Installing flv and mp4 module on cpanel apache 2

Well, If you're going to use flv or mp4 videos on your websites hosted on cpanel server, you will probably need this :

put the following codes into /scripts/after_apache_make_install :
cd /usr/local/src
wget http://people.apache.org/~pquerna/modules/mod_flvx.c
/usr/local/apache/bin/apxs -i -c mod_flvx.c

wget http://h264.code-shop.com/download/apache_mod_h264_streaming-2.2.7.tar.gz
tar -zxvf apache_mod_h264_streaming-2.2.7.tar.gz
cd /mod_h264_streaming-2.2.7
./configure --with-apxs='/usr/local/apache/bin/apxs'
make
make install
/usr/local/cpanel/bin/apache_conf_distiller --update


put the following codes into /usr/local/apache/conf/includes/pre_virtualhost_global.conf :
LoadModule h264_streaming_module modules/mod_h264_streaming.so
<IfModule mod_h264_streaming.c>
AddHandler h264-streaming.extensions .mp4
</IfModule>

LoadModule flvx_module modules/mod_flvx.so
<IfModule mod_flvx.c>
AddHandler flv-stream .flv
</IfModule>

Now, compile apache2 with EasyApache and it's on !!

PHP-SHELL script to whitelist IP on CSF

I needed a fast way to whitelist my IP on a linux server to be able to login to secure administration page...

I set it up by using a php file + shell file + cronjob

Now I easily open a public website address "mydomain.com/whatis.php" and it automatically whitelist my IP.

"whatis.php" PHP file code :
<?php
echo file_put_contents("/tmp/iplog",$_SERVER["REMOTE_ADDR"]);
?>

"/script/ip" Shell file code :
#!/bin/bash
i=1
while [ $i -le 10 ]
do
        status=`cat /tmp/iplog`
        if [ "$status" != "0" ]; then
                echo $status >> /etc/csf/csf.allow
                echo $status >> /etc/csf/csf.ignore
#                echo "allow from $status" >> /home/DOMAIN/public_html/admin/.htaccess
                echo "0" > /tmp/iplog
                `/etc/csf/csf.pl -r > /tmp/csf.log`
        fi
        sleep 5
        (( i++ ))
done

"/script/ip" Cronjob :
* * * * * /script/ip

Note : I tried to run `csf -r` to reset CSF firewall in shell script but it didn't work ! I don't know why. I found here that we should use `/etc/csf/csf.pl -r` instead. Thanks to that guy !!

Running mini_sendmail with php-fpm chroot on Centos 6 , debian 6, ...

Chrooting a website is a good security improvement on a server with multiple websites hosted.
When you set the chroot  of php-fpm you'll not be able to send mails, I fixed this using mini_sendmail. Here's the procedure:

Download and extract your OS template on chroot directory from openvz.  (Don't forget to set the file owners correctly)
Enter chroot directory and run :
chmod 0666 dev/{tty,null,zero}
echo "8.8.8.8" > etc/resolv.conf

Now compile mini_sendmail:
cd /usr/src
wget http://acme.com/software/mini_sendmail/mini_sendmail-1.3.6.tar.gz
tar -zxf mini_sendmail-1.3.6.tar.gz
cd mini_sendmail-1.3.6

If you start compiling mini_sendmail now, you'll receive the following error and mini_sendmail will not work properly :
mini_sendmail.c:(.text+0x5df): warning: Using 'getpwuid' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking

To fix that edit mini_sendmail.c and in Line #148 replace :
username = getlogin();
with
username = "USERNAME";
where USERNAME is your php-fpm user .
Now compile it :
make

and copy it to usr/sbin/sendmail
/home/USERNAME/usr/sbin/sendmail
chmod 755 /home/USERNAME/usr/sbin/sendmail
chown USERNAME:USERNAME /home/USERNAME/usr/sbin/sendmail

Notes :
- I also tested mini_sendmail on chrooted ssh user, if you don't replace username with getlogin() according to above instructions, mini_sendmail will fail to work with the following error :
mini_sendmail: can't determine username

- The following error can be ignored safely :
mini_sendmail.c:(.text+0xa47): warning: Using 'getaddrinfo' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking

- When I compiled mini_sendmail on debian 6 x64, It didn't work with the following error :
unexpected reloc type in static binarySegmentation fault
I tried to compile it on another OS ( centos 6, debian 6 i686 ) and copy the binary to the server, it worked...

building latest version of ffmpeg with x264 on Centos 6

A good tutorial has been posted here.
Here are some fixes on the above tutorial :

- You should remove ffmpeg and its libraries before you proceed to manual compilation of the program:

yum remove libvpx libogg libvorbis libtheora libx264 x264 ffmpeg

It's really important.My compilation was failed with the following error

libx264.c:552: undefined reference to `x264_encoder_open_130' 

And the reason was that I had not removed x264-libs and x264-devel packages.

-You'll receive the following error while compiling faac 1.28 library :
mpeg4ip.h:126: error: new declaration ‘char* strcasestr(const char*, const char*)’
And the fix is to remove line 126 from the file ./common/mp4v2/mpeg4ip.h :
char *strcasestr(const char *haystack, const char *needle);
 
- Compile x264 with the following parameters :
cd x264
./configure --enable-static --enable-shared

- You'll need to install libvpx to compile ffmpeg :
git clone http://git.chromium.org/webm/libvpx.git
cd libvpx
./configure
make && make install
ldconfig


That's all.

Mos

Install latest Wine [1.5] version on Debian

I don't know why debian loves wine v1.01 ?? an obsolete version of wine. They don't upgrade to the next stable versions. The winehq.org doesn't provide .deb packages for squeeze too.
So here's the way, I've just installed  the latest version of wine on my squeeze ! Just remember that compiling wine from source takes ~ 1h of time...

apt-get build-dep wine
cd /usr/src
wget http://downloads.sourceforge.net/project/wine/Source/wine-1.5.25.tar.bz2
tar -jxf wine-1.5.25.tar.bz2
chown -R nobody:nogroup wine-1.5.25
cd wine-1.5.25
sudo -u nobody ./configure
sudo -u nobody make
make install 

~Mos

Speed improvement

Here's some tips which I  applied recently on one busy ded server and the result was a significant reduce in disk I/O load and so faster speed, lesser load avg.

- mount /tmp in ramdisk : Here's the /etc/fstab file line related to tmp :
none /tmp tmpfs nr_inodes=200k,mode=01777,nosuid,nodev 0 0

Check if php uses /tmp as session.save_path , mysql also uses /tmp as tmpdir (mysqladmin variables | grep tmpdir). I've notices on websites with high join queries, mysql has a lot of I/O in /tmp so it's recommended to mount this to ram instead of hdd.


- Mysql datadir : /var/lib/mysql  , recommended to mount in a SSD disk which will give you much greater performance.

- nginx + php-fpm  : There're lots of resources on web suggesting that nginx+php-fpm have much more performance rather than php via apache2 handler.

- ... I'll update this post if I found/remember new tricks ...

- More ?

Security improvement : nginx symlink and php-fpm chroot features

I've found the new directive in nginx old documentation :

disable_symlinks if_not_owner; # off | on | if_not_owner

Default value is off ! Setting it to if_not_owner is a good security improve and I recommend it.

Also don't miss php-fpm chroot feature ! You can make a chroot jail for working fpm pool by extracting an OS-template to chrooted folder ! (Select the template which matches your main OS). I had to run the following additional commands to make the dns resolving and php working correctly in chrooted jail :

cd jail-path

mknod -m 666 dev/null c 1 3
mknod -m 666 dev/zero c 1 5

mknod -m 666 dev/random c 1 8
mknod -m 666 dev/urandom c 19

cp /lib/*dns* lib

cp /lib64/*dns* lib64

echo "nameserver 8.8.8.8" > etc/resolv.conf

chown -R user:user .