# ⚡ Linux Server Management Toolkit

Comprehensive multi-panel server management suite supporting cPanel, InterWorx, Plesk, and standalone Apache with modular architecture and intelligent security features.

## 📦 Directory Structure

```
server-toolkit/
├── launcher.sh                          # Main menu system
├── README.md                            # This file
│
├── modules/                             # Modular scripts organized by category
│   │
│   ├── diagnostics/                     # 🔍 System Diagnostics
│   │   ├── system-health-check.sh      # Comprehensive health analysis
│   │   └── loadwatch-analyzer.sh       # Historical system health analysis
│   │
│   ├── security/                        # 🛡️ Security & Monitoring
│   │   ├── bot-analyzer.sh             # Full bot/threat analysis
│   │   ├── live-attack-monitor.sh      # Real-time attack monitoring dashboard
│   │   ├── ssh-attack-monitor.sh       # SSH brute force detection
│   │   ├── web-traffic-monitor.sh      # Web traffic monitoring
│   │   ├── firewall-activity-monitor.sh # CSF/iptables monitoring
│   │   ├── enable-cphulk.sh            # cPHulk enablement with CSF whitelist import
│   │   ├── ip-reputation-manager.sh    # Centralized IP reputation tracking
│   │   └── tail-*.sh                   # Various log monitoring scripts
│   │
│   ├── backup/                          # 💾 Backup & Recovery
│   │   ├── acronis-*.sh                # Acronis Cyber Protect (9 management scripts)
│   │   └── mysql-restore-to-sql.sh     # MySQL/MariaDB database restore & dump tool
│   │
│   ├── website/                         # 🌐 Website Diagnostics
│   │   ├── website-error-analyzer.sh   # Comprehensive error analysis
│   │   ├── 500-error-tracker.sh        # Fast 500 error tracking
│   │   └── wordpress/                  # WordPress tools
│   │
│   ├── performance/                     # 📊 Performance Analysis
│   │   ├── hardware-health-check.sh    # Hardware diagnostics
│   │   ├── mysql-query-analyzer.sh     # MySQL performance analysis
│   │   ├── network-bandwidth-analyzer.sh # Network analysis
│   │   ├── php-optimizer.sh            # PHP Configuration Optimizer
│   │   ├── nginx-varnish-manager.sh    # Nginx + Varnish Cache Manager (NEW!)
│   │   └── (other performance modules)
│   │
│   └── maintenance/                     # 🧹 System Maintenance
│       └── cleanup-toolkit-data.sh     # Clean temporary toolkit data
│
├── lib/                                 # Shared libraries
│   ├── common-functions.sh             # Reusable functions
│   ├── system-detect.sh                # System type detection
│   ├── user-manager.sh                 # User account management
│   ├── mysql-analyzer.sh               # MySQL utilities
│   ├── reference-db.sh                 # Cross-module intelligence sharing
│   ├── php-detector.sh                 # PHP configuration detection (NEW!)
│   ├── php-analyzer.sh                 # PHP performance analysis engine (NEW!)
│   └── php-config-manager.sh           # PHP config backup/restore/modification (NEW!)
│
├── config/                              # Configuration files
│   ├── settings.conf                   # Main configuration
│   ├── whitelist-ips.txt               # IP whitelist
│   └── whitelist-user-agents.txt       # User-Agent whitelist
│
└── tools/                               # Utility scripts
    ├── diagnostic-report.sh            # Generate system reports
    └── test-*.sh                       # Testing utilities
```

## 🚀 Quick Start

### Installation & Running

**One command - automatic cleanup:**
```bash
curl -sL https://git.mull.lol/cschantz/Linux-Server-Management-Toolkit/archive/main.tar.gz | tar xz && source linux-server-management-toolkit/run.sh
```

When exiting (option 0), answer "yes" and cleanup happens automatically - no extra steps.

Or if already downloaded:
```bash
source /root/linux-server-management-toolkit/run.sh
```

## ✨ Key Features

### 🛡️ Security & Monitoring
- **Live Attack Monitor**: Real-time SOC dashboard with intelligent auto-blocking
  - **Auto-Mitigation Engine**: Automatic blocking at Score >= 80 (critical) or >= 100 (instant)
  - **Distributed Attack Detection**: Blocks coordinated attacks (5+ IPs, 25+ for subnet-level blocking)
  - **24 Attack Signatures**: RCE, SQL injection, XSS, path traversal, SSRF, XXE, credential stuffing, and more
  - **IPset Integration**: Kernel-level blocking for instant response (batched for performance)
  - **Bot Classification**: Distinguishes legitimate bots (Google, Bing) from AI scrapers and attack tools
  - **Attack Scoring System**: Dynamic scoring with volume bonuses and attack severity weighting
  - **Multi-Source Monitoring**: HTTP, SSH, Email, FTP, Database, Network attacks in unified dashboard
- **Bot & Traffic Analyzer**: Full bot/threat analysis with pattern detection
- **IP Reputation Manager**: Centralized cross-module IP intelligence with query/tracking
- **Malware Scanner**: ImunifyAV, ClamAV, and Maldet integration with auto-installation
- **cPHulk Integration**: Auto-imports CSF whitelists from all sources
- **Specialized Monitors**: SSH attacks, web traffic, firewall activity
- **Log Viewers**: Live tail for Apache access/error, mail, and security logs
- **No System Pollution**: All data stored in /tmp (auto-cleanup on reboot, no /var/lib/ files)

### 💾 Backup & Recovery
- **Acronis Cyber Protect**: Complete agent management (install, update, configure, monitor, troubleshoot)
- **MySQL Database Restore Tool**: Advanced recovery from file-based backups with intelligent Force Recovery
  - Multi-control panel support (cPanel, InterWorx, Plesk, standalone)
  - Smart detection for selective restore scenarios
  - Safe single-database extraction from full backups
  - Clean SQL export for production import

### 🌐 Website Diagnostics
- **Error Analysis**: Comprehensive website error detection and troubleshooting
- **500 Error Tracking**: Detailed analysis of application errors
- **Log Integration**: Apache, PHP-FPM, cPanel error log analysis
- **Smart Recommendations**: Context-aware suggestions for fixing issues

### 🔍 Performance & Diagnostics
- **System Health Check**: Comprehensive hardware, services, and security posture analysis
- **Loadwatch Analyzer**: Historical system health analysis (1h/6h/24h/7d/30d time ranges)
- **MySQL Query Analyzer**: Slow query detection and optimization recommendations
- **Network & Bandwidth Analyzer**: Traffic analysis and top consumers
- **Hardware Health Check**: SMART, memory, CPU sensors
- **PHP Configuration Optimizer**: Per-domain PHP-FPM tuning with auto-backup and zero downtime
- **Nginx + Varnish Cache Manager**: Complete Varnish cache installation and management for cPanel
  - **99.5% Stock Compliance**: Only settings.json modified (RPM config file)
  - **Full HTTP + HTTPS Caching**: SSL termination at Nginx, HTTP backends to Varnish
  - **Update Survival**: Proven to survive ea-nginx package updates and rebuilds
  - **93 Static File Types**: Images, fonts, CSS/JS, videos, documents, archives, and more
  - **Self-Healing**: 8 automatic fixes including config-script integrity checks
  - **Complete Backup/Revert**: Full restoration to pre-installation state
  - **Smart Bypasses**: AutoSSL, cPanel services, admin pages, POST requests
  - **Automated Audit**: 44 tests verify configuration and functionality
- **Multi-Panel Support**: cPanel, InterWorx, Plesk, standalone Apache

### 📊 Session Intelligence
- **Reference Database**: Cross-module data sharing (.sysref)
- **No Historical Tracking**: Session-based intelligence only
- **"Download, Run, Fix, Delete"**: Designed for one-time troubleshooting

## 🎯 Usage Examples

### Quick System Health Check

```bash
bash launcher.sh
# Select: 1) System Health Check
```

### Security Analysis & Monitoring

```bash
bash launcher.sh
# Select: 2) Security & Monitoring
# Options:
#   - Live Attack Monitor (real-time SOC dashboard with auto-blocking)
#     * Monitors HTTP, SSH, Email, FTP, Database, Network attacks
#     * Auto-blocks IPs at Score >= 80 (critical) or >= 100 (instant)
#     * Detects distributed attacks (5+ IPs) and blocks all participants
#     * Subnet blocking when 25+ IPs attack from same /24 range
#     * IPset kernel-level blocking for instant response
#   - Bot & Traffic Analyzer (full scan or 1-hour quick scan)
#   - IP Reputation Manager
#   - Malware Scanner (ImunifyAV, ClamAV, Maldet with auto-install)
#   - Enable cPHulk Protection
#   - SSH/Web/Firewall attack monitors
```

### Website Diagnostics

```bash
bash launcher.sh
# Select: 3) Website Diagnostics
# Options:
#   - Website Error Analyzer (comprehensive error detection)
#   - Fast 500 Error Tracker (500 errors only)
#   - WordPress Tools (WP-Cron manager)
```

### Performance Analysis

```bash
bash launcher.sh
# Select: 4) Performance Analysis
# Options:
#   - MySQL Query Analyzer (slow query detection)
#   - Network & Bandwidth Analyzer
#   - Hardware Health Check
#   - PHP Configuration Optimizer (per-domain tuning)
#   - Nginx + Varnish Cache Manager (transparent caching layer)
#   - Loadwatch Health Analyzer (1h/6h/24h/7d/30d analysis)
```

### Backup & Recovery

```bash
bash launcher.sh
# Select: 5) Backup & Recovery
# Options:
#   - Acronis Management (complete backup interface)
#   - MySQL File Restore (convert DB files to SQL)
```

## 🔧 Configuration

Edit the configuration file:
```bash
nano /root/server-toolkit/config/settings.conf
```

## 🔒 Security Considerations

- **Run as root**: Most modules require root access
- **Credentials stored safely**: Git credentials in ~/.git-credentials (outside project)
- **No sensitive data in repo**: .gitignore excludes keys, tokens, credentials
- **Test first**: Try on non-production environments first

## 📊 Recent Updates (v2.2)

### January 2026 Highlights - Performance & Security
- **Nginx + Varnish Cache Manager**: Complete Varnish cache installation system (NEW!)
  - 99.5% stock compliance (only settings.json modified)
  - Full HTTP + HTTPS caching via SSL termination and config-script automation
  - Proven update survival (RPM config file preservation)
  - 93 static file types cached
  - 8 self-healing auto-fixes
  - Complete backup/revert capability
  - Automated 44-test audit system
- **Auto-Mitigation Engine**: Automatic IP blocking at Score >= 80/100 via IPset (kernel-level)
- **Distributed Attack Blocking**: Detects and blocks coordinated botnet attacks (5+ IPs)
- **Subnet-Level Blocking**: Blocks entire /24 subnets when 25+ IPs attack from same range
- **Attack Signature Improvements**: Fixed false positives in HTTP_SMUGGLING and SUSPICIOUS_UA detection
- **Function Exports**: Fixed critical bug preventing HTTP attack auto-blocking in subshells
- **No System Pollution**: Moved all persistent data from /var/lib/ to /tmp/ for clean removal
- **Maldet Auto-Installation**: Enhanced Plesk support with improved directory detection

### December 2025 Highlights
- **Launcher Cleanup**: Removed 90+ phantom menu items, reduced from 1,576 to 574 lines (64% reduction)
- **Performance**: Cached domain status checks save ~5 minutes on 50-domain servers
- **MySQL Restore Tool**: Advanced database recovery with intelligent Force Recovery detection
- **Multi-Panel**: Full support for cPanel, InterWorx, Plesk, standalone Apache

### Current Feature Set
- **42 Working Modules**: Security (14), Website (3), Performance (6), Backup (11), Diagnostics (8)
- **24 Attack Signatures**: RCE, SQL Injection, XSS, Path Traversal, SSRF, XXE, and more
- **Varnish Cache Integration**: Transparent caching layer with stock compliance and auto-healing
- **Reference Database**: 1-hour cached status for cross-module intelligence
- **Zero Hardcoded Paths**: Automatic control panel detection and path abstraction
- **Self-Contained Design**: Delete toolkit directory = all data removed (no system files)

## 🙏 Credits

Built for comprehensive cPanel/Linux server management with a focus on security and intelligent automation.

---

**Version**: 2.2.0
**Last Updated**: January 2026
**Repository**: https://git.mull.lol/cschantz/Linux-Server-Management-Toolkit