SOHO Network Management

Showing posts with label Linux. Show all posts

Tuesday, July 1, 2014

Edit crontab with nano in centos the easyway

source : http://myquickfix.co.uk/2013/09/edit-crontab-with-nano-on-centos-crontab-e/

Edit crontab with NANO on centos (crontab -e)
Posted September 25th, 2013 by Ben & filed under CentOS.

Problem: I don’t know where my root users crontab file is, and this doesn’t usually matter because using the command ‘crontab -e’ opens it for editing anyway… but it opens in VI and I am too stupid / lazy / in a rush to use VI.

Solution: The -e switch makes the file open in whatever the default editor for the environment is. To override this, pass the EDITOR environment var to the command when it’s run:

sudo env EDITOR=nano crontab -e

Monday, January 6, 2014

Mount HFS+ (apple) file system in ubuntu

Mount HFS+ apples file system in ubuntu

sudo apt-get install hfsplus hfsutils hfsprogs

Mount as usual.

Note: HFS file system by default will be read only to enable write mode journal has to be disabled first before removing the drive.

Sunday, November 10, 2013

Find WAN / public IP from command line

There are many websites and web scripts available to know your external (WAN/INTERNET/PUBLIC) IP address. To find out the wan IP address from command line below are two simple methods

The below two methods rely on external services to detect the IP address. Any one of the listed service can be used

1) curl :

Can be installed by running command "sudo apt-get install curl". To know the IP run command

curl http://myip.dnsomatic.com

my preferred url is http://myip.dnsomatic.com a service by opendns and can be replaced with any one of the above urls.

2) wget :

By default wget would be installed on most of the system if not can be installed with command "sudo apt-get install wget". To know the IP run command

wget http://myip.dnsomatic.com -O - -q ; echo

Wednesday, July 3, 2013

Remove offending RSA key in ~/.ssh/known_hosts file with one line command

When you ssh to a server where the host key (RSA) has changed then you will get an error message as shown in the image:

The error in the above example :

Offending RSA key in /home/username/.ssh/known_hosts:8

Looking in to the error message, we can find the offending RSA key and its position in the known_hosts file. In the above example image the offending key is at line 8. (marked with red line). This can be fixed by deleting the offending key so that ssh lets you to connect after accepting the new key. This offending RSA key from the known_hosts file can be removed using `sed` with the following parameters:

$ sed -i '8d' ~/.ssh/known_hosts

The parameters

-i : For inplace editing

8d : Offending RSA key at line no 8

~/.ssh/known_hosts : path to and file known_hosts.

Remote shutdown one line ssh command

Q.) How to shut down / restart a remote linux server from ssh ?

A.) ssh -t user@hostname 'sudo shutdown -P now'

In the above example

-t : forces the allocation of a tty for the command.

-P : stands for power off.

-r : to reboot.

-h : to halt.

Also all the shutdown arguments can be passed along. To know more about shutdown options run command.

shutdown --help

Thursday, May 3, 2012

Install openvpn on ubuntu VPS in less than 10 minutes

Overview

If all that you want is just a openvpn server without the hassle of compiling, I recommend a debian / ubuntu system with a minimum of 64mb RAM. The below instructions would let you connect to your own openvpn (openvz VPS) server in less than 10 minutes.

Prerequisite

Before we install openvpn, check if tun/tap is enable for your vps:

cat /dev/net/tun

In the above image "File descriptor in bad state" means tun/tap enabled. If not, contact your vps provider to activate tun/tap. Without tun/tap vpn connection cannot be established.

Installation

To install openvpn in a terminal enter:

sudo apt-get install openvpn

Server Certificates

Now that the openvpn package is installed, the certificates for the VPN server need to be created.

First, copy the easy-rsa directory to /etc/openvpn. This will ensure that any changes to the scripts will not be lost when the package is updated. You will also need to adjust permissions in the easy-rsa directory to allow the current user permission to create files. From a terminal enter:

sudo mkdir /etc/openvpn/easy-rsa/
sudo cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-rsa/
sudo chown -R $USER /etc/openvpn/easy-rsa/

Next, edit /etc/openvpn/easy-rsa/vars adjusting the following to your environment:

export KEY_COUNTRY="US"
export KEY_PROVINCE="NC"
export KEY_CITY="Winston-Salem"
export KEY_ORG="Example Company"
export KEY_EMAIL="steve@example.com"

Enter the following to create the server certificates:

cd /etc/openvpn/easy-rsa/
source vars
./clean-all
./build-dh
./pkitool --initca
./pkitool --server server
cd keys
openvpn --genkey --secret ta.key
sudo cp server.crt server.key ca.crt dh1024.pem ta.key /etc/openvpn/

Client Certificates

The VPN client will also need a certificate to authenticate itself to the server. To create the certificate, enter the following in a terminal:

cd /etc/openvpn/easy-rsa/
source vars
./pkitool hostname
Replace hostname with the actual hostname of the machine connecting to the VPN.

Copy the following files to the client:

/etc/openvpn/ca.crt
/etc/openvpn/easy-rsa/keys/hostname.crt
/etc/openvpn/easy-rsa/keys/hostname.key
/etc/openvpn/ta.key
Remember to adjust the above file names for your client machine's hostname.

It is best to use a secure method to copy the certificate and key files. The scp utility is a good choice, but copying the files to removable media then to the client, also works well.

Configuration

Server Configuration

Now configure the openvpn server by creating /etc/openvpn/server.conf from the example file. In a terminal enter:

sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/
sudo gzip -d /etc/openvpn/server.conf.gz

Edit /etc/openvpn/server.conf changing the following options to:

push "redirect-gateway defi by-pass-dhcp" ; uncomment this line
push "dhcp-option DNS 10.8.0.1"; add this line
script-security 3 ; add this line
push: are directives to add networking options for clients.

After configuring the server, restart openvpn by entering:

sudo /etc/init.d/openvpn restart

Network Configuration

This network configuration is for openvz virtualization only, This guide is not related to dedicated or xen server.

Edit /etc/sysctl.conf file and uncomment the following line:

net.ipv4.ip_forward=1

We want the ipv4 forward to be persistent even on reboot:

sudo echo 1 > /proc/sys/net/ipv4/ip_forward

Firewall / iptables Configuration

Setup iptables to allow vpn connection

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 1.1.1.1
Replace 1.1.1.1 with the actual ip address.

Saving iptables

You may want to have your iptables saved everytime you reboot. You could add a line like this one in /etc/network/interfaces

pre-up iptables-restore < /etc/iptables.rules
post-down iptables-save > /etc/iptables.rules

The line "post-down iptables-save > /etc/iptables.rules" will save the rules to be used on the next boot.

Manage users

You may want to add multiple users to your vpn server with the command:

useradd username -s /bin/false
passwd username

You may want to delete a user with the command

userdel username

Finally, restart openvpn:

sudo /etc/init.d/openvpn restart

You should now be able to connect to the remote LAN through the VPN..

Client Configuration

First, install openvpn on the client:

sudo apt-get install openvpn

Then with the server configured and the client certificates copied to the /etc/openvpn/ directory, create a client configuration file by copying the example. In a terminal on the client machine enter:

sudo cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf /etc/openvpn

Now edit /etc/openvpn/client.conf changing the following options:

remote vpn.example.com 1194
cert hostname.crt
key hostname.key
ca ca.crt
tls-auth ta.key 1
script-security 3
Replace vpn.example.com with the hostname of your VPN server, and hostname.* with the actual certificate and key filenames.

Windows Client Configuration

Download and install openvpn-gui stable
copy client.conf file to c:\program files\openvpn\config\ rename client.conf to client.ovpn
copy ca.crt, hostname.crt, hostname.key, ta.key to c:\program files\openvpn\config\
Right click openvpn tray icon and connect

Sample server configuration

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.8.0.1"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
script-security 3

Sample client configuration

client
dev tun
proto udp
remote vps4.tidydns.net 1194
resolv-retry infinite
nobind
persist-key
persist-tun
script-security 3
ca ca.crt
cert vps4.tidydns.net.crt
key vps4.tidydns.net.key
ns-cert-type server
comp-lzo
verb 3

Wednesday, May 2, 2012

Setup ramdisk with ramfs or tmpfs

Overview:

Using ramfs or tmpfs you can allocate part of the physical memory to be used as a partition. You can mount this partition and start writing and reading files like a hard disk partition. Since you’ll be reading and writing to the RAM, it will be faster.

When a vital process becomes drastically slow because of disk writes, you can choose either ramfs or tmpfs file systems for writing files to the RAM.

Both tmpfs and ramfs mount will give you the power of fast reading and writing files from and to the primary memory. When you test this on a small file, you may not see a huge difference. You’ll notice the difference only when you write large amount of data to a file with some other processing overhead such as network.

How to mount Tmpfs

# mkdir -p /mnt/tmp
# mount -t tmpfs -o size=20m tmpfs /mnt/tmp

The last line in the following df -k shows the above mounted /mnt/tmp tmpfs file system.

# df -k
Filesystem      1K-blocks  Used     Available Use%  Mounted on
/dev/sda2       32705400   5002488  26041576  17%   /
/dev/sda1       194442     18567    165836    11%   /boot
tmpfs           517320     0        517320    0%    /dev/shm
tmpfs           20480      0        20480     0%    /mnt/tmp

How to mount Ramfs

# mkdir -p /mnt/ram
# mount -t ramfs -o size=20m ramfs /mnt/ram

The last line in the following mount command shows the above mounted /mnt/ram ramfs file system.

# mount
/dev/sda2 on / type ext3 (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
/dev/sda1 on /boot type ext3 (rw)
tmpfs on /dev/shm type tmpfs (rw)
none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)
sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)
fusectl on /sys/fs/fuse/connections type fusectl (rw)
tmpfs on /mnt/tmp type tmpfs (rw,size=20m)
ramfs on /mnt/ram type ramfs (rw,size=20m)

You can mount ramfs and tmpfs during boot time by adding an entry to the /etc/fstab

Ramfs vs TmpfsPrimarily both ramfs and tmpfs does the same thing with few minor differences.

Ramfs will grow dynamically. So, you need control the process that writes the data to make sure ramfs doesn’t go above the available RAM size in the system. Let us say you have 2GB of RAM on your system and created a 1 GB ramfs and mounted as /tmp/ram. When the total size of the /tmp/ram crosses 1GB, you can still write data to it. System will not stop you from writing data more than 1GB. However, when it goes above total RAM size of 2GB, the system may hang, as there is no place in the RAM to keep the data.

Tmpfs will not grow dynamically. It would not allow you to write more than the size you’ve specified while mounting the tmpfs. So, you don’t need to worry about controlling the process that writes the data to make sure tmpfs doesn’t go above the specified limit. It may give errors similar to “No space left on device”.

Tmpfs uses swap.

Ramfs does not use swap.

Disadvantages of Ramfs and Tmpfs
Since both ramfs and tmpfs is writing to the system RAM, it would get deleted once the system gets rebooted, or crashed. So, you should write a process to pick up the data from ramfs/tmpfs to disk in periodic intervals. You can also write a process to write down the data from ramfs/tmpfs to disk while the system is shutting down. But, this will not help you in the time of system crash.

Table: Comparison of ramfs and tmpfs
Experimentation	Tmpfs	Ramfs
Fill maximum space and continue writing	Will display error	Will continue writing
Fixed Size	Yes	No
Uses Swap	Yes	No
Volatile Storage	Yes	Yes

If you want your process to write faster, opting for tmpfs is a better choice with precautions about the system crash.

ramfs manpage

NAME
ramfs - memory file system

SYNOPSIS
ramfs [ -Dipsu ] [ -m mountpoint ] [ -S srvname ]

DESCRIPTION
Ramfs starts a process that mounts itself on mountpoint (default /tmp). The ramfs process implements a tree rooted at dir, keeping all files in memory. Ini- the file tree is empty.

The -D option enables a trace of general debugging

The -i flag tells ramfs to use file descriptors 0 and 1 for its communication channel rather than create a pipe. This makes it possible to use ramfs as a file server on a remote machine: the file descriptors 0 and 1 will be the network channel from ramfs to the client machine.

The -p flag causes ramfs to make its memory `private' so that its files are not accessible through the debugging interface.

The -s (-S) flag causes ramfs to post its channel on /srv/ramfs (/srv/srvname) rather than mounting it on mountpoint, enabling multiple clients to access its files. However, it does not authenticate its clients and its implementation of groups is simplistic, so it should not be used for precious data.

The -u option permits ramfs to consume as much memory as needed; without it, ramfs will limit its consumption to some arbitrary amount, currently 768MB (enough to hold a CD image).

This program is useful mainly as an example of how to write a user-level file server. It can also be used to provide high-performance temporary files.

source : http://man.aiju.de/4/ramfs

Saturday, April 7, 2012

create terminal bash shortcuts

You can assign shortcuts for your most frequently used terminal commands by appending alias as many times as you did like to your bash configuration file (~/.bashrc). The syntax for alias is as follows.

alias yourCommand="YourTerminalCommand"

example:

alias la="ls -la"

alias gs1="ssh gs1.yourdomain.com"

Aliases shorten the amount of keystrokes necessary to throw commands.

I put my aliases in a file called ~/.aliases and then insert "source ~/.aliases" in my bash ~/.profile. That way it's easy to grab a copy of .aliases in case I'm doing command-line stuff on someone else's computer and don't want to mess with their .profile.

I would advise that you only alias commands, that don't change your system or delete files. So don't alias "sudo" or "apt-get". When you're actually installing software, you want to do it deliberately, and you don't want the chance that a typo will actually do something that changes your system with elevated permissions.

Common Linux commands on system info

pwd

Print working directory, i.e., display the name of my current directory on the screen.

hostname

Print the name of the local host (the machine on which you are working). Use netconf (as root) to change the name of the machine.

whoami

Print my login name.

id username

Print user id (uid) and his/her group id (gid), effective id (if different than the real id) and the supplementary groups.

date

Print or change the operating system date and time. E.g., I could change the date and time to 2000-12-31 23:57 using this command:

date 123123572000

To set the hardware (BIOS) clock from the system (Linux) clock, use the command (as root) setclock

time

Determine the amount of time that it takes for a process to complete + other info. Don't confuse it with the date command. E.g. I can find out how long it takes to display a directory content using:

time ls

who

Determine the users logged on the machine.

rwho -a

(=remote who) Determine all users logged on your network. The rwho service must be enabled for this command to run. If it isn't, run setup as root to enable "rwho".

finger user_name

System info about a user. Try: finger root

last

Show listing of users last logged-in on your system.

history | more

Show the last (1000 or so) commands executed from the command line on the current account. The "| more" causes the display to stop after each screenful.

uptime

Show the amount of time since the last reboot.

(=print status) List the processes currently run by the current user.

ps axu | more

List all the processes currently running, even those without the controlling terminal, together with the name of the user that owns each process.

top

Keep listing the currently running processes, sorted by cpu usage (top users first). In KDE, you can get GUI-based Ktop from "K"menu under "System"-"Task Manager" (or by executing "ktop" in an X-terminal).

uname -a

(= Unix name with option "all") Info on your (local) server. I can also use guname (in X-window terminal) to display the info more nicely.

free

Memory info (in kilobytes).

df -h

(=disk free) Print disk info about all the filesystems (in human-readable form)

du / -bh | more

(=disk usage) Print detailed disk usage for each subdirectory starting at the "/" (root) directory (in human legible form).

cat /proc/cpuinfo

Cpu info--it show the content of the file cpuinfo. Note that the files in the /proc directory are not real files--they are hooks to look at information available to the kernel.

cat /proc/interrupts

List the interrupts in use.

cat /proc/version

Linux version and other info

cat /proc/filesystems

Show the types of filesystems currently in use.

cat /etc/printcap

Show the setup of printers.

lsmod

(As root. Use /sbin/lsmod to execute this command when you are a non-root user.) Show the kernel modules currently loaded.

set|more

Show the current user environment.

echo $PATH

Show the content of the environment variable "PATH". This command can be used to show other environment variables as well. Use "set" to see the full environment.

dmesg | less

Print kernel messages (the content of the so-called kernel ring buffer). Press "q" to quit "less". Use less /var/log/dmesg to see what "dmesg" dumped into this file right after the last system bootup.

Tuesday, April 3, 2012

perl: warning: Setting locale failed

I get this error while updating and installing software : perl: warning: Setting locale failed

perl: warning: Falling back to the standard locale ("C").
perl: warning: Setting locale failed.
perl: warning: Please check that your locale settings:
    LANGUAGE = (unset),
    LC_ALL = (unset),
    LANG = "en_US.UTF-8"
    are supported and installed on your system.
perl: warning: Falling back to the standard locale ("C").

As root enter the following command in terminal and reboot your server.
echo "en_US.UTF-8 UTF-8" > /var/lib/locales/supported.d/local dpkg-reconfigure locales

Saturday, March 31, 2012

How to secure a VPS

To disable Formmail in order to stop spam mails -

1) Command to find Mails -
find / -name “[Ff]orm[mM]ai*”

2) Command to find CGI mails -
find / -name “[Cc]giemai*”

3) To disable form mails -

chmod a-rwx /path/to/filename

this is will disable all the scripts.

B) Root kits should be installed -

- Set a root kit on a cron job, this will show if any one has hacked in the roots.
- Update the roots

1) Command to install chrootkit -

cd /root/
wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz
tar xvzf chkrootkit.tar.gz
cd chkrootkit-0.44

2) To run chkrootkit -

/root/chkrootkit-0.44/chkrootkit

C) Installation of a root breach detector and warning of any emails -

pico .bash_profile

At the end of the page -

Add,

echo ‘ALERT – Root Shell Access on:’ `date` `name` | mail -s “Alert: Root Access from `the person accessing | awk ‘{print $6}’`” self@mail.com

Thereafter save the changes

Exit.

2) To release an SSH message -

pico /etc/motd

thereafter enter the message

Save changes

Exit

D) Changes to be made in WHM/cpanel to secure server -

Log in to cpanel>Server setup>Tweak settings

a) Domains -

Prevent users from parking/adding domains.

b) Mail -

Prevent pop3 connections loading

c) System -

Jailshell should be used as a default shell for all the accounts.

d) Server setup>Tweak security
1) Enable php open_basedir Protection
2) Enable mod_userdir Protection

e) Server setup>Manage Wheel Group Users
1) Remove all other users except for root and main account users.

f) Server setup > Shell Fork Bomb Protection
1) Enable Shell Fork Bomb Protection

g) Service Configuration>FTP Configuration
1) Disable Anonymous FTP

h) Account Functions>Manage Shell Access
1) Disable shell access

I) Mysql>MySQL Root Password
1) Change root password

j) Security>Run Quick Security Scan>Trojan Horses -
1) The following are not Trojan -
/sbin/depmod
/sbin/insmod
/sbin/insmod.static
/sbin/modinfo
/sbin/modprobe
/sbin/rmmod

Set Linux local timezone for VPS

This guide describes how to set the Linux local timezone.

ls /usr/share/zoneinfo/ and note the region where you reside
ls /usr/share/zoneinfo/<YOUR_REGION> (where <YOUR_REGION> is your local region) and note the timezone which corresponds to your location

For Ubuntu
ln -sf /usr/share/zoneinfo/<YOUR_REGION>/<YOUR_TIMEZONE> /etc/localtime

For Debian

ln -sf /usr/share/zoneinfo/<YOUR_REGION>/<YOUR_TIMEZONE localtime

Use date command to verify that your timezone has change.

Friday, March 30, 2012

Common iptables sample

# Modify this file accordingly for your specific requirement.
# 1. Delete all existing rules
iptables -F

# 2. Set default chain policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# 3. Block a specific ip-address
#BLOCK_THIS_IP="x.x.x.x"
#iptables -A INPUT -s "$BLOCK_THIS_IP" -j DROP

# 4. Allow ALL incoming SSH
#iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

# 5. Allow incoming SSH only from a sepcific network
#iptables -A INPUT -i eth0 -p tcp -s 192.168.200.0/24 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

# 6. Allow incoming HTTP
#iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

# Allow incoming HTTPS
#iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -A OUTPUT -o eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT

# 7. MultiPorts (Allow incoming SSH, HTTP, and HTTPS)
iptables -A INPUT -i eth0 -p tcp -m multiport --dports 22,80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m multiport --sports 22,80,443 -m state --state ESTABLISHED -j ACCEPT

# 8. Allow outgoing SSH
iptables -A OUTPUT -o eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

# 9. Allow outgoing SSH only to a specific network
#iptables -A OUTPUT -o eth0 -p tcp -d 192.168.101.0/24 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

# 10. Allow outgoing HTTPS
iptables -A OUTPUT -o eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT

# 11. Load balance incoming HTTPS traffic
#iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 0 -j DNAT --to-destination 192.168.1.101:443
#iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 1 -j DNAT --to-destination 192.168.1.102:443
#iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 2 -j DNAT --to-destination 192.168.1.103:443

# 12. Ping from inside to outside
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT

# 13. Ping from outside to inside
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT

# 14. Allow loopback access
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# 15. Allow packets from internal network to reach external network.
# if eth1 is connected to external network (internet)
# if eth0 is connected to internal network (192.168.1.x)
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

# 16. Allow outbound DNS
#iptables -A OUTPUT -p udp -o eth0 --dport 53 -j ACCEPT
#iptables -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT

# 17. Allow NIS Connections
# rpcinfo -p | grep ypbind ; This port is 853 and 850
#iptables -A INPUT -p tcp --dport 111 -j ACCEPT
#iptables -A INPUT -p udp --dport 111 -j ACCEPT
#iptables -A INPUT -p tcp --dport 853 -j ACCEPT
#iptables -A INPUT -p udp --dport 853 -j ACCEPT
#iptables -A INPUT -p tcp --dport 850 -j ACCEPT
#iptables -A INPUT -p udp --dport 850 -j ACCEPT

# 18. Allow rsync from a specific network
iptables -A INPUT -i eth0 -p tcp -s 192.168.101.0/24 --dport 873 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 873 -m state --state ESTABLISHED -j ACCEPT

# 19. Allow MySQL connection only from a specific network
iptables -A INPUT -i eth0 -p tcp -s 192.168.200.0/24 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 3306 -m state --state ESTABLISHED -j ACCEPT

# 20. Allow Sendmail or Postfix
iptables -A INPUT -i eth0 -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT

# 21. Allow IMAP and IMAPS
iptables -A INPUT -i eth0 -p tcp --dport 143 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 143 -m state --state ESTABLISHED -j ACCEPT

iptables -A INPUT -i eth0 -p tcp --dport 993 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 993 -m state --state ESTABLISHED -j ACCEPT

# 22. Allow POP3 and POP3S
iptables -A INPUT -i eth0 -p tcp --dport 110 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 110 -m state --state ESTABLISHED -j ACCEPT

iptables -A INPUT -i eth0 -p tcp --dport 995 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 995 -m state --state ESTABLISHED -j ACCEPT

# 23. Prevent DoS attack
iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT

# 24. Port forwarding 422 to 22
iptables -t nat -A PREROUTING -p tcp -d 192.168.102.37 --dport 422 -j DNAT --to 192.168.102.37:22
iptables -A INPUT -i eth0 -p tcp --dport 422 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 422 -m state --state ESTABLISHED -j ACCEPT

# 25. Log dropped packets
iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7
iptables -A LOGGING -j DROP

To save and restore iptables
iptables-save > /path/iptabels.conf
iptables-restore < /path/iptables.conf

To delete a rule

You can delete them based on what they're doing:

iptables -D INPUT -s 127.0.0.1 -p tcp --dport 111 -j ACCEPT
Or you can delete them based on their number and chain name:

iptables -D INPUT 4

The number is the row number of the item when you list them using:

how to know chain number

The number is the row number of the item when you list them using:

iptables --list

or

best way to view chain numbers is

iptables -L INPUT --line-numbers

you can also substitute with OUTPUT etc

Most important : Getting iptables to survive a reboot

Create some iptables rules and list them:

iptables --list
if the listed rules satisfy your needs, then save them somewhere. I use /etc/firewall.conf but this location is not fixed:

iptables-save > /etc/firewall.conf
Then create a script so ifupdown loads these rules on boot:

echo "#!/bin/sh" > /etc/network/if-up.d/iptables
echo "iptables-restore < /etc/firewall.conf" >> /etc/network/if-up.d/iptables
chmod +x /etc/network/if-up.d/iptables

Now reboot your machine and pray - the rules should come up exactly like before (use "iptables --list" to verify this).
--------------------------------------------------------------------

Run the following commands to reset Iptables:

iptables -F
iptables -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

/sbin/service iptables save ( for centos)

Thursday, March 29, 2012

Syslog file is not readable, read access may be denied

User permissions in syslog files are 640 but for LogAnalyzer to work syslog files must be readable by www-data. Below are the steps to make syslog readable

1. First add a new group by using this command, we call the group logadmin in this sample.

groupadd logadmin

2. Now we add the www-data user to the new created logadmin group!

usermod -a -G logadmin www-data

3. Verify the success by using this command:

groups www-data

4. Now it is time to edit the /etc/logrotate.conf configuration file. Search for the default "create" command, and change it to the following:

create 640 root logadmin

The next time logrotate will run, the logfiles will become readable to the webserver by default.

What is Log Analyzer?
The LogAnalyzer project provides an easy to use but powerful front end for searching, reviewing and analyzing network event data, including syslog, windows event log and many other event sources. It focusses on the user-interface side of this project, so the data itself needs to be gathered by another program, for example the stock syslogd, rsyslog (often the distro's default syslogd), WinSyslog or MonitorWare Agent. LogAnalyzer works equally well on Linux and Windows. It is a free, GPLed open source application written mostly in php.

How to make syslog files readable by default on ubuntu?

We installed LogAnalyzer for easy analysis and reporting of the server. For this syslog files must be readable by www-data. Below are the steps to make syslog readable

1. First add a new group by using this command, we call the group logadmin in this sample.

groupadd logadmin

2. Now we add the www-data user to the new created logadmin group!

usermod -a -G logadmin www-data

3. Verify the success by using this command:

groups www-data

4. Now it is time to edit the /etc/logrotate.conf configuration file. Search for the default "create" command, and change it to the following:

create 640 root logadmin

The next time logrotate will run, the logfiles will become readable to the webserver by default.

Monday, March 19, 2012

How to add & remove users by command line in ubuntu?

To add a user you must use be root or use the sudo command. Here are the commands:

To add a user. NOTE: do not use the useradd command.

$ sudo adduser <username>

To see the options for adding a user try the man command.

$ man adduser

Add user

Here is a useful example of the useradd command. Why use useradd? It gives a few more options for special cases. To add a user, give her a standard home directory in the /home folder and specify the shell she accesses by default do this:

$ sudo useradd username -m -s /bin/bash 
$ sudo passwd username

Groups

You might also wish to create a new group for your users.

# sudo addgroup <groupname>

To add a new user to a existing group you would do this:

# sudo adduser <username> audio

To add an existing user to an existing group you can use the same command:

# sudo adduser <username> <groupname>

# sudo usermod -aG <groupname> <username>

Delete user

To remove a user from a system without deleting the users home directory.

# sudo userdel username

To remove the user and delete the users home folder:

# sudo userdel -r username