vault repo สำหรับ Centos 5

[base]
name=CentOS-$releasever – Base
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os
#baseurl=http://mirror.centos.org/centos/$releasever/os/$basearch/
baseurl=http://vault.centos.org/5.11/os/i386/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5

#released updates
[updates]
name=CentOS-$releasever – Updates
mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=updates
#baseurl=http://mirror.centos.org/centos/$releasever/updates/$basearch/
gpgcheck=1
enabled=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5

#additional packages that may be useful
[extras]
name=CentOS-$releasever – Extras
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=extras
#baseurl=http://mirror.centos.org/centos/$releasever/extras/$basearch/
baseurl=http://vault.centos.org/5.11/extras/i386/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5

วิธีเซ็ตค่า php.ini เพื่อความปลอดภัย

แบบมาตรฐาน
——————————–
disable_functions = symlink,shell_exec,exec,proc_close,proc_open,popen,system,passthru,escapeshellarg,escapeshellcmd,ini_restore

แบบสูงสุด
——————————–
disable_functions = symlink,shell_exec,exec,proc_close,proc_open,popen,system,passthru,escapeshellarg,escapeshellcmd,pcntl_exec_proc_get_status,proc_nice,proc_terminate,pclose,ini_alter,virtual,openlog,ini_restore

——————————–
กำหนด upload_tmp_dir และ session_save_path ไปที่ /tmp ที่เราได้ mount แบบ noexec ไว้แล้ว
upload_tmp_dir = “/tmp”
session.save_path = “/tmp”

กำหนดขนาดไฟล์สูงสุดที่ upload ได้ผ่าน PHP โดยกำหนด post_max_size ให้มากกว่า upload_max_filesize เล็กน้อย
upload_max_filesize = 10M
post_max_size = 12M

/etc/init.d/httpd restart

วิธี Block spam ด้วย Iptables

rm -rf /root/spamhaus.sh
nano /root/spamhaus.sh
chmod 777 /root/spamhaus.sh
./root/spamhaus.sh

crontab -e

0 3 * * * /root/spamhaus.sh

 

service iptables stop
rm -rf /mnt/iptables
wget –no-check-certificate https://myip.ms/files/blacklist/csf/latest_blacklist.txt -O /mnt/iptables
IPT=/sbin/iptables
SPAMLIST=”spamlist”
SPAMDROPMSG=”SPAM LIST DROP”
BADIPS=$(egrep -v -E “^#|^$” /mnt/iptables)
# create a new iptables list
$IPT -N $SPAMLIST
for ipblock in $BADIPS
do
$IPT -A $SPAMLIST -s $ipblock -j LOG –log-prefix “$SPAMDROPMSG”
$IPT -A $SPAMLIST -s $ipblock -j DROP
done
$IPT -I INPUT -j $SPAMLIST
$IPT -I OUTPUT -j $SPAMLIST
$IPT -I FORWARD -j $SPAMLIST