Icinga auf Ubuntu Server 10.04

Icinga auf Ubuntu Server 10.04 (64bit)
--------------------------------------

0. Installation Ubuntu Server


1. apt-get install -y libdbi0-dev libdbd-mysql build-essential libgd2-xpm-dev libjpeg62-dev libpng12-dev mysql-server mysql-client apache2 openssl libssl-dev libmysqlclient16-dev

2. useradd -m icinga
passwd icinga
groupadd icinga-cmd
usermod -a -G icinga-cmd icinga
usermod -a -G icinga-cmd www-data


3. cd /var/tmp
wget http://sourceforge.net/projects/icinga/files/icinga/1.0.2/icinga-1.0.2.tar.gz/download

tar xvfz icinga-1.0.2.tar.gz

cd /var/tmp/icinga-1.0.2
./configure --with-command-group=icinga-cmd --enable-idoutils
make all
sudo make fullinstall

4. cd /var/tmp
wget http://sourceforge.net/projects/nagiosplug/files/nagiosplug/1.4.15/nagios-plugins-1.4.15.tar.gz/download
tar xvfz nagios-plugins-1.4.15.tar.gz

cd /usr/src/nagios-plugins-1.4.15
./configure --prefix=/usr/local/icinga --with-nagios-user=icinga
make
sudo make install


5.

sudo htpasswd -c /usr/local/icinga/etc/htpasswd.users icingaadmin
sudo /etc/init.d/apache2 restart
sudo mysql -u root -p
create database icinga;
GRANT USAGE ON *.* TO 'icinga'@'localhost' IDENTIFIED BY 'icinga' WITH MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0;
GRANT SELECT , INSERT , UPDATE , DELETE ON icinga.* TO 'icinga'@'localhost';
flush privileges;
quit

cd /var/tmp/icinga-1.0.2/module/idoutils/db/mysql
sudo mysql -u root -p icinga < mysql.sql

sudo mv /usr/local/icinga/etc/ido2db.cfg-sample /usr/local/icinga/etc/ido2db.cfg
sudo mv /usr/local/icinga/etc/idomod.cfg-sample /usr/local/icinga/etc/idomod.cfg

sudo vi /usr/local/icinga/etc/ido2db.cfg

db_user und db_password anpassen wenn nicht "icinga" als password verwendet wurde.

sudo vi /usr/local/icinga/etc/icinga.cfg

broker_module=/usr/local/icinga/bin/idomod.o config_file=/usr/local/icinga/etc/idomod.cfg

sudo /etc/init.d/ido2db start
sudo /etc/init.d/icinga start
sudo update-rc.d ido2db defaults 50
sudo update-rc.d icinga defaults 51



püfen der config

cd /usr/local/icinga/bin
sudo ./icinga -v /usr/local/icinga/etc/icinga.cfg




sudo apt-get install sendmail mailutils

vi /etc/mail/sendmail.mc

add: FEATURE(`mailertable', `hash -o /etc/mail/mailertable.db')dnl

vi /etc/mail/mailertable

example:

.domain.tld esmtp:[mailserver]


sendmailconfig



mail user@domain.tld

check mail recivied

ntop 4 installation unter Ubuntu 10.04 Server

nTop 4 unter Ubuntu 10.04(64bit)
--------------------------------

Internetanbindung notwendig!
Möglichst 2 Netzwerkkarten (eine zum Mitlauschen, eine zum Netzwerkzugriff)
Festplatte sollte min 4 GB haben (für kleinen Test) lieber grösser.


1. Installation von Ubuntu Server 10.04 (64bit)
Download: http://www.ubuntu.com/server/get-ubuntu/download
OpenSSH Server

2. Online Update
sudo apt-get update
sudo apt-get updrade

u.U. muss man den akt. Kernel noch instl.
sudo apt-get install linux-headers-server linux-image-server linux-server

diese sagt einem aber sudo apt-get upgrade wenn man es nochmals aufruft

Danach ein reboot: sudo reboot
dann sudo apt-get autoremove um alte nichtmehr benötigte
Packte zu deinstallieren

sudo apt-get install build-essential
sudo apt-get install libtool
sudo apt-get install autoconf
sudo apt-get install automake
sudo apt-get install m4
sudo apt-get install libpcap0.8
sudo apt-get install libpcap0.8-dev
sudo apt-get install zlib1g
sudo apt-get install zlib1g-dev
sudo apt-get install rrdtool
sudo apt-get install librrd4
sudo apt-get install librrd-dev
sudo apt-get install graphviz


sudo apt-get install openssl
sudo apt-get install libssl-dev

sudo apt-get install libgeoip-dev


sudo aptitude install python-dev
sudo apt-get install pyhton-dev
sudo apt-get install pyhton-mako

sudo apt-get install libgdbm-dev


3. Download von nTop Source
http://sourceforge.net/projects/ntop/

oder

wget http://sourceforge.net/projects/ntop/files/ntop/ntop-4.0.1/ntop-4.0.1.tar.gz/download

z.B: tar xvfz ntop-4.0.1.tar.gz


cd ntop-4.0.1

./autogen.sh

./configure

make

sudo make install

sudo adduser --system --group --home /usr/local/lib/ntop ntop


sudo cp packages/debian/etc/ld.so.conf.d/ntop.conf /etc/ld.so.conf.d




vi /etc/init.d/ntop

#! /bin/sh
#
# ntop script
#
# NOTE: Copy this script in /etc/init.d/ntop
#
# Author:
# Paul Mansfield
# Worldpay - 20020218
#
# Fixed by L.Deri - May 2007
# mod. D.Schneck - August 2010

set -e

NAME=ntop
DAEMON=/usr/local/bin/ntop
CONFIG=/etc/ntop/ntop.conf
PROTOCOLFILE=/etc/ntop/protocol.list
test -x $DAEMON || exit 0

start_ntop() {
echo -n "Starting ntop "
$DAEMON @$CONFIG -p $PROTOCOLFILE > /var/log/ntop.out &
echo " ...done"
}

stop_ntop() {
echo -n "Stopping ntop "
if test -f /var/run/ntop.pid ; then
kill `cat /var/run/ntop.pid`
echo -n " killed pid `cat /var/run/ntop.pid`"
rm /var/run/ntop.pid
fi
echo " ...done"
}

case "$1" in
start)
start_ntop
;;

stop)
stop_ntop
;;

restart)
stop_ntop
start_ntop
;;

defaults)
$DAEMON -u ntop --set-admin-password=admin
;;

*)
echo "Usage: /etc/init.d/$NAME {start|stop|restart|install}"
exit 1
;;
esac

exit 0



sudo chmod 755 /etc/init.d/ntop






sudo ldconfig

sudo chown -R ntop.ntop /usr/local/var/ntop

cd /etc/init.d

sudo mkdir /etc/ntop

cd /var/tmp/ntop-4.0.1

sudo cp packages/Redhat/ntop.conf.sample /etc/ntop/ntop.conf

In dieser Datei werden z.B: Portnummer, Netzwerkkarte usw. eingestellt.

--db-file-path /usr/local/var/ntop muss angepasst werden

sudo cp packages/debian.official/protocol.list /etc/ntop

sudo ntop --user ntop -P /usr/local/var/ntop

sudo chown -R ntop.ntop /usr/local/var/ntop

sudo service ntop start

Soll ntop beim starten des Systemns automatisch gestartet werden, geben Sie folgendes ein:

sudo update-rc.d ntop defaults

OGG in MP3 umwandeln

for x in *.ogg; do ffmpeg -i "$x" "`basename "$x" .ogg`.mp3"; done

Ändern von gruppen

ändern von gruppen(rechten)

find admin audit bin esa etc home lpp opt oracle pconsole sapmnt sbin tivoli unix usr var -group 203 -exec chgrp 200 {} \;

Apache: Ein kleiner Schutz vor Schwachstellen Scanner

Ein kleiner Schutz vor Schwachstellen Scanner: w00tw00t.at.ISC.SANS.DFind

apt-get install fail2ban


/etc/fail2ban/jail.conf

#####
# HTTP
####

[apache-404]
enabled = true
port = http,https
filter = apache-404
logpath = /var/log/apache*/*error.log
maxretry = 3

[block_ww0twt]
enabled = true
port = http,https
filter = apache-404
logpath = /var/log/apache*/*error.log
maxretry = 3


/etc/fail2ban/filter.d/apache-404.conf

# Fail2Ban configuration file
#
# License: GPL
# You are free to Use this on other Sites if you link back to this Site.
#
[Definition]
# Option: failregex
# Notes.: regex to match the "File does not exist" messages in the logfile. The
# host must be matched by a group named "host". The tag "" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P\S+)
# Values: TEXT
#

failregex = [[]client (?P\S*)[]] File does not exist: *

#

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# standart search for favicon.ico and robots.txt - this is often thrown and may do stupid mistakes
# Values: TEXT
#
ignoreregex = .*(robots.txt|favicon.ico)


/etc/fail2ban/filter.d/block_ww0twt.conf

# Fail2Ban configuration file
#
# License: GPL
# You are free to Use this on other Sites if you link back to this Site.
#
[Definition]
# Option: failregex
# Notes.: regex to match the "File does not exist" messages in the logfile. The
# host must be matched by a group named "host". The tag "" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P\S+)
# Values: TEXT
#

#failregex = [[]client (?P\S*)[]] client sent HTTP/1.1 request without hostname *
failregex = [[]client (?P\S*)[]] client sent HTTP/1.1 request without hostname \(see RFC2616 section 14.23\): \/w00tw00t.*

#

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# standart search for favicon.ico and robots.txt - this is often thrown and may do stupid mistakes
# Values: TEXT
#
ignoreregex = .*(robots.txt|favicon.ico)






block_ww0twt_2.conf

# Fail2Ban configuration file
#
# License: GPL
# You are free to Use this on other Sites if you link back to this Site.
#
[Definition]
# Option: failregex
# Notes.: regex to match the "File does not exist" messages in the logfile. The
# host must be matched by a group named "host". The tag "" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P\S+)
# Values: TEXT
#

#failregex = [[]client (?P\S*)[]] client sent HTTP/1.1 request without hostname *
failregex = [[]client (?P\S*)[]] script .* not found or unable to stat

#

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# standart search for favicon.ico and robots.txt - this is often thrown and may do stupid mistakes
# Values: TEXT
#
ignoreregex = .*(robots.txt|favicon.ico)

JPG verkleinern

for i in `ls *.jpg`; do convert -resize "AUFLÖSUNG" $i klein_dateiname.jpg; done

z.B.

for i in `ls *.jpg`; do convert -resize "1024x786" $i klein_$i; done

for i in `ls *.JPG`; do convert -resize "1024x786" $i klein_$i; done

Clonezilla: Automatisches Backup auf ext. USB Festplatte

CloneZilla BootCD/ISO anpassen um ein Automatisches Backup
auf eine USB-Festplatte machen zu können.

Downloaden der ISO z.B. clonezilla-live-20110530-natty.iso
http://clonezilla.org/downloads/alternative/iso-zip-files.php

Öffnen der ISO-Datei: clonezilla-live-20110530-natty.iso mit ISOMaster (http://www.littlesvr.ca/isomaster/)

1. Erstellen eines Verzeichnises "custom" in der ROOT des ISOs

2. Erstellen des Scripts "ocs-clientname.sh" für das Backup
in diesem Beispiel wird eine ext. USB-Festplatte
mittels uuid gemountet und nach /home/partimag gemountet

Das Script erzeuget ein Verzeichnis clientname_HHMMSSTTMMJJJJ in das das Backup geschrieben wird.


Script für /dev/sda

##!/bin/bash
# Author: Steven Shiau
# License: GPL
# When this script is ready, you can run
# /opt/drbl/sbin/ocs-iso -g en -k NONE -s -m ./custom-ocs
# to create the iso file for CD/DVD. or
# /opt/drbl/sbin/ocs-live-dev -g en -k NONE -s -c -m ./custom-ocs
# to create the zip file for USB flash drive.
# Begin of the scripts:
# Load DRBL setting and functions
if [ ! -f "/opt/drbl/sbin/drbl-conf-functions" ]; then
echo "Unable to find /opt/drbl/sbin/drbl-conf-functions! Program terminated!"
exit 1
fi

. /opt/drbl/sbin/drbl-conf-functions
. /opt/drbl/sbin/ocs-functions

# load the setting for clonezilla live.
[ -e /etc/ocs/ocs-live.conf ] && . /etc/ocs/ocs-live.conf

# Load language files. For English, use "en_US.UTF-8". For Traditional Chinese, use "zh_TW.UTF-8"
ask_and_load_lang_set en_US.UTF-8

# The above is almost necessary, it is recommended to include them in your own custom-ocs.
# From here, you can write your own scripts.
echo "#########################################################################################"
echo "# 1. Configure network"
#dhclient
echo "#########################################################################################"
echo "# 2. Mount the clonezilla image home"

mkdir /home/partimag
mount /dev/disk/by-uuid/9a467114-d745-4b53-b1ab-f70ca1918d0d /home/partimag

echo "#######################################after mounting, now showing mounts###########"
mount
echo "#########################################################################################"
echo "# 3. backing up sda"
/opt/drbl/sbin/ocs-sr -b -q -j2 -z1 -i 0 -p reboot savedisk "clientname_`date +%H%M%S_%d%m%Y`" "sda"
echo "#########################################################################################"



Script für /dev/hda

##!/bin/bash
# Author: Steven Shiau
# License: GPL
# When this script is ready, you can run
# /opt/drbl/sbin/ocs-iso -g en -k NONE -s -m ./custom-ocs
# to create the iso file for CD/DVD. or
# /opt/drbl/sbin/ocs-live-dev -g en -k NONE -s -c -m ./custom-ocs
# to create the zip file for USB flash drive.
# Begin of the scripts:
# Load DRBL setting and functions
if [ ! -f "/opt/drbl/sbin/drbl-conf-functions" ]; then
echo "Unable to find /opt/drbl/sbin/drbl-conf-functions! Program terminated!"
exit 1
fi

. /opt/drbl/sbin/drbl-conf-functions
. /opt/drbl/sbin/ocs-functions

# load the setting for clonezilla live.
[ -e /etc/ocs/ocs-live.conf ] && . /etc/ocs/ocs-live.conf

# Load language files. For English, use "en_US.UTF-8". For Traditional Chinese, use "zh_TW.UTF-8"
ask_and_load_lang_set en_US.UTF-8

# The above is almost necessary, it is recommended to include them in your own custom-ocs.
# From here, you can write your own scripts.
echo "#########################################################################################"
echo "# 1. Configure network"
#dhclient
echo "#########################################################################################"
echo "# 2. Mount the clonezilla image home"

mkdir /home/partimag
mount /dev/disk/by-uuid/9a467114-d745-4b53-b1ab-f70ca1918d0d /home/partimag

echo "#######################################after mounting, now showing mounts###########"
mount
echo "#########################################################################################"
echo "# 3. backing up hda"
/opt/drbl/sbin/ocs-sr -b -q -j2 -z1 -i 0 -p reboot savedisk "clientname_`date +%H%M%S_%d%m%Y`" "hda"
echo "#########################################################################################"



Wichtig ist das das Script: "ocs-clientname.sh" mittels chmod 755 ausführbar gemacht wird.
oder per ISOMaster mit change Permissions rwx-r-x-r-x


Wie findet man die uuid einer Partiton herraus ?

Booten mit der CloneZilla ISO/CD

Enter Commandline

$ sudo su -

# tune2fs -l /dev/sdbX | grep "Filesystem UUID:"

z.B.

# tune2fs -l /dev/sdb1 | grep "Filesystem UUID:"


3. Anpassung / Erstellung der Datei: isolinux/isolinux.cfg

# Since no network setting in the squashfs image, therefore if ip=frommedia, the network is disabled. That's what we want.
label Clonezilla clientname
# MENU HIDE
MENU LABEL Autobackup CLIENTNAME
# MENU PASSWD
kernel /live/vmlinuz
append initrd=/live/initrd.img boot=live hostname=natty config quiet noswap nolocales edd=on nomodeset ocs_live_run="/live/image/custom/ocs-clientname.sh" ocs_live_extra_param="" ocs_live_keymap="/usr/share/keymaps/i386/qwertz/de-latin1-nodeadkeys.kmap.gz" ocs_live_batch="yes" ocs_lang="en_US.UTF-8" video=uvesafb:mode_option=800x600-16 ip=frommedia
nosplash
TEXT HELP
* Clonezilla live version: 20110530-natty. (C) 2003-2011, NCHC, Taiwan
* Disclaimer: Clonezilla comes with ABSOLUTELY NO WARRANTY
ENDTEXT


4. die Orginale Datei: /isolinux/isolinux.cfg entfernen
und die selbst erstellte Datei einfügen

5. Speichern als neues ISO
ggf. auf CD-ROM brennen