cschantz
e4611b994f
Added comprehensive documentation for: - Auto-Mitigation Engine (Score >= 80/100 blocking) - Distributed attack detection and blocking (5+ IPs) - Subnet-level blocking (25+ IPs from same /24) - IPset kernel-level blocking with batching - 24 attack signatures with improved accuracy - Bot classification system - Multi-source monitoring (HTTP, SSH, Email, FTP, DB, Network) - No system pollution design (/tmp storage) Updated version to 2.2.0 with January 2026 highlights. Enhanced security module documentation in usage examples.
239 lines
11 KiB
Markdown
239 lines
11 KiB
Markdown
# ⚡ Linux Server Management Toolkit
|
|
|
|
Comprehensive multi-panel server management suite supporting cPanel, InterWorx, Plesk, and standalone Apache with modular architecture and intelligent security features.
|
|
|
|
## 📦 Directory Structure
|
|
|
|
```
|
|
server-toolkit/
|
|
├── launcher.sh # Main menu system
|
|
├── README.md # This file
|
|
│
|
|
├── modules/ # Modular scripts organized by category
|
|
│ │
|
|
│ ├── diagnostics/ # 🔍 System Diagnostics
|
|
│ │ ├── system-health-check.sh # Comprehensive health analysis
|
|
│ │ └── loadwatch-analyzer.sh # Historical system health analysis
|
|
│ │
|
|
│ ├── security/ # 🛡️ Security & Monitoring
|
|
│ │ ├── bot-analyzer.sh # Full bot/threat analysis
|
|
│ │ ├── live-attack-monitor.sh # Real-time attack monitoring dashboard
|
|
│ │ ├── ssh-attack-monitor.sh # SSH brute force detection
|
|
│ │ ├── web-traffic-monitor.sh # Web traffic monitoring
|
|
│ │ ├── firewall-activity-monitor.sh # CSF/iptables monitoring
|
|
│ │ ├── enable-cphulk.sh # cPHulk enablement with CSF whitelist import
|
|
│ │ ├── ip-reputation-manager.sh # Centralized IP reputation tracking
|
|
│ │ └── tail-*.sh # Various log monitoring scripts
|
|
│ │
|
|
│ ├── backup/ # 💾 Backup & Recovery
|
|
│ │ ├── acronis-*.sh # Acronis Cyber Protect (9 management scripts)
|
|
│ │ └── mysql-restore-to-sql.sh # MySQL/MariaDB database restore & dump tool
|
|
│ │
|
|
│ ├── website/ # 🌐 Website Diagnostics
|
|
│ │ ├── website-error-analyzer.sh # Comprehensive error analysis
|
|
│ │ ├── 500-error-tracker.sh # Fast 500 error tracking
|
|
│ │ └── wordpress/ # WordPress tools
|
|
│ │
|
|
│ ├── performance/ # 📊 Performance Analysis
|
|
│ │ ├── hardware-health-check.sh # Hardware diagnostics
|
|
│ │ ├── mysql-query-analyzer.sh # MySQL performance analysis
|
|
│ │ ├── network-bandwidth-analyzer.sh # Network analysis
|
|
│ │ ├── php-optimizer.sh # PHP Configuration Optimizer (NEW!)
|
|
│ │ └── (other performance modules)
|
|
│ │
|
|
│ └── maintenance/ # 🧹 System Maintenance
|
|
│ └── cleanup-toolkit-data.sh # Clean temporary toolkit data
|
|
│
|
|
├── lib/ # Shared libraries
|
|
│ ├── common-functions.sh # Reusable functions
|
|
│ ├── system-detect.sh # System type detection
|
|
│ ├── user-manager.sh # User account management
|
|
│ ├── mysql-analyzer.sh # MySQL utilities
|
|
│ ├── reference-db.sh # Cross-module intelligence sharing
|
|
│ ├── php-detector.sh # PHP configuration detection (NEW!)
|
|
│ ├── php-analyzer.sh # PHP performance analysis engine (NEW!)
|
|
│ └── php-config-manager.sh # PHP config backup/restore/modification (NEW!)
|
|
│
|
|
├── config/ # Configuration files
|
|
│ ├── settings.conf # Main configuration
|
|
│ ├── whitelist-ips.txt # IP whitelist
|
|
│ └── whitelist-user-agents.txt # User-Agent whitelist
|
|
│
|
|
└── tools/ # Utility scripts
|
|
├── diagnostic-report.sh # Generate system reports
|
|
└── test-*.sh # Testing utilities
|
|
```
|
|
|
|
## 🚀 Quick Start
|
|
|
|
### Installation & Running
|
|
|
|
**One command - automatic cleanup:**
|
|
```bash
|
|
curl -sL https://git.mull.lol/cschantz/Linux-Server-Management-Toolkit/archive/main.tar.gz | tar xz && source linux-server-management-toolkit/run.sh
|
|
```
|
|
|
|
When exiting (option 0), answer "yes" and cleanup happens automatically - no extra steps.
|
|
|
|
Or if already downloaded:
|
|
```bash
|
|
source /root/linux-server-management-toolkit/run.sh
|
|
```
|
|
|
|
## ✨ Key Features
|
|
|
|
### 🛡️ Security & Monitoring
|
|
- **Live Attack Monitor**: Real-time SOC dashboard with intelligent auto-blocking
|
|
- **Auto-Mitigation Engine**: Automatic blocking at Score >= 80 (critical) or >= 100 (instant)
|
|
- **Distributed Attack Detection**: Blocks coordinated attacks (5+ IPs, 25+ for subnet-level blocking)
|
|
- **24 Attack Signatures**: RCE, SQL injection, XSS, path traversal, SSRF, XXE, credential stuffing, and more
|
|
- **IPset Integration**: Kernel-level blocking for instant response (batched for performance)
|
|
- **Bot Classification**: Distinguishes legitimate bots (Google, Bing) from AI scrapers and attack tools
|
|
- **Attack Scoring System**: Dynamic scoring with volume bonuses and attack severity weighting
|
|
- **Multi-Source Monitoring**: HTTP, SSH, Email, FTP, Database, Network attacks in unified dashboard
|
|
- **Bot & Traffic Analyzer**: Full bot/threat analysis with pattern detection
|
|
- **IP Reputation Manager**: Centralized cross-module IP intelligence with query/tracking
|
|
- **Malware Scanner**: ImunifyAV, ClamAV, and Maldet integration with auto-installation
|
|
- **cPHulk Integration**: Auto-imports CSF whitelists from all sources
|
|
- **Specialized Monitors**: SSH attacks, web traffic, firewall activity
|
|
- **Log Viewers**: Live tail for Apache access/error, mail, and security logs
|
|
- **No System Pollution**: All data stored in /tmp (auto-cleanup on reboot, no /var/lib/ files)
|
|
|
|
### 💾 Backup & Recovery
|
|
- **Acronis Cyber Protect**: Complete agent management (install, update, configure, monitor, troubleshoot)
|
|
- **MySQL Database Restore Tool**: Advanced recovery from file-based backups with intelligent Force Recovery
|
|
- Multi-control panel support (cPanel, InterWorx, Plesk, standalone)
|
|
- Smart detection for selective restore scenarios
|
|
- Safe single-database extraction from full backups
|
|
- Clean SQL export for production import
|
|
|
|
### 🌐 Website Diagnostics
|
|
- **Error Analysis**: Comprehensive website error detection and troubleshooting
|
|
- **500 Error Tracking**: Detailed analysis of application errors
|
|
- **Log Integration**: Apache, PHP-FPM, cPanel error log analysis
|
|
- **Smart Recommendations**: Context-aware suggestions for fixing issues
|
|
|
|
### 🔍 Performance & Diagnostics
|
|
- **System Health Check**: Comprehensive hardware, services, and security posture analysis
|
|
- **Loadwatch Analyzer**: Historical system health analysis (1h/6h/24h/7d/30d time ranges)
|
|
- **MySQL Query Analyzer**: Slow query detection and optimization recommendations
|
|
- **Network & Bandwidth Analyzer**: Traffic analysis and top consumers
|
|
- **Hardware Health Check**: SMART, memory, CPU sensors
|
|
- **PHP Configuration Optimizer**: Per-domain PHP-FPM tuning with auto-backup and zero downtime
|
|
- **Multi-Panel Support**: cPanel, InterWorx, Plesk, standalone Apache
|
|
|
|
### 📊 Session Intelligence
|
|
- **Reference Database**: Cross-module data sharing (.sysref)
|
|
- **No Historical Tracking**: Session-based intelligence only
|
|
- **"Download, Run, Fix, Delete"**: Designed for one-time troubleshooting
|
|
|
|
## 🎯 Usage Examples
|
|
|
|
### Quick System Health Check
|
|
|
|
```bash
|
|
bash launcher.sh
|
|
# Select: 1) System Health Check
|
|
```
|
|
|
|
### Security Analysis & Monitoring
|
|
|
|
```bash
|
|
bash launcher.sh
|
|
# Select: 2) Security & Monitoring
|
|
# Options:
|
|
# - Live Attack Monitor (real-time SOC dashboard with auto-blocking)
|
|
# * Monitors HTTP, SSH, Email, FTP, Database, Network attacks
|
|
# * Auto-blocks IPs at Score >= 80 (critical) or >= 100 (instant)
|
|
# * Detects distributed attacks (5+ IPs) and blocks all participants
|
|
# * Subnet blocking when 25+ IPs attack from same /24 range
|
|
# * IPset kernel-level blocking for instant response
|
|
# - Bot & Traffic Analyzer (full scan or 1-hour quick scan)
|
|
# - IP Reputation Manager
|
|
# - Malware Scanner (ImunifyAV, ClamAV, Maldet with auto-install)
|
|
# - Enable cPHulk Protection
|
|
# - SSH/Web/Firewall attack monitors
|
|
```
|
|
|
|
### Website Diagnostics
|
|
|
|
```bash
|
|
bash launcher.sh
|
|
# Select: 3) Website Diagnostics
|
|
# Options:
|
|
# - Website Error Analyzer (comprehensive error detection)
|
|
# - Fast 500 Error Tracker (500 errors only)
|
|
# - WordPress Tools (WP-Cron manager)
|
|
```
|
|
|
|
### Performance Analysis
|
|
|
|
```bash
|
|
bash launcher.sh
|
|
# Select: 4) Performance Analysis
|
|
# Options:
|
|
# - MySQL Query Analyzer (slow query detection)
|
|
# - Network & Bandwidth Analyzer
|
|
# - Hardware Health Check
|
|
# - PHP Configuration Optimizer (per-domain tuning)
|
|
# - Loadwatch Health Analyzer (1h/6h/24h/7d/30d analysis)
|
|
```
|
|
|
|
### Backup & Recovery
|
|
|
|
```bash
|
|
bash launcher.sh
|
|
# Select: 5) Backup & Recovery
|
|
# Options:
|
|
# - Acronis Management (complete backup interface)
|
|
# - MySQL File Restore (convert DB files to SQL)
|
|
```
|
|
|
|
## 🔧 Configuration
|
|
|
|
Edit the configuration file:
|
|
```bash
|
|
nano /root/server-toolkit/config/settings.conf
|
|
```
|
|
|
|
## 🔒 Security Considerations
|
|
|
|
- **Run as root**: Most modules require root access
|
|
- **Credentials stored safely**: Git credentials in ~/.git-credentials (outside project)
|
|
- **No sensitive data in repo**: .gitignore excludes keys, tokens, credentials
|
|
- **Test first**: Try on non-production environments first
|
|
|
|
## 📊 Recent Updates (v2.2)
|
|
|
|
### January 2026 Highlights - Security Enhancements
|
|
- **Auto-Mitigation Engine**: Automatic IP blocking at Score >= 80/100 via IPset (kernel-level)
|
|
- **Distributed Attack Blocking**: Detects and blocks coordinated botnet attacks (5+ IPs)
|
|
- **Subnet-Level Blocking**: Blocks entire /24 subnets when 25+ IPs attack from same range
|
|
- **Attack Signature Improvements**: Fixed false positives in HTTP_SMUGGLING and SUSPICIOUS_UA detection
|
|
- **Function Exports**: Fixed critical bug preventing HTTP attack auto-blocking in subshells
|
|
- **No System Pollution**: Moved all persistent data from /var/lib/ to /tmp/ for clean removal
|
|
- **Maldet Auto-Installation**: Enhanced Plesk support with improved directory detection
|
|
|
|
### December 2025 Highlights
|
|
- **Launcher Cleanup**: Removed 90+ phantom menu items, reduced from 1,576 to 574 lines (64% reduction)
|
|
- **Performance**: Cached domain status checks save ~5 minutes on 50-domain servers
|
|
- **MySQL Restore Tool**: Advanced database recovery with intelligent Force Recovery detection
|
|
- **Multi-Panel**: Full support for cPanel, InterWorx, Plesk, standalone Apache
|
|
|
|
### Current Feature Set
|
|
- **41 Working Modules**: Security (14), Website (3), Performance (5), Backup (11), Diagnostics (8)
|
|
- **24 Attack Signatures**: RCE, SQL Injection, XSS, Path Traversal, SSRF, XXE, and more
|
|
- **Reference Database**: 1-hour cached status for cross-module intelligence
|
|
- **Zero Hardcoded Paths**: Automatic control panel detection and path abstraction
|
|
- **Self-Contained Design**: Delete toolkit directory = all data removed (no system files)
|
|
|
|
## 🙏 Credits
|
|
|
|
Built for comprehensive cPanel/Linux server management with a focus on security and intelligent automation.
|
|
|
|
---
|
|
|
|
**Version**: 2.2.0
|
|
**Last Updated**: January 2026
|
|
**Repository**: https://git.mull.lol/cschantz/Linux-Server-Management-Toolkit
|