cschantz/Linux-Server-Management-Toolkit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Comprehensive README update with all new modules and features

Browse Source 
MAJOR DOCUMENTATION UPDATE:

Directory Structure:
- Added complete security module listing (14 modules)
- Added email diagnostics category (9 modules)
- Added all backup/Acronis modules (18 total)
- Added maintenance modules (disk-space-analyzer)
- Added all 18 shared libraries with descriptions
- Added 6 utility tools (QA checker, signature updater, etc.)

New Features Documented:
- Bot Blocker: Apache User-Agent blocking manager
- Cloudflare Detector: Orange cloud vs gray cloud detection with locations
- Email Diagnostics: Complete 9-module email troubleshooting suite
- Live Attack Monitor v2: Updated from legacy version
- All Acronis Cyber Protect utilities

Enhanced Documentation:
- Complete module counts: 60+ modules across 6 categories
- Detailed feature descriptions for new tools
- Usage examples for bot blocker, cloudflare detector, email tools
- Updated version to 2.3.0
- Added statistics section (LOC, QA tests, etc.)

Libraries Documented:
- Attack detection: attack-patterns.sh, attack-signatures.sh, bot-signatures.sh
- Intelligence: threat-intelligence.sh, ip-reputation.sh, rate-anomaly-detector.sh
- Analysis: http-attack-analyzer.sh
- System: domain-discovery.sh, email-functions.sh, plesk-helpers.sh

Recent Updates:
- Week 4 (Jan 2026): Cloudflare detector + Bot blocker
- Week 3 (Jan 2026): Varnish cache + auto-mitigation
- Organized by feature release timeline

Before: Incomplete tree, missing 20+ modules
After: Complete documentation of all 60+ modules and 18 libraries
This commit is contained in:
cschantz
2026-01-28 16:01:47 -05:00
parent 79efeeb62c
commit ce7879c964
1 changed files with 159 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+159 -31
View File
@@ -13,47 +13,91 @@ server-toolkit/
│ │ │ │
│ ├── diagnostics/ # 🔍 System Diagnostics │ ├── diagnostics/ # 🔍 System Diagnostics
│ │ ├── system-health-check.sh # Comprehensive health analysis │ │ ├── system-health-check.sh # Comprehensive health analysis
│ │ └── loadwatch-analyzer.sh # Historical system health analysis │ │ └── loadwatch-analyzer.sh # Historical system health analysis (1h/6h/24h/7d/30d)
│ │ │ │
│ ├── security/ # 🛡️ Security & Monitoring │ ├── security/ # 🛡️ Security & Monitoring
│ │ ├── bot-analyzer.sh # Full bot/threat analysis │ │ ├── live-attack-monitor-v2.sh # Real-time SOC dashboard with auto-mitigation
│ │ ├── live-attack-monitor.sh # Real-time attack monitoring dashboard │ │ ├── live-attack-monitor.sh # Legacy attack monitoring (deprecated)
│ │ ├── bot-analyzer.sh # Full bot/threat analysis with pattern detection
│ │ ├── bot-blocker.sh # Apache User-Agent blocking manager (NEW!)
│ │ ├── malware-scanner.sh # ImunifyAV, ClamAV, Maldet integration
│ │ ├── ip-reputation-manager.sh # Centralized IP reputation tracking
│ │ ├── ssh-attack-monitor.sh # SSH brute force detection │ │ ├── ssh-attack-monitor.sh # SSH brute force detection
│ │ ├── web-traffic-monitor.sh # Web traffic monitoring │ │ ├── web-traffic-monitor.sh # Web traffic monitoring
│ │ ├── firewall-activity-monitor.sh # CSF/iptables monitoring │ │ ├── firewall-activity-monitor.sh # CSF/iptables monitoring
│ │ ├── enable-cphulk.sh # cPHulk enablement with CSF whitelist import │ │ ├── enable-cphulk.sh # cPHulk enablement with CSF whitelist import
│ │ ├── ip-reputation-manager.sh # Centralized IP reputation tracking │ │ ├── optimize-ct-limit.sh # Connection tracking optimization
│ │ └── tail-*.sh # Various log monitoring scripts │ │ ├── tail-apache-access.sh # Live Apache access log viewer
│ │ ├── tail-apache-error.sh # Live Apache error log viewer
│ │ ├── tail-mail-log.sh # Live mail log viewer
│ │ └── tail-secure-log.sh # Live secure/auth log viewer
│ │ │ │
│ ├── backup/ # 💾 Backup & Recovery │ ├── backup/ # 💾 Backup & Recovery
│ │ ├── acronis-*.sh # Acronis Cyber Protect (9 management scripts) │ │ ├── acronis-*.sh # Acronis Cyber Protect (17 management scripts)
│ │ │ ├── acronis-install.sh # Install Acronis agent
│ │ │ ├── acronis-register.sh # Register agent with cloud
│ │ │ ├── acronis-configure.sh # Configure backup plans
│ │ │ ├── acronis-status.sh # Agent status check
│ │ │ ├── acronis-backup-status.sh # Backup job status
│ │ │ ├── acronis-manual-backup.sh # Trigger manual backup
│ │ │ ├── acronis-restore.sh # Restore from backup
│ │ │ ├── acronis-update.sh # Update agent
│ │ │ ├── acronis-uninstall.sh # Remove agent
│ │ │ ├── acronis-troubleshoot.sh # Diagnostics and repair
│ │ │ └── (7 more utilities)
│ │ └── mysql-restore-to-sql.sh # MySQL/MariaDB database restore & dump tool │ │ └── mysql-restore-to-sql.sh # MySQL/MariaDB database restore & dump tool
│ │ │ │
│ ├── website/ # 🌐 Website Diagnostics │ ├── website/ # 🌐 Website Diagnostics
│ │ ├── website-error-analyzer.sh # Comprehensive error analysis │ │ ├── website-error-analyzer.sh # Comprehensive error analysis
│ │ ├── 500-error-tracker.sh # Fast 500 error tracking │ │ ├── 500-error-tracker.sh # Fast 500 error tracking
│ │ └── wordpress/ # WordPress tools │ │ ├── cloudflare-detector.sh # Cloudflare domain detection (NEW!)
│ │ ├── wordpress-menu.sh # WordPress tools submenu
│ │ └── wordpress/
│ │ └── wordpress-cron-manager.sh # WP-Cron diagnostics and management
│ │
│ ├── email/ # 📧 Email Diagnostics & Management
│ │ ├── email-diagnostics.sh # Comprehensive email diagnostics
│ │ ├── mail-log-analyzer.sh # Mail log analysis
│ │ ├── mail-queue-inspector.sh # Exim queue inspection
│ │ ├── flush-mail-queue.sh # Flush stuck mail queue
│ │ ├── blacklist-check.sh # RBL/DNSBL blacklist checker
│ │ ├── spf-dkim-dmarc-check.sh # Email authentication validator
│ │ ├── deliverability-test.sh # Email delivery testing
│ │ ├── smtp-connection-test.sh # SMTP connectivity checker
│ │ └── clean-mailboxes.sh # Mailbox cleanup utility
│ │ │ │
│ ├── performance/ # 📊 Performance Analysis │ ├── performance/ # 📊 Performance Analysis
│ │ ├── hardware-health-check.sh # Hardware diagnostics │ │ ├── nginx-varnish-manager.sh # Nginx + Varnish Cache Manager
│ │ ├── mysql-query-analyzer.sh # MySQL performance analysis
│ │ ├── network-bandwidth-analyzer.sh # Network analysis
│ │ ├── php-optimizer.sh # PHP Configuration Optimizer │ │ ├── php-optimizer.sh # PHP Configuration Optimizer
│ │ ├── nginx-varnish-manager.sh # Nginx + Varnish Cache Manager (NEW!) │ │ ├── hardware-health-check.sh # Hardware diagnostics (SMART, sensors)
│ │ └── (other performance modules) │ │ ├── mysql-query-analyzer.sh # MySQL performance analysis
│ │ └── network-bandwidth-analyzer.sh # Network analysis
│ │ │ │
│ └── maintenance/ # 🧹 System Maintenance │ └── maintenance/ # 🧹 System Maintenance
│ └── cleanup-toolkit-data.sh # Clean temporary toolkit data │ ├── cleanup-toolkit-data.sh # Clean temporary toolkit data
│ └── disk-space-analyzer.sh # Disk usage analysis and recommendations
│ │
├── lib/ # Shared libraries ├── lib/ # Shared libraries
│ ├── common-functions.sh # Reusable functions │ ├── common-functions.sh # Reusable UI, logging, and utility functions
│ ├── system-detect.sh # System type detection │ ├── system-detect.sh # Multi-panel system detection (cPanel/Plesk/InterWorx)
│ ├── user-manager.sh # User account management │ ├── user-manager.sh # User account management across panels
│ ├── mysql-analyzer.sh # MySQL utilities │ ├── domain-discovery.sh # Multi-panel domain discovery
│ ├── reference-db.sh # Cross-module intelligence sharing │ ├── reference-db.sh # Cross-module intelligence sharing (.sysref)
│ ├── php-detector.sh # PHP configuration detection (NEW!) │ │
│ ├── php-analyzer.sh # PHP performance analysis engine (NEW!) │ ├── attack-patterns.sh # Attack pattern definitions and scoring
│ └── php-config-manager.sh # PHP config backup/restore/modification (NEW!) │ ├── attack-signatures.sh # 24+ attack signature detection rules
│ ├── bot-signatures.sh # Bot classification (legitimate vs malicious)
│ ├── http-attack-analyzer.sh # HTTP attack analysis engine
│ ├── threat-intelligence.sh # Threat scoring and intelligence aggregation
│ ├── ip-reputation.sh # IP reputation tracking and querying
│ ├── rate-anomaly-detector.sh # Request rate anomaly detection
│ │
│ ├── mysql-analyzer.sh # MySQL performance utilities
│ ├── php-detector.sh # PHP configuration detection
│ ├── php-analyzer.sh # PHP performance analysis engine
│ ├── php-config-manager.sh # PHP config backup/restore/modification
│ ├── email-functions.sh # Email-related utilities
│ └── plesk-helpers.sh # Plesk-specific helper functions
│ │
├── config/ # Configuration files ├── config/ # Configuration files
│ ├── settings.conf # Main configuration │ ├── settings.conf # Main configuration
@@ -61,8 +105,12 @@ server-toolkit/
│ └── whitelist-user-agents.txt # User-Agent whitelist │ └── whitelist-user-agents.txt # User-Agent whitelist
│ │
└── tools/ # Utility scripts └── tools/ # Utility scripts
├── diagnostic-report.sh # Generate system reports ├── diagnostic-report.sh # Generate comprehensive system reports
└── test-*.sh # Testing utilities ├── toolkit-qa-check.sh # Quality assurance checker (88 tests)
├── qa-functional-tests.sh # Functional testing suite
├── update-attack-signatures.sh # Update attack signature database
├── analyze-historical-attacks.sh # Historical attack pattern analysis
└── erase-toolkit-traces.sh # Complete toolkit removal utility
``` ```
## 🚀 Quick Start ## 🚀 Quick Start
@@ -84,7 +132,7 @@ source /root/linux-server-management-toolkit/run.sh
## ✨ Key Features ## ✨ Key Features
### 🛡️ Security & Monitoring ### 🛡️ Security & Monitoring
- **Live Attack Monitor**: Real-time SOC dashboard with intelligent auto-blocking - **Live Attack Monitor v2**: Real-time SOC dashboard with intelligent auto-blocking
- **Auto-Mitigation Engine**: Automatic blocking at Score >= 80 (critical) or >= 100 (instant) - **Auto-Mitigation Engine**: Automatic blocking at Score >= 80 (critical) or >= 100 (instant)
- **Distributed Attack Detection**: Blocks coordinated attacks (5+ IPs, 25+ for subnet-level blocking) - **Distributed Attack Detection**: Blocks coordinated attacks (5+ IPs, 25+ for subnet-level blocking)
- **24 Attack Signatures**: RCE, SQL injection, XSS, path traversal, SSRF, XXE, credential stuffing, and more - **24 Attack Signatures**: RCE, SQL injection, XSS, path traversal, SSRF, XXE, credential stuffing, and more
@@ -92,6 +140,11 @@ source /root/linux-server-management-toolkit/run.sh
- **Bot Classification**: Distinguishes legitimate bots (Google, Bing) from AI scrapers and attack tools - **Bot Classification**: Distinguishes legitimate bots (Google, Bing) from AI scrapers and attack tools
- **Attack Scoring System**: Dynamic scoring with volume bonuses and attack severity weighting - **Attack Scoring System**: Dynamic scoring with volume bonuses and attack severity weighting
- **Multi-Source Monitoring**: HTTP, SSH, Email, FTP, Database, Network attacks in unified dashboard - **Multi-Source Monitoring**: HTTP, SSH, Email, FTP, Database, Network attacks in unified dashboard
- **Bot Blocker**: Apache User-Agent blocking manager with one-click enable/disable
- Blocks 24+ malicious bots: security scanners, AI scrapers, SEO bots, vulnerability scanners
- Safe Apache restart with automatic rollback on syntax errors
- Configuration backup and restore capability
- Syntax validation before applying changes
- **Bot & Traffic Analyzer**: Full bot/threat analysis with pattern detection - **Bot & Traffic Analyzer**: Full bot/threat analysis with pattern detection
- **IP Reputation Manager**: Centralized cross-module IP intelligence with query/tracking - **IP Reputation Manager**: Centralized cross-module IP intelligence with query/tracking
- **Malware Scanner**: ImunifyAV, ClamAV, and Maldet integration with auto-installation - **Malware Scanner**: ImunifyAV, ClamAV, and Maldet integration with auto-installation
@@ -111,9 +164,27 @@ source /root/linux-server-management-toolkit/run.sh
### 🌐 Website Diagnostics ### 🌐 Website Diagnostics
- **Error Analysis**: Comprehensive website error detection and troubleshooting - **Error Analysis**: Comprehensive website error detection and troubleshooting
- **500 Error Tracking**: Detailed analysis of application errors - **500 Error Tracking**: Detailed analysis of application errors
- **Cloudflare Detector**: Identify domains using Cloudflare with datacenter locations
- Distinguishes between Proxied (orange cloud) and DNS-Only (gray cloud)
- Shows Cloudflare datacenter locations (Chicago, Los Angeles, etc.)
- Detects NXDOMAIN domains that need cleanup
- Triple validation: nameservers, IP ranges, CF-RAY headers
- Helps debug regional outages and cache issues
- **WordPress Tools**: WP-Cron manager for WordPress diagnostics
- **Log Integration**: Apache, PHP-FPM, cPanel error log analysis - **Log Integration**: Apache, PHP-FPM, cPanel error log analysis
- **Smart Recommendations**: Context-aware suggestions for fixing issues - **Smart Recommendations**: Context-aware suggestions for fixing issues
### 📧 Email Diagnostics & Management
- **Comprehensive Email Diagnostics**: Full email system health check
- **Mail Log Analyzer**: Parse and analyze mail logs for delivery issues
- **Mail Queue Inspector**: Inspect stuck/frozen mail queue with filtering
- **Flush Mail Queue**: Clear stuck messages from Exim queue
- **Blacklist Checker**: Check server IP against 50+ RBL/DNSBL lists
- **SPF/DKIM/DMARC Validator**: Verify email authentication records
- **Deliverability Testing**: Send test emails and verify delivery
- **SMTP Connection Test**: Test SMTP connectivity and authentication
- **Mailbox Cleanup**: Clean up mailbox quotas and old messages
### 🔍 Performance & Diagnostics ### 🔍 Performance & Diagnostics
- **System Health Check**: Comprehensive hardware, services, and security posture analysis - **System Health Check**: Comprehensive hardware, services, and security posture analysis
- **Loadwatch Analyzer**: Historical system health analysis (1h/6h/24h/7d/30d time ranges) - **Loadwatch Analyzer**: Historical system health analysis (1h/6h/24h/7d/30d time ranges)
@@ -152,12 +223,17 @@ bash launcher.sh
bash launcher.sh bash launcher.sh
# Select: 2) Security & Monitoring # Select: 2) Security & Monitoring
# Options: # Options:
# - Live Attack Monitor (real-time SOC dashboard with auto-blocking) # - Live Attack Monitor v2 (real-time SOC dashboard with auto-blocking)
# * Monitors HTTP, SSH, Email, FTP, Database, Network attacks # * Monitors HTTP, SSH, Email, FTP, Database, Network attacks
# * Auto-blocks IPs at Score >= 80 (critical) or >= 100 (instant) # * Auto-blocks IPs at Score >= 80 (critical) or >= 100 (instant)
# * Detects distributed attacks (5+ IPs) and blocks all participants # * Detects distributed attacks (5+ IPs) and blocks all participants
# * Subnet blocking when 25+ IPs attack from same /24 range # * Subnet blocking when 25+ IPs attack from same /24 range
# * IPset kernel-level blocking for instant response # * IPset kernel-level blocking for instant response
# - Bot Blocker (Apache User-Agent blocking)
# * One-click enable/disable
# * Blocks 24+ malicious bots (scanners, scrapers, AI bots)
# * Safe Apache restart with syntax validation
# * Automatic backup and restore
# - Bot & Traffic Analyzer (full scan or 1-hour quick scan) # - Bot & Traffic Analyzer (full scan or 1-hour quick scan)
# - IP Reputation Manager # - IP Reputation Manager
# - Malware Scanner (ImunifyAV, ClamAV, Maldet with auto-install) # - Malware Scanner (ImunifyAV, ClamAV, Maldet with auto-install)
@@ -173,9 +249,31 @@ bash launcher.sh
# Options: # Options:
# - Website Error Analyzer (comprehensive error detection) # - Website Error Analyzer (comprehensive error detection)
# - Fast 500 Error Tracker (500 errors only) # - Fast 500 Error Tracker (500 errors only)
# - Cloudflare Detector
# * Scan all domains or check single domain
# * Shows Proxied (orange cloud) vs DNS-Only (gray cloud)
# * Displays datacenter locations (Chicago, LA, etc.)
# * Identifies NXDOMAIN domains that need cleanup
# - WordPress Tools (WP-Cron manager) # - WordPress Tools (WP-Cron manager)
``` ```
### Email Diagnostics
```bash
bash launcher.sh
# Select: 6) Email Diagnostics
# Options:
# - Comprehensive Email Diagnostics
# - Mail Log Analyzer
# - Mail Queue Inspector
# - Blacklist Checker (RBL/DNSBL)
# - SPF/DKIM/DMARC Validator
# - Deliverability Testing
# - SMTP Connection Test
# - Flush Mail Queue
# - Clean Mailboxes
```
### Performance Analysis ### Performance Analysis
```bash ```bash
@@ -214,10 +312,26 @@ nano /root/server-toolkit/config/settings.conf
- **No sensitive data in repo**: .gitignore excludes keys, tokens, credentials - **No sensitive data in repo**: .gitignore excludes keys, tokens, credentials
- **Test first**: Try on non-production environments first - **Test first**: Try on non-production environments first
## 📊 Recent Updates (v2.2) ## 📊 Recent Updates (v2.3)
### January 2026 Highlights - Performance & Security ### January 2026 Highlights - Performance & Security
- **Nginx + Varnish Cache Manager**: Complete Varnish cache installation system (NEW!)
#### Week 4 - Cloudflare & Bot Management
- **Cloudflare Detector**: Advanced Cloudflare domain detection with location tracking (NEW!)
- Distinguishes between Proxied (orange cloud) and DNS-Only (gray cloud) configurations
- Shows datacenter locations with city names (Chicago, Los Angeles, etc.)
- NXDOMAIN detection for identifying old/deleted domains
- Triple validation: nameservers, IP range matching, CF-RAY header analysis
- Helps debug regional outages and identify misconfigured domains
- **Bot Blocker**: Apache User-Agent blocking manager for malicious bots (NEW!)
- One-click enable/disable for 24+ malicious user-agents
- Blocks: security scanners (nikto, nmap), AI scrapers (GPTBot, Claude-Web), SEO bots
- Safe Apache restart with syntax validation and automatic rollback
- Configuration backup/restore with timestamped backups
- Real-time testing to verify blocking effectiveness
#### Week 3 - Varnish Cache & Auto-Mitigation
- **Nginx + Varnish Cache Manager**: Complete Varnish cache installation system
- 99.5% stock compliance (only settings.json modified) - 99.5% stock compliance (only settings.json modified)
- Full HTTP + HTTPS caching via SSL termination and config-script automation - Full HTTP + HTTPS caching via SSL termination and config-script automation
- Proven update survival (RPM config file preservation) - Proven update survival (RPM config file preservation)
@@ -240,9 +354,14 @@ nano /root/server-toolkit/config/settings.conf
- **Multi-Panel**: Full support for cPanel, InterWorx, Plesk, standalone Apache - **Multi-Panel**: Full support for cPanel, InterWorx, Plesk, standalone Apache
### Current Feature Set ### Current Feature Set
- **42 Working Modules**: Security (14), Website (3), Performance (6), Backup (11), Diagnostics (8) - **60+ Working Modules**: Security (14), Website (5), Email (9), Performance (5), Backup (18), Diagnostics (2), Maintenance (2)
- **18 Shared Libraries**: Attack detection, bot classification, system detection, PHP/MySQL analysis
- **6 Utility Tools**: QA checker (88 tests), attack signature updater, diagnostic reports
- **24 Attack Signatures**: RCE, SQL Injection, XSS, Path Traversal, SSRF, XXE, and more - **24 Attack Signatures**: RCE, SQL Injection, XSS, Path Traversal, SSRF, XXE, and more
- **Varnish Cache Integration**: Transparent caching layer with stock compliance and auto-healing - **Bot Management**: Auto-blocking malicious bots via Apache User-Agent filtering
- **Cloudflare Integration**: Advanced detection with datacenter location tracking
- **Varnish Cache**: Transparent caching layer with 99.5% stock compliance
- **Email Diagnostics**: Complete email troubleshooting suite with RBL checking
- **Reference Database**: 1-hour cached status for cross-module intelligence - **Reference Database**: 1-hour cached status for cross-module intelligence
- **Zero Hardcoded Paths**: Automatic control panel detection and path abstraction - **Zero Hardcoded Paths**: Automatic control panel detection and path abstraction
- **Self-Contained Design**: Delete toolkit directory = all data removed (no system files) - **Self-Contained Design**: Delete toolkit directory = all data removed (no system files)
@@ -253,6 +372,15 @@ Built for comprehensive cPanel/Linux server management with a focus on security
--- ---
**Version**: 2.2.0 **Version**: 2.3.0
**Last Updated**: January 2026 **Last Updated**: January 28, 2026
**Repository**: https://git.mull.lol/cschantz/Linux-Server-Management-Toolkit **Repository**: https://git.mull.lol/cschantz/Linux-Server-Management-Toolkit
## 📈 Statistics
- **Total Modules**: 60+
- **Shared Libraries**: 18
- **Attack Signatures**: 24+
- **Supported Panels**: cPanel, InterWorx, Plesk, Standalone
- **Lines of Code**: ~30,000+
- **QA Tests**: 88 automated checks