The whole list of Cpanel backend and log files

In some situations we are using the backend files rather than the GUI interface. Using cpanel backend files are less time consuming and sometimes it is the only way to understand the actual issues. So it is better to byheart these all important cpanel backend and log files. Please take a look at these and I am sure that it will help you in some situations.

Apache
=======
/usr/local/apache
+ bin- apache binaries are stored here - httpd, apachectl, apxs
+ conf - configuration files - httpd.conf
+ cgi-bin
+ domlogs - domain log files are stored here
+ htdocs
+ include - header files
+ libexec - shared object (.so) files are stored here - libphp4.so,mod_rewrite.so
+ logs - apache logs - access_log, error_log, suexec_log
+ man - apache manual pages
+ proxy -
+ icons -

Init Script :/etc/rc.d/init.d/httpd - apache start script
Cpanel script to restart apache - /scripts/restartsrv_httpd
========================================================== 

Exim
=====
Conf : /etc/exim.conf - exim main configuration file
/etc/localdomains - list of domains allowed to relay mail
Log : /var/log/exim_mainlog - incoming/outgoing mails are logged here
/var/log/exim_rejectlog - exim rejected mails are reported here
/exim errors are logged here
Mail queue: /var/spool/exim/input
Cpanel script to restart exim - /scripts/restartsrv_exim
Email forwarders and catchall address file - /etc/valiases/domainname.com
Email filters file - /etc/vfilters/domainname.com
POP user authentication file - /home/username/etc/domainname/passwd
catchall inbox - /home/username/mail/inbox
POP user inbox - /home/username/mail/domainname/popusername/inbox
POP user spambox - /home/username/mail/domainname/popusername/spam
Program : /usr/sbin/exim (suid - -rwsr-xr-x 1 root root )
Init Script: /etc/rc.d/init.d/exim
=========================================================== 

ProFTPD
========
Program :/usr/sbin/proftpd
Init Script :/etc/rc.d/init.d/proftpd
Conf: /etc/proftpd.conf
Log: /var/log/messages, /var/log/xferlog
FTP accounts file - /etc/proftpd/username - all ftp accounts for the domain are listed here
=========================================================

Pure-FTPD
=========
Program : /usr/sbin/pure-ftpd
Init Script :/etc/rc.d/init.d/pure-ftpd
Conf: /etc/pure-ftpd.conf
Anonymous ftp document root - /etc/pure-ftpd/ip-address
==========================================================

Frontpage Extensions
=================
Program - (Install): /usr/local/frontpage/version5.0/bin/owsadm.exe
Uninstall and then install for re-installations
FP files are found as _vti-bin, _vti-pvt, _vti-cnf, vti-log inside the public_html
==========================================================

Mysql
=======
Program : /usr/bin/mysql
Init Script : /etc/rc.d/init.d/mysql
Conf : /etc/my.cnf, /root/.my.cnf
Data directory - /var/lib/mysql - Where all databases are stored.
Database naming convention - username_dbname (eg: john_sales)
Permissions on databases - drwx 2 mysql mysql
Socket file - /var/lib/mysql/mysql.sock, /tmp/ mysql.sock
===========================================================

SSHD
======
Program :/usr/local/sbin/sshd
Init Script :/etc/rc.d/init.d/sshd
/etc/ssh/sshd_config
Log: /var/log/messages
=========================================================

Perl
====
Program :/usr/bin/perl
Directory :/usr/lib/perl5/5.6.1/
=======================================================

PHP
====
Program :/usr/local/bin/php, /usr/bin/php
ini file: /usr/local/lib/php.ini - apache must be restarted after any change to this file
php can be recomplied using /scripts/easyapache
=========================================================

Named(BIND)
============
Program: /usr/sbin/named
Init Script: /etc/rc.d/init.d/named
/etc/named.conf
db records:/var/named/
/var/log/messages
========================================================

Cpanel installation directory structure
=============================
/usr/local/cpanel
+ 3rdparty/ - tools like fantastico, mailman files are located here
+ addons/ - AdvancedGuestBook, phpBB etc
+ base/ - phpmyadmin, squirrelmail, skins, webmail etc
+ bin/ - cpanel binaries
+ cgi-sys/ - cgi files like cgiemail, formmail.cgi, formmail.pl etc
+ logs/ - cpanel access log and error log
+ whostmgr/ - whm related files

WHM related files
===============
/var/cpanel - whm files
+ bandwidth/ - rrd files of domains
+ username.accts - reseller accounts are listed in this files
+ packages - hosting packages are listed here
+ root.accts - root owned domains are listed here
+ suspended - suspended accounts are listed here
+ users/ - cpanel user file - theme, bwlimit, addon, parked, sub-domains all are listed in this files
+ zonetemplates/ - dns zone template files are taken from here

Common CPanel scripts
===================
cpanel/whm Scripts are located in /scripts/
+ addns - add a dns zone
+ addfpmail - Add frontpage mail extensions to all domains without them
+ addfpmail2 -Add frontpage mail extensions to all domains without them
+ addnetmaskips - Add the netmask 255.255.255.0 to all IPs that have no netmask
+ addnobodygrp - Adds the gorup nobody and activates security
+ addpop - add a pop account
+ addservlets - Add JSP support to an account (requires tomcat)
+ addstatus - (Internal use never called by user)
+ adduser - Add a user to the system
+ bandwidth - (OLD)
+ betaexim - Installs the latest version of exim
+ biglogcheck - looks for logs nearing 2 gigabytes in size
+ bsdcryptoinstall - Installs crypto on FreeBSD
+ bsdldconfig - Configures the proper lib directories in FreeBSD
+ bsdpkgpingtest - Tests the connection speed for downloading FreeBSD packages
+ buildbsdexpect - Install expect on FreeBSD
+ builddomainaddr - (OLD)
+ buildeximconf - Rebuilds exim.conf
+ buildpostgrebsd-dev - Installs postgresql on FreeBSD.
+ chcpass - change cpanel passwords
+ easyapache - recompile/upgrade apache and/or php
+ exim4 - reinstall exim and fix permissions
+ fixcommonproblems - fixes most common problems
+ fixfrontpageperm - fixes permission issues with Front Page
+ fixmailman - fixes common mailman issues
+ fixnamed - fixes common named issues
+ fixndc - fixes rndc errors with named
+ fixquotas - fixes quota problems
+ fullhordereset - resets horde database to a fresh one - all previous user data are lost
+ initquotas - initializes quotas
+ installzendopt - installs zend optimizer
+ killacct - terminate an account - make sure you take a backup of the account first
+ mailperm - fixes permission problems with inboxes
+ park - to park a domain
+ pkgacct - used to backup an account
+ restartsrv - restart script for services
+ restorepkg - restores an account from a backup file ( pkgacct file)
+ runlogsnow - update logs of all users
+ runweblogs - update stats for a particular user
+ securetmp - secures /tmp partition with options nosuexec and nosuid
+ suspendacct - suspends an account
+ unsuspendacct - unsuspends a suspended account
+ upcp - updates cpanel to the latest version
+ updatenow - updates the cpanel scripts
+ updateuserdomains - updates userdomain entries
==========================================================

Important cpanel/whm files
====================
/etc/httpd/conf/httpd.conf - apache configuration file
/etc/exim.conf - mail server configuration file
/etc/named.conf - name server (named) configuration file
/etc/proftpd.conf - proftpd server configuration file
/etc/pure-ftpd.conf - pure-ftpd server configuration file
/etc/valiases/domainname - catchall and forwarders are set here
/etc/vfilters/domainname - email filters are set here
/etc/userdomains - all domains are listed here - addons, parked,subdomains along with their usernames
/etc/localdomains - exim related file - all domains should be listed here to be able to send mails
/var/cpanel/users/username - cpanel user file
/var/cpanel/cpanel.config - cpanel configuration file ( Tweak Settings )*
/etc/cpbackup-userskip.conf -
/etc/sysconfig/network - Networking Setup*
/etc/hosts -
/var/spool/exim -
/var/spool/cron -
/etc/resolv.conf - Networking Setup--> Resolver Configuration
/etc/nameserverips - Networking Setup--> Nameserver IPs ( FOr resellers to give their nameservers )
/var/cpanel/resellers - For addpkg, etc permissions for resellers.
/etc/chkserv.d - Main >> Service Configuration >> Service Manager *
/var/run/chkservd - Main >> Server Status >> Service Status *
/var/log/dcpumon - top log process
/root/cpanel3-skel - skel directory. Eg: public_ftp, public_html. (Account Functions-->Skeleton Directory )*
/etc/wwwacct.conf - account creation defaults file in WHM (Basic cPanel/WHM Setup)*
/etc/cpupdate.conf - Update Config *
/etc/cpbackup.conf - Configure Backup*
/etc/clamav.conf - clamav (antivirus configuration file )
/etc/my.cnf - mysql configuration file
/usr/local/Zend/etc/php.ini OR /usr/local/lib/php.ini - php configuration file
/etc/ips - ip addresses on the server (except the shared ip) (IP Functions-->Show IP Address Usage )*
/etc/ipaddrpool - ip addresses which are free
/etc/ips.dnsmaster - name server ips
/var/cpanel/Counters - To get the counter of each users.
/var/cpanel/bandwidth - To get bandwith usage of domain
==========================================================

/var/cpanel
accounting.log - Contains a list of accounting functions performed such as account removal and creation
cpanel.config – Tweak settings for whm can be done in this file
mainip – Main ip of the server is specified in this file
maxemail - Maximum emails per hour for a domain can be specified here The format is like the following domainname=number


Run the script /scripts/build_maxemails_config after editing this file This will create a file named after the corresponding domain name inside the directory maxemailsperdomain with the value specified in it.
Maxemailsperhour - Server wide maximum emails per hour can be set in this file. It applies to the whole domains in the server. You only need to insert the corresponding value in the file. A value of zero means unlimited.
Resellers-nameservers – This file gives you the name of the nameservers used by reseller users
resellers – This file lists the privileges of different reseller users
packages/ - This directory contains files for all the packages created under the WHM and the corresponding files will give all the details related to that package
suspended/ – This directory contains files for all the suspended users. You can get the
reason for suspension from the corresponding user file.
Users/ – This directory contains cpanel user files which contain all the information related to a cpanel account.
Zonetemplates/ - This directory contains templates for zone files, which will be used for creating zone file for a particular domain when a user is created
bandwidth/ - This directory contains files named after the domain names which give separate http and all bandwidth usages for a particular day
datastore/ - This directory contains sub directories named after the cpanel user name which contains two files named mysql-db-count and mysql-disk-usage .These files give you the number of databases a user have and the total disk space used by all these databases respectively.
=========================================================

/etc
localdomains – This file contains domains which are using the local mail server.
remotedomains - This file contains domains which are using a remote mail server instead of the local mail server
userdomains - All the domains of users are listed in this file including the addon, parked and subdomains along with their username.
trueuserdomains - The main domains of all cpanel uesrs are listed in this file along with their username
trueuserowners – All cpanel users along with their owners are listed in this file
wwwacct.conf - This is the default file used in cpanel account creation Information from this file is taken when an account is created
mailips - The ip which should be used for sending mails can be specified in this file Different ips can be set for different domains for sending mails and that can be specified in the file like the following domainname: ip address
ips – This file lists all the ips in the file except the main shared ip
ips.dnsmaster – This file lists all the ips of nameservers used by different domains
ipaddrpool – Lists the ip addresses in the server which are free
cpupdate.conf - Cpanel updation configuration can be done in this file Once you edit this file do not forgot to run the script /scripts/upcp
cpbackup.conf - Cpanel backup configuration can be done in this file You can enable or disable cpanel backup using this file.
Valiases/ - Email forwarders and catchall for a domain can be specified in the corresponding file inside this directory.
The format is like the following *: accountname
vfilters - Email filters can be specified in the corresponding file inside this directory.
========================================================== 

/usr/local/cpanel
bin/ – Cpanel binaries are located in this directory
version – You can get cpanel version from this file
logs/ - All log files of cpanel are located inside this directory.
error_log – cpanel logs any error it incurs in this file
license_log – All cpanel license update attempts are logged in this file stats_log – The stats daemon logs the output from all the status generators like awstats, webalizer.
access_log – General information pertaining to cPanel requests is logged in this file
base/ – Files of phpmyadmin, webmail etc are located in this directory
3rdparty/ – Files of mailman, fantastico etc are located in this directory
==========================================================

Important Log Files
================
Apache
/usr/local/apache/logs – It is the main log for apache
/usr/local/apache/domlogs/ – Domain specific logs are located inside this directory
/usr/local/apache/logs/access_log – This log records all requests processed by the server

Exim
/var/log/exim_mainlog - An entry is created inside this log every time a message is received or delivered
/var/log/exim_rejectlog - An entry is created inside this log every time a message is rejected based on either ACLs or other policies
/var/log/exim_paniclog - An entry is created inside this log when exim doesn’t know how to handle an error
/var/log/messages – General information and login attempts of FTP are logged here
/var/log/secure - General information and login attempts of SSHD are logged here
/var/log/maillog - The IMAP, POP, and SpamAssassin services all log here. This includes all general logging information (login attempts, transactions, spam scoring), along with fatal errors.
/var/log/mysqld.log ; /var/lib/mysql/$(hostname).err – Mysql general informations and errors are logged in either of these two files
/var/log/chkservd.log - The service monitoring daemon (chkservd) logs all service checks here. Failed services are represented with a [-], and active are represented with
/var/log/cron – An entry is created in this file when a cron is executed
/var/log/messages - General informations and errors of named are logged in this File
/var/log/dcpumon/toplog.[timestamp] - This log lists the top processes running Each five minute a new log is created
/usr/local/apache/logs/suexec_log - This log file contains auditing information reported by suexec each time a CGI application is executed.
/var/log/cpanel*install* – These log files contain verbose logs of the cPanel installation.
/var/cpanel/updatelogs/update-[timestamp.log] – It is the log file for upcp. Log entries are created when upcp runs


[See the original post:]

http://techzgroup.blogspot.com/2010/12/whole-list-of-cpanel-backend-and-log.html 

5 Tips to Reduce Disk Space on Linux Server

From time to time we need to clear up disk space on our servers, whether it is to just reduce disk space to help minimize the costs and usage of backup servers, or if it’s to clean up the server and help with performance.

Here are 5 easy ways you can instantly clear up hard drive space and reduce the number of inodes on your server:

1.) Remove User Generated cPanel Backups

Many times cPanel users aren’t aware that they should delete a cPanel backup before performing another cPanel backup. Essentially they are taking backups of backups and this can quite easily add up to several gigabytes of space just for one account. A quick and easy way to remove these is to run the following command from root:

for user in #`/bin/ls -A /var/cpanel/users` ; do rm -fv /home/$user/backup-*$user.tar.gz ; done

Make sure to copy the full command exactly how it is above. This will work forcPanel hosting servers only.

2.) Audit your MySQL Databases

Not only will this free up disk space but it can greatly help with increasing the performance on your server. Large MySQL databases on sites that are receiving a large amount of traffic can really slow down a server. Many times the tables that are using the most space in a database are simply from visitor logging or caching, things that can be freed up instantly be truncating the table.

Use the following command when logged in as root to show the highest usage

databases on the server:

#du -k --max-depth 1 /var/lib/mysql | sort -n

This will show a list of individual databases from lowest to highest. Databases larger than 500mb can be an issue with performance so it is worth it to investigate them.

Once you have the results from the command above, it is easy to go into phpMyAdmin and find the database. Once you have clicked on the database you should sort the table size by space, clicking it twice so that it shows the highest usage table on the top.

If the table is some type of visitor logging or tracking table, it generally is okay to truncate it. The same goes for caching. Make sure to backup the database just in-case before doing so, and it won’t hurt to do a quick google search to see if that table is okay to empty. Searching for the exact term/table name usually will bring up the results you are looking for.

This is a great way to free up disk space, RAM and help increase overall server performance.

3.) Remove Installatron and Fantastico Backups

If you are running Installatron or Fantastico on your server, it is easy for the backups for these files to use up a lot of inodes and space, taking up resources and slowing down performance. Usually once every few months we will remove these for that reason. You can do so by entering the following commands:

For Fantastico:

#rm -rfv /home/*/fantastico_backups

For Installatron:

#rm -rfv /home/*/.installatron/backups

These are the two software installers I am familiar with, if you are using another software installer the same can be done for it if you just insert the proper location where the backups are stored. Consult with the software developer to make sure it is okay to do so first.

4.) Get Rid of Cached Yum Files

Updates from Yum usually leave some unneeded files on the server. Do some

Yum house cleaning:

#yum clean all

5.) Delete Failed FTP Uploads

When users are uploading files via pure-ftp and the upload either fails or is interrupted it will leave a partial file on the server. You can quickly get rid of these to clean up some disk space:

#locate .pureftpd-upload | xargs rm -fv

Using the above five ways we have sometimes cleared hundreds of Gigabytes of space and doing all of the above should take you less than an hour.

Let us know your results or if you have anything to add.

Kernel Compile with Grsecurity Patch

Kernel Compile with Grsecurity Patch

This is a tutorial to compile kernel 2.6.11.12 with grsecurity. Works cool specially with exec logging you can trace just any minor activity on your server. Here are the commands I used for the compilation :

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

#cd /usr/local/src/

#wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.24.5.tar.bz2

#wget http://grsecurity.net/grsecurity-2.1.11-2.6.24.5-200804211829.patch.gz

#tar xvfj linux-2.6.24.5.tar.bz2

#gunzip grsecurity-2.1.11-2.6.24.5-200804211829.patch.gz

#patch -p0 < grsecurity-2.1.11-2.6.24.5-200804211829.patch.gz

#cd linux-2.6.24.5

#cp /boot/config-'uname -r' .config

#make menuconfig

#make

#make modules_install

#make install

#grubby --bootloader-probe

#pico /etc/grub.conf

#grub-install /dev/hda

#reboot

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Try at your own risk :D . Best of luck. :)

Secure /tmp Dir.

Every system needs temporary folders that any user is able to read and write BUT these directories should not be able to execute programs or scripts. Though this will only protect you from somebody running the script directly it will help with a large portion of the automated rootkits and trojans that script kiddies use. They will still be able to put the files on the system but they will be unable to execute them and create the back door. One of the biggest problems is php injection via apache in which people will have apache download and then run an exploit. Securing the temp directories is probably the single biggest thing you can do towards securing your server.

 This guide will work fine with cPanel, ensim, plesk, and of course with no control panel. It is designed for Redhat but should work on any linux varient.

The first step is to check if /tmp is already secure. Some datacenters do not create a /tmp partition while others do.

#df -h |grep tmp

If that displays nothing then go below to create a tmp partition. If you do have a tmp partition you need to see if it mounted with noexec.

#cat /etc/fstab |grep tmp

If there is a line that includes /tmp and noexec then it is already mounted as non-executable. If not follow the instructions below to create one without having to physically format your disk. Idealy you would make a real partition when the disk was originally formated, that being said I have not had any trouble create a /tmp partition using the following method.

Create a 190Mb partition

#cd /dev/; dd if=/dev/zero of=tmpMnt bs=1024 count=800000

Format the partion

#mke2fs /dev/tmpMnt

When it asks about not being a block special device press Y

Make a backup of the old data

#cp -Rp /tmp /tmp_backup

Mount the temp filesystem

#mount -o loop,noexec,nosuid,rw /dev/tmpMnt /tmp

Set the permissions

#chmod 0777 /tmp

Copy the old files back

#cp -Rp /tmp_backup/* /tmp/

Once you do that go ahead and restart mysql and make sure it works ok. We do this because mysql places the mysql.sock in /tmp which neeeds to be moved. If not it migth have trouble starting. If it does you can add this line to the bottom of the /etc/fstab to automatically have it mounted:

Open the file in nano:

#nano -w /etc/fstab

Now add this single line at the bottom:

[/dev/tmpMnt /tmp ext2 loop,noexec,nosuid,rw 0 0]

While we are at it we are going to secure /dev/shm. Look for the mount line for /dev/shm and change it to the following:

none /dev/shm tmpfs noexec,nosuid 0 0

Umount and remount /dev/shm for the changes to take effect.

#umount /dev/shm

#mount /dev/shm

Next delete the old /var/tmp and create a link to /tmp

#rm -rf /var/tmp/

#ln -s /tmp/ /var/

If everything still works fine you can go ahead and delete the /tmp_backup directory.

#rm -rf /tmp_backup

You /tmp, /var/tmp, and /dev/shm are now mounted in a way that no program can be directly run from these directories. Like I have said in other articles there are still ways in but this is one of the many layers of security you should have on your system.

Which is the role of System Administrator?

Duties of a system administrator

The duties of a system administrator are wide-ranging, and vary widely from one organization to another. Sysadmins are usually charged with installing, supporting, and maintaining servers or other computer systems, and planning for and responding to service outages and other problems. Other duties may include scripting or light programming, project management for systems-related projects.

The system administrator is responsible for following things:

• User administration (setup and maintaining account)
• Maintaining system
• Verify that peripherals are working properly
• Quickly arrange repair for hardware in occasion of hardware failure
• Monitor system performance
• Create file systems
• Install software
• Create a backup and recover policy
• Monitor network communication
• Update system as soon as new version of OS and application software comes out
• Implement the policies for the use of the computer system and network
• Setup security policies for users. A sysadmin must have a strong grasp of computer security (e.g. firewalls and intrusion detection systems).

Source By :
http://www.cyberciti.biz/faq/what-is-the-role-of-the-system-administrator/

Network Scanning tool

The typical UNIX® administrator has a key range of utilities, tricks, and systems he or she uses regularly to aid in the process of administration. There are key utilities, command-line chains, and scripts that are used to simplify different processes. Some of these tools come with the operating system, but a majority of the tricks come through years of experience and a desire to ease the system administrator's life. The focus of this series is on getting the most from the available tools across a range of different UNIX environments, including methods of simplifying administration in a heterogeneous environment.

http://www.ibm.com/developerworks/aix/library/au-satnetworkscan/?ca=dgr-lnxw97netwktlkit&S_TACT=105AGX59&S_CMP=GR

10 most important Linux Security issues

A good place for security education is the SANS/FBI site (http://www.sans.org/top20/). These are the most important Unix related security issues:

1. Web Server. One of the places that an intruder is going to check first is for vulnerabilities in your Apache version and in you cgi-scripts.

2. Remote Procedure Calls. RPC Services should be down if they are not required, they allow a remote user to execute instructions in your computer; the intruder usualy gains root access this way.

3. SNMP (Simple Network Management Protocol). This protocol is known to have had its vulnerabilities and their password can be easily cracked and more easier captured from the network.

4. SSH (Secure Shell). SSH has been exploited before, if you do not need it then you can turn it off, or filter the source ip addresses with TCP Wrapper.

5. Remote Services (Trusted host). This was a setup in the machines based on the rely of other machines IP address, and leaved access without asking password. Their binaries are "rsh", "rcp", "rlogin" and "rexec". They exist and can be used also today, the attacked can do a party with your machine if they use a technique known as "ip spoofing".

6. FTP (File Transfer Protocol). Many vulnerabilities have been found in FTP, as exploits and protocol weaknesses, like clear text password transfer (resolved in SFTP).

7. LPD (Line Printer Daemon). This daemon is also remotely exploitable with help of an overflow and a shellcode, gaining root access if the server is running as root.

8. BIND/DNS (Dynamic Name Server). DNS Flooding, exploits and other attacks are available, if you are going to set up a DNS, use a firewall to filter any port that you do not want.

9. Sendmail. This mail transfer agent is known for its buffer overflows and remote exploits, though it has resolved its issues, always appears something new. It is recommended to use qmail.

10. Weak Password / No Passwords in the system. I do not need to explain this.

Many people that talk about security talk about a false sense of security that one can have in the cyberspace, i do not totaly agree with them, i see very often thay it is created a false sense of insecurity also. The items i have listed before create some sense of insecurity and alert; but do not worry, if you are going to run one of this critical services, just keep in mind:

* Use a well configured firewall (pay more attention to "well configured" than "firewall")
* Set up correctly an Intrusion Detection and Prevention System.
* Ask for help a security professional, here in Argentina we have very good ones :-)

The screen function in linux

In unix like operating systems we have the 'screen' utility, so usefull as easy to use. In cases where you need to compile a kernel in the background in a remote server (where the connection can get lost), download a file or do some critical operation without the risk of loosing the network connection to the server, the 'screen' utility comes handy.

Run it just writing its name:

#screen

This creates a virtual shell, a virtual terminal, for those (like me) that love virtualization :-)
Now you see a new shell, type some commands, leave a 'top' running, and type:

ctrl+a+c (this creates a new window, like a new shell).

How to go back to the window with the 'top' ?
Type ctrl+a+n (this jumps to the next window, in this case, the first one).

I dont know of a limit of shells you can create with "ctrl+a+c".
You jump backward to the previous window with "ctrl+a+p".
Split the current 'screen' window in multiple windows with "ctrl+a+S"
Jump between splitted windows with "ctrl+a+TAB".

And, if you need to send the the terminal the "ctrl+a" signal, press "ctrl+a+a".

Now... the real magic, how to leave this process running in the background and how to recover the terminal after a connection loose ?

Press ctrl+a+d to disconnect from 'screen' and leave all the terminals in the background, these processes will survive as i said, a disconnection, so you can disconnect from that server and come back in two days that screen will be still there.

Out of 'screen' write:
#screen -ls

This shows something like:

There is a screen on:
31696.pts-2.gw0 (Detached)
1 Socket in /tmp/uscreens/S-wlamagna.

To re-connect to screen write:
#screen -r 31696.pts-2.gw0

split display: C-a S
jump to next display: C-a tab
remove current region: C-a X
remove regions but the current one: C-a Q

And you are back in the screen terminals.
I hope it was usefull, please leave me a message with your experience or new tricks.

How to set runlevel with chkconfig

This implementation of chkconfig was inspired by the chkconfig command present in the IRIX operating system. Rather than maintaining configuration information outside of the /etc/rc[0-6].d hierarchy, however, this version directly manages the symlinks in /etc/rc[0-6].d.

In Redhat Linux you have a powerfull tool called chkconfig, you can list all the services with:
#chkconfig --list
To see the services started in runlevel 3:
#chkconfig --list | grep 3:on

To turn off a service in all the runlevels:
#chkconfig pcmcia off

Turn off a service in a desired runlevel:
#[root@monitor1]# chkconfig --list | grep hpoj
hpoj 0:off 1:off 2:on 3:on 4:on 5:on 6:off
#[root@monitor1]# chkconfig --level 3 hpoj off
#[root@monitor1 rc3.d]# chkconfig --list | grep hpoj
hpoj 0:off 1:off 2:on 3:off 4:on 5:on 6:off


If you want to add a new service, you created the /etc/rc.d/init.d/ file and now you wans to manage the service, configure it to start and stop on desired runlevels.

Edit the /etc/rc.d/init.d/service-name file, and add this line on the top:

#!/bin/bash
# chkconfig: 2345 55 25
# description: A service that does powerful things
#

This is a description of what this line does:
# chkconfig: 2345 55 25
             |   |  |
             |   |  priority for kill scripts
             |   |
             |   priority for start scripts
             |
             run levels at which to start service

Then execute, for example, adding the qmail service:
#[root@monitor1 init.d]# chkconfig --add qmail
#[root@monitor1 init.d]# chkconfig --list qmail
qmail           0:off   1:off   2:off   3:on    4:off   5:on    6:off

Now configure it to start on desired runlevels !