Here are some grsec kernels links

http://nix101.com/linux-2.6.24.2-grsec-x86_64.tar.gz

http://nix101.com/linux-2.6.24.7-with-tarpit-64bit.tar.gz

http://nix101.com/linux64.tar.gz <– 2.6.25.6 One of the last test patches

Anyone who runs litespeed knows about the huge core dumps the lsphp leaves in users public_html directories. No matter what you set in limits config or ulimit it still does them. I suppose it does like the webserver does and overrides or sets certain things on startup as root. I have been on litespeed a while now over these core dumps. I have had users entire disks get filled up with these within hours.

It doesnt look like they will do anything about it. Litespeed still is a great http server, very fast and great against ddos so I have no plans for dumping it in the future. George finally posted a patch for lsphp disabling core dumps. I applied the patch to my php source that I use for all servers. So I figured I would share this with those who want these dumps disabled but dont have time to patch and compile php.

Php-5.2.6 with litespeed sapi, suhosin patch and mail header patch,. Build on 64 bit, should not matter what you build it on.

Make sure after you untar config to cd into the source directory and do

wget sph1.net/php.tar.gz

touch ac*

./buildconf --force

Then configure with your usual modules and configurations.

This is probably not needed since it was done when I added litespeed to the source but it doesnt hurt to make sure and it wont hurt anything to do it when its not needed.

For the ones who does not know what the TARPIT module is or what it does. Here is some resources. The tarpit module is basically unsupported at this time but some at Harvard have been updating it to work with newer kernels.

The tarpit module is great for adding rules for port scanners and ddos bots. What it does is tarpit the attackers connection slowing it down and making their cpu go through the roof. Here is an article about using tarpitting for ddos protected web hosting.

http://www.secureworks.com/research/threats/ddos/?threat=ddos

Here is the page for the students at harvard who are updating the tarpit module

http://enterprise.bidmc.harvard.edu/pub/tarpit-updates/