Tuesday, July 13, 2010

Kernel sysctl configuration file for Linux

Category: , , — SkyHi @ Tuesday, July 13, 2010
sysctl.conf
# Kernel sysctl configuration file for Linux
#
# Version 1.9 - 2011-03-23
# Michiel Klaver - IT Professional
# http://klaver.it/linux/ for the latest version - http://klaver.it/bsd/ for a BSD variant
#
# This file should be saved as /etc/sysctl.conf and can be activated using the command:
# sysctl -e -p /etc/sysctl.conf
#
# For binary values, 0 is disabled, 1 is enabled.  See sysctl(8) and sysctl.conf(5) for more details.
#
# Tested with: Debian 4 etchnhalf kernel version 2.6.24 default stock out-of-the-box
#              Debian 5 kernel version 2.6.26 default stock out-of-the-box
#              CentOS 5.4 kernel 2.6.18 default stock out-of-the-box

#
# Intended use for dedicated server systems at high-speed networks with loads of RAM and bandwidth available
# Optimised and tuned for high-performance web/ftp/mail/dns servers with high connection-rates
# DO NOT USE at busy networks or xDSL/Cable connections where packetloss can be expected
# ----------

# Credits:
# http://www.enigma.id.au/linux_tuning.txt
# http://www.securityfocus.com/infocus/1729
# http://fasterdata.es.net/TCP-tuning/linux.html
# http://fedorahosted.org/ktune/browser/sysctl.ktune
# http://www.cymru.com/Documents/ip-stack-tuning.html
# http://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt
# http://www.frozentux.net/ipsysctl-tutorial/chunkyhtml/index.html
# http://knol.google.com/k/linux-performance-tuning-and-measurement
# http://www.cyberciti.biz/faq/linux-kernel-tuning-virtual-memory-subsystem/
# http://www.redbooks.ibm.com/abstracts/REDP4285.html
# http://www.speedguide.net/read_articles.php?id=121
# http://lartc.org/howto/lartc.kernel.obscure.html
# http://en.wikipedia.org/wiki/Sysctl



###
### GENERAL SYSTEM SECURITY OPTIONS ###
###

# Auto-reboot linux 30 seconds after a kernel panic
kernel.panic = 30
kernel.panic_on_oops = 30

# Controls the System Request debugging functionality of the kernel
kernel.sysrq = 0

# Controls whether core dumps will append the PID to the core filename.
# Useful for debugging multi-threaded applications.
kernel.core_uses_pid = 1

#Allow for more PIDs
kernel.pid_max = 65536

# The contents of /proc/<pid>/maps and smaps files are only visible to
# readers that are allowed to ptrace() the process
kernel.maps_protect = 1

#Enable ExecShield protection
kernel.exec-shield = 1
kernel.randomize_va_space = 1

# Controls the maximum size of a message, in bytes
kernel.msgmnb = 65536

# Controls the default maxmimum size of a mesage queue
kernel.msgmax = 65536



###
### IMPROVE SYSTEM MEMORY MANAGEMENT ###
###

# Increase size of file handles and inode cache
fs.file-max = 209708

# Do less swapping
vm.swappiness = 10
vm.dirty_ratio = 60
vm.dirty_background_ratio = 2

# specifies the minimum virtual address that a process is allowed to mmap
vm.mmap_min_addr = 4096

# No overcommitment of available memory
vm.overcommit_ratio = 0
vm.overcommit_memory = 0

# Set maximum amount of memory allocated to shm to 256MB
kernel.shmmax = 268435456
kernel.shmall = 268435456

# Keep at least 64MB of free RAM space available
vm.min_free_kbytes = 65536



###
### GENERAL NETWORK SECURITY OPTIONS ###
###

#Prevent SYN attack, enable SYNcookies (they will kick-in when the max_syn_backlog reached)
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_syn_retries = 5
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_max_syn_backlog = 4096

# Disables packet forwarding
net.ipv4.ip_forward = 0
net.ipv4.conf.all.forwarding = 0
net.ipv4.conf.default.forwarding = 0
net.ipv6.conf.all.forwarding = 0
net.ipv6.conf.default.forwarding = 0

# Disables IP source routing
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Enable IP spoofing protection, turn on source route verification
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Disable ICMP Redirect Acceptance
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

# Disable Log Spoofed Packets, Source Routed Packets, Redirect Packets
net.ipv4.conf.all.log_martians = 0
net.ipv4.conf.default.log_martians = 0

# Decrease the time default value for tcp_fin_timeout connection
net.ipv4.tcp_fin_timeout = 15

# Decrease the time default value for connections to keep alive
net.ipv4.tcp_keepalive_time = 300
net.ipv4.tcp_keepalive_probes = 5
net.ipv4.tcp_keepalive_intvl = 15

# Don't relay bootp
net.ipv4.conf.all.bootp_relay = 0

# Don't proxy arp for anyone
net.ipv4.conf.all.proxy_arp = 0

# Turn on SACK
net.ipv4.tcp_dsack = 1
net.ipv4.tcp_sack = 1
net.ipv4.tcp_fack = 1

# Turn on the tcp_timestamps
net.ipv4.tcp_timestamps = 1

# Don't ignore directed pings
net.ipv4.icmp_echo_ignore_all = 0

# Enable ignoring broadcasts request
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Enable bad error message Protection
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Allowed local port range
net.ipv4.ip_local_port_range = 16384 65536

# Enable a fix for RFC1337 - time-wait assassination hazards in TCP
net.ipv4.tcp_rfc1337 = 1



###
### TUNING NETWORK PERFORMANCE ###
###

# Do a 'modprobe tcp_cubic' first
net.ipv4.tcp_congestion_control = cubic

# Turn on the tcp_window_scaling
net.ipv4.tcp_window_scaling = 1

# Increase the maximum total buffer-space allocatable
# This is measured in units of pages (4096 bytes)
net.ipv4.tcp_mem = 65536 131072 262144
net.ipv4.udp_mem = 65536 131072 262144

# Increase the read-buffer space allocatable
net.ipv4.tcp_rmem = 8192 87380 16777216
net.ipv4.udp_rmem_min = 16384
net.core.rmem_default = 131072
net.core.rmem_max = 16777216

# Increase the write-buffer-space allocatable
net.ipv4.tcp_wmem = 8192 65536 16777216
net.ipv4.udp_wmem_min = 16384
net.core.wmem_default = 131072
net.core.wmem_max = 16777216

# Increase number of incoming connections
net.core.somaxconn = 32768

# Increase number of incoming connections backlog
net.core.netdev_max_backlog = 4096
net.core.dev_weight = 64

# Increase the maximum amount of option memory buffers
net.core.optmem_max = 65536

# Increase the maximum number of skb-heads to be cached
#net.core.hot_list_length = 1024

# Increase the tcp-time-wait buckets pool size to prevent simple DOS attacks
net.ipv4.tcp_max_tw_buckets = 1440000
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_tw_reuse = 1

# Limit number of orphans, each orphan can eat up to 16M (max wmem) of unswappable memory
net.ipv4.tcp_max_orphans = 16384
net.ipv4.tcp_orphan_retries = 0

# Increase the maximum memory used to reassemble IP fragments
net.ipv4.ipfrag_high_thresh = 512000
net.ipv4.ipfrag_low_thresh = 446464

# don't cache ssthresh from previous connection
net.ipv4.tcp_no_metrics_save = 1
net.ipv4.tcp_moderate_rcvbuf = 1

# Increase RPC slots
sunrpc.tcp_slot_table_entries = 32
sunrpc.udp_slot_table_entries = 32

# Increase size of RPC datagram queue length
net.unix.max_dgram_qlen = 50

# Don't allow the arp table to become bigger than this
net.ipv4.neigh.default.gc_thresh3 = 2048

# Tell the gc when to become aggressive with arp table cleaning.
# Adjust this based on size of the LAN. 1024 is suitable for most /24 networks
net.ipv4.neigh.default.gc_thresh2 = 1024

# Adjust where the gc will leave arp table alone - set to 32.
net.ipv4.neigh.default.gc_thresh1 = 32

# Adjust to arp table gc to clean-up more often
net.ipv4.neigh.default.gc_interval = 30

# Increase TCP queue length
net.ipv4.neigh.default.proxy_qlen = 96
net.ipv4.neigh.default.unres_qlen = 6

# Enable Explicit Congestion Notification (RFC 3168), disable it if it doesn't work for you
net.ipv4.tcp_ecn = 1
net.ipv4.tcp_ecn = 2
net.ipv4.tcp_reordering = 3

# How many times to retry killing an alive TCP connection
net.ipv4.tcp_retries2 = 15
net.ipv4.tcp_retries1 = 3

# This will enusre that immediatly subsequent connections use the new values
net.ipv4.route.flush = 1
net.ipv6.route.flush = 1



###
### Comments/suggestions/additions are welcome!
###

rc.iptables
#!/bin/bash
#### BEGIN INIT INFO
# Provides:          iptables
# Required-Start:    $network
# Required-Stop:     
# Default-Start:     2 3 4 5
# Default-Stop:      S 0 1 6
# Short-Description: iptables firewall script
# Description:       iptables firewall script
### END INIT INFO

###
### FireWall script - v1.1 Michiel Klaver 2008-10-29
###



set -e

. /lib/init/vars.sh
. /lib/lsb/init-functions

# iptables Location - adjust if needed
IPT="/sbin/iptables"

# Internet Interface
INET_IFACE="eth0"

# Localhost Interface
LO_IFACE="lo"
LO_IP="127.0.0.1"



# we do not use forwarding / NAT
echo 0 > /proc/sys/net/ipv4/ip_forward

# remove any existing ipchains
([ -f /var/lock/subsys/ipchains ] && /etc/init.d/ipchains stop) >/dev/null 2>&1 || true
(rmmod ipchains) >/dev/null 2>&1 || true

# insert iptable modules
/sbin/modprobe ip_tables
/sbin/modprobe ipt_state
/sbin/modprobe iptable_filter
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp



# clear all previous iptable rules
$IPT -F
$IPT -X
$IPT -Z

# do not use forwarding / NAT
$IPT -t nat -F
$IPT -t nat -X
$IPT -t nat -Z

# do not alter packets
$IPT -t mangle -F
$IPT -t mangle -X
$IPT -t mangle -Z



case "$1" in
    stop|open|clear|reset)
 # set default policy for all traffic to ACCEPT
 $IPT -P INPUT ACCEPT
 $IPT -P OUTPUT ACCEPT
 $IPT -P FORWARD ACCEPT
 
 $IPT -A INPUT -j ACCEPT
 $IPT -A OUTPUT -j ACCEPT
 $IPT -A FORWARD -j ACCEPT
 exit 0
    ;;
esac



# set default policy for all traffic to DROP
$IPT -P INPUT DROP
$IPT -P OUTPUT DROP
$IPT -P FORWARD DROP

# Every new connection attempt should begin with a syn packet.  If it doesn't, it is likely a
# port scan.  This drops packets in state NEW that are not flagged as syn packets.
$IPT -A INPUT -p all -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
$IPT -A INPUT -p all -m state --state INVALID -j DROP

$IPT -A OUTPUT -p all -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -p tcp ! --syn -m state --state NEW -j DROP
$IPT -A OUTPUT -p all -m state --state INVALID -j DROP



# ICMP packets should fit in a Layer 2 frame, thus they should
# never be fragmented.  Fragmented ICMP packets are a typical sign
# of a denial of service attack.
$IPT -A INPUT --fragment -p ICMP -j DROP

# Block stealth portscans
$IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
$IPT -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
$IPT -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
$IPT -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

# all connections from / to localhost are allowed
$IPT -A INPUT -p all -i $LO_IFACE -j ACCEPT
$IPT -A OUTPUT -p all -o $LO_IFACE -j ACCEPT
$IPT -A OUTPUT -p all -s $LO_IP -j ACCEPT



# HTTP / HTTPS
$IPT -A INPUT -p tcp --dport 80 -j ACCEPT
$IPT -A INPUT -p tcp --dport 443 -j ACCEPT

# FTP
$IPT -A INPUT -p tcp --dport 20 -j ACCEPT
$IPT -A INPUT -p tcp --dport 21 -j ACCEPT

# SSH
$IPT -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set
$IPT -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j REJECT --reject-with tcp-reset
$IPT -A INPUT -p tcp --dport 22 -j ACCEPT

# SMTP / SSMTP
$IPT -A INPUT -p tcp --dport 25 -j ACCEPT
$IPT -A INPUT -p tcp --dport 465 -j ACCEPT
$IPT -A INPUT -p tcp --dport 587 -j ACCEPT

# POP3PASS
$IPT -A INPUT -p tcp --dport 106 -j ACCEPT

# POP3 / POP3S
$IPT -A INPUT -p tcp --dport 110 -j ACCEPT
$IPT -A INPUT -p tcp --dport 995 -j ACCEPT

# IMAP / IMAPS
$IPT -A INPUT -p tcp --dport 143 -j ACCEPT
$IPT -A INPUT -p tcp --dport 993 -j ACCEPT

# MySQL
$IPT -A INPUT -p tcp --dport 3306 -j ACCEPT

# PostgreSQL
$IPT -A INPUT -p tcp --dport 5432 -j ACCEPT

# DNS
$IPT -A INPUT -p udp --dport 53 -j ACCEPT
$IPT -A INPUT -p tcp --dport 53 -j ACCEPT

# Admin Panels (Plesk / DirectAdmin)
$IPT -A INPUT -p tcp --dport 8443 -j ACCEPT
$IPT -A INPUT -p tcp --dport 2222 -j ACCEPT

# ICMP
$IPT -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type fragmentation-needed -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type source-quench -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type parameter-problem -j ACCEPT



# UDP part of tracerouting
$IPT -A INPUT  -p udp --sport 32769:65535 --dport 33434:33523 -j ACCEPT
$IPT -A OUTPUT -p udp --sport 32769:65535 --dport 33434:33523 -j ACCEPT

# SSH
$IPT -A OUTPUT -p tcp --dport 22 -j ACCEPT

# SMTP
$IPT -A OUTPUT -p tcp --dport 25 -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 465 -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 587 -j ACCEPT

# POP3/IMAP
$IPT -A OUTPUT -p tcp --dport 110 -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 143 -j ACCEPT

# HTTP/HTTPS
$IPT -A OUTPUT -p tcp --dport 80 -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 443 -j ACCEPT

# DNS
$IPT -A OUTPUT -p udp --dport 53 -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 53 -j ACCEPT

# SNMP
$IPT -A OUTPUT -p udp --dport 161 -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 161 -j ACCEPT
$IPT -A OUTPUT -p udp --dport 162 -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 162 -j ACCEPT

# NTP (date/time)
$IPT -A OUTPUT -p tcp --dport 37 -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 123 -j ACCEPT
$IPT -A OUTPUT -p udp --dport 123 -j ACCEPT

# WhoIs clientside
$IPT -A OUTPUT -p tcp --dport 43 -j ACCEPT

# Razor2/Pyzor/DCC (spamchecks)
$IPT -A OUTPUT -p udp --dport 24441 -j ACCEPT
$IPT -A OUTPUT -p udp --dport 6277 -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 2703 -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 7 -j ACCEPT

# MySQL
$IPT -A OUTPUT -p tcp --dport 3306 -j ACCEPT

# PostgreSQL
$IPT -A OUTPUT -p tcp --dport 5432 -j ACCEPT

# ICMP
$IPT -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
$IPT -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
$IPT -A OUTPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
$IPT -A OUTPUT -p icmp --icmp-type fragmentation-needed -j ACCEPT
$IPT -A OUTPUT -p icmp --icmp-type source-quench -j ACCEPT
$IPT -A OUTPUT -p icmp --icmp-type time-exceeded -j ACCEPT
$IPT -A OUTPUT -p icmp --icmp-type parameter-problem -j ACCEPT



# DROP any other protocol other than stated above
$IPT -A INPUT -j DROP
$IPT -A OUTPUT -j DROP
$IPT -A FORWARD -j DROP



$IPT -L -n

REFERENCES
http://klaver.it/linux/sysctl.conf

Centralized Backup Server With Amanda On CentOS

Category: , — SkyHi @ Tuesday, July 13, 2010

This document describes how to set up a centralized network backup with Amanda. We will use virtual tape to store the backup.


In my environment, I have 2 Linux servers that I want to backup.


192.168.20.200 (Alpha) : /home/kulathep


192.168.20.201 (Beta) : /data and /var


I am going to build a new server with Amanda as a centralized backup server.


192.168.20.202 (Gamma)


Setup Server (Gamma)


1. Install Amanda with yum:


yum -y install amanda*


2. Edit Amanda conf in xinetd.d:


vi /etc/xinetd.d/amanda

vi /etc/xinetd.d/amandaidx

vi /etc/xinetd.d/amidxtape


Change Disable = yes to Disable = no.


3. Copy Amanda conf files:


cp -r /etc/amanda/DailySet1 /etc/amanda/intra


4. Edit amanda.conf:


vi /etc/amanda/intra/amanda.conf


org “Configuration name”

mailto “email”

netusage 600 Kbps


dumpcycle 2 weeks

runspercycle 10

tapecycle 15 tapes


#tpchanger “chg-manual”

tpchanger “chg-disk”


changerfile “/etc/amanda/intra/changer”


#tapedev “null:”

tapedev “file:/backup/intra/slots”


#tapetype HP-DAT

#labelstr “^DailySet1-[0-9][0-9]*$”


tapetype HARDDISK

define tapetype HARDDISK {

comment “Backup to Virtual Tape”

length 3072 mbytes # each tape is 3 Gigs

}


# amrecover_changer “null:”

amrecover_changer “changer”


#infofile “/etc/amanda/DailySet1/curinfo” # database DIRECTORY

#logdir “/etc/amanda/ DailySet1″ # log directory

#indexdir “/etc/amanda/ DailySet1/index” # index directory

infofile “/var/log/amanda/intra/curinfo” # database DIRECTORY

logdir “/var/log/amanda/intra” # log directory

indexdir “/var/log/amanda/intra/index” # index directory


With this configuration, Amanda will do a full backup every 2 weeks, and an incremental backup every week day. The backup will be stored and rotated on 15 virtual tapes.


5. Edit disklist (tell Amanda which servers, directory to backup, what dumptype to use).


vi /etc/amanda/intra/disklist


Remove every lines including “localhost /etc comp-root-tar” at the end of the file. And add:


alpha /home/kulathep comp-user-tar

beta /data comp-user-tar

beta /var comp-user-tar


Note: See amanda.conf for the dumptype.


6. Edit hosts file:


vi /etc/hosts


Add:


192.168.20.200 alpha

192.168.20.201 beta


7. Create backup directory (we will store the backup here):


mkdir -p -m 770 /backup/intra/slots

chown -R amanda:disk /backup


8. Create tape list:


touch /etc/amanda/intra/tapelist

chown –R amanda:disk /etc/amanda/intra


9. Create slots (virtual tapes):


su - amanda

cd /backup/intra/slots

for ((i=1; $i<=15; i++)); do mkdir slot$i; done

ln -s slot1 data


10. Test virtual tapes:


/usr/sbin/ammt -f file:/backup/intra/slots status


11. Label the virtual tapes:


for ((i=1; $i<=15; i++)); do /usr/sbin/amlabel intra intra-$i slot $i; done


12. Reset the tape:


/usr/sbin/amtape intra reset


13. Edit .amandahosts to allow communications from clients:


vi /var/lib/amanda/.amandahosts


alpha amanda

beta amanda

gamma amanda


14. Start xinetd service:


su –

service xinetd start


15. Check amanda process:


lsof | grep amanda


Set Up Client


1. Install amanda client with yum:


yum -y install amanda-client


2. Edit file .amandahosts to allow communications from server:


vi /var/lib/amanda/.amandahosts


gamma amanda


3. Edit xinetd.d:


vi /etc/xinetd.d/amanda


Disable = no


4. Start xinetd:


service xinetd start


5. Check Amanda service:


lsof | grep amanda


Backup Data


1. Check tapes and clients on server:


su - amanda

/usr/sbin/amcheck intra


2. Dump manually:


/usr/sbin/amdump intra


3. Add amdump to cron:


crontab –e


0 16 * * 1-5 /usr/sbin/amcheck -m intra

45 0 * * 2-6 /usr/sbin/amdump intra


The first line checks the tape/clients and sends an email if it found something wrong (no email if everything is okay) at 4pm.


The second line dumps at 12.45am on weekdays.


Restore Data


1. Prepare tapes:


cd /tmp

/usr/sbin/amtape intra slot 1 # select slot1 (tape1)

/usr/sbin/ammt -t file:/backup/intra/slots rewind # rewind


2.1. Restore everything from every server:


/usr/sbin/amrestore file:/backup/intra/slots


2.2. Restore only a server and a directory:


/usr/sbin/amrestore file:/backup/intra/slots beta /var


3. Extract:


tar xvf <Restored files>



REFERENCES
http://redhatvn.net/centralized-backup-server-with-amanda-on-centos


Installing LES (Linux Environment Security) on CentOS

Category: — SkyHi @ Tuesday, July 13, 2010
:: Whati is
Please take a look at this.

:: Installing LES
[root@centoz ~]# mkdir download
[root@centoz ~]# cd download/
[root@centoz download]# wget http://www.r-fx.ca/downloads/les-current.tar.gz
[root@centoz download]# tar -xzf les-current.tar.gz
[root@centoz download]# cd les-0.2/
[root@centoz les-0.2]# ./install.sh
.: LES installed
Install path:    /usr/local/les
Config path:     /usr/local/les/conf.les
Executable path: /usr/local/sbin/les

:: Running LES
[root@centoz les-0.2]# /usr/local/sbin/les -ea
You can try other options :
-da | --disable-all       Disable all options
-ea | --enable-all        Enable all options
-sb | --secure-bin        Set root only execution of critical binaries
-sp | --secure-path       Set root only traversal of critical paths
-sr | --secure-rpmpkg     Set immutable on core rpm package binaries
-so | --secure-prof       Set immutable on interactive login profiles
-sd | --secure-devel      Set access to devel utils for group deva & root


REFERENCES
http://www.blackonsole.org/2009/07/installing-les-linux-environment.html

How to disable wget

Category: , — SkyHi @ Tuesday, July 13, 2010
wget is one of the largest threats for your server security. A single abuser that gains access to wget can download and run any script that he wants, totally compromising your server.



It is highly recommended that you allow only root to use wget and you restrict all other users from it.



1. Login to your server as root

2. Run the fallowing command



chmod 0700 /usr/bin/wget



Please note that disabling wget might cause some scripts to stop working. A known problem is that Fantastico will stop updating after this. The solution is pretty easy…

Before you disable wget make sure that you do a copy of it with the initial permissions. You can use any name that you want, the following is just an example:



cp /usr/bin/wget /usr/bin/wget_secret





In the Fantastico configuration input the location to wget as:



/usr/bin/wget_secret



If for some reason you you want to revert the change you simply have to do:



chmod 0711 /usr/bin/wget

=================================================================

I make it a habbit on my systems to chmod 700 some of the keyfiles
like wget, netstat. Also a good idea to set your /tmp to noexec.



dropby23

Nov 3 2005, 06:05 AM



there are alot of ways to get a file in the server i am ussualy using
this one

chmod 750 /usr/bin/rcp

chmod 750 /usr/bin/wget

chmod 750 /usr/bin/lynx

chmod 750 /usr/bin/links

chmod 750 /usr/bin/scp

chmod 750 /usr/bin/nc

chmod 750 /usr/bin/elinks

chmod 750 /usr/bin/curl

rm -rf /etc/httpd/proxy/

chmod 000 /var/mail/vbox

rm -rf /usr/local/apache/proxy

chmod 700 /usr/bin/lwp-*

chmod 750 /usr/bin/GET

chmod 750 /usr/bin/curl



HostGeekZ

Nov 7 2005, 09:12 PM



Install LES, which will chmod/chattr most of these binarys for you.

REFERENCES
http://www.cyberls.com/forum/showthread.php?tid=440
http://forums.theplanet.com/lofiversion/index.php/t81289.html


Outlook 2003 freezing

Category: — SkyHi @ Tuesday, July 13, 2010
click on start => run => type outlook /safe and press Ok.

check outlook in this mode.

click on tools => options => other => advanced options => click on com addins and list the addins you have

REFERENCES
http://www.techsupportforum.com/microsoft-support/microsoft-office-support/287117-outlook-2003-freezing.html

Saturday, July 10, 2010

installing postfix and dovecot maildir

Category: , — SkyHi @ Saturday, July 10, 2010
:: what is
- postfix ??
- dovecot ??

:: installing postfix and dovecot on opensuse 
[ linux: ~ ]# zypper in postfix dovecot

:: configuration postfix email
[ linux: ~ ]# vi /etc/postfix/main.cf
#
# configuration some like this:

queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix
data_directory = /var/lib/postfix
mail_owner = postfix
unknown_local_recipient_reject_code = 550


debug_peer_level = 2
debugger_command =
 PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
 ddd $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/sbin/sendmail
newaliases_path = /usr/bin/newaliases
mailq_path = /usr/bin/mailq
setgid_group = maildrop
html_directory = /usr/share/doc/packages/postfix/html
manpage_directory = /usr/share/man
sample_directory = /usr/share/doc/packages/postfix/samples
readme_directory = /usr/share/doc/packages/postfix/README_FILE
inet_protocols = all
biff = no


myhostname = mail.blackonsole.org
mydomain = blackonsole.org
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
mynetworks_style = host
home_mailbox = Maildir/
virtual_mailbox_domains = hash:/etc/postfix/virtual
virtual_mailbox_maps = hash:/etc/postfix/virtual
alias_maps = hash:/etc/aliases


smtp_use_tls = yes
smtp_tls_note_starttls_offer = yes
smtpd_use_tls = yes
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
smtpd_tls_key_file = /etc/ssl/smtpd.pem
smtpd_tls_cert_file = /etc/ssl/smtpd.pem
smtpd_tls_CAfile = /etc/ssl/smtpd.pem
tls_random_source = dev:/dev/urandom
smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination,permit

:: make cert 
[ linux: postfix ]# cd /etc/ssl/
[ linux: ssl ]# openssl req -new -x509 -nodes -out smtpd.pem -keyout smtpd.pem -days 3650

:: configure dovecot
[ linux: ~ ]# vi /etc/dovecot/dovecot.conf
#
# change on this configuration:

protocols = imap imaps pop3
disable_plaintext_auth = no
ssl = no
auth_debug = yes
auth default {
    mechanisms = plain login
    passdb pam {
    }
    passdb shadow {
    }
    userdb passwd {
    }

socket listen {   
   client {
   path = /var/spool/postfix/private/auth
     mode = 0660
       user = postfix
       group = postfix
  }
 }
}

:: starting postfix and dovecot
[ linux: ~ ]# /etc/init.d/postfix start
[ linux: ~ ]# /etc/init.d/dovecot start

:: links
+ googlelinux
+ wowtutorial
http://www.blackonsole.org/2010/06/install-postfix-dovecot.html

Linux: Subnet (CIDR) Calculator Netmask

Category: — SkyHi @ Saturday, July 10, 2010

I'm new to networking and need help with network settings. I'm looking for a tool for calculating available host address ranges with CIDR using Linux command prompt. How do I use subnet calculator under Linux or UNIX?

Linux comes with various IP subnet calculator that will help you with network settings. Once such program is Sipcalc which is an ip subnet calculator. You can install it as follows under Debian or Ubuntu Linux:
$ sudo apt-get update
$ sudo apt-get install sipcalc
Sample outputs:

Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
 sipcalc
0 upgraded, 1 newly installed, 0 to remove and 51 not upgraded.
Need to get 30.6kB of archives.
After this operation, 123kB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu/ lucid/universe sipcalc 1.1.4-2 [30.6kB]
Fetched 30.6kB in 2s (15.1kB/s)
Selecting previously deselected package sipcalc.
(Reading database ... 203411 files and directories currently installed.)
Unpacking sipcalc (from .../sipcalc_1.1.4-2_i386.deb) ...
Processing triggers for man-db ...
Processing triggers for doc-base ...
Processing 1 added doc-base file(s)...
Registering documents with scrollkeeper...
Setting up sipcalc (1.1.4-2) ...

How Do I Calculate Subnets?

$ sipcalc 192.168.1.0/24
Sample outputs:

-[ipv4 : 192.168.1.0/24] - 0

[CIDR]
Host address  - 192.168.1.0
Host address (decimal) - 3232235776
Host address (hex) - C0A80100
Network address  - 192.168.1.0
Network mask  - 255.255.255.0
Network mask (bits) - 24
Network mask (hex) - FFFFFF00
Broadcast address - 192.168.1.255
Cisco wildcard  - 0.0.0.255
Addresses in network - 256
Network range  - 192.168.1.0 - 192.168.1.255
Usable range  - 192.168.1.1 - 192.168.1.254

The above will provide network start & stop range, wildcard, mask and other information. You can calculate 192.168.1.0/24 subnet as follows
$ sipcalc 192.168.1.5/24

Interface Specific Calculation

Instead of taking address information from the shell command line arg sipcalc can obtain relevant information by looking at a specified interface on the system. In this example, get information for eth0 interface:
$ sipcalc eth0
Sample outputs:

-[int-ipv4 : eth0] - 0

[CIDR]
Host address  - 192.168.3.254
Host address (decimal) - 3232236542
Host address (hex) - C0A803FE
Network address  - 192.168.3.0
Network mask  - 255.255.255.0
Network mask (bits) - 24
Network mask (hex) - FFFFFF00
Broadcast address - 192.168.3.255
Cisco wildcard  - 0.0.0.255
Addresses in network - 256
Network range  - 192.168.3.0 - 192.168.3.255
Usable range  - 192.168.3.1 - 192.168.3.254

whatmask Program

Whatmask is a small C program that will help you with network settings. Download and compile it as follows:
$ cd /tmp
$ wget http://downloads.laffeycomputer.com/current_builds/whatmask/whatmask-1.2.tar.gz
$ tar -zxvf whatmask-1.2.tar.gz
$ cd whatmask-1.2/
$ ./configure
$ make
$ sudo make install
You can use it as follows to find out usable ip address with /29:
$ whatmask /29
Sample outputs:

---------------------------------------------
      TCP/IP SUBNET MASK EQUIVALENTS
---------------------------------------------
CIDR = .....................: /29
Netmask = ..................: 255.255.255.248
Netmask (hex) = ............: 0xfffffff8
Wildcard Bits = ............: 0.0.0.7
Usable IP Addresses = ......: 6

OR
$ whatmask 202.54.1.2/27
Sample outputs:

------------------------------------------------
          TCP/IP NETWORK INFORMATION
------------------------------------------------
IP Entered = ..................: 202.54.1.2
CIDR = ........................: /27
Netmask = .....................: 255.255.255.224
Netmask (hex) = ...............: 0xffffffe0
Wildcard Bits = ...............: 0.0.0.31
------------------------------------------------
Network Address = .............: 202.54.1.0
Broadcast Address = ...........: 202.54.1.31
Usable IP Addresses = .........: 30
First Usable IP Address = .....: 202.54.1.1

Last Usable IP Address = ......: 202.54.1.30

Download software featured in this faq:




REFERENCES
http://www.laffeycomputer.com/whatmask.html
http://www.cyberciti.biz/faq/linux-subnet-calculator-cidr/
http://www.blackonsole.org/2010/07/ip-subnet-calc-with-whatmask.html


Subscribe to: Posts (Atom)