⚡ Linux Server Management Toolkit

Comprehensive multi-panel server management suite supporting cPanel, InterWorx, Plesk, and standalone Apache with modular architecture and intelligent security features.

📦 Directory Structure

server-toolkit/
├── launcher.sh                          # Main menu system
├── README.md                            # This file
│
├── modules/                             # Modular scripts organized by category
│   │
│   ├── diagnostics/                     # 🔍 System Diagnostics
│   │   ├── system-health-check.sh      # Comprehensive health analysis
│   │   └── loadwatch-analyzer.sh       # Historical system health analysis
│   │
│   ├── security/                        # 🛡️ Security & Monitoring
│   │   ├── bot-analyzer.sh             # Full bot/threat analysis
│   │   ├── live-attack-monitor.sh      # Real-time attack monitoring dashboard
│   │   ├── ssh-attack-monitor.sh       # SSH brute force detection
│   │   ├── web-traffic-monitor.sh      # Web traffic monitoring
│   │   ├── firewall-activity-monitor.sh # CSF/iptables monitoring
│   │   ├── enable-cphulk.sh            # cPHulk enablement with CSF whitelist import
│   │   ├── ip-reputation-manager.sh    # Centralized IP reputation tracking
│   │   └── tail-*.sh                   # Various log monitoring scripts
│   │
│   ├── backup/                          # 💾 Backup & Recovery
│   │   ├── acronis-*.sh                # Acronis Cyber Protect (9 management scripts)
│   │   └── mysql-restore-to-sql.sh     # MySQL/MariaDB database restore & dump tool
│   │
│   ├── website/                         # 🌐 Website Diagnostics
│   │   ├── website-error-analyzer.sh   # Comprehensive error analysis
│   │   ├── 500-error-tracker.sh        # Fast 500 error tracking
│   │   └── wordpress/                  # WordPress tools
│   │
│   ├── performance/                     # 📊 Performance Analysis
│   │   ├── hardware-health-check.sh    # Hardware diagnostics
│   │   ├── mysql-query-analyzer.sh     # MySQL performance analysis
│   │   ├── network-bandwidth-analyzer.sh # Network analysis
│   │   ├── php-optimizer.sh            # PHP Configuration Optimizer
│   │   ├── nginx-varnish-manager.sh    # Nginx + Varnish Cache Manager (NEW!)
│   │   └── (other performance modules)
│   │
│   └── maintenance/                     # 🧹 System Maintenance
│       └── cleanup-toolkit-data.sh     # Clean temporary toolkit data
│
├── lib/                                 # Shared libraries
│   ├── common-functions.sh             # Reusable functions
│   ├── system-detect.sh                # System type detection
│   ├── user-manager.sh                 # User account management
│   ├── mysql-analyzer.sh               # MySQL utilities
│   ├── reference-db.sh                 # Cross-module intelligence sharing
│   ├── php-detector.sh                 # PHP configuration detection (NEW!)
│   ├── php-analyzer.sh                 # PHP performance analysis engine (NEW!)
│   └── php-config-manager.sh           # PHP config backup/restore/modification (NEW!)
│
├── config/                              # Configuration files
│   ├── settings.conf                   # Main configuration
│   ├── whitelist-ips.txt               # IP whitelist
│   └── whitelist-user-agents.txt       # User-Agent whitelist
│
└── tools/                               # Utility scripts
    ├── diagnostic-report.sh            # Generate system reports
    └── test-*.sh                       # Testing utilities

🚀 Quick Start

Installation & Running

One command - automatic cleanup:

curl -sL https://git.mull.lol/cschantz/Linux-Server-Management-Toolkit/archive/main.tar.gz | tar xz && source linux-server-management-toolkit/run.sh

When exiting (option 0), answer "yes" and cleanup happens automatically - no extra steps.

Or if already downloaded:

source /root/linux-server-management-toolkit/run.sh

✨ Key Features

🛡️ Security & Monitoring

• Live Attack Monitor: Real-time SOC dashboard with intelligent auto-blocking
  • Auto-Mitigation Engine: Automatic blocking at Score >= 80 (critical) or >= 100 (instant)
  • Distributed Attack Detection: Blocks coordinated attacks (5+ IPs, 25+ for subnet-level blocking)
  • 24 Attack Signatures: RCE, SQL injection, XSS, path traversal, SSRF, XXE, credential stuffing, and more
  • IPset Integration: Kernel-level blocking for instant response (batched for performance)
  • Bot Classification: Distinguishes legitimate bots (Google, Bing) from AI scrapers and attack tools
  • Attack Scoring System: Dynamic scoring with volume bonuses and attack severity weighting
  • Multi-Source Monitoring: HTTP, SSH, Email, FTP, Database, Network attacks in unified dashboard
• Bot & Traffic Analyzer: Full bot/threat analysis with pattern detection
• IP Reputation Manager: Centralized cross-module IP intelligence with query/tracking
• Malware Scanner: ImunifyAV, ClamAV, and Maldet integration with auto-installation
• cPHulk Integration: Auto-imports CSF whitelists from all sources
• Specialized Monitors: SSH attacks, web traffic, firewall activity
• Log Viewers: Live tail for Apache access/error, mail, and security logs
• No System Pollution: All data stored in /tmp (auto-cleanup on reboot, no /var/lib/ files)

💾 Backup & Recovery

• Acronis Cyber Protect: Complete agent management (install, update, configure, monitor, troubleshoot)
• MySQL Database Restore Tool: Advanced recovery from file-based backups with intelligent Force Recovery
  • Multi-control panel support (cPanel, InterWorx, Plesk, standalone)
  • Smart detection for selective restore scenarios
  • Safe single-database extraction from full backups
  • Clean SQL export for production import

🌐 Website Diagnostics

• Error Analysis: Comprehensive website error detection and troubleshooting
• 500 Error Tracking: Detailed analysis of application errors
• Log Integration: Apache, PHP-FPM, cPanel error log analysis
• Smart Recommendations: Context-aware suggestions for fixing issues

🔍 Performance & Diagnostics

• System Health Check: Comprehensive hardware, services, and security posture analysis
• Loadwatch Analyzer: Historical system health analysis (1h/6h/24h/7d/30d time ranges)
• MySQL Query Analyzer: Slow query detection and optimization recommendations
• Network & Bandwidth Analyzer: Traffic analysis and top consumers
• Hardware Health Check: SMART, memory, CPU sensors
• PHP Configuration Optimizer: Per-domain PHP-FPM tuning with auto-backup and zero downtime
• Nginx + Varnish Cache Manager: Complete Varnish cache installation and management for cPanel
  • 99.5% Stock Compliance: Only settings.json modified (RPM config file)
  • Full HTTP + HTTPS Caching: SSL termination at Nginx, HTTP backends to Varnish
  • Update Survival: Proven to survive ea-nginx package updates and rebuilds
  • 93 Static File Types: Images, fonts, CSS/JS, videos, documents, archives, and more
  • Self-Healing: 8 automatic fixes including config-script integrity checks
  • Complete Backup/Revert: Full restoration to pre-installation state
  • Smart Bypasses: AutoSSL, cPanel services, admin pages, POST requests
  • Automated Audit: 44 tests verify configuration and functionality
• Multi-Panel Support: cPanel, InterWorx, Plesk, standalone Apache

📊 Session Intelligence

• Reference Database: Cross-module data sharing (.sysref)
• No Historical Tracking: Session-based intelligence only
• "Download, Run, Fix, Delete": Designed for one-time troubleshooting

🎯 Usage Examples

Quick System Health Check

bash launcher.sh
# Select: 1) System Health Check

Security Analysis & Monitoring

bash launcher.sh
# Select: 2) Security & Monitoring
# Options:
#   - Live Attack Monitor (real-time SOC dashboard with auto-blocking)
#     * Monitors HTTP, SSH, Email, FTP, Database, Network attacks
#     * Auto-blocks IPs at Score >= 80 (critical) or >= 100 (instant)
#     * Detects distributed attacks (5+ IPs) and blocks all participants
#     * Subnet blocking when 25+ IPs attack from same /24 range
#     * IPset kernel-level blocking for instant response
#   - Bot & Traffic Analyzer (full scan or 1-hour quick scan)
#   - IP Reputation Manager
#   - Malware Scanner (ImunifyAV, ClamAV, Maldet with auto-install)
#   - Enable cPHulk Protection
#   - SSH/Web/Firewall attack monitors

Website Diagnostics

bash launcher.sh
# Select: 3) Website Diagnostics
# Options:
#   - Website Error Analyzer (comprehensive error detection)
#   - Fast 500 Error Tracker (500 errors only)
#   - WordPress Tools (WP-Cron manager)

Performance Analysis

bash launcher.sh
# Select: 4) Performance Analysis
# Options:
#   - MySQL Query Analyzer (slow query detection)
#   - Network & Bandwidth Analyzer
#   - Hardware Health Check
#   - PHP Configuration Optimizer (per-domain tuning)
#   - Nginx + Varnish Cache Manager (transparent caching layer)
#   - Loadwatch Health Analyzer (1h/6h/24h/7d/30d analysis)

Backup & Recovery

bash launcher.sh
# Select: 5) Backup & Recovery
# Options:
#   - Acronis Management (complete backup interface)
#   - MySQL File Restore (convert DB files to SQL)

🔧 Configuration

Edit the configuration file:

nano /root/server-toolkit/config/settings.conf

🔒 Security Considerations

• Run as root: Most modules require root access
• Credentials stored safely: Git credentials in ~/.git-credentials (outside project)
• No sensitive data in repo: .gitignore excludes keys, tokens, credentials
• Test first: Try on non-production environments first

📊 Recent Updates (v2.2)

January 2026 Highlights - Performance & Security

• Nginx + Varnish Cache Manager: Complete Varnish cache installation system (NEW!)
  • 99.5% stock compliance (only settings.json modified)
  • Full HTTP + HTTPS caching via SSL termination and config-script automation
  • Proven update survival (RPM config file preservation)
  • 93 static file types cached
  • 8 self-healing auto-fixes
  • Complete backup/revert capability
  • Automated 44-test audit system
• Auto-Mitigation Engine: Automatic IP blocking at Score >= 80/100 via IPset (kernel-level)
• Distributed Attack Blocking: Detects and blocks coordinated botnet attacks (5+ IPs)
• Subnet-Level Blocking: Blocks entire /24 subnets when 25+ IPs attack from same range
• Attack Signature Improvements: Fixed false positives in HTTP_SMUGGLING and SUSPICIOUS_UA detection
• Function Exports: Fixed critical bug preventing HTTP attack auto-blocking in subshells
• No System Pollution: Moved all persistent data from /var/lib/ to /tmp/ for clean removal
• Maldet Auto-Installation: Enhanced Plesk support with improved directory detection

December 2025 Highlights

• Launcher Cleanup: Removed 90+ phantom menu items, reduced from 1,576 to 574 lines (64% reduction)
• Performance: Cached domain status checks save ~5 minutes on 50-domain servers
• MySQL Restore Tool: Advanced database recovery with intelligent Force Recovery detection
• Multi-Panel: Full support for cPanel, InterWorx, Plesk, standalone Apache

Current Feature Set

• 42 Working Modules: Security (14), Website (3), Performance (6), Backup (11), Diagnostics (8)
• 24 Attack Signatures: RCE, SQL Injection, XSS, Path Traversal, SSRF, XXE, and more
• Varnish Cache Integration: Transparent caching layer with stock compliance and auto-healing
• Reference Database: 1-hour cached status for cross-module intelligence
• Zero Hardcoded Paths: Automatic control panel detection and path abstraction
• Self-Contained Design: Delete toolkit directory = all data removed (no system files)

🙏 Credits

Built for comprehensive cPanel/Linux server management with a focus on security and intelligent automation.

---

Version: 2.2.0 Last Updated: January 2026 Repository: https://git.mull.lol/cschantz/Linux-Server-Management-Toolkit