Howto - Setup an Illegal File Scanner

**PowerHosting123** · May 7th, 2010, 11:47

This source was posted on WHT. I've recently updated it.

Server I"m using is a Centos 5 server the commands I'm getting ready to use might be little be difference for your server operating system.

Step1.

First you need to loggin into SSH on your server using Putty or other SSH Client

Step2.

After you've logged into root using ssh type the following command below

Code:

Type mkdir server_scan

Step 3.

After you've type the command above now type the following command below:

Code:

Type cd /home/server_scan

After you've type the command above to change into the directory server_scan type the following command below

Code:

Type nano scan.sh

After you've type the command above copy & paste the following below into your SSH. But don't forget to change youremail_address_here with your actual email address you check everyday.

Code:

#!/bin/sh
# Locate & E-mail banned script results

updatedb
(locate Ultimate.cgi; locate cutecast.pl; locate myboard.cgi; locate anyboard.cgi; 
locate teemz.cgi; locate database.cgi; locate cfdirectory.cgi; locate db_TalkToMe.cgi; 
locate message.cgi; locate iforum.cgi; locate talkshop.cgi; locate dboard.pl; locate 
ruboard.pl; locate ib.cgi; locate colloquius.pl; locate forum6.main.cgi; locate 
index.cgi; locate dcboard.cgi; locate forum.cgi; locate WMCboard.cgi; locate 
xtartforum.pl; locate beebalm.cgi; locate zcboard.cgi; locate admin.pl; locate 
message.pl; locate webbbs_form.pl; locate forum.pl; locate netboard.cgi; locate 
wwwboard.pl; locate x-forum.cgi; locate ikonboard.cgi; locate ultimatebb.cgi; locate 
YaBB.cgi; locate YaBB.pl ) | mail -s Banned-Forums youremail_address_here
locate lstmrge.cgi | mail -s Banned-Spam-Tools youremail_address_here
locate phpshell.php | mail -s PHPShell youremail_address_here
locate c99shell.php | mail -s c99shell youremail_address_here
locate r57shell.php | mail -s r57shell youremail_address_here
locate vbulletin | mail -s vbulletin youremail_address_here
locate nph-proxy.cgi | mail -s Banned-Proxy-Utils youremail_address_here
locate *.mp3 | mail -s MP3s youremail_address_here
locate *.rar | mail -s RAR-Files youremail_address_here
(locate warez; locate ftf; locate vcd; locate svcd; locate xxx; locate telesync; locate 
screener; locate divx; locate *.nfo) | mail -s warez youremail_address_here
locate *.zip | mail -s zip-files youremail_address_here
(locate *.avi; locate *.mov; locate *.mpeg; locate *.mpg; locate *.rm; locate *.ram; 
locate *.divx; locate *.wmv; locate *.asf ) | mail -s Movie-Files youremail_address_here
locate adcycle.cgi | mail -s ad-systems youremail_address_here
locate clientexec | mail -s Clientexec youremail_address_here
locate whmcs | mail -s WHMCS youremail_address_here
locate invision | mail -s InvisionBoard  youremail_address_here
locate vbulletin | mail -s Vbulletin  youremail_address_here
find / -size +5000000c | mail -s Over5MB youremail_address_here

How to setup to run automatically as a cronjobs

Type the command below

Code:

Type crontab -e

After you've type the following command below copy & paste the line below this will run the scan.sh at 1AM every day including weekdays.

Code:

0 1 * * * /home/server_scan/scan.sh >/dev/null 2>&1

After you've setup the cronjobs don't forget to save

You can run this script manual by running the following command below

Code:

sh /home/server_scan/scan.sh

This script will email the results to your email address you've listed in scan.sh

Once you've finshed I would recommended you to run the script manual first since updatedb command does take alongtime.

**aloycasmir** · May 7th, 2010, 22:44

That's a good script .
Why not add this to the beginning of the script:
email_address=your_email@email.com

Now wherever you wanna add the email , just say $email_address instead of having to type it everywhere .

**jphilipson** · May 7th, 2010, 23:45

That's all well and good, run updatedb on a real production servers and you'll kill them, unless they are mostly empty. We have it disabled on our fleet at work. Run that on servers that have around 1 TB each and locatedb will take a few hours to run and drive the load through the roof.