How to configure Apache for maximum performance

The default settings need not be changed if the websites receive normal traffic. But once the traffic increases you would need to change the default settings and one should know what values need to be changed and why. Below setting will help you understand most of the Apache directives and what needs to be tweaked.

1. Apache modules and settings

a) mod_reqtimeout

    Syntax:

    RequestReadTimeout [header=timeout[-maxtimeout][,MinRate=rate] [body=timeout[-maxtimeout][,MinRate=rate]

As seen above, time outs can be set for both request header and body from the client. Set this to a low value to make sure both header and body times out after the configured time.


b) TimeOut

This directive defines the time that Apache process will wait for I/O. The default value is set to 60 seconds and you should lower it to say 10-20 seconds in case of DDOS attacks. Some cgi scripts that need more execution time may face issues due to this.


c) KeepAlive and KeepAliveTimeout

Most of the webhosts disable KeepAlive during DDOS but doing so affects the server's performance again. A better idea would be to decrease the KeepAliveTimeout to 2 (default 5) and still have the KeepAlive enabled.


d) LimitRequestBody

This defines the allowed size of message body to be allowed. During DDOS attacks, set this server-wide. The default value is 0 which means unlimited. Set that to 100MB and see if improves the performance.

    Syntax:

    LimitRequestBody value

    LimitRequestBody 102400000

e) LimitRequestFields

This directive limits the request header fields from the client. Set this to a value between 40-50
LimitRequestFields 40 (default is 100)

f)  LimitRequestFieldSize

This limits the size of the HTTP request header allowed from the client. Default is 8190 and is hard coded when it is recompiled. Decrease this value to half.

    LimitRequestFieldSize 4095

g)  LimitRequestLine

This limits the size of the HTTP request line that will be accepted from the client.

    LimitRequestLine 4095 (default is 8190)

h)  LimitXMLRequestBody

This limits the size of an XML type body request.

    LimitXMLRequestBody 500000 (defaults to 1000000)

i) MaxRequestWorkers

A webserver should never use SWAP as doing so further decreases the server's performance and increases the server load drastically. You should regulate this directive to make sure that Apache doesn't spawn so many child processes as it starts swapping.

j) ServerLimit

It is the upper limit for the number of connections configured for Apache.

k) MaxClients

It is the maximum number of simultaneous connections that will be processed by Apache web server. This value should never exceed the #ServerLimit set. Extra care should be taken into consideration while setting the MaxClients value as any slight variation could badly affect the overall server's performance.

Remote FTP configuration in WHM

Inorder to configure the remote ftp backup of a particular user account in whm. We have to first login to the server, Where the ftp server is hosted :
cd /home
mkdir backup (making a folder for account backups)
mkdir /home/backup/vmuser1(making a folder for user account)
Create a ftp user in the server :
useradd ftp user
set passwd


Login to User WHM :

Main >> Backup >> Configure Backup


Set the remote ftp host with the IP address of ftp server
Back up type : remote ftp
Ftp Back up user : ftp user (created in ftp server )
Ftp Back up password : password

Save it.
Ready to go !!!!!

You can access the remote ftp account via : ftp://Ip address of ftp server

Test :

Please create a test file in the location (/home/backup/vmuser1 in ftp server)
If you see the file, When you access the link ftp://Ip (Ftp server).

It works !!!!!!!

Cpanel Log Files

Cpanel - How to view error logs

cat /var/log/messages | more

it will give you the server wide error messages

for cpanel server apache logs.


cd /usr/local/apache/domlogs


cat domainname - it will give you the logs for a particular domain.

Cpanel logs:

/usr/local/cpanel/logs

Apache logs:

/usr/local/apache/logs

Captcha images not working on websites !!!!

               
This issue is due to the absence of a module called TTF (free type support for php ). It depends on how your version of  php was compiled. Please check your version of GD and PHP, Since php.net suggests that you need atleast 1.8 version for this support.

Fix :

           1 .Login to WHM

           2. In home select "Software" then "EasyApache (Apache Update)"  then select "Previously Saved Config" then in the bottom of the page click the button "Start customization based on the profile" then go to Exhaustive options by completing the previous steps then make sure checkboxe for "TTF" are checked. Once they are checked then initiate Build process.

CSF Installation

Pre Setup: Make sure perl modules are installed

yum install -y perl-libwww-perl

Step 1 :  Download, unpack, install of APF from source.

cd /usr/local/src
wget http://www.configserver.com/free/csf.tgz
tar -zxvf csf.tgz
cd csf
./install.sh

Step 1.1: Cleanup source install files.

rm -Rf /usr/local/src/csf* && cd

Step 2: Backup orginal CSF config

cp /etc/csf/csf.conf /etc/csf/csf.conf.bak

Step 3: Edit current CSF config

vi /etc/csf/csf.conf

                                                         

----------------------

csf -x : stop csf

csf -r : restart csf
----------------------



Changing the CSF mode

By default the firewall is running in testing mode(testing= "1"). We have to disable the firewall running in testing mode.
vi /etc/csf/csf.conf
testing = "0"
csf -r

Important Commands: 

csf -d IPADDRESS will deny an IP.
csf -a IPADDRESS will allow an IP.
csf -r will reload all rules.
csf -g IPADDRESSES (will tell you the reason ann IP address is blocked, and if not, will return no reason)

Important files: 

csf.conf   - the main configuration file, it has helpful comments explaining
        what each option does
csf.allow   - a list of IP's and CIDR addresses that should always be allowed
        through the firewall
csf.deny   - a list of IP's and CIDR addresses that should never be allowed
        through the firewall
csf.ignore   - a list of IP's and CIDR addresses that lfd should ignore and not
        not block if detected
csf.*ignore   - various ignore files that list files, users, IP's that lfd
        should ignore. See each file for their specific purpose

Finding spammer

Check for bulk/spam emails.

The 1st thing you should check for is the number of emails in the Exim queue using the below command:

exim -bpc

Then check if the emails are from same source:

exim -bp

Quote

    0m  1.6K 1Ryd9X-000aSt-8N <euser@host.hostname.com>

              user1@aol.com

     0m  1.6K 1Ryd9X-000aTK-NT <euser@host.hostname.com>

              user2@sbcglobal.net

     0m  1.6K 1Ryd9X-000aTT-Ui <euser@host.hostname.com>

              user3@aol.com

     0m  1.6K 1Ryd9Y-000aUC-Tp <euser@host.hostname.com>

              user4@aol.com

     0m  1.6K 1Ryd9Z-000aUN-59 <euser@host.hostname.com>

              user5@aol.com

     0m  1.6K 1Ryd9Z-000alM-P0 <euser@host.hostname.com>

              user6@aol.com

As you can see all the emails were sent a few minutes before I checked (0m), so there is definitely a bulk emailer/spammer. See if there is a cPanel user in the name "euser".

grep euser /etc/userdomains

If there is one, suspend/block him.

If you don't get much details. Check the header of one of the emails, using the below command.

exim -Mvh message_id

for eg:

exim -Mvh 1Ryd9Z-000alM-P0

Analyze the subject, from and to email address to locate the spammer.

Mailnull spammers, won't show up in the above headers most of the time. However an SSH connection is opened and we can identify them after seeing the netstat output.

Quote

    tcp        0      0 127.0.0.1:32587             127.0.0.1:25                ESTABLISHED 547580/sshd: euser

    tcp        0      0 127.0.0.1:32568             127.0.0.1:25                ESTABLISHED 547580/sshd: euser

    tcp        0      0 127.0.0.1:32458             127.0.0.1:25                ESTABLISHED 547580/sshd: euser

    tcp        0      0 127.0.0.1:32541             127.0.0.1:25                ESTABLISHED 547580/sshd: euser

Suspend the "euser" in that case and disable SSH access for him.

If you still don't find any spammers, enable extended logging for Exim. Read http://www.webhostgear.com/118.html

Also check the exim logs using the message_id to find more details.

Quote

    exigrep message_id /var/log/exim_mainlog

    exigrep 1Ryd9Z-000alM-P0 /var/log/exim_mainlog

Prevent Spamming

To prevent spamming, you should enable SpamFilters, SpammAssassin and anti-virus in the server. Read

http://www.sput.nl/software/exim.html http://wiki.exim.org/SpamFiltering and http://www.webhostgear.com/338.html

Also, the following command will give you some information if the spamming is done using any script.

ps -C exim -fH eww | grep home

Fantastico installation on WHM

SSH in to the server then : 

cd /usr/local/cpanel/whostmgr/docroot/cgi
wget -N http://files.betaservant.com/files/free/fantastico_whm_admin.tgz
tar -xzpf fantastico_whm_admin.tgz
rm -rf fantastico_whm_admin.tgz

A number of issues with Fantastico all have exactly the same cause and solution, so please try these two simple steps if you're having any problems with Fantastico either not working, displaying errors such as disabled functions or saying that Fantastico isn't installed in the correct location:

1)  Log into WHM as root, click on Tweak Settings, scroll down to the PHP section and make sure the      IONCUBE PHP Loader is selected. Save changes if needed.

2)  Log into your server as root via SSH and execute the following command:
    /scripts/makecpphp

For step number 2, make sure that the script completes the task without any errors. If the script stops the installation with errors, please deal with those errors before continuing.

We've seen a lot of servers lately that have cPanel and WHM incorrectly using a server's frontend (public) php.ini configuration instead of the correct backend copy located at /usr/local/cpanel/3rdparty/etc/php.ini. Running /scripts/makecpphp will fix this problem so long as your cPanel installation is reasonably up-to-date. Also, some people have missed the IONCUBE step mentioned in our installation directions or have accidentally had the loader changed or removed.

Reminder: Setting the IONCUBE loader in Tweak Settings does not affect your public PHP configuration, only the backend copy used by cPanel and WHM