Sharing a Terminal Or SSH session using screen

Objective : I want to access a ssh session of  user1 on server 192.168.1.1  and see what all command he types in there using the same user  user1 on server 192.168.1.1

Solution : We can  do this using the multiuser function of screen.Assuming you use the same user name to ssh in and connect as the other user is using.

Step 1 :  One person needs to  create the screen by selecting a name for the session and then typing

# screen -L -S <SESSIONNAME>

Then other user  can ssh into the machine, and join this screen

sudo screen -x <SESSIONNAME>

And even after the session ends  you can view all the commands that were typed by the user1 looking at the

.screenlog

How to find IP Address that Launch DDOS Attack

If your VPS or server load suddenly increases much higher than normal, it could be a DDOS attack.

To find out which IPs did that do the following,

Option 1 :- If you know which domain is attacked. SSH to your server & issue the following command. Make sure you replace “DOMAIN” with your domain name. If you are using cPanel/WHM and the domain is not the primary domain, normally it will be the sub domain of the primary domain.

less /usr/local/apache/domlogs/DOMAIN | awk '{print $1}' | sort | uniq -c | sort -n

Option 2  :- If you don’t know which domain is attacked. SSH to your server & issue the following command. Option 1 if preferable especially if your server is very busy has many domain. It will take quite sometimes to process the log file. You can check by issuing “top -c” command to find out which domain consume the most resources.

less /usr/local/apache/logs/access_log | awk '{print $1}' | sort | uniq -c | sort -n


Both of the option will give the ip and number of connections in the descending order. For example:

1 2 3 4 5 6 7

..... ..... ..... ..... 17843 56.51.155.156 19234 66.156.66.266 234578 156.56.16.76

In the above case we can see too many connections from those ips and it is abnormal. You can block these ips in the firewall such as ConfigServer Firewall (“csf”).

How to Check mod_rewrite Module in Apache/LiteSpeed is Loaded

To check if mod_rewrite Module is loaded in Apache/LiteSpeed follow the following steps:

1. For system with cPanel, log to SSH in issue the following commands

/usr/local/apache/bin/httpd -D DUMP_MODULES | grep rewrite

If it return the following, then mod_rewrite is loaded

Syntax OK rewrite_module (static)

2. For system with no cPanel, check “httpd.conf” file. If the following is in the file then it should be loaded.

LoadModule rewrite_module libexec/apache2/mod_rewrite.so