Author Archives: cahpct

How to create a SPF record in cPanel

  1. Login to the cPanel Account.
  2. Click the “Email Authentication” button.
  3. Click the “Enable” button found under the SPF heading
  4. You now have a basic SPF record setup for the domain name. Advanced users may wish to tweak it by modifying the settings below the “Enable” button.

Enterprise storage

Senin dan selasa tanggal 24 dan 25 juni saya berkesempatan nimbrung bareng dengan team surya University (selanjutnya saya singkat SU), di summarecon gading serpong untuk mempersiapkan datacenter kampus baru SU.

Selama ini dalam pekerjaan sehari – hari yang berhubungan datacenter saya masih menggunakan server yang  berbasiskan singel server dan virtual server yang gratis. Untuk os server saya biasa menggunakan LINUX dengan apalikasi cPanel, bind, postfix, apache, nginx dll , untuk kebutuhan virtual server saya menggunakan vmware versi gratisan dengan alasan cukup mudah dalam hal installasi dan maintenance, tapi tidak untuk backup sampai saat ini saya belum pernah explore bagaimana membackup vmware yang versi free ini. Continue reading

Membuat Smtp email Gateway

Dua hari ini saya berkesempatan membantu teman untuk membuat smtp email gateway. Sebenarnya saya sudah lama tidak ngoprek smtp. Mumpung ada kesempatan untuk merefresh ulang ingatan maka saya siap membantu.

Berikut hal yang akan di bangun

  • Smtp email gateway untuk menerima dan mengirim email dari emailserver dengan detail : hostname :(server ip = Setting mx pada dns sudah mengarah ke = smtp IN MX 10
  • Email server menggunakan zimbra 8.0 dengan detail : hostname: ( ip =

Langkah – langkah pembuatan email server gateway:

      • Install linux centos 6.4 64 bit ( akan di gabungkan dengan kaspersky mailgateway dikemudian hari)
      • Pastikan hostname dengan command: nano /etc/hosts  :-> untuk melihat hostname yang sudah di buat dengan perintah : hostname -f
      • Install postfix = yum install Postfix
      • Settup = nano /etc/postfix/

alias_database = hash:/etc/aliases
append_at_myorigin = no
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
html_directory = no
inet_interfaces = all
inet_protocols = all
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain,
mydomain =
myhostname =
mynetworks =
mynetworks_style = host
myorigin =
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
relay_domains =
sample_directory = /usr/share/doc/postfix-2.6.6/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
transport_maps = hash:/etc/postfix/transport
unknown_local_recipient_reject_code = 550
    • Edit file  : nano /etc/postfix/transport  smtp:[]
  • Setiap perubahan perlu melakukan map ulang dan restart system postfix:
postmap /etc/postfix/transport

Dan lakukan restart Postfix:

/etc/init.d/postfix restart

Selanjutnya untuk server zimbra. Asumsinya bahwa server zimbra sudah berjalan dan tinggal mensetting relay ke server smtp dengan mengganti pada MTA setting.

Home -> Configure -> Global Settings -> MTA

Relay MTA for external delivery:

Web mail MTA

Inbound SMTP host name:

MTA Trusted Networks:

Selanjutnya tes kirim email dan cek log pada smtp server email gateway

tail -f /var/log/maillog

May 30 06:28:49 smtp postfix/qmgr[18042]: EA47022034A: from=<>, size=13742, nrcpt=1 (queue active)
May 30 06:28:49 smtp postfix/smtpd[23059]: disconnect from[]
May 30 06:28:49 smtp postfix/smtp[23064]: EA47022034A: to=<>, 
relay=[]:25, delay=0.77, delays=0.57/0.01/0.12/0.08, dsn=2.0.0, status=sent (250 2.0.0 Ok: 
queued as 0659B30002F)

Apabila anda atau perusahaan anda memerlukan jasa setting email gateway dan membangun email server yang free alias gratis silahkan menggunakan zimbra, jangan lupa contact saya di jamin maknyus!!

clnt_create: RPC: Program not registered

Usually you get this error if the you are trying to using showmount command to see the available nfs shares on your remote nfs server.

[root@client ~]# showmount -e
clnt_create: RPC: Program not registered

If the nfs service is runnging on your remote nfs server, you get this error on your client machine after running showmount command.To resolve this issue, just check if the nfs service is running on your server or not

[root@manny ~]# /etc/init.d/nfs status
rpc.svcgssd is stopped
rpc.mountd is stopped
nfsd is stopped
rpc.rquotad is stopped

Simply restart the nfs service on server and also make it start at startup using chkconfig command

[root@server ~]# /etc/init.d/nfs restart

[root@server ~]# chkconfig nfs on



Recomended wordpress security mode

.htaccess    ../.htaccess    404
wp-config.php    ../wp-config.php    400
index.php    ../index.php    400
wp-blog-header.php    ../wp-blog-header.php    400
root folder    ../    705
wp-admin/    ../wp-admin    705
wp-includes/    ../wp-includes    705
wp-content/    ../wp-content    705
wp-content/bps-backup/    ../wp-content/bps-backup    755

Try again: Unable to connect to the MTA

Saat kemaren saya setting email zimbra setelah usai install dan test server saya mendapatkan error Try again: Unable to connect to the MTA.

Setelah melakukan penelusuran hingga larut malam saya putuskan tidur dulu karena badan dah lemah gemulai. Dan setelah bangun pagi , saya lanjutkan dan ternyata masalahnya domainya tidak bisa query ke dns server, di karenakan di dns server saya pasang firewall config server sebagai aplikasi tambahan untuk cpanel.

Solusinya adalah ip server email saya whitelest dari config server setelah itu saya coba send email dan berjalan lancar.

10 Tips for making your cPanel and WHM servers more secure

Please note that these tips are suggestions only and cPanel takes no responsibility for modifications to individual servers, or the security practices of individual servers. Server security is a collection of compromises, as any server that allows connections could be insecure. These tips are to be followed at your own risk.

1) Use secure passwords!
Insecure passwords are the most common security vulnerability for most servers. If an account password is insecure and is compromised, client sites can be defaced, infected, or used to spread viruses. Having secure passwords is paramount to having a secure server.

You can edit /etc/login.defs to configure many password options on your system. It is well documented.

Generally, a password utilizing at least 8 characters including alphanumeric and grammatical symbols is sufficient. Never use passwords based upon dictionary words or significant dates. If you are uncertain about the security of a password, then you can test it using JTR cracker. If a password can be broken in a few hours, then it is probably too insecure and should not be used. You can also install tools like pam_passwdqc to check the strength of passwords.

2) Secure SSH
Enable public key authentication for SSH and disable password authentication read more >>

Move SSH access to a different port. People are looking for port 22 as a possible way to access your servers. Moving SSH to a different port will add a simple way to deter those without specific knowledge of your server from easily discovering your SSH port.

You can modify the port that SSH runs on within /etc/ssh/sshd_config. Change the line that says #Port 22 to a different port such as: Port 1653. Make sure to keep your current SSH session open when testing the new port so you can change back to port 22 if the new port doesn’t work.

You should always use SSHv2 only as SSHv1 is not secure. Make sure to change the line in /etc/ssh/sshd_config that says #Protocol 2,1 to Protocol 2.

You may also wish to set Shell Resource Limits for you users to prevent applications and scripts from using all up your resources and taking down your server. You can configure shell resource limits in /etc/security/limits.conf on most Linux systems.

3) Secure Apache
The most readily available way to access a web server, is of course, the web server application. It is important to take steps to secure your Apache installation.

One of the best tools for preventing malicious Apache use is mod_security. This can be installed in Addon Modules in the cPanel section of WebHost Manager. You can find information about mod_security at

When compiling Apache, you should include suexec to ensure that CGI applications and scripts run as the user that owns / executes them. This will help identify where malicious scripts are and who is running them. It will also enforce permission and environment controls.

We also recommend compiling Apache + PHP with PHPsuexec. PHPsuexec forces all PHP scripts to run as the user who owns the script. This means that you will be able to identify the owner of all PHP scripts running on your server. If one is malicious, you will be able to find it’s owner quickly and resolve the issue. To compile Apache + PHP with PHPsuexec, select the PHPSuexec option in the Apache Upgrade interface in WHM or when running /scripts/easyapache from the command line.

You should enable PHP’s open_basedir protection. This protection will prevent users from open files outside of their home directory with PHP. This can be enabled in Tweak Security within WebHost Manager.

You may also wish to include safe_mode for PHP 5.x and below. Safe_mode ensures that the owner of a PHP script matches the owner of any files to be operated on. You can enable safe_mode by changing the safe_mode = line in php.ini to safe_mode = On.

4) Secure your /tmp partition
We recommend that you use a separate partition for /tmp that is mounted with nosetuid. Nosetuid will force a process to run with the privileges of it’s executor. You may also wish to mount /tmp with noexec after installing cPanel. Check the mount man page for more information.

Also, Running /scripts/securetmp will mount your /tmp partition to a temporary file for extra security.

5) Upgrade your mail to maildir format
Maildir format adds extra security and speed to your mail system. Newer installs use maildir by default. If you’re running an older copy of cPanel, you’ll probably want to upgrade using /scripts/convert2maildir. Make sure to back up your current mail before converting to maildir, this can be done within /scripts/convert2maildir. If you see maildir is enabled when running /scripts/convert2maildir, you are already using maildir, and will not need to convert.

6) Lock down your system’s compilers
Most users do not require the use of C and C++ compilers. You can use the Compilers Tweak within Tweak Security in WebHost Manager to turn off use of the compilers for all unprivileged users, or to disable them for specific users only. Many pre-packaged exploits require working compilers. Disabling compilers will help protect against many exploits.

7) Turn off unused services and daemons
Any service or daemon that allows a connection to be established to your server is away for hackers to gain access. To reduce security risks, you should disable all services and daemons that are not being used.

For Daemons on Linux:
Check /etc/xinetd.conf for services you are not using. For example, cupsd (printing daemon) and nfs/statd (network file system daemons) are not used on many systems.

For Services:
Go to the Service Manager in the Service Configuration section of WHM and disable any services that you are not using.

Monitor your system
It is important to be up to date on what is going on with your system. Make sure that you know when accounts are being created, what software is being installed, when software needs updates, etc.

Check your system frequently to ensure it is functioning in the way you expect. Make sure to check things like:

netstat -anp : Look for programs attached to ports that you did not install / authorize

find / ( -perm -a+w ) ! -type l >> world_writable.txt : Look at world_writable.txt to see all world writable files and directories. This will reveal locations where an attacker can store files on your system. NOTE: Fixing permissions on some PHP/CGI scripts that are not properly coded will break them.

find / -nouser -o -nogroup >> no_owner.txt : Look at no_owner for all files that do not have a user or group associated with them. All files should be owned by a specific user or group to restrict access to them.

ls /var/log/: There are many different logs on your system which can be valuable resources. Check your system logs, apache logs, mail logs, and other logs frequently to make sure your system is functioning as expected.

There are many readily available utilities to monitor your system and to detect rootkits, backdoors, etc. Here are some commonly available utilities:

  • Tripwire – Monitors checksums of files and reports changes. or
  • Chrookit – Scans for common rootkits, backdoors, etc.
  • Rkhunter – Scans for common rootkits, backdoors, etc.
  • Logwatch – Monitors and reports on daily system activity.

9) Enable a Firewall
Installing a firewall to limit access to your server is useful. Removing all unused software on your system is more useful. Before you have the chance to remove all unused services and daemons, or the chance to figure out which services / daemons are unused, you can enable a firewall to prevent unwanted access.

The following will show the ports cPanel and WHM need open to function properly and what the port is used for:

Please note that these ports are for all services that can be used by cPanel and WHM, you may or may not be using all of these services or other services and should adjust your rules accordingly.

Remember to set a cron job to disable your firewall every 5 minutes when testing your rules, or you may be locked out of your server.

10) Stay up to date
It is important to make sure that you are running the latest stable versions of the software on your system to ensure that it has been patched of any security issues that past versions may be susceptible to. Make sure to keep on top of updates for:

  • Kernel
  • cPanel and WHM*
  • User Applications (bulletin boards, CMS, blog engines, etc)**
  • System Software*

*These can be set to automatically update in WebHost Manager under Update Config in the Server Configuration section.

**You can upgrade all cPAddon installations through Manage cPAddons in the cPanel section of WebHost Manager.