Encrypting the Backup...

 

By now many of you might have come to know about the importance of backing up the data.To make the backed up data much more secure we have to encrypt the data so that,those who know the password can only check the data.
If you have ssl installed on your system, you can use it to encrypt your backup.

echo "your_key" > /tmp/.key

to save your data =>

tar cvf - files_to_save | openssl enc -des3 -salt -pass file:/tmp/.key >/dev/rmt0

to restore your data =>

openssl enc -d -des3 -pass file:/tmp/.key </dev/rmt0 | tar xvf -

NOTE:DON'T FORGET THE /tmp/.key file WHEN YOU ARE DONE WITH IT.!!!!

Where,
    * /dev/rmt0 : Tape device name.
    * openssl : The OpenSSL toolkit command line utility.
    * tar : The tar archiving utility.
    * des3 : Triple-DES Cipher (Triple DES is the common name for the Triple Data Encryption Algorithm).
    * -salt : The -salt option should ALWAYS be used if the key is being derived from a password unless you want compatibility with previous versions of OpenSSL and SSLeay. Without the -salt option it is possible to perform efficient dictionary attacks on the password and to attack stream cipher encrypted data. The reason for this is that without the salt the same password always generates the same encryption key. When the salt is being used the first eight bytes of the encrypted data are reserved for the salt: it is generated at random when encrypting a file and read from the encrypted file when it is decrypted. (source enc man page)

How to find out the best dns server for your system?

 

In my previous post I have mentioned about some public DNS servers, that you can use instead of the servers mentioned by ur ISP.
Now you might be in a confusion that Which servers are best for you.
This checking simply consists of pinging from your system to all the nameservers one after another and to see the one that is having minimum average time to do this, take your terminal and type in as follows

1: $ ping -c 5 8.8.8.8
2: Checkout the average time needed for the process.
Its shown in   the terminal. Replace the address
8.8.8.8 with all other  dns addresses and repeat steps 1 and 2.

Which ever DNS has the least average time is the one you are searching for.

All You Should Know About: lsof

Lsof follows Unix philosophy closely. It does just one task and it does it perfectly -- it lists information about files opened by processes. An open file may be a regular file, a directory, a NFS file, a block special file, a character special file, a shared library, a regular pipe, a named pipe, a symbolic link, a socket stream, an Internet socket, a UNIX domain socket, and many others. Since almost everything in Unix is a file, you can imagine how incredibly useful lsof is!

How to use lsof?

In this article I will try to present lsof based on as many use cases as I can think of. Let's start with the simplest (that you probably already know) and proceed to more complicated ones.

List all open files.

# lsof
Running lsof without any arguments lists all open files by all processes.

Find who's using a file.

# lsof /path/to/file
With an argument of a path to a file, lsof lists all the processes, which are using the file in some way.

You may also specify several files, which lists all the processes, which are using all the files:

# lsof /path/to/file1 /path/to/file2
Find all open files in a directory recursively.

# lsof +D /usr/lib
With the +D argument lsof finds all files in the specified directory and all the subdirectories.

Note that it's slower than the usual version with grep:

# lsof | grep '/usr/lib'
It's slower because +D first finds all the files and only then does the output.

List all open files by a user.

# lsof -u Dejavu
The -u option (think user) limits output of files opened only by user Dejavu.

You can use comma separated list of values to list files open by several users:

# lsof -u rms,root
This will list all the files that are open by users rms and root.

Another way to do the same is by using the -u option twice:

# lsof -u rms -u root
Find all open files by program's name.

# lsof -c apache
The -c option selects the listing of files for processes whose name begins with apache.

So instead of writing:

# lsof | grep foo
You can now write the shorter version:

# lsof -c foo
In fact, you can specify just the beginning part of the process name you're looking for:

# lsof -c apa
This will list all the open files by a processes whose starts with apa.

You can also specify several -c options to output open files by several processes:

# lsof -c apache -c python
This will list all open files by apache and python.

List all open files by a user OR process.

# lsof -u Dejavu -c apache
Lsof options can be combined. The default is to OR between options. It means it will combine outputs of -u Dejavu and -c apache producing a listing of all open files by Dejavu and all open files by apache.

List all open files by a user AND process.

# lsof -a -u Dejavu -c bash
Notice the -a option. It combines the options with AND. The output listing is files opened by bash, which is run under Dejavu user.

List all open files by all users EXCEPT root.

# lsof -u ^root
Notice the ^ character before root username. It negates the match and causes lsof print all open files by all users who are not root.

List all open files by the process with PID.

# lsof -p 1
The -p option (think PID) filters out open files by program's id.

Remember that you can select multiple PIDs by either comma separating the list or using multiple -p arguments:

# lsof -p 450,980,333
This selects processes with PIDs 450, 980 and 333.

List all open files by all the processes EXCEPT process with PID.

# lsof -p ^1
Here the negation operator ^ is used again. It inverts the list and does not include process with PID 1.

List all network connections.

# lsof -i
Lsof with -i option lists all processes with open Internet sockets (TCP and UDP).

List all TCP network connections.

# lsof -i tcp
The -i argument can take several options, one of them is tcp. The tcp option forces lsof to list only processes with TCP sockets.

List all UDP network connections.

# lsof -i udp
The udp option causes lsof to list processes with UDP sockets.

Find who's using a port.

# lsof -i :25
The :25 option to -i makes lsof find processes using TCP or UDP port 25.

You may also use service port name (found in /etc/services) rather than port number:

# lsof -i :smtp
Find who's using a specific UDP port.

# lsof -i udp:53
Similarly, to find who's using a TCP port, use:

# lsof -i tcp:80
Find all network activity by user.

# lsof -a -u hacker -i
Here the -a option combines -u and -i to produce listing of network file usage by user hacker.

List all NFS (Network File System) files.

# lsof -N
This option is easy to remember because -N is NFS.

List all Unix domain socket files.

# lsof -U
This option is also easy to remember because -U is Unix.

List all files for processes with a specific group id.

# lsof -g 1234
Process groups are used to logically group processes. This example finds all files opened by processes with PGID 1234.

List all files associated with specific file descriptors.

# lsof -d 2
This lists all files that have been opened as file descriptor 2.

You may also specify ranges of file descriptors:

# lsof -d 0-2
This would list all files with file descriptors 0, 1 and 2.

There are also many special values, such as mem, that lists memory-mapped files:

# lsof -d mem
Or txt for programs loaded in memory and executing:

# lsof -d txt
Output PIDs of processes using some resource.

# lsof -t -i
The -t option outputs only PIDs of processes. Used together with -i it outputs PIDs of all processes with network connections. It's easy to kill all processes that use network:

# kill -9 `lsof -t -i`
Repeat listing files.

# lsof -r 1
The -r option makes lsof repeatedly list files until interrupted. Argument 1 means repeat the listing every 1 second. This option is best combined with a narrower query such as monitoring user network file activity:

# lsof -r 1 -u john -i -a
How to install lsof?

Lsof comes preinstalled on many Unix systems. If your system doesn't have it, try to install it from the source.

BSD supplies its own utility that does similar things, it's called fstat.

For the full documentation of lsof see the man lsof page or type lsof -h for a small cheat sheet.

Have fun with lsof!

Linux kernel Versions:

 

Linux kernels are numbered using an even/odd system. An even-numbered

kernel—for example, Linux 2.2—is called a called stable kernel.

Changes are generally made to a stable kernel only to fix bugs and problems.

An odd-numbered kernel—for example, Linux 2.3—is called a development

kernel. Development kernels are works-in-progress and sometimes contain

bugs, some of which are serious. Most Linux users work with stable kernels,

reserving spare computers for testing development kernels.

At the time I’m writing this post , Linux 2.6.33.1 is the latest stable kernel.

You can download it from HERE .

How to set multiple IP addresses using Linux command line ?

 

Go to /etc/sysconfig/network-scripts

Make multiple copies of ifcfg-eth0 and name them as ifcfg-eth0:0, ifcfg-eth0:1 etc.

Open each of them and at least change the IPADDR to your chosen IP address and the NETMASK to the subnet mask for that IP address.

A sample entry would look like this:

DEVICE=eth0:0

BOOTPROTO=static

IPADDR=34.123.111.21

NETMASK=255.255.255.0

ONBOOT=yes

Restart the network:

/sbin/service network restart

You are done!

SSH Without Password Authentication

 

Often you need to remotely run utilities on other machines through unattended batch process or cron job. ssh allows you to execute code on remote machine. However in normal usage it prompts you for password which makes it hard to use in unattended processes. Here is a simple way to eliminate the need for specifying password every time when connecting through ssh.

Let's assume your want to connect to remote machine named remote as user named user.

You need to first, and only once, generate a private-public keypair using ssh-keygen as follows:

ssh-keygen -t dsa

This will create a private and public keypair which is stored in ~/.ssh directory.

Next run the following command once for every machine you want to remotely login without specifying password:

scp ~/.ssh/id_dsa.pub user@remote:~user/.ssh/authorized_keys

Now you can login to the machine using ssh without requiring to specify any password. Your public key, which you copied to the remote machine, is checked (not directly) against your private key to verify your authenticity.

One Linux Formatting Tip I Bet You Didn’t Know:

 

You probably know how you can format a Linux partition:

mkfs.ext3 /dev/hda

This formats the partition with ext3 file system. However did you know how to extract maximum space out of this partition, especially if it a large partition?

How to maximize available space in a partition?

Enter the magical -m option. If the file system becomes filled and there is no more space to write, it is basically unusable because the operating system is constantly writing to disk. By default, five percent of the partition is reserved for use by the root user. This allows root to conduct administrative activities on the partition and perhaps move some data off. Firstly, this is most critical when the partition contains / or home directories. For pure data partitions, this is just lost space. Five percent of a 250Gb partition is 12.5 Gb. Especially in the case of large partitions, it is safe to set the reserved space to the minimum, which is one percent.

mkfs.ext3 -m 1 /dev/hdb1

creates a file system with only 1% of its space reserved for the root user.

Note: You can use tune2fs -m later to adjust the reserved blocks after data is loaded on the partition.

Bonus tip: How to label a partition

Use -L with mkfs.ext3 to add a label to the partition. You can later refer to this label instead of the device name when mounting. This provides the same functionality as e2label which can be used to label a partition later.

Tracing system cals in linux

 

There are certain programs in Linux for which the source is not readily available. There is an useful diagnostic, instructional, and debugging tool for Linux to solve it. The system intercepts and records the system calls that are called by process and the signals which are received by a process. It also gives students and hackers a great chance to learn about system and system calls by tracing even ordinary programs. Let's a pick at the useful tool.

Here's the simple tool to trace calls and signals

strace

This will output a great amount of data on to the screen. If it is hard to keep track of the scrolling mass of data, then there is an option to write the output of strace to a file instead which is done using the -o option.

Block IP Addresses On Linux Server

 

I hope by now all of you have heard about firewalls. In linux we generally use IPtables for controlling the traffic as per our requirement.

From Wikipedia: IPtables is a user space application program that allows a system administrator to configure the tables provided by the Linux kernel firewall

(implemented as different Netfilter modules) and the chains and rules it stores.

Iptables requires elevated privileges to operate and must be executed by user root, otherwise it fails to function.

Now let us go to our scenario:

Take a look at your log file (/var/log/secure for REDHAT/Fedora ) and you will discover numerous automated ssh hacking attempts using dictionary attack. So now you have identified the offending addresses. How do you stop them?

Here comes the magic mantra which uses iptables (packet) firewall:

iptables -A INPUT -s a.b.c.d -j DROP

Replace a.b.c.d with the offending IP address. Repeat this for each of the offending IP addresses.

Install of Apache, SSL, PHP, MySQL in linux

 

The following steps will show you how to install the Apache web server on GNU/Linux. This install also includes installing mod_ssl, MySQL and PHP4.You may encounter problems compiling any one of these tarballs. It is up to you to fix the problems. This install assumes that you have everything you need to do all of the compiles. The x's in each file name stands for what ever the version number is at the time you download it.

Download and extract all the source tarballs.

The following are links to the sites you will need to download the source files. Go to each sites download section and download the latest version of each piece of software. After you have downloaded them all to the same directory we are going to unzip and untar them.

Apache http://www.apache.org/dyn/closer.cgi

Openssl http://openssl.org/

ModSSL http://www.modssl.org/

Php.net

MySQL.com (Download the Linux binary version)

tar -xvzf apache_1.3.xx.tar.gz

tar -xvzf openssl-0.9.Xx

tar -xvzf mod_ssl-2.X.xx-1.3.xx

tar -xvzf php-4.X.x.tar.gz

Install MySQL (binary version)

groupadd mysql

useradd -g mysql mysql

cd /usr/local

gunzip < /path/to/mysql-VERSION-OS.tar.gz | tar xvf -

ln -s full-path-to-mysql-VERSION-OS mysql

cd mysql

scripts/mysql_install_db

chown -R root .

chown -R mysql data

chgrp -R mysql .

bin/safe_mysqld --user=mysql &

or

bin/mysqld_safe --user=mysql &

## if you are running MySQL 4.x

Build OpenSSL

cd openssl-0.9.Xx

./config

make

make test

make install

cd ..

Patch Apache with mod_ssl

cd mod_ssl-2.X.xx-1.3.xx

./configure --with-apache=../apache_1.3.xx

cd ..

Preconfigure Apache for PHP

cd apache_1.3.xx

./configure --prefix=/usr/local/apache

cd ..

Configure PHP and compile it for Apache

cd php-4.x.x

CFLAGS='-O2 -I../openssl-0.9.Xx'

./configure --with-apache=../apache_1.3.xx --with-mysql

make

make install

cd ..

or

You can configure and compile a ton of other things into PHP.Make sure if you compile these other things in that you scan back thru the configure output to make sure all of the things you tried to compile in were found. If you install the libjpeg,freetype,libpng,and zlib on RedHat you just need to put /usr in for the directory. Other paths refer to the areas the library's were installed and compiled. Type: ./configure --help to see all of the things you can configure PHP with. My config line looks like this:

./configure \

--with-gd=/usr \

--with-mysql \

--with-png-dir=/usr \

--with-zlib-dir=/usr \

--with-ttf=/tmp/freetype-2.0.5/ \

--with-freetype-dir=/tmp/freetype-2.0.x \

--with-jpeg-dir=/usr \

--with-mcrypt=/tmp/libmcrypt \

--with-apache=../apache_1.3.xx

make

make install

cd ..

Build Apache with mod_ssl and PHP

cd apache_1.3.xx

SSL_BASE=../openssl-0.9.Xx \

./configure \

--prefix=/usr/local/apache \

--enable-module=ssl \

--activate-module=src/modules/php4/libphp4.a \

--enable-module=php4

make

make certificate <--Optional step.

make install

cd ..

Configure Apache's Preferences File

vi /usr/local/apache/conf/httpd.conf

See the Apache documentation on how to configure your Apache httpd.conf.

Start your Apache server

Service httpd start

That's it, enjoy!

Accessing NTFS partitions in Linux

 

Mount NTFS file system with read only access

NTFS kernel support

Majority of current Linux distributions supports NTFS file system out of the box. To be more specific, support for NTFS file system is more feature of Linux kernel modules rather than Linux distributions. First verify if we have NTFS modules installed on our system.

ls /lib/modules/2.6.30/kernel/fs/ | grep ntfs

Check for NTFS kernel support, if NTFS module is present. Let's identify NTFS partition.

Identifying partition with NTFS file system

One simple way to identify NTFS partition is:

fdisk -l | grep NTFS

For our example lets assume that a partition named /dev/sdb1 is the NTFS partition.

First create a mount point:

mkdir /mnt/ntfs

Then simply use mount command to mount it:

mount -t ntfs /dev/sdb1 /mnt/ntfs

Now we can access NTFS partition and its files with read write access.

Spy on your users through SSH:

 

You just connected through SSH and are wondering what your users are doing. Do a

cat /dev/vcs1

and this will show you what happens on the first console. If someone is typing, you’ll be able to get an output of his keystrokes. Substitute cat /dev/vcs1 with cat /dev/vcs2 or cat /dev/vcs3 and so on for other consoles.

Change your MAC address in Linux

 

In a local area network (LAN) or other network, the MAC (Media Access Control) address is your computer's unique hardware number. (On an Ethernet LAN, it's the same as your Ethernet address.) When you're connected to the Internet from your computer (or host as the Internet protocol thinks of it), a correspondence table relates your IP address to your computer's physical (MAC) address on the LAN.

MAC addresses are 12-digit hexadecimal numbers (48 bits in length). By convention, MAC addresses are usually written in one of the following two formats:

MM:MM:MM:SS:SS:SS

MM-MM-MM-SS-SS-SS

The first half of a MAC address contains the ID number of the adapter manufacturer. These IDs are regulated by an Internet standards body (see sidebar). The second half of a MAC address represents the serial number assigned to the adapter by the manufacturer.

In the example,

00:A0:C9:14:C8:29

The prefix : 00A0C9

indicates the manufacturer is Intel Corporation.

If you wish to change your MAC address in Linux, all you have to do is bring the interface down then use the hw ether switch:

ifconfig eth0 down

ifconfig eth0 hw ether 02:01:02:03:04:08

ifconfig eth0 up

nice but if you want your pc to change its MAC address on boot add that to a script in /etc/init.d/ folder, and also add symbolic link(ln) to /etc/rc2.d, /etc/rc3.d, /etc/rc4.d, /etc/rc5.d which refers to the script in /init.d/

script:

#!/bin/bash

ifconfig eth0 down

ifconfig eth0 hw ether 02:01:02:03:04:08

ifconfig eth0 up

/etc/init.d/networking restart

Configuring NIC interface :

 

When you find that you are not connected to the network, then follow these steps to troubleshoot the problem :

Go to terminal and type :

$ /sbin/ifconfig

You should see this:

etho Link encap:Ethernet HWaddr 00:50:56:85:00:23

inet addr:192.168.0.135 Bcast:192.168.0.255 Mask:255.255.255.0

UP LOOPBACK RUNNING MULTICAST MTU:1500 Metric:1

RX packets:50 error:0 dropped:0 overruns:0 frame:0

TX packets:0 error:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:0

Interrupt:9 Base address:0x1000

lo Link encap:Local Loopback

inet addr:127.0.0.1 Mask:255.0.0.0

UP LOOPBACK RUNNING MTU:16436 Metric:1

RX packets:6 error:0 dropped:0 overruns:0 frame:0

TX packets:6 error:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:0

If you don't see the eth0 line, then Linux did not recognize your NIC, or it is not enabled. Check if the NIC is enabled by entering this command:

$ ifconfig eth0 -- (you can also try: $ ifconfig eth0 up) -- where eth0 is the name of your NIC.

You should see something similar to this outputted:

eth0 Link encap:Ethernet HWaddr 00:A0:CC:24:BA:02

inet addr:192.168.203.2 Bcast:192.168.203.255

Mask:255.255.255.0

UP BROADCAST RUNNING MT:1500 Metric:1 .....

If you don't see the "inet addr..." and "Bcast:..." IP numbers then you need to install a NIC that is supported by your version of Linux (the easiest route for newbies...but costs a few dollars if you don't have one), or go to your NIC's manufacturer's website (or other driver sites) and see if they have a driver for your NIC and version of Linux.

In most of the linux distributions the compiled drivers modules are found in: /lib/modules/kernel-version/ directory .

The modules related to the NIC are present in the location :

/lib/modules/kernel-version/kernel/drivers/net/

(In My case the drivers are located here, it may slightly vary for your distribution)

When you do a `ls` in the above mentioned directory you will see something like this :

Dejavu : /lib/modules/kernel-version/net/# ls

3c501.ko  ewrk3.ko ne.ko 3c503.ko fealnx.ko ni5010.ko 3c505.ko hp100.ko ni52.ko 3c507.ko hp.ko ni65.ko 3c509.ko hp-plus.ko pcnet32.ko 3c515.ko ip_conntrack_amanda.ko ppp_async.ko 8139cp.ko ip_conntrack_ftp.ko ppp_generic.ko 8139too.ko ip_conntrack_h323.ko pppoe.ko 82596.ko ip_conntrack_irc.ko pppox.ko 8390.ko ac3200.ko ip_conntrack_quake3.ko sch_htb.ko amd8111e.ko ip_conntrack_rtsp.ko sch_ingress.ko at1700.ko ip_conntrack_talk.ko sch_sfq.ko b44.ko ip_conntrack_tftp.ko sis900.ko bsd_comp.ko ip_nat_amanda.ko slhc.ko cls_fw.ko ip_nat_cuseeme.ko smc9194.ko ip_conntrack_mms.ko ppp_synctty.ko cls_u32.ko ip_nat_ftp.ko smc-ultra.ko cs89x0.ko ip_nat_h323.ko softdog.ko de4x5.ko ip_nat_irc.ko starfire.ko depca.ko ip_nat_mms.ko sundance.ko 3c59x.ko ip_conntrack_egg.ko ppp_deflate.ko dgrs.ko ip_nat_quake3.ko tlan.ko dmfe.ko ip_nat_rtsp.ko tulip.ko e100.ko ip_nat_talk.ko typhoon.ko e2100.ko ip_nat_tftp.ko via-rhine.ko eepro100.ko lance.ko wd.ko eepro.ko lp486e.ko winbond-840.ko eexpress.ko mii.ko zlib_deflate.ko epic100.ko natsemi.ko zlib_inflate.ko eth16i.ko ne2k-pci.ko

These are the modules for different types of interfaces. For our experiment I'm considering the module of RealTek 8139 chipset based NIC i.e., 8139too.ko

So here I'll be installing driver for RealTek 8139 chipset based NIC.

Go to the directory of the driver:

# cd /lib/modules/kernel-version/kernel/drivers/net/

Then we will install the driver:

CODE

# install -m 644 8139too.ko

Load the driver:

CODE

# /sbin/insmod 8139too.ko ( You can also use modprobe in place of insmod which is a better option).

# depmod -a

CODE

# cd

( come back to the home directory )

CODE

# netconfig

( to configure your networkcard )

CODE

# ifconfig eth0 up

( will put your connection up ) ( ifconfig eth0 down to kill it )

If all went well:

CODE

# netstat -i

( Will show you the ¨eth0¨ and ¨lo¨ )

Now try to ping a welknown host like your ISP or www.google.com

CODE

# ping www.google.com

You should be able to see traffic there and your connection is O.K.

If not, a reboot, after editing your modules.conf ( see next part ) sometimes helps.

Now you still have to edit your modules.conf for the modules to be loaded at boot:

CODE

$ su

< password >

# vim /etc/modules.conf

Goto insert mode by typing 'i' without quotes and insert the below mentioned line.

NOTE: There will already be a few lines in modules.conf, do not change those ! Only add the line:

QUOTE

alias eth0 8139too

and save the file and quit by typing wq

That´s all there is to it folks !

Backing up the MBR:

 

Just another note about restoring the boot loader for dual boot systems,

after Windows messes it up. In Linux, the "dd" command can read and

write to/from raw disks and files. If you have a floppy drive, creating

a boot disk is as simple as putting a floppy in the drive and typing

this:

$ su

<type password>

# dd if=/dev/hda of=/dev/fd0 bs=512 count=1

This makes an exact copy of the MBR of the first hard drive, copying it

to a floppy disk. You can boot directly from this floppy, and see your

old boot menu. You can restore it by switching the "if=" and "of="

(input file, output file) parameters.

If you don't have a floppy drive, you can back it up to a file with

this:

# dd if=/dev/hda of=/home/john/boot.mbr bs=512 count=1

Then you can boot into a CD-ROM distribution such as Knoppix, or often

use your Linux distribution's installation CD to boot into rescue mode,

and restore it with:

$ su

# dd if=/mnt/hda5/john/boot.mbr of=/dev/hda bs=512 count=1

(you'll need to find and mount the partition containing the directory

where you backed up the MBR for the "if" parameter--this is an example).

Recover ROOT Password :

 

First of all disconnect your PC from the internet connection !

Steps to recover lost root password:

(Here I'm assuming that you are lot allowed to boot into linux maching through single user mode or your Bootloader is password protected. )

Step 1: For Redhat and Mandrake:

Then boot from your first install CD and as the very first screen comes up hit F2 and type:

rescue ( For RedHat "linux rescue" )

and the computer will boot in rescue mode.

It will show a few alternatives, select : ¨mount the existing partitions¨ and go to the shell/console prompt.

( Booting Mandrake in "failsafe" from the Lilo menu does the same )

Step 1: For SUSE:

Boot from your first install CD and press F1 at the first screen, then choose "Rescue System" from the menu and at the prompt type "root" ( you do not need a password )

Step 1: For other distro's

Boot from the first install CD ( or any Live CD like Knoppix ) and at the bootprompt type:

CODE

linux single

( For Knoppix: knoppix single )

And it will boot in "single user mode" and you will get an odd looking prompt like “sh-2.05b#”

Alternative for step 1

Sure with most Live and Rescue CDs you can also just boot in the live version, mount the partition and, as root, make changes to the files indicated below:

Step 2

CODE

# cd /etc

( if you boot from knoppix first cd to the partition your lost-password-distro is on )

We need to change two files; ¨passwd¨ and ¨shadow¨:

CODE

# vi passwd

( opens the file )

< i > ( puts vi in insertmode )

This is the first line:

root:x:0:0:root:/root:/bin/bash

Make it:

root::0:0:root:/root:/bin/bash

So just get writ of the ¨x¨ do not touch the ¨:¨ ( colons )

Save the file:

Esc

ZZ

Second file to be changed:

CODE

# vi shadow

( open the file )

< i > ( insert mode )

The first line is a long scrambled line of characters, just make it:

root:::: ( four colons ! )

Save the file and quit editor.

wq

Now you can reboot your computer. Log in as normal user, open a console and type:

CODE

$ su

# passwd

And set the new root password !

Log out as root:

Ctrl+d

And the job is done !!

WARNING: Only after setting your new root password it is safe to connect your computer to the internet or local network again !!

Make Linux ignore a ping

 

Because I want to monitor traffic, not block it entirely. I just want this machine to basically lurk on my network looking for suspicious activity and then notifying me if it occurs. Sometimes it can be useful to hide a Linux machine a bit. Not responding to pings would at least keep most "hackers" out because they would never even

Know it's there.

To turn answers to icmp_echos off, as root type:

echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all

and to turn it on again type:

echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all

Even better way:

Don't ignore ICMP echos:

sysctl -w net.ipv4.icmp_echo_ignore_all=0

do ignore ICMP echos:

sysctl -w net.ipv4.icmp_echo_ignore_all=1

sysctl -a will give you a nice list of values that you can tweak.

If you're running a Redhat-based system, you can plop the desired values in /etc/sysctl.conf.

Reading compressed Files

 

I did not know this, but if you need to show a compressed text file on the screen, you do not actually need to uncompress it.

You can use zcat to send the file to the standard output, uncompressed, but the original file remains untouched.

The syntax of the command is:

zcat file.gz

or you can also use,

gunzip -c file.gz

what is going to happen is that the file will be uncompressed on the fly, sent to the standard output (usually screen).

If the .gz file contains more than one file they will be shown in sequence, you can also redirect the output using >.

How to find which service is listening on a given port?

 

It is really important to know which ports are open in your PC, this is not only useful for Linux, but also for other operating systems, Linux has a lot of tools to check which ports are open, the most common is nmap which is a command line tool, but also exist a Graphical frontEnd for it if you prefer that way.

So to scan you own PC and find open ports you can enter:

sudo nmap -T Aggressive -A -v 127.0.0.1 -p 1-65000

That will scan all ports and you will an output like this:

Starting Nmap 4.53 ( http://insecure.org ) at 2009-12-10 10:20 BOT

Initiating SYN Stealth Scan at 10:20

Scanning localhost (127.0.0.1) [65000 ports]

Discovered open port 113/tcp on 127.0.0.1

Discovered open port 22/tcp on 127.0.0.1

Discovered open port 80/tcp on 127.0.0.1

Discovered open port 443/tcp on 127.0.0.1

Discovered open port 902/tcp on 127.0.0.1

Discovered open port 55378/tcp on 127.0.0.1

Discovered open port 3143/tcp on 127.0.0.1

Discovered open port 8307/tcp on 127.0.0.1

Discovered open port 631/tcp on 127.0.0.1

Discovered open port 8222/tcp on 127.0.0.1

Discovered open port 8308/tcp on 127.0.0.1

Discovered open port 8009/tcp on 127.0.0.1

Discovered open port 111/tcp on 127.0.0.1

Discovered open port 8005/tcp on 127.0.0.1

Discovered open port 8123/tcp on 127.0.0.1

Discovered open port 38599/tcp on 127.0.0.1

Completed SYN Stealth Scan at 10:20, 1.47s elapsed (65000 total ports)

Initiating Service scan at 10:20

Scanning 16 services on localhost (127.0.0.1)

Completed Service scan at 10:21, 88.68s elapsed (16 services on 1 host)

Initiating OS detection (try #1) against localhost (127.0.0.1)

Initiating RPCGrind Scan against localhost (127.0.0.1) at 10:21

Completed RPCGrind Scan against localhost (127.0.0.1) at 10:21, 0.12s elapsed (3 ports)

SCRIPT ENGINE: Initiating script scanning.

SCRIPT ENGINE: rpcinfo.nse is not a file.

SCRIPT ENGINE: Aborting script scan.

Host localhost (127.0.0.1) appears to be up ... good.

Interesting ports on localhost (127.0.0.1):

Not shown: 64984 closed ports

PORT STATE SERVICE VERSION

22/tcp open ssh OpenSSH 4.7p1 Debian 9 (protocol 2.0)

80/tcp open http Apache httpd 2.2.8 ((Debian))

111/tcp open rpcbind 2 (rpc #100000)

113/tcp open ident

443/tcp open https?

631/tcp open ipp CUPS 1.2

902/tcp open ssl/vmware-auth VMware GSX Authentication Daemon 1.10 (Uses VNC, SOAP)

3143/tcp open unknown

8005/tcp open unknown

8009/tcp open ajp13?

8123/tcp open http-proxy Polipo http proxy

8222/tcp open unknown

8307/tcp open unknown

8308/tcp open http Apache Tomcat/Coyote JSP engine 1.1

38599/tcp open status 1 (rpc #100024)

55378/tcp open nlockmgr 1-4 (rpc #100021)

As you can see, it tries to guess which service is listening on each port, but it can make mistakes, so if you want to be sure you need to use some other tools, we will see three different now.

Netstat

With netstat the command you need to enter is:

sudo netstat --tcp --udp --listening --program

The output could be something like this:

Active Internet connections (only servers)

Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name

tcp 0 0 *:902 *:* LISTEN 3441/inetd

tcp 0 0 *:38599 *:* LISTEN 2926/rpc.statd

tcp 0 0 *:3143 *:* LISTEN 2763/perl

tcp 0 0 *:sunrpc *:* LISTEN 2919/portmap

tcp 0 0 *:auth *:* LISTEN 3441/inetd

tcp 0 0 *:55378 *:* LISTEN -

tcp 0 0 *:8307 *:* LISTEN 4096/vmware-hostd

tcp 0 0 localhost:ipp *:* LISTEN 3407/cupsd

tcp 0 0 *:https *:* LISTEN 4096/vmware-hostd

tcp 0 0 *:8123 *:* LISTEN 3455/polipo

tcp 0 0 *:8222 *:* LISTEN 4096/vmware-hostd

tcp6 0 0 localhost:8005 [::]:* LISTEN 3956/webAccess

tcp6 0 0 [::]:8009 [::]:* LISTEN 3956/webAccess

tcp6 0 0 [::]:www [::]:* LISTEN 4175/apache2

tcp6 0 0 [::]:8308 [::]:* LISTEN 3956/webAccess

tcp6 0 0 [::]:ssh [::]:* LISTEN 3281/sshd

udp 0 0 *:44807 *:* 2926/rpc.statd

udp 0 0 *:36555 *:* 3467/avahi-daemon:

udp 0 0 *:982 *:* 2926/rpc.statd

udp 0 0 *:mdns *:* 3467/avahi-daemon:

udp 0 0 *:sunrpc *:* 2919/portmap

udp 0 0 *:ipp *:* 3407/cupsd

udp6 0 0 [::]:51107 [::]:* 3467/avahi-daemon:

udp6 0 0 [::]:mdns [::]:* 3467/avahi-daemon:

Now you can see which programs are opening/listening on those ports.

lsof

With this command you need to enter

sudo lsof +M -i4

You will get an output like this:

COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME

apt-cache 2763 www-data 3u IPv4 6403 TCP *:3143 (LISTEN)

portmap 2919 daemon 3u IPv4 6686 UDP *:sunrpc[portmapper]

portmap 2919 daemon 4u IPv4 6687 TCP *:sunrpc[portmapper] (LISTEN)

rpc.statd 2926 statd 5u IPv4 6726 UDP *:982

rpc.statd 2926 statd 7u IPv4 6736 UDP *:44807[status]

rpc.statd 2926 statd 8u IPv4 6741 TCP *:38599[status] (LISTEN)

cupsd 3407 root 0u IPv4 20058 TCP localhost:ipp (LISTEN)

cupsd 3407 root 3u IPv4 20061 UDP *:ipp

inetd 3441 root 4u IPv4 7612 TCP *:auth (LISTEN)

inetd 3441 root 5u IPv4 7615 TCP *:902 (LISTEN)

polipo 3455 proxy 0u IPv4 7649 TCP *:8123 (LISTEN)

polipo 3455 proxy 2u IPv4 11350 UDP debian.go2linux.org:59528->vnsc-bak.sys.gtei.net:domain

polipo 3455 proxy 5u IPv4 21863 TCP localhost:8123->localhost:56811 (ESTABLISHED)

polipo 3455 proxy 8u IPv4 21405 TCP localhost:8123->localhost:50403 (ESTABLISHED)

polipo 3455 proxy 22u IPv4 21872 TCP localhost:8123->localhost:56813 (ESTABLISHED)

polipo 3455 proxy 42u IPv4 21965 TCP localhost:8123->localhost:56828 (ESTABLISHED)

avahi-dae 3467 avahi 14u IPv4 7702 UDP *:mdns

avahi-dae 3467 avahi 16u IPv4 7704 UDP *:36555

vmware-ho 4096 root 6u IPv4 9022 TCP *:https (LISTEN)

vmware-ho 4096 root 7u IPv4 9023 TCP *:8222 (LISTEN)

vmware-ho 4096 root 30u IPv4 9455 TCP *:8307 (LISTEN)

firefox-b 4431 dejavu 58u IPv4 21862 TCP localhost:56811->localhost:8123 (ESTABLISHED)

firefox-b 4431 dejavu 61u IPv4 21871 TCP localhost:56813->localhost:8123 (ESTABLISHED)

firefox-b 4431 dejavu 62u IPv4 21964 TCP localhost:56828->localhost:8123 (ESTABLISHED)

firefox-b 4431 dejavu 68u IPv4 21404 TCP localhost:50403->localhost:8123 (ESTABLISHED)

Now you have the program running, as an example, netstat showed on 3143 (Perl) but lsoft showed (apt-cacher), which is a perl script.

fuser

Fuser, does help, but is not like those other tools, with fuser you can also kill the process which is listening on a given port.

sudo fuser -v 3143/tcp

The output is:

USER PID ACCESS COMMAND

3143/tcp: www-data 2763 F.... apt-cacher

If you need to kill the process enter

sudo fuser -vk 3143/tcp

Do not forget to read the man pages of this tools to have more info about its uses.

Force your users to change their passwords frequently

 

The users of a Linux Operating system computer, should always take care about security and if you are the admin of a Linux box with lots of users, you are responsible for the security of it, and maybe you should "force" the other users to change their passwords from time to time, to make this use the command chage

Apply this to a user, lets say johnny

sudo chage --list johnny

something like this may appear.

$sudo chage --list johnny

Last password change : Dec 10, 2009

Password expires : never

Password inactive : never

Account expires : never

Minimum number of days between password change : 0

Maximum number of days between password change : 99999

Number of days of warning before password expires : 7

Now lets change change its expiry password date.

sudo chage -M 30 johnny

This will make its password to expire after 30 days of the last change date.

See now the new info:

$ sudo chage --list johnny

Last password change : Dec 10, 2009

Password expires : never

Password inactive : never

Account expires : never

Minimum number of days between password change : 0

Maximum number of days between password change : 30

Number of days of warning before password expires : 7

Now when I try to login as johnny, this is what I got:

$ su - johnny

Password:

You are required to change your password immediately (password aged)

Changing password for johnny.

(current) UNIX password:

Enter new UNIX password:

Retype new UNIX password:

Password unchanged

Enter new UNIX password:

Retype new UNIX password:

I tried to use the same password again the Linux refused to let me use it, so I was forced to pick a new password.

It is good to have the warn days to 3 or more days, so the user may have time to think a new good password, otherwise will use the first thing he/she may read around resulting in a weak password, which is worse that not changing the original one.

To set the warn days use this command.

sudo chage -W 4 johnny

Now lets check the info for user johnny

$ sudo chage --list johnny

Last password change : Nov 11, 2009

Password expires : Dec 10, 2009

Password inactive : never

Account expires : never

Minimum number of days between password change : 0

Maximum number of days between password change : 30

Number of days of warning before password expires : 4

Now you may see the new expiry date is Dec 10, 2009and he will have a 4 days warning about the expiry of his password.