tcp_timestamps abschalten

Abschalten von Info der (nic)uptime


z.B: in der /etc/rc.local
echo 0 > /proc/sys/net/ipv4/tcp_timestamps



Testen mit:



für SSL

hping3 -S --tcp-timestamp -p 443 -c 2


für HTTP

hping3 -S --tcp-timestamp -p 80 -c


für ssh

hping3 -S --tcp-timestamp -p 22 -c

Icinga auf Ubuntu Server 10.04

Icinga auf Ubuntu Server 10.04 (64bit)
--------------------------------------

0. Installation Ubuntu Server


1. apt-get install -y libdbi0-dev libdbd-mysql build-essential libgd2-xpm-dev libjpeg62-dev libpng12-dev mysql-server mysql-client apache2 openssl libssl-dev libmysqlclient16-dev

2. useradd -m icinga
passwd icinga
groupadd icinga-cmd
usermod -a -G icinga-cmd icinga
usermod -a -G icinga-cmd www-data


3. cd /var/tmp
wget http://sourceforge.net/projects/icinga/files/icinga/1.0.2/icinga-1.0.2.tar.gz/download

tar xvfz icinga-1.0.2.tar.gz

cd /var/tmp/icinga-1.0.2
./configure --with-command-group=icinga-cmd --enable-idoutils
make all
sudo make fullinstall

4. cd /var/tmp
wget http://sourceforge.net/projects/nagiosplug/files/nagiosplug/1.4.15/nagios-plugins-1.4.15.tar.gz/download
tar xvfz nagios-plugins-1.4.15.tar.gz

cd /usr/src/nagios-plugins-1.4.15
./configure --prefix=/usr/local/icinga --with-nagios-user=icinga
make
sudo make install


5.

sudo htpasswd -c /usr/local/icinga/etc/htpasswd.users icingaadmin
sudo /etc/init.d/apache2 restart
sudo mysql -u root -p
create database icinga;
GRANT USAGE ON *.* TO 'icinga'@'localhost' IDENTIFIED BY 'icinga' WITH MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0;
GRANT SELECT , INSERT , UPDATE , DELETE ON icinga.* TO 'icinga'@'localhost';
flush privileges;
quit

cd /var/tmp/icinga-1.0.2/module/idoutils/db/mysql
sudo mysql -u root -p icinga < mysql.sql

sudo mv /usr/local/icinga/etc/ido2db.cfg-sample /usr/local/icinga/etc/ido2db.cfg
sudo mv /usr/local/icinga/etc/idomod.cfg-sample /usr/local/icinga/etc/idomod.cfg

sudo vi /usr/local/icinga/etc/ido2db.cfg

db_user und db_password anpassen wenn nicht "icinga" als password verwendet wurde.

sudo vi /usr/local/icinga/etc/icinga.cfg

broker_module=/usr/local/icinga/bin/idomod.o config_file=/usr/local/icinga/etc/idomod.cfg

sudo /etc/init.d/ido2db start
sudo /etc/init.d/icinga start
sudo update-rc.d ido2db defaults 50
sudo update-rc.d icinga defaults 51



püfen der config

cd /usr/local/icinga/bin
sudo ./icinga -v /usr/local/icinga/etc/icinga.cfg




sudo apt-get install sendmail mailutils

vi /etc/mail/sendmail.mc

add: FEATURE(`mailertable', `hash -o /etc/mail/mailertable.db')dnl

vi /etc/mail/mailertable

example:

.domain.tld esmtp:[mailserver]


sendmailconfig



mail user@domain.tld

check mail recivied

ntop 4 installation unter Ubuntu 10.04 Server

nTop 4 unter Ubuntu 10.04(64bit)
--------------------------------

Internetanbindung notwendig!
Möglichst 2 Netzwerkkarten (eine zum Mitlauschen, eine zum Netzwerkzugriff)
Festplatte sollte min 4 GB haben (für kleinen Test) lieber grösser.


1. Installation von Ubuntu Server 10.04 (64bit)
Download: http://www.ubuntu.com/server/get-ubuntu/download
OpenSSH Server

2. Online Update
sudo apt-get update
sudo apt-get updrade

u.U. muss man den akt. Kernel noch instl.
sudo apt-get install linux-headers-server linux-image-server linux-server

diese sagt einem aber sudo apt-get upgrade wenn man es nochmals aufruft

Danach ein reboot: sudo reboot
dann sudo apt-get autoremove um alte nichtmehr benötigte
Packte zu deinstallieren

sudo apt-get install build-essential
sudo apt-get install libtool
sudo apt-get install autoconf
sudo apt-get install automake
sudo apt-get install m4
sudo apt-get install libpcap0.8
sudo apt-get install libpcap0.8-dev
sudo apt-get install zlib1g
sudo apt-get install zlib1g-dev
sudo apt-get install rrdtool
sudo apt-get install librrd4
sudo apt-get install librrd-dev
sudo apt-get install graphviz


sudo apt-get install openssl
sudo apt-get install libssl-dev

sudo apt-get install libgeoip-dev


sudo aptitude install python-dev
sudo apt-get install pyhton-dev
sudo apt-get install pyhton-mako

sudo apt-get install libgdbm-dev


3. Download von nTop Source
http://sourceforge.net/projects/ntop/

oder

wget http://sourceforge.net/projects/ntop/files/ntop/ntop-4.0.1/ntop-4.0.1.tar.gz/download

z.B: tar xvfz ntop-4.0.1.tar.gz


cd ntop-4.0.1

./autogen.sh

./configure

make

sudo make install

sudo adduser --system --group --home /usr/local/lib/ntop ntop


sudo cp packages/debian/etc/ld.so.conf.d/ntop.conf /etc/ld.so.conf.d




vi /etc/init.d/ntop

#! /bin/sh
#
# ntop script
#
# NOTE: Copy this script in /etc/init.d/ntop
#
# Author:
# Paul Mansfield
# Worldpay - 20020218
#
# Fixed by L.Deri - May 2007
# mod. D.Schneck - August 2010

set -e

NAME=ntop
DAEMON=/usr/local/bin/ntop
CONFIG=/etc/ntop/ntop.conf
PROTOCOLFILE=/etc/ntop/protocol.list
test -x $DAEMON || exit 0

start_ntop() {
echo -n "Starting ntop "
$DAEMON @$CONFIG -p $PROTOCOLFILE > /var/log/ntop.out &
echo " ...done"
}

stop_ntop() {
echo -n "Stopping ntop "
if test -f /var/run/ntop.pid ; then
kill `cat /var/run/ntop.pid`
echo -n " killed pid `cat /var/run/ntop.pid`"
rm /var/run/ntop.pid
fi
echo " ...done"
}

case "$1" in
start)
start_ntop
;;

stop)
stop_ntop
;;

restart)
stop_ntop
start_ntop
;;

defaults)
$DAEMON -u ntop --set-admin-password=admin
;;

*)
echo "Usage: /etc/init.d/$NAME {start|stop|restart|install}"
exit 1
;;
esac

exit 0



sudo chmod 755 /etc/init.d/ntop






sudo ldconfig

sudo chown -R ntop.ntop /usr/local/var/ntop

cd /etc/init.d

sudo mkdir /etc/ntop

cd /var/tmp/ntop-4.0.1

sudo cp packages/Redhat/ntop.conf.sample /etc/ntop/ntop.conf

In dieser Datei werden z.B: Portnummer, Netzwerkkarte usw. eingestellt.

--db-file-path /usr/local/var/ntop muss angepasst werden

sudo cp packages/debian.official/protocol.list /etc/ntop

sudo ntop --user ntop -P /usr/local/var/ntop

sudo chown -R ntop.ntop /usr/local/var/ntop

sudo service ntop start

Soll ntop beim starten des Systemns automatisch gestartet werden, geben Sie folgendes ein:

sudo update-rc.d ntop defaults

OGG in MP3 umwandeln

for x in *.ogg; do ffmpeg -i "$x" "`basename "$x" .ogg`.mp3"; done

Ändern von gruppen

ändern von gruppen(rechten)

find admin audit bin esa etc home lpp opt oracle pconsole sapmnt sbin tivoli unix usr var -group 203 -exec chgrp 200 {} \;

Apache: Ein kleiner Schutz vor Schwachstellen Scanner

Ein kleiner Schutz vor Schwachstellen Scanner: w00tw00t.at.ISC.SANS.DFind

apt-get install fail2ban


/etc/fail2ban/jail.conf

#####
# HTTP
####

[apache-404]
enabled = true
port = http,https
filter = apache-404
logpath = /var/log/apache*/*error.log
maxretry = 3

[block_ww0twt]
enabled = true
port = http,https
filter = apache-404
logpath = /var/log/apache*/*error.log
maxretry = 3


/etc/fail2ban/filter.d/apache-404.conf

# Fail2Ban configuration file
#
# License: GPL
# You are free to Use this on other Sites if you link back to this Site.
#
[Definition]
# Option: failregex
# Notes.: regex to match the "File does not exist" messages in the logfile. The
# host must be matched by a group named "host". The tag "" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P\S+)
# Values: TEXT
#

failregex = [[]client (?P\S*)[]] File does not exist: *

#

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# standart search for favicon.ico and robots.txt - this is often thrown and may do stupid mistakes
# Values: TEXT
#
ignoreregex = .*(robots.txt|favicon.ico)


/etc/fail2ban/filter.d/block_ww0twt.conf

# Fail2Ban configuration file
#
# License: GPL
# You are free to Use this on other Sites if you link back to this Site.
#
[Definition]
# Option: failregex
# Notes.: regex to match the "File does not exist" messages in the logfile. The
# host must be matched by a group named "host". The tag "" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P\S+)
# Values: TEXT
#

#failregex = [[]client (?P\S*)[]] client sent HTTP/1.1 request without hostname *
failregex = [[]client (?P\S*)[]] client sent HTTP/1.1 request without hostname \(see RFC2616 section 14.23\): \/w00tw00t.*

#

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# standart search for favicon.ico and robots.txt - this is often thrown and may do stupid mistakes
# Values: TEXT
#
ignoreregex = .*(robots.txt|favicon.ico)






block_ww0twt_2.conf

# Fail2Ban configuration file
#
# License: GPL
# You are free to Use this on other Sites if you link back to this Site.
#
[Definition]
# Option: failregex
# Notes.: regex to match the "File does not exist" messages in the logfile. The
# host must be matched by a group named "host". The tag "" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P\S+)
# Values: TEXT
#

#failregex = [[]client (?P\S*)[]] client sent HTTP/1.1 request without hostname *
failregex = [[]client (?P\S*)[]] script .* not found or unable to stat

#

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# standart search for favicon.ico and robots.txt - this is often thrown and may do stupid mistakes
# Values: TEXT
#
ignoreregex = .*(robots.txt|favicon.ico)

JPG verkleinern

for i in `ls *.jpg`; do convert -resize "AUFLÖSUNG" $i klein_dateiname.jpg; done

z.B.

for i in `ls *.jpg`; do convert -resize "1024x786" $i klein_$i; done

for i in `ls *.JPG`; do convert -resize "1024x786" $i klein_$i; done