Filter Rule

1. Delete Existing Rules

Before you start building new set of rules, you might want to clean-up all the default rules, and existing rules. Use the iptables flush command as shown below to do this.

iptables -F
(or)
iptables --flush

2. Set Default Chain Policies

The default chain policy is ACCEPT. Change this to DROP for all INPUT, FORWARD, and OUTPUT chains as shown below.

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

When you make both INPUT, and OUTPUT chain’s default policy as DROP, for every firewall rule requirement you have, you should define two rules. i.e one for incoming and one for outgoing.

In all our examples below, we have two rules for each scenario, as we’ve set DROP as default policy for both INPUT and OUTPUT chain.

If you trust your internal users, you can omit the last line above. i.e Do not DROP all outgoing packets by default. In that case, for every firewall rule requirement you have, you just have to define only one rule. i.e define rule only for incoming, as the outgoing is ACCEPT for all packets.

Note: If you don’t know what a chain means, you should first familiarize yourself with the IPTables fundamentals.

3. Block a Specific ip-address

Before we proceed further will other examples, if you want to block a specific ip-address, you should do that first as shown below. Change the “x.x.x.x” in the following example to the specific ip-address that you like to block.

BLOCK_THIS_IP="x.x.x.x"
iptables -A INPUT -s "$BLOCK_THIS_IP" -j DROP

This is helpful when you find some strange activities from a specific ip-address in your log files, and you want to temporarily block that ip-address while you do further research.

You can also use one of the following variations, which blocks only TCP traffic on eth0 connection for this ip-address.

iptables -A INPUT -i eth0 -s "$BLOCK_THIS_IP" -j DROP
iptables -A INPUT -i eth0 -p tcp -s "$BLOCK_THIS_IP" -j DROP

4. Allow ALL Incoming SSH

The following rules allow ALL incoming ssh connections on eth0 interface.

iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

Note: If you like to understand exactly what each and every one of the arguments means, you should read How to Add IPTables Firewall Rules

5. Allow Incoming SSH only from a Specific Network

The following rules allow incoming ssh connections only from 192.168.100.X network.

iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0/24 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

In the above example, instead of /24, you can also use the full subnet mask. i.e “192.168.100.0/255.255.255.0”.

6. Allow Incoming HTTP and HTTPS

The following rules allow all incoming web traffic. i.e HTTP traffic to port 80.

iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

The following rules allow all incoming secure web traffic. i.e HTTPS traffic to port 443.

iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT

7. Combine Multiple Rules Together using MultiPorts

When you are allowing incoming connections from outside world to multiple ports, instead of writing individual rules for each and every port, you can combine them together using the multiport extension as shown below.

The following example allows all incoming SSH, HTTP and HTTPS traffic.

iptables -A INPUT -i eth0 -p tcp -m multiport --dports 22,80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m multiport --sports 22,80,443 -m state --state ESTABLISHED -j ACCEPT

8. Allow Outgoing SSH

The following rules allow outgoing ssh connection. i.e When you ssh from inside to an outside server.

iptables -A OUTPUT -o eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

Please note that this is slightly different than the incoming rule. i.e We allow both the NEW and ESTABLISHED state on the OUTPUT chain, and only ESTABLISHED state on the INPUT chain. For the incoming rule, it is vice versa.

9. Allow Outgoing SSH only to a Specific Network

The following rules allow outgoing ssh connection only to a specific network. i.e You an ssh only to 192.168.100.0/24 network from the inside.

iptables -A OUTPUT -o eth0 -p tcp -d 192.168.100.0/24 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

10. Allow Outgoing HTTPS

The following rules allow outgoing secure web traffic. This is helpful when you want to allow internet traffic for your users. On servers, these rules are also helpful when you want to use wget to download some files from outside.

iptables -A OUTPUT -o eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT

Note: For outgoing HTTP web traffic, add two additional rules like the above, and change 443 to 80.

11. Load Balance Incoming Web Traffic

You can also load balance your incoming web traffic using iptables firewall rules.

This uses the iptables nth extension. The following example load balances the HTTPS traffic to three different ip-address. For every 3th packet, it is load balanced to the appropriate server (using the counter 0).

iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 0 -j DNAT --to-destination 192.168.1.101:443
iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 1 -j DNAT --to-destination 192.168.1.102:443
iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 2 -j DNAT --to-destination 192.168.1.103:443

12. Allow Ping from Outside to Inside

The following rules allow outside users to be able to ping your servers.

iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT

13. Allow Ping from Inside to Outside

The following rules allow you to ping from inside to any of the outside servers.

iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT

14. Allow Loopback Access

You should allow full loopback access on your servers. i.e access using 127.0.0.1

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

15. Allow Internal Network to External network.

On the firewall server where one ethernet card is connected to the external, and another ethernet card connected to the internal servers, use the following rules to allow internal network talk to external network.

In this example, eth1 is connected to external network (internet), and eth0 is connected to internal network (For example: 192.168.1.x).

iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

16. Allow outbound DNS

The following rules allow outgoing DNS connections.

iptables -A OUTPUT -p udp -o eth0 --dport 53 -j ACCEPT
iptables -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT

17. Allow NIS Connections

If you are running NIS to manage your user accounts, you should allow the NIS connections. Even when the SSH connection is allowed, if you don’t allow the NIS related ypbind connections, users will not be able to login.

The NIS ports are dynamic. i.e When the ypbind starts it allocates the ports.

First do a rpcinfo -p as shown below and get the port numbers. In this example, it was using port 853 and 850.

rpcinfo -p | grep ypbind

Now allow incoming connection to the port 111, and the ports that were used by ypbind.

iptables -A INPUT -p tcp --dport 111 -j ACCEPT
iptables -A INPUT -p udp --dport 111 -j ACCEPT
iptables -A INPUT -p tcp --dport 853 -j ACCEPT
iptables -A INPUT -p udp --dport 853 -j ACCEPT
iptables -A INPUT -p tcp --dport 850 -j ACCEPT
iptables -A INPUT -p udp --dport 850 -j ACCEPT

The above will not work when you restart the ypbind, as it will have different port numbers that time.

There are two solutions to this: 1) Use static ip-address for your NIS, or 2) Use some clever shell scripting techniques to automatically grab the dynamic port number from the “rpcinfo -p” command output, and use those in the above iptables rules.

18. Allow Rsync From a Specific Network

The following rules allows rsync only from a specific network.

iptables -A INPUT -i eth0 -p tcp -s 192.168.101.0/24 --dport 873 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 873 -m state --state ESTABLISHED -j ACCEPT

19. Allow MySQL connection only from a specific network

If you are running MySQL, typically you don’t want to allow direct connection from outside. In most cases, you might have web server running on the same server where the MySQL database runs.

However DBA and developers might need to login directly to the MySQL from their laptop and desktop using MySQL client. In those case, you might want to allow your internal network to talk to the MySQL directly as shown below.

iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0/24 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 3306 -m state --state ESTABLISHED -j ACCEPT

20. Allow Sendmail or Postfix Traffic

The following rules allow mail traffic. It may be sendmail or postfix.

iptables -A INPUT -i eth0 -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT

21. Allow IMAP and IMAPS

The following rules allow IMAP/IMAP2 traffic.

iptables -A INPUT -i eth0 -p tcp --dport 143 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 143 -m state --state ESTABLISHED -j ACCEPT

The following rules allow IMAPS traffic.

iptables -A INPUT -i eth0 -p tcp --dport 993 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 993 -m state --state ESTABLISHED -j ACCEPT

22. Allow POP3 and POP3S

The following rules allow POP3 access.

iptables -A INPUT -i eth0 -p tcp --dport 110 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 110 -m state --state ESTABLISHED -j ACCEPT

The following rules allow POP3S access.

iptables -A INPUT -i eth0 -p tcp --dport 995 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 995 -m state --state ESTABLISHED -j ACCEPT

23. Prevent DoS Attack

The following iptables rule will help you prevent the Denial of Service (DoS) attack on your webserver.

iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT

In the above example:

• -m limit: This uses the limit iptables extension
• –limit 25/minute: This limits only maximum of 25 connection per minute. Change this value based on your specific requirement
• –limit-burst 100: This value indicates that the limit/minute will be enforced only after the total number of connection have reached the limit-burst level.

24. Port Forwarding

The following example routes all traffic that comes to the port 442 to 22. This means that the incoming ssh connection can come from both port 22 and 422.

iptables -t nat -A PREROUTING -p tcp -d 192.168.102.37 --dport 422 -j DNAT --to 192.168.102.37:22

If you do the above, you also need to explicitly allow incoming connection on the port 422.

iptables -A INPUT -i eth0 -p tcp --dport 422 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 422 -m state --state ESTABLISHED -j ACCEPT

25. Log Dropped Packets

You might also want to log all the dropped packets. These rules should be at the bottom.

First, create a new chain called LOGGING.

iptables -N LOGGING

Next, make sure all the remaining incoming connections jump to the LOGGING chain as shown below.

iptables -A INPUT -j LOGGING

Next, log these packets by specifying a custom “log-prefix”.

iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7

Finally, drop these packets.

iptables -A LOGGING -j DROP

Linux Firewall Tutorial: IPTables Tables, Chains, Rules Fundamentals

iptables firewall is used to manage packet filtering and NAT rules. IPTables comes with all Linux distributions. Understanding how to setup and configure iptables will help you manage your Linux firewall effectively.

iptables tool is used to manage the Linux firewall rules. At a first look, iptables might look complex (or even confusing). But, once you understand the basics of how iptables work and how it is structured, reading and writing iptables firewall rules will be easy.

This article is part of an ongoing iptables tutorial series. This is the 1st article in that series.

This article explains how iptables is structured, and explains the fundamentals about iptables tables, chains and rules.

On a high-level iptables might contain multiple tables. Tables might contain multiple chains. Chains can be built-in or user-defined. Chains might contain multiple rules. Rules are defined for the packets.

So, the structure is: iptables -> Tables -> Chains -> Rules. This is defined in the following diagram.

Fig: IPTables Table, Chain, and Rule Structure

Just to re-iterate, tables are bunch of chains, and chains are bunch of firewall rules.

I. IPTABLES TABLES and CHAINS

IPTables has the following 4 built-in tables.

1. Filter Table

Filter is default table for iptables. So, if you don’t define you own table, you’ll be using filter table. Iptables’s filter table has the following built-in chains.

• INPUT chain – Incoming to firewall. For packets coming to the local server.
• OUTPUT chain – Outgoing from firewall. For packets generated locally and going out of the local server.
• FORWARD chain – Packet for another NIC on the local server. For packets routed through the local server.

2. NAT table

Iptable’s NAT table has the following built-in chains.

• PREROUTING chain – Alters packets before routing. i.e Packet translation happens immediately after the packet comes to the system (and before routing). This helps to translate the destination ip address of the packets to something that matches the routing on the local server. This is used for DNAT (destination NAT).
• POSTROUTING chain – Alters packets after routing. i.e Packet translation happens when the packets are leaving the system. This helps to translate the source ip address of the packets to something that might match the routing on the desintation server. This is used for SNAT (source NAT).
• OUTPUT chain – NAT for locally generated packets on the firewall.

3. Mangle table

Iptables’s Mangle table is for specialized packet alteration. This alters QOS bits in the TCP header. Mangle table has the following built-in chains.

• PREROUTING chain
• OUTPUT chain
• FORWARD chain
• INPUT chain
• POSTROUTING chain

4. Raw table

Iptable’s Raw table is for configuration excemptions. Raw table has the following built-in chains.

• PREROUTING chain
• OUTPUT chain

The following diagram shows the three important tables in iptables.

Fig: IPTables built-in tables

II. IPTABLES RULES

Following are the key points to remember for the iptables rules.

• Rules contain a criteria and a target.
• If the criteria is matched, it goes to the rules specified in the target (or) executes the special values mentioned in the target.
• If the criteria is not matached, it moves on to the next rule.

Target Values

Following are the possible special values that you can specify in the target.

• ACCEPT – Firewall will accept the packet.
• DROP – Firewall will drop the packet.
• QUEUE – Firewall will pass the packet to the userspace.
• RETURN – Firewall will stop executing the next set of rules in the current chain for this packet. The control will be returned to the calling chain.

If you do iptables –list (or) service iptables status, you’ll see all the available firewall rules on your system. The following iptable example shows that there are no firewall rules defined on this system. As you see, it displays the default input table, with the default input chain, forward chain, and output chain.

# iptables -t filter --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Do the following to view the mangle table.

# iptables -t mangle --list

Do the following to view the nat table.

# iptables -t nat --list

Do the following to view the raw table.

# iptables -t raw --list

Note: If you don’t specify the -t option, it will display the default filter table. So, both of the following commands are the same.

# iptables -t filter --list
(or)
# iptables --list

The following iptable example shows that there are some rules defined in the input, forward, and output chain of the filter table.

# iptables --list
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination
1    RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination
1    RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain RH-Firewall-1-INPUT (2 references)
num  target     prot opt source               destination
1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
2    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 255
3    ACCEPT     esp  --  0.0.0.0/0            0.0.0.0/0
4    ACCEPT     ah   --  0.0.0.0/0            0.0.0.0/0
5    ACCEPT     udp  --  0.0.0.0/0            224.0.0.251         udp dpt:5353
6    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:631
7    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:631
8    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
9    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
10   REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

The rules in the iptables –list command output contains the following fields:

• num – Rule number within the particular chain
• target – Special target variable that we discussed above
• prot – Protocols. tcp, udp, icmp, etc.,
• opt – Special options for that specific rule.
• source – Source ip-address of the packet
• destination – Destination ip-address for the packet
• 
  
  
  
  

install-php-7-on-centos-

1. Login via SSH and update the system software

To install PHP 7 on an CentOS VPS, you need to login to your server via SSH. Once you are logged in, update all your system software to the latest version using the command below:

yum update

2. Add the required repositories to yum

Once the update of your system is completed, you can go ahead and add the required repositories to yum.

rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
rpm -Uvh https://mirror.webtatic.com/yum/el7/webtatic-release.rpm

3. Install PHP 7

Now, install PHP 7 using the following command:

yum install php70w

4. Verify the PHP 7 installation

The installation should take a few moments. Once it is completed, you can ensure that the latest stable release of PHP 7 is installed on your system by using the command:

php -v

You should see something like this:

PHP 7.0.0 (cli) (built: Dec  2 2015 20:42:32) ( NTS )
Copyright (c) 1997-2015 The PHP Group
Zend Engine v3.0.0, Copyright (c) 1998-2015 Zend Technologies

5. Search all available PHP 7 modules

If you like to search all the available PHP 7 modules you can use to command:

yum search php70w

6. Install specific PHP 7 module

To install specific PHP 7 modules like the module that allows PHP applications to use MySQL databases, you can use the command below:

yum install php70w-mysql

7. Test PHP 7 functionality

To test the functionality of PHP 7 on your CentOS VPS you can create a simple PHP info file and place it in your web server’s document root. Navigate to your web server’s document root:

cd /var/www/html/

Create a PHP info file using nano:

nano info.php

Paste the following content into that file:

<?php
phpinfo();
?>

Save the file and close it. Also, change the ownership of the file and make Apache the owner of that file:

chown apache: info.php

8. Restart Apache Server

Do not forget to restart your Apache web server if you haven’t restarted it yet so the installation changes can take effect:

systemctl restart httpd

The last thing is to access the file using a web browser. Open your favorite web browser and navigate to the following address:

http://111.111.111.111/info.php

Roundcube (Webmail) on CentOS /RHEL 7

To install roundcube on CentOS 7 followings are the prerequisite that should be installed.

• PHP
• Database ( MariaDB or MySQL )
• Web Server ( Apache )
• Any MTA – Postfix , Sendmail & Qmail

In My Case i have already installed Postfix with dovecot on CentOS 7 with

• Domain name = hackthesec.co.in
• Hostname = tec.hackthesec.co.in

Follow below Steps to install & configure latest versions of Roundcube :

Step:1 Install PHP , Database & Apache using below command :

[root@hackthesec ~]# yum install httpd php php-common php-json php-xml php-mbstring php-imap php-pear-DB php-mysql mysql mariadb-server

Once the above package list is installed , set the time zone value in PHP .

root@hackthesec ~]# vi /etc/php.ini
date.timezone = Asia/Delhi

Save & exit the file

Step:2 Create & Configure Roundcube Database

Let us first set the Initial settings & root password of Mariadb Server :

[root@hackthesec ~]# systemctl start mariadb
[root@hackthesec ~]# systemctl enable mariadb
ln -s '/usr/lib/systemd/system/mariadb.service' '/etc/systemd/system/multi-user.target.wants/mariadb.service'
[root@hackthesec ~]#
[root@hackthesec ~]# mysql_secure_installation

Above Command “mysql_secure_installation” will allow us to set root password , remove anonymous users , disable remote root login and will remove test database.

Now Create database for Roundube and grant all the permissions to the database

Step:3 Download tar file of Roundcube

Download latest version of Roundcube tar file either from their official site “https://roundcube.net/download/” or we can use below wget command.

[root@hackthesec ~]# wget http://nchc.dl.sourceforge.net/project/roundcubemail/roundcubemail/1.1.3/roundcubemail-1.1.3-complete.tar.gz

Untar the downloaded file in your web server document root.

[root@hackthesec ~]# tar -zxpvf roundcubemail-1.1.3-complete.tar.gz -C /var/www/html/

Rename the extracted file as Roundcube and set the required permissions

[root@hackthesec html]# mv roundcubemail-1.1.3 roundcube
[root@hackthesec html]# chown apache:apache roundcube

Start the Apache service

[root@hackthesec html]# systemctl start httpd
[root@hackthesec html]# systemctl enable httpd
ln -s '/usr/lib/systemd/system/httpd.service' '/etc/systemd/system/multi-user.target.wants/httpd.service'
[root@hackthesec html]#

Step:4 Start Roundcube installation using web browser installer.

To start the installation of Rouncube , access the below url in the web browser

http://tec.hackthesec.co.in/roundcube/installer

click on Next…

Define the Database, Authentication Mechanism, SMTP & IMAP setting in this step. When We click on Create Config option it will ask us to Copy or download the configuration and save it as config.inc.php within the /var/www/html/roundcube/config/ directory of your Roundcube installation.

In my case i am using http based authentication mechanism , so i create one user on my Linux box and set its password using htpasswd command .

Linux box and set its password using htpasswd command .

[root@hackthesec ~]# htpasswd -c /home/hackthsec/.htpasswd hackthsec
New password:
Re-type new password:
Adding password for user hackthsec
[root@hackthesec ~]#

Remove the installer directory from your web server document root (/var/www/html/roundcube )

[root@hackthesec ~]# cd /var/www/html/roundcube/
[root@hackthesec roundcube]# rm -rf installer
[root@hackthesec roundcube]#

Step:5 Now access your account using Roundcube

Open the url in the browser “http://tec.hackthsec.co.in/roundcube/” , use the credentials that we set using htpasswd command.

MANAGING DATABASE USERS

MANAGING DATABASE USERS

To access MySQL databases, you must first create at least one user. The following procedures describe how to manage MySQL database users using cPanel.

Creating a database user

To create a MySQL database user, follow these steps:

1. In the Databases section of the cPanel home screen, click MySQL® Databases.
2. Under Add New User, type the MySQL username in the Username text box.
3. In the Password text box, type the user password.
4. In the Password (Again) text box, retype the user password.
   You can click Password Generator and cPanel generates a random, strong password for you.
5. Click Create User.

Changing a user's password

You can change a database user's password. You may want to do this for security reasons (changing passwords periodically is a good security practice), or you may need to do this if you forget the password.

To change a MySQL user's password, follow these steps:

1. In the Databases section of the cPanel home screen, click MySQL® Databases.
2. Under Current Users, locate the user for which you want to change the password, and then click Set Password.
3. In the Password and Password (Again) text boxes, type the new password.
   You can click Password Generator and cPanel generates a random, strong password for you.
4. Click Change Password. The new password takes effect immediately.

Renaming a user

To rename a MySQL user, follow these steps:

1. In the Databases section of the cPanel home screen, click MySQL® Databases.
2. Under Current Users, locate the user that you want to rename, and then click Rename.
3. In the text box, type the new name, and then click Proceed.

Deleting a user

When you delete a user, the user and its database permissions are deleted.

To delete a MySQL user, follow these steps:

1. In the Databases section of the cPanel home screen, click MySQL® Databases.
2. Under Current Users, locate the user that you want to delete, and then click the red X icon.
3. Click Delete User to confirm the deletion.

MANAGING DATABASES

After you create a database user, you are ready to create a database and associate the user with the new database.

Creating a database

To create a MySQL database, follow these steps:

1. In the Databases section of the cPanel home screen, click MySQL® Databases.
2. Under Create New Database, type the name of the database in the New Database text box.
3. Click Create Database.
   When you create a database, your username is added to the database name. For example, if your username is username, and you create a database named database, the actual MySQL database name is username_database.

Adding a user to a database

To add a MySQL user to a database, follow these steps:

1. In the Databases section of the cPanel home screen, click MySQL® Databases.
2. Under Add User to Database, select the user that you want to add in the User list box.
3. In the Database list box, select the database.
4. Click Add.
5. Click the check boxes to grant the user specific privileges, or click the ALL PRIVILEGES check box to grant the user all permissions to the database.
6. Click Make Changes.

Checking and repairing a database

You can check MySQL databases for errors or possible corruption. If a database check reveals problems, you can repair the database as well.

To check and repair a database, follow these steps:

1. In the Databases section of the cPanel home screen, click MySQL® Databases.
2. To check a database:
   • Under Modify Databases, select the database in the Check DB list box.
   • Click Check DB.
3. If a database check indicates problems with a database, you can repair it:
   • Under Modify Databases, select the database in the Repair DB list box.
   • Click Repair DB.

Removing a user from a database

When you remove a user from a database, the user can no longer access the database.

To remove a MySQL user from a database, follow these steps:

1. In the Databases section of the cPanel home screen, click MySQL® Databases.
2. Under Current Databases, locate the user that you want to remove, and then click the red X icon.
3. Click Delete User from Database to confirm the deletion.

Deleting a database

Before you delete a database, make sure that you have a backup copy if you want to save any information that it contains.

When you delete a database, its associated users are not deleted. However, all permissions users have for that database are deleted.

To delete a MySQL database, follow these steps:

1. In the Databases section of the cPanel home screen, click MySQL® Databases.
2. Under Current Databases, locate the database that you want to delete, and then click Delete Database.
3. Click Delete Database to confirm the deletion.