Friday, October 23, 2026 at 12:46:37
To detect intrusions:
cd /var/log/apache2
grep exhausted access* error*
more access.log access.log.1 | perl -e 'while(<>){if ($_ =~ m`[[^]]*?]s+"[^"]*"s+(d+)` && $1 == 500) { print $_; }}'
To detect processes that may have been spawned by intrusion:
ps -ef | grep bash
ps -ef | grep sh
ps -ef | grep python
ps -ef | grep perl
ps -ef | grep curl
ps -ef | grep wget
ps -ef | grep nc
ps -ef | grep cert
To check if PHP has been patched (some ubuntu versions remain the same but have patches applied)
zgrep -E 'CVE-2026-109618|CVE-2026-109619' /usr/share/doc/php8.3-common/changelog.Debian.gz
all systems that had phpadmin running, disabled before updating php:
a2disconf phpmyadmin
Any sites using php - I created an index.html stating that site offline, then did this:
mv sitedir sitedir.offline ; mkdir sitedir ; cp index.html sitedir/ ; chown www-data:www-data sitedir
Updating (if we’re at 8.3 in this instance):
sudo apt update && sudo apt install --only-upgrade 'php8.3*'
systemctl restart php8.3-fpm
systemctl restart apache2
Updating from 8.1 to 8.3:
apt update
apt install -y software-properties-common
add-apt-repository -y ppa:ondrej/php
dpkg -l | grep '^ii' | grep php8.1 | awk '{print $2}' > php8.1_packages.txt
cat php8.1_packages.txt
EXTENSIONS=$(cat php8.1_packages.txt | sed 's/php8.1-/php8.3-/g' | tr 'n' ' ')
apt install -y php8.3 php8.3-cli php8.3-common $EXTENSIONS
php -v
sudo update-alternatives --set php /usr/bin/php8.3
php -v
a2query -m | grep php
a2dismod php8.1
a2enmod php8.3
systemctl restart apache2
apt purge "php8.1-*"
a2query -m | grep php
systemctl restart apache2
Putting phpmyadmin back online:
a2enconf phpmyadmin
putting sites back online (from wherever site paths are):
ls | grep offline | perl -e 'while(<>){
chomp;
if ($_ =~ m`^(.*).offline$`) {
$x = $1; $y = $_; print "Moving $x to $x.temp.php.issuesn"; system("mv $x ${x}.temp.php.issues");
print "Moving $y to $xn"; system("mv $y $x");
if (-e $x && -e "${x}.temp.php.issues") { print "Success!n-----------------------------n"; }
else { print "oops... $xn-----------------------------n"; }}}'
Sunday, August 9, 2026 at 07:27:40
Stop mysql
sudo systemctl stop mysql
sudo systemctl status mysql
Rsync to new location
sudo rsync -av /var/lib/mysql /mnt/new_disk/
mv original dir
sudo mv /var/lib/mysql /var/lib/mysql.bak
edit the mysql.cnf file
sudo vi /etc/mysql/mysql.conf.d/mysqld.cnf
find datadir and change to new location
datadir = /mnt/new_disk/mysql
edit apparmor file (for ubuntu)
sudo nano /etc/apparmor.d/tunables/alias
change/add the following line
alias /var/lib/mysql/ -> /mnt/new_disk/mysql/,
restart everything
sudo systemctl restart apparmor
sudo systemctl start mysql
Of course, I forgot that the mounted drive is ntfs so I could access from my dual boot windows side (rarely if ever used), so the owner of the files/directories can’t be changed. Sigh… putting everything back.
😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵
So, I ended up resizing the ntfs partition, making an ext4 partition in the leftover space, and moving mysql to that partition. Also, before doing all that, I rsync’d all the data to another system/drive.
Friday, May 15, 2026 at 17:12:20
Getting scanned on one of the system by libredtail-http. So I’m blocking it on that server.
I tried adding this to apache2.conf, didn’t work:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond "%{HTTP_USER_AGENT}" "libredtail-http" [NC]
RewriteRule ^ - [F,L]
</IfModule>
So i tried moving it within the file, I tried adding the same thing to global-redtailban.conf in apache2/conf-available and running a2enconf global-redtailban, also didn’t work.
So I finally found something that said to add this to the apache2.conf file (replacing BadBot with the one I want to ban):
<If "%{HTTP_USER_AGENT} == 'BadBot'">
Require all denied
</If>
That seems to have done the trick.
Saturday, October 18, 2025 at 02:25:34
svpsdev.e5l.co -
Followed the installations I’ve done in the past, plus the following (main reason for the additional server):
- apt install cpanminus
- apt install build-essential
- apt install libpng-dev
- apt install ./google-chrome-stable_current_amd64.deb
- cpanm install WWW::Mechanize::Chrome
Thursday, May 8, 2025 at 17:09:50
To use on same machine:
- Log in as user (not gituser)
-
cd /home/thisuser/
-
mkdir gitstuff
-
cd gitstuff
-
git config --global user.email "thisuser@localhost"
-
git config --global user.name "thisuser"
-
git clone /usr/local/gitpath/newrepositoryname
- At this point, you have an empty directory. Add files, do ‘git add *’, then ‘git commit’, and it will be pushed to main git path.
To use on different machine (linux anyway):