If you plan on running one, you have to plan FOR abuse. The main way I am solving this now is by ACTIVE moderation, but in this little "guide" I will explain how to find and solve an abuse problem.

So lets get started.

First login to your server and check load and so on.

uptime 16:22:15 up 67 days, 5:13, 1 user, load average: 1.30, 2.38, 2.70

As you see this server is having a high load, if you have 2 processors then this should not worry you, but in this case it does not. So lets check out whats causing such a high load.

top

18340 root 15 0 4332 4088 3056 S 20.3 0.4 0:28 0 httpd 16347 root 20 0 1316 1316 856 R 1.9 0.1 0:00 0 top 1 root 15 0 112 84 56 S 0.0 0.0 0:04 0 init

As we see, httpd is causing a very high load. On image hosting, it is a different way from any other host, as you know its going to be an abuse image. So just go straight and find out why, check your netstat output for ips with multiple connections, also understand this will only find forum posts with multiple images. In my experience its these boards that cause main problem.

netstat -an | grep :80 | sort | awk '{print $5}'

You should see lots of ips, if you are unable to view them all at same time you can either save to a file or use | more command.

netstat -an | grep :80 | sort | awk '{print $5}' >> file.txt netstat -an | grep :80 | sort | awk '{print $5}' | more

Just for easy viewing, now its up to you to decide ips with lots of connections.

In this example I will pick

81.57.149.78:24225 81.57.149.78:24226 81.57.149.78:24229 81.57.149.78:24232 81.57.149.78:24236 81.57.149.78:24237 81.57.149.78:24241 81.57.149.78:24265 81.57.149.78:24238 81.57.149.78:24224 81.57.149.78:24231

Now we want to see what this ip is viewing, this is on a cPanel server so it logs to /usr/local/apache/domlogs , yours may be different.

Now ls -al, and get your sites name log, most commonly this will be your sites name. For our example we will use HostGeekZ.com , so lets view it for that ip.

cat HostGeekZ.com | grep 81.57.149.78

Your output will obviously be different, but I just picked 1 entry out of entire things they accessed.

69.241.239.147 - - [11/Jun/2005:16:28:05 -0500] "GET /Uploads/Images/DDS1.jpg HTTP/1.1" 200 3677 "http://www.fmforums.co.uk/forums/index.php?showtopic=30783" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"

Now this tells us they where on http://www.fmforums.co.uk/forums/index.php?showtopic=30783 viewing /Uploads/Images/DDS1.jpg , which just so happens to be a R-Rated pictures, so we will go ahead and block ip, remove picture(s), and block this board from hosting pictures.

So lets ban ip first.

iptables -I INPUT -s 81.57.149.78 -j DROP

Please read more about iptables by typing `man iptables`, you can block them in your firewall and so on, I just prefer to use iptables.

Now we want to remove offending images, commonly they use names that are offensive, or they use similar names for each, ie if it was called HostGeekZ1.jpg next one will be HostGeekZ2.jpg and so on.

So go to your images directory, in this case /Uploads/Images , and type ls -al | grep partofimage

Again in this case DDS

So we type

oidentd), its mainly targeted towards installing cPanel on freeBSD.

I used freeBSD 5.4-RELEASE so you might not encounter problems I did.

firstly login to your server and we will just install cpanel straight away.

-------------------------------------------------------------------------------- mkdir /home/cpins cd /home/cpins wget http://layer1.cpanel.net/latest sh latest --------------------------------------------------------------------------------

This will take awhile so go grab a coffee. This will install everything for cPanel.

Once this is complete, go to WHM

http://yourip/whm

and login with username root and your root password. Now you will be prompted with WHM setup screen. This is really

simple, just follow onscreen instructions to setup whm. This will setup your server hostname,resolvers,nameservers and

so on.

Once this is done, you have done it. You have installed cPanel, but don't get your hopes up just yet. No doubt there will

be bugs, you are best to search google but I will go over what ones I encounter. If I do that is.

So straight off I am going to go test account creation, go to Create A New Account in WHM, and input any domain you

want, for my example I just put google.com. After I hit created it created account but returned a bind error. So we

have to fix this first.

I ran

--------------------------------------------------------------------------------/scripts/fixnamed /scripts/fixndc --------------------------------------------------------------------------------

Which returned

--------------------------------------------------------------------------------Found key in named.conf .. Found controls in named.conf .. Found key in named.conf .. Adding key... Adding controls... Restarting bind.....Waiting for named to restart..............finished.

named has failed, please contact sysadmin (result was "named is not running"). Jun 7 14:03:26 serv named[52645]: starting BIND 9.3.1 -u bind -c /etc/namedb/named.conf Jun 7 14:03:26 serv named[52645]: could not configure root hints from '/var/named/named.root': file not

found Jun 7 14:03:26 serv named[52645]: loading configuration: file not found Jun 7 14:03:26 serv named[52645]: exiting (due to fatal error) Done All fixed --------------------------------------------------------------------------------

So I just created /var/named/named.root file manually by using touch command then I re-ran /scripts/fixndc this done

the job.

--------------------------------------------------------------------------------serv# touch /var/named/named.root serv# /scripts/fixndc Found key in named.conf .. Found controls in named.conf .. Found key in named.conf .. Adding key... Adding controls... Restarting bind.....Waiting for named to restart..............finished.

bind 53378 0.0 0.7 5240 3744 ?? Ss 2:09PM 0:00.04 /usr/sbin/named -u bind -c /etc/namedb/named.conf

named started ok Jun 7 14:09:18 serv named[53378]: starting BIND 9.3.1 -u bind -c /etc/namedb/named.conf Jun 7 14:09:18 serv named[53378]: command channel listening on 127.0.0.1#953 Jun 7 14:09:18 serv named[53378]: zone 0.0.127.IN-ADDR.ARPA/IN: loading master file

/var/named/localhost.rev: file not found Jun 7 14:09:18 serv named[53378]: zone

1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA/IN: loading master file

/var/named/localhost-v6.rev: file not found Jun 7 14:09:18 serv named[53378]: zone

1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.INT/IN: loading master file

/var/named/localhost-v6.rev: file not found Jun 7 14:09:18 serv named[53378]: running Done All fixed --------------------------------------------------------------------------------

---

Now go back and terminate test account and recreate it.

This time it created successfully.

--------------------------------------------------------------------------------Keeping Shell Access (y) Copying skel files from /root/cpanel3-skel/ to /usr/home/google/ Using Freebsd Copy /root/cpanel3-skel/public_html -> /usr/home/google/public_html /root/cpanel3-skel/public_ftp -> /usr/home/google/public_ftp Using redhat 6.x/freebsd support Name Virtual Host already exists Added Entries to httpd.conf (noip) Bind reconfiguring on serv using rndc Added Named File Using Frontpage 5.x!

Starting install, port: 80.

Creating web http://www.google.com. Chowning Content in service /. Install completed.

Starting chown, port: 80, web: "/".