Gudasoft

Software development

Show menu Hide menu

CategoryAdministration

Hardening linux

J November, 2009 /

Check those links if you want to be ontop of the securuty

  • CIS Benchmarks – contains requirements from the Center for Internet Security (CIS) benchmarks.
  • DCID – contains requirements from the Director of Central Intelligence Directives (DCID).
  • DISA UNIX STIG – contains modules that address DISA UNIX Security Technical Implementation Guides (STIGs) security recommendations.
  • FERC CIP – contains modules that address the Critical Infrastructure Protection (CIP) standards for electricity distributors.
  • JAFAN – the Joint Air Force-Army-Navy (JAFAN) manual established the security policy and procedures for storing, processing, and communicating classified Department of Defence (DoD) Special Access Program (SAP) information in information systems.
  • NISPOM – contains modules that address the National Industrial Security Program Operating Manual (NISPOM).
  • PCI DSS – Payment Card Industry Security Standards Council includes members from Visa, MasterCard, American Express, Discover, and JCB International Credit Card Company. This council administers the Data Security Standard (DSS).
  • Web Services Protection – contains modules that address standard security functionality to provide protection.

IBM tutorial

Emulate3buttons

J November, 2009 /

Faithful to the rule that I must blog everything that took me more than 15min searching in google I am here again.

This time the post is related to my notebook which mousepad doesnt support double tap (poor lenovo :) )

Emulate3buttons – this is the magic key. Wonder how to use it? Just click left+right at the same time.

Also be aware: in the new distros this setting is not changed from xorg.conf  check this article

http://www.seebs.net/log/articles/459/disabling-emulate3buttons-on-ubuntuleft+left+right clicks right clicks

The rest is a copy/paste from the post above

The problem is that you can’t just override this in xorg.conf anymore. You need to use xinput. xinput’s powerful, clever, flexible… and totally over the heads of a lot of users. Here’s a script to run from .xinitrc or the equivalent which disables Emulate3Buttons on any input devices which have it. (It’s now called “Middle Button Emulation”, mind.)

#!/bin/sh
xinput list | sed -ne 's/^[^ ][^V].*id=\([0-9]*\).*/\1/p' | while read id
do
        case `xinput list-props $id` in
        *"Middle Button Emulation"*)
                xinput set-int-prop $id "Middle Button Emulation" 8 0
                ;;
        esac
done

How this works: We first obtain a list of ID numbers, disregarding those where the second character on the line was V, because xinput list-props doesn’t work on the "Virtual[...] lines for the generic keyboard and mouse. For each such device, we check to see whether it has the feature; if so, we disable it. (The number 8 indicates that we’re setting an 8-bit value; it doesn’t really matter. The disabled state is 0.)

Mod Rewrite, mod_rewrite

J October, 2009 /

Found great summary of mod rewrite here

http://stackoverflow.com/questions/286004/hidden-features-of-modrewrite

 

I aways forget the params for mod_rewrite so here is the summary

  • [R] force a redirect (default 301)
  • [R=302] force a 302 redirect
  • [L] stop rewriting process (see note below in common pitfalls)
  • [NC] case insensitive matches

Ubuntu (9.0.4) on Dell Optiflex 320

J July, 2009 / 
To install ubuntu on Dell system you need to change the default boot loader to grub2 or something else
#change the root password to something that you know
sudo passwd
#become root
su

mkdir /media/ubuntu
mount /dev/sda1 /media/ubuntu

# check that you have mounted the right partition.
ls /media/ubuntu

mount -t proc none /media/ubuntu/proc
mount -o bind /dev/ /media/ubuntu/dev
cp /etc/resolv.conf /mediaubuntu/etc

chroot /media/ubuntu /bin/bash
/etc/init.d/networking restart
aptitude update
aptitude install grub2

upgrade-....<tab>

Tools for calibrating LCD monitors

J May, 2009 /

http://www.lagom.nl/lcd-test/black.php

Synergy – one keyboard for two PC-s

J April, 2009 /

“Synergy lets you easily share a single mouse and keyboard between multiple computers with different operating systems, each with its own display, without special hardware. It’s intended for users with multiple computers on their desk since each system uses its own monitor(s).”

root@guda-desktop:/etc# cat synergy.conf

section: screens
desktop:
guda-laptop:
end

section: aliases
guda-laptop:
192.168.1.101
end

section: links
desktop:
right = desktop
guda-laptop:
left = guda-laptop
end

# synergys –config /etc/synergy.conf
# synergyc IP

On windows I am defining:

“Share this computer…” -> configure

Screens: desktop, guda-laptop

links: guda-laptop is left on desktop and the oposite

Updates: Check the http://code.google.com/p/synergy-plus/ clone

MSI notebook are total scrab

J April, 2009 /

For MSI Notebooks

Don’t buy MSI. Look for HP, IBM or some real brand.

  1. The lid of the laptop is breaking – I have  MSI 3 laptops and all of them are broken. One of my friends has the luck to return his laptop and now he is with a nice HP machine – lucky man. It was 6 months for repairing.
  2. The wireless is loosing connection all the time. My wife is with IBM and she is chating chating chating, and I am reconnecting, reconnecting reconecting….
    Update:The MSI lan adaptor has gone away. The only way to use Internet is via the integrated broken wireless. I hate MSI.
  3. The heat is like an oven – my son don’t want to play NFS because of the heat. Me too.
  4. The LCD screen gets on some dark and light spots very soon
  5. The material for the laptop is not good – not nice to touch. The silver color is quickly gone and ugly black places are shown
  6. If you enable the 32 bit access mode Linux kernel wont work (tested till ubunto 8.10
    1. After such try you must remove the battery start the power without any AC and return the power – is this magic ?
  7. The fan of the notebook is making awfull noise. The fan costs 40EUR and there no garantee that the new fan will be the same like the old one.
    1. The fan never stops
  8. Their support is not answering on ANY of the problems pointed here. maybe all from MSI are dead. Who knows.
  9. The microphone is very quiet and the this makes it impossible to talk with skype, btw why they have put the camara then?
  10. The mouse which they give as a bonus doesnt work – both 2 are broken, missing some clicks from time to time.
  11. Try searching for “MSI fan” in google. I got this result. Internet is full of “happy” MSI owners.

CHEAP RUBBISH !

I want my money back! for all 2 laptops that I have bought.

I will publish some pictures soon.

blah

Logs monitoring

J April, 2009 /

I have been asked from one my friends who hosts many websites on single machine to help him to find which vhost is doing some slow requests.

the load of the machine from 0.5 has become 1.5. and there are some apache processess eating the CPU.

It is obvious that some php file is slowing down all the machine but who?

I found this wonderfull tool in Internet

http://code.google.com/p/wtop/wiki/Installing

http://code.google.com/p/wtop/wiki/LogrepCookbook

With this script I can monitor all the pages and not sitting in the dark while some evil pages are drying the CPU power.

logrep -m tail -f 'msec>1000' -o 'ts,ip,msec,class,url' *.log

One server, two bind/named process, one domain (with two nameservers)

J February, 2009 /

Yes you need two bind instances

When you register a domain name you provide two nameservers.

Those nameservers the registrarar will know their ip addresses.

in my example the domain is cenite.com and the nameservers are ns1.cenite.com and ns2.cenite.com

Both nameservers are running on signle debian machine. I have started two bind processes on the machine. one is binded to the ns1.cenite.com external interface and ns2.cenite.com is to the other (backup) internet interface.

Here is a tool to check your domain name

Here is example zone file

cenite.com.db

cenite.com.ns2.db

here are the configuration files.

named2.conf

named.conf

The good think is when the first internet connection is down, the second will still serve your clients.

Bonus links

Go and switch to tinydns – people say it is much easier to configure  http://cr.yp.to/djbdns/run-server-bind.html

dns zone generator

How to create a self-signed SSL Certificate …

J January, 2009 /

Low cost certificates

Certificates in this category should cost under US$50 annually and include availability from Trusted CAs ipsCA and FreeSSL.com. As these certificates do not carry a known brand, fraud control or human support, they are suitable for non- or light commerce environments, though they do provide bonus 128-bit encryption. According to FreeSSL.com, a light commerce environment is one with no more than 50 transactions weekly, and an average transaction value of US$50.

How to create a self-signed SSL Certificate …

…  which can be used for testing purposes or internal usage

Overview

The following is an extremely simplified view of how SSL is implemented and what part the certificate plays in the entire process.

Normal web traffic is sent unencrypted over the Internet. That is, anyone with access to the right tools can snoop all of that traffic. Obviously, this can lead to problems, especially where security and privacy is necessary, such as in credit card data and bank transactions. The Secure Socket Layer is used to encrypt the data stream between the web server and the web client (the browser).

SSL makes use of what is known as asymmetric cryptography, commonly referred to as public key cryptography (PKI). With public key cryptography, two keys are created, one public, one private. Anything encrypted with either key can only be decrypted with its corresponding key. Thus if a message or data stream were encrypted with the server’s private key, it can be decrypted only using its corresponding public key, ensuring that the data only could have come from the server.

If SSL utilizes public key cryptography to encrypt the data stream traveling over the Internet, why is a certificate necessary? The technical answer to that question is that a certificate is not really necessary – the data is secure and cannot easily be decrypted by a third party. However, certificates do serve a crucial role in the communication process. The certificate, signed by a trusted Certificate Authority (CA), ensures that the certificate holder is really who he claims to be. Without a trusted signed certificate, your data may be encrypted, however, the party you are communicating with may not be whom you think. Without certificates, impersonation attacks would be much more common.

Step 1: Generate a Private Key

The openssl toolkit is used to generate an RSA Private Key and CSR (Certificate Signing Request). It can also be used to generate self-signed certificates which can be used for testing purposes or internal usage.

The first step is to create your RSA Private Key. This key is a 1024 bit RSA key which is encrypted using Triple-DES and stored in a PEM format so that it is readable as ASCII text.

openssl genrsa -des3 -out server.key 1024

Generating RSA private key, 1024 bit long modulus
…………………………………………………++++++
……..++++++
e is 65537 (0x10001)
Enter PEM pass phrase:
Verifying password – Enter PEM pass phrase:

Step 2: Generate a CSR (Certificate Signing Request)

Once the private key is generated a Certificate Signing Request can be generated. The CSR is then used in one of two ways. Ideally, the CSR will be sent to a Certificate Authority, such as Thawte or Verisign who will verify the identity of the requestor and issue a signed certificate. The second option is to self-sign the CSR, which will be demonstrated in the next section.

During the generation of the CSR, you will be prompted for several pieces of information. These are the X.509 attributes of the certificate. One of the prompts will be for “Common Name (e.g., YOUR name)”. It is important that this field be filled in with the fully qualified domain name of the server to be protected by SSL. If the website to be protected will be https://public.akadia.com, then enter public.akadia.com at this prompt. The command to generate the CSR is as follows:

openssl req -new -key server.key -out server.csr

Country Name (2 letter code) [GB]:CH
State or Province Name (full name) [Berkshire]:Bern
Locality Name (eg, city) [Newbury]:Oberdiessbach
Organization Name (eg, company) [My Company Ltd]:Akadia AG
Organizational Unit Name (eg, section) []:Information Technology
Common Name (eg, your name or your server’s hostname) []:public.akadia.com
Email Address []:martin dot zahn at akadia dot ch
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Step 3: Remove Passphrase from Key

One unfortunate side-effect of the pass-phrased private key is that Apache will ask for the pass-phrase each time the web server is started. Obviously this is not necessarily convenient as someone will not always be around to type in the pass-phrase, such as after a reboot or crash. mod_ssl includes the ability to use an external program in place of the built-in pass-phrase dialog, however, this is not necessarily the most secure option either. It is possible to remove the Triple-DES encryption from the key, thereby no longer needing to type in a pass-phrase. If the private key is no longer encrypted, it is critical that this file only be readable by the root user! If your system is ever compromised and a third party obtains your unencrypted private key, the corresponding certificate will need to be revoked. With that being said, use the following command to remove the pass-phrase from the key:

cp server.key server.key.org
openssl rsa -in server.key.org -out server.key

The newly created server.key file has no more passphrase in it.

-rw-r–r– 1 root root 745 Jun 29 12:19 server.csr
-rw-r–r– 1 root root 891 Jun 29 13:22 server.key
-rw-r–r– 1 root root 963 Jun 29 13:22 server.key.org

Step 4: Generating a Self-Signed Certificate

At this point you will need to generate a self-signed certificate because you either don’t plan on having your certificate signed by a CA, or you wish to test your new SSL implementation while the CA is signing your certificate. This temporary certificate will generate an error in the client browser to the effect that the signing certificate authority is unknown and not trusted.

To generate a temporary certificate which is good for 365 days, issue the following command:

openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
Signature ok
subject=/C=CH/ST=Bern/L=Oberdiessbach/O=Akadia AG/OU=Information
Technology/CN=public.akadia.com/Email=martin dot zahn at akadia dot ch
Getting Private key

Step 5: Installing the Private Key and Certificate

When Apache with mod_ssl is installed, it creates several directories in the Apache config directory. The location of this directory will differ depending on how Apache was compiled.

cp server.crt /usr/local/apache/conf/ssl.crt
cp server.key /usr/local/apache/conf/ssl.key

Step 6: Configuring SSL Enabled Virtual Hosts

SSLEngine on
SSLCertificateFile /usr/local/apache/conf/ssl.crt/server.crt
SSLCertificateKeyFile /usr/local/apache/conf/ssl.key/server.key
SetEnvIf User-Agent “.*MSIE.*” nokeepalive ssl-unclean-shutdown
CustomLog logs/ssl_request_log \
“%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \”%r\” %b”

Step 7: Restart Apache and Test

/etc/init.d/httpd stop
/etc/init.d/httpd stop

https://public.akadia.com

Older posts Newer posts

Google analytics

© 2024 Gudasoft

Theme by Anders Norén — Up ↑