Screen session?

screen -r

If I have multiple screen sessions, how do I see them?

screen -list

How to exit Screen?

exit

How do I exit Screen but still leaving my compilations to keep on compiling?

ctrl+a+d

You will then led back to your original shell session. Your screen session will keep on working. To resume, you can use “screen -r”. Pretty useful right?

Some useful sysadmin commands

Stephen — Mon, 08 Sep 2008 15:30:11 +0000

Some useful sysadmin commands:

Show the disk usage per directory one level:

FreeBSD: du -h -d 1
Linux: du -h --max-depth=1

How to create a Symlink/Softlink?
```
ln -s realpath fakepath
```
Emptying a file without deleting it:(i.e. quick way to empty system logs)
```
cp /dev/null filename
```
This command will show exim processes including the path to the script being utilized to send mail. Very useful in locating a spamming script.
```
ps -C exim -fH eww
```
To trace through the hops the email gets delivered. This is useful to determine if the message can reach its destination or not.
```
exim -bt username@domain.com
```
Watching logs:
```
tail -f /path/to/log-file
```