Command Center

Q. Wordpress and many other open source application developers asks users to protect PHP apps using Suhosin patch to get protection from the full exploit. Suhosin is an advanced protection system for PHP installations. It was designed to protect your servers from various attacks. How do I install Suhosin under RHEL / CentOS / Fedora Linux?

A. Suhosin was designed to protect your servers against a number of well known problems in PHP applications and on the other hand against potential unknown vulnerabilities within these applications or the PHP core itself including wordpress and many other open source php based apps.
Install Suhosin as extension

Download latest version of Suhosin, enter:
# cd /opt
# wget http://download.suhosin.org/suhosin-0.9.27.tgz
Make sure you have php-devel installed:
# yum install php-devel
Compile Suhosin under PHP 5 and RHEL / CentOS Linux

Type the following commands:
# cd suhosin-0.9.27
# phpize
#./configure
# make
# make install
Configure Suhosin

Type the following command to create Suhosin configuration file:
# echo 'extension=suhosin.so' > /etc/php.d/suhosin.ini
Restart web server

Type the following command to restart httpd:
# service httpd restart
If you are using lighttpd, enter:
# service lighttpd restart
Verify Suhosin installation

Type the following command:
$ php -v
Sample output:

PHP 5.1.6 (cli) (built: Jun 12 2008 05:02:36)
Copyright (c) 1997-2006 The PHP Group
Zend Engine v2.1.0, Copyright (c) 1998-2006 Zend Technologies
with XCache v1.2.2, Copyright (c) 2005-2007, by mOo
with Suhosin v0.9.27, Copyright (c) 2007, by SektionEins GmbH

You can find more information by running phpinfo():

phpinfo();
?>

Sample output:
Fig.01: Suhosin information and settings displayed by phpinfo().

Fig.01: Suhosin information and settings displayed by phpinfo().

Q. I'd like to sort a list of IP address stored in a text file. How do I sort by last notation or entire address under Linux or UNIX operating systems?

A.. You need to use sort command to displays the lines of its input listed in sorted order. Sorting is done based on one or more sort keys extracted from each line of input. By default, the entire input is taken as sort key. Blank space is taken used as default field separator.
Sort command to sort IP address

Here is our sample input file:

192.168.1.100
192.168.1.19
192.168.1.102
192.168.2.1
192.168.0.2

Type the following sort command:
$ sort -t . -k 3,3n -k 4,4n /path/to/file
Sample output:

192.168.0.2
192.168.1.19
192.168.1.100
192.168.1.102
192.168.2.1

Where,

* -t . : Set field to . (dot) as our IPs separated by dot symbol
* -n : Makes the program sort according to numerical value
* -k opts: Sort data / fields using the given column number. For example, the option -k 2 made the program sort using the second column of data. The option -k 3,3n -k 4,4n sorts each column. First it will sort 3rd column and then 4th column.

Find Out If Patch Number ( CVE ) Has Been Applied To RHEL / CentOS Linux

Q. I know how to update my system using yum command. But how can I find out that patch has been applied to a package? How do I search CVE patch number applied to a package under Red Hat / CentOS / RHEL / Fedora Linux?

A. You need to use rpm command. Each rpm package stores information about patches including date, small description and CVE number. You can use the -q query option to display change information for the package.
rpm --changelog option

Use the command as follows:
rpm -q --changelog {package-name}
rpm -q --changelog {package-name} | more
rpm -q --changelog {package-name} | grep CVE-NUMBER

For example find out if CVE-2008-1927 has been applied to perl package or not, enter:
# rpm -q --changelog perl|grep CVE-2008-1927
Sample output:

- CVE-2008-1927 perl: double free on regular expressions with utf8 characters

List all applied patches for php, enter:
# rpm -q --changelog php
Sample output:

* Tue Jun 03 2008 Joe Orton 5.1.6-20.el5_2.1
- add security fixes for CVE-2007-5898, CVE-2007-4782, CVE-2007-5899,
CVE-2008-2051, CVE-2008-2107, CVE-2008-2108 (#445923)

* Tue Jan 15 2008 Joe Orton 5.1.6-20.el5
- use magic.mime provided by file (#240845)
- fix possible crash with setlocale() (#428675)

* Thu Jan 10 2008 Joe Orton 5.1.6-19.el5
- ext/date: fix test cases for recent timezone values (#266441)

* Thu Jan 10 2008 Joe Orton 5.1.6-18.el5
- ext/date: updates for system tzdata support (#266441)

* Wed Jan 09 2008 Joe Orton 5.1.6-17.el5
- ext/date: use system timezone database (#266441)

* Tue Jan 08 2008 Joe Orton 5.1.6-16.el5
- add dbase extension in -common (#161639)
- add /usr/share/php to builtin include_path (#238455)
- ext/ldap: enable ldap_sasl_bind (#336221)
- ext/libxml: reset stream context (#298031)
.........
...
....
* Fri May 16 2003 Joe Orton 4.3.1-3
- link odbc module correctly
- patch so that php -n doesn't scan inidir
- run tests using php -n, avoid loading system modules

* Wed May 14 2003 Joe Orton 4.3.1-2
- workaround broken parser produced by bison-1.875

* Tue May 06 2003 Joe Orton 4.3.1-1
- update to 4.3.1; run test suite
- open extension modules with RTLD_NOW rather than _LAZY

How do I find CVE for a rpm file itself?

Above command will query installed package only. To query rpm file, enter:
$ rpm -qp --changelog rsnapshot-1.3.0-1.noarch.rpm | more

Q. I have an external new hard drive connected using USB port under Red Hat Fedora Core Linux. I want to use it for backup. There are two partition /dev/sda1 and /dev/sda2. This hard disk was setup and formatted by friend under Windows XP (NTFS partition). Now I want to format and use one partition for Linux and another for Windows XP.

How do I format sda1 without losing data from /dev/sda2?

A. To format /dev/sda1 as Linux ext3 partition use command mkfs.ext3. It is used to create an ext2/ext3 filesystem

Type the command as follows:
# mkfs.ext3 /dev/sda1

Before hitting [enter] key make sure you double check partition device name (/dev/sda1). If unsure make backup of important data on USB pen or DVD disk.

nik@Januty:~$ dmesg
[ 3573.698883] usbcore: registered new interface driver usb-storage
[ 3573.698890] USB Mass Storage support registered.
[ 3573.699114] usb-storage: device found at 3
[ 3573.699117] usb-storage: waiting for device to settle before scanning
[ 3578.690390] usb-storage: device scan complete
[ 3578.691230] scsi 2:0:0:0: Direct-Access     WDC WD40 0BB-23JHA1       1C06 PQ: 0 ANSI: 2 CCS
[ 3578.692345] sd 2:0:0:0: Attached scsi generic sg2 type 0
[ 3578.698932] sd 2:0:0:0: [sdb] 78156288 512-byte logical blocks: (40.0 GB/37.2 GiB)
[ 3578.701348] sd 2:0:0:0: [sdb] Write Protect is off
[ 3578.701356] sd 2:0:0:0: [sdb] Mode Sense: 00 38 00 00
[ 3578.701361] sd 2:0:0:0: [sdb] Assuming drive cache: write through
[ 3578.706594] sd 2:0:0:0: [sdb] Assuming drive cache: write through
[ 3578.706605]  sdb: sdb1
[ 3578.715633] sd 2:0:0:0: [sdb] Assuming drive cache: write through
[ 3578.715642] sd 2:0:0:0: [sdb] Attached SCSI disk


Step 2:

nik@Januty:~$mkfs.ext3 /dev/sdb
mke2fs 1.41.9 (22-Aug-2009)
/dev/sdb is entire device, not just one partition!
Proceed anyway? (y,n) y
mkfs.ext3: Permission denied while trying to determine filesystem size

Step 3:
nik@Januty:~$sudo mkdir /mnt/sdb
nik@Januty:~$sudo mount /dev/sdb /mnt/sdb

Ubuntu Linux format USB pen drive

Q. How do I format a USB pen drive under Ubuntu Linux for ext3 file system?
A. You can format USB pen drive with the help of following commands:

[a] fdisk : Partition table manipulator for Linux

[b] mkfs.ext3 : Create an ext2/ext3 filesystem by formatting given partition name (/dev/partition)

[c] e2label : Change the label on an ext2/ext3 filesystem

First make sure USB pen is not mounted. Click on Places > Computer > Select USB pen > Right click > Select Unmount Volume.

Let us assume that /dev/sda1 is your partition name for USB pen. To format type the following command (Open X terminal and type the command)
$ sudo mkfs.ext3 /dev/sda1
Caution: Careful while entering device/partition name; wrong name can wipe out entire hard disk!!!
Now use e2label command to change the filesystem label on the ext3 filesystem located on device /dev/sda1:
$ sudo e2label /dev/sda1 usb-pen
You can also create an MS-DOS/Windows XP file system under Linux, enter:
$ sudo mkfs.vfat /dev/sda1

Now you are ready to use USB pen.

[root@web12 home]# cat vsftpd.conf
# Example config file /etc/vsftpd/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
#anonymous_enable=YES
anonymous_enable=NO
#
# Uncomment this to allow local users to log in.
local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
#anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
#
# Activate logging of uploads/downloads.
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#chown_uploads=YES
#chown_username=whoever
#
# You may override where the log file goes if you like. The default is shown
# below.
#xferlog_file=/var/log/vsftpd.log
###modified
xferlog_file=/var/log/vsftpd.log
#
# If you want, you can have your log file in standard ftpd xferlog format
#xferlog_std_format=YES
xferlog_std_format=NO
#
# You may change the default value for timing out an idle session.
#idle_session_timeout=600
idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
#ascii_upload_enable=YES
#ascii_download_enable=YES
#
# You may fully customise the login banner string:
ftpd_banner=**** WARNING - Your actions are being logged ****
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd/banned_emails
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
#chroot_list_enable=YES
# (default follows)
#chroot_list_file=/etc/vsftpd/chroot_list

###Added April 14 2009 jail each user into their specified directory####
chroot_local_user=YES
user_config_dir=/etc/vsftpd/vsftpd_user_conf
#
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
#ls_recurse_enable=YES
#
# When "listen" directive is enabled, vsftpd runs in standalone mode and
# listens on IPv4 sockets. This directive cannot be used in conjunction
# with the listen_ipv6 directive.
listen=YES
#
# This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6
# sockets, you must run two copies of vsftpd whith two configuration files.
# Make sure, that one of the listen options is commented !!
#listen_ipv6=YES

pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES


####This function is to enable passive mode
pasv_enable=YES
#This function is to limite passive mode range from 50000 to 51000 TCP ports
pasv_min_port=60000
pasv_max_port=60040
#port_enable=YES

###TLS Support###
ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=NO
#force_local_logins_ssl=YES
force_local_logins_ssl=NO
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
rsa_cert_file=/etc/vsftpd/vsftpd.pem


###Performance ###
#Specifies the maximum of clients allowed to connected from the same source IP address.
max_per_ip=3
#Specifies the maximum number of simultaneous clients allowed to connect to the
#server when it is running in standalone mode.
max_clients=50
##Specifies the maximum rate data is transfered for local users logged into the server in bytes per second.
local_max_rate=0
#Specifies the maximum amount of time between commands from a remote client.
idle_session_timeout=400
#Specifies the maximum amount of time a client using active mode has to respond to
#a data connection, in seconds.
connect_timeout=60



[root@home vsftpd]# iptables -L -n
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:21
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:20
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpts:60000:60040


[root@home log]# cat /etc/vsftpd/vsftpd_user_conf/user101
dirlist_enable=YES
local_root=/var/www/html/home.exmaple.net/html/site1/

Question: I've downloaded configuration file in a PDF format. I do not have GUI installed on remote Linux / UNIX server. How do I convert a PDF (Portable Document Format) file to a text format using command line so that I can view file over remote ssh session?

Answer: Use pdftotext utility to convert Portable Document Format (PDF) files to plain text. It reads the PDF file, and writes a text file. If text file is not specified, pdftotext converts file.pdf to file.txt. If text-file is -, the text is sent to stdout.

Install pdftotext under RedHat / RHEL / Fedora / CentOS Linux

pdftotext is installed using poppler-utils package under various Linux distributions:
# yum install poppler-utils
OR use the following under Debian / Ubuntu Linux
$ sudo apt-get install poppler-utils

pdftotext syntax

pdftotext {PDF-file} {text-file}

How do I convert a pdf to text?

Convert a pdf file called hp-manual.pdf to hp-manual.txt, enter:
$ pdftotext hp-manual.pdf hp-manual.txt

Specifies the first page 5 and last page 10 (select 5 to 10 pages) to convert, enter:
$ pdftotext -f 5 -l 10 hp-manual.pdf hp-manual.txt

Convert a pdf file protected and encrypted by owner password:
$ pdftotext -opw 'password' hp-manual.pdf hp-manual.txt

Convert a pdf file protected and encrypted by user password:
$ pdftotext -upw 'password' hp-manual.pdf hp-manual.txt

Sets the end-of-line convention to use for text output. You can set it to unix, dos or mac. For UNIX / Linux oses, enter:
$ pdftotext -eol unix hp-manual.pdf hp-manual.txt

Further readings:

• man page pdftotext

REFERENCES
http://www.cyberciti.biz/faq/converter-pdf-files-to-text-format-command/

Well I fixed it, I just went into the bios and changed the IDE mode to Compatibility instead of Enhanced mode and I've got SuSe 9.0 installed and working now. Only problem I have now is that I can't get the PPP module installed correctly. Using YaSt2 I installed the module, and it is reciding in the /etc/ folder. But when I click Kinternet to connect, the log file says it can't find the PPP module and when I type PPP into the Konsole, it says the kernel doesn't have PPP support... Do I need to recompile the kernel with the PPP module and if so how do I do that? Thx

Reference: http://www.linuxquestions.org/questions/linux-hardware-18/suse-linux-hde-attached-ide-disk-driver-freeze-111048/