I got a problem. Unfortunately, IPTables are not included in the Ubuntu kernel on the vps I used. Activate it would take some time, so I decided to reinstall my vps and use Debian 4 image instead. The steps for day 1 are the same as in ubuntu, only that sudo package is not installed by default. Install it by running:
debian:~# apt-get sudo
Now, check the iptables configuration:
cath@debian:~$ sudo iptables -L
We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:
#1) Respect the privacy of others.
#2) Think before you type.
#3) With great power comes great responsibility.
Password:
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
cath@debian:~$
Save old configuration (if any, usually the rules is still empty):
cath@debian:~$ sudo iptables-save > /etc/iptables.up.rules
Create new rules:
cath@debian:~$ sudo vim /etc/iptables.test.rules
*filter
# Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -i ! lo -d 127.0.0.0/8 -j REJECT
# Accepts all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allows all outbound traffic
-A OUTPUT -j ACCEPT
# Allows HTTP and HTTPS connections from anywhere (the normal ports for websites)
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT
# Allows SSH connections
#
# THE -dport NUMBER IS THE SAME ONE YOU SET UP IN THE SSHD_CONFIG FILE
#
-A INPUT -p tcp --dport 2987 -j ACCEPT
# Reject ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j REJECT
# log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
# Reject all other inbound - default deny unless explicitly allowed policy
-A INPUT -j REJECT
-A FORWARD -j REJECT
COMMIT
Use above rules in iptables:
cath@debian:~$ sudo iptables-restore < /etc/iptables.test.rules
Check it to see the differences:
cath@debian:~$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT 0 -- anywhere anywhere
REJECT 0 -- anywhere loopback/8 reject-with icmp-prt-unreachable
ACCEPT 0 -- anywhere anywhere state RELATED,ESTALISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:www
ACCEPT tcp -- anywhere anywhere tcp dpt:https
ACCEPT tcp -- anywhere anywhere tcp dpt:2987
REJECT icmp -- anywhere anywhere icmp echo-request eject-with icmp-port-unreachable
LOG 0 -- anywhere anywhere limit: avg 5/min brst 5 LOG level debug prefix `iptables denied: '
REJECT 0 -- anywhere anywhere reject-with icmp-prt-unreachable
Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT 0 -- anywhere anywhere reject-with icmp-prt-unreachable
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT 0 -- anywhere anywhere
cath@debian:~$
cath@debian:~$
cath@debian:~$ cath@debian:~$ sudo vim /etc/iptables.test.rules
-su: cath@debian:~$: command not found
cath@debian:~$
Finally, test it:
Pinging ppa16.vpsfarm.com [209.9.227.210] with 32 bytes of data:
Reply from 209.9.227.210: Destination port unreachable.
Reply from 209.9.227.210: Destination port unreachable.
Reply from 209.9.227.210: Destination port unreachable.
Reply from 209.9.227.210: Destination port unreachable.
Ping statistics for 209.9.227.210:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
There it is for day 2. I am searching again for other tips and tricks to secure our vps. Till then, good bye for now!
Showing posts with label vps. Show all posts
Showing posts with label vps. Show all posts
Thursday, May 28, 2009
Wednesday, May 20, 2009
Secure VPS Day 1: Use different port for SSH
One of my commercial project requires me to setup TRAC to manage the development phase. Hence, I need to secure my server that will host TRAC. I understand this is only basic but should be enough to start with.
Today, I will redirect the SSH to use other port. The idea behind it is that they way to login to the server needs IP Address (hostname), port number, username and password. IP Address/hostname you cannot do anything with this since this is the location of the server. Barebone VPS will use default values for port number (=22) and username (=root). There only left the password is unknown to the public. However, if we change the port number and not permitting root to login via ssh, instead using other user. We can DELAY people to get into your server. I said DELAY because it would be not too dificult to get the port number.
Step 1: login to your vps. I am using VPSFarm again. Check you email to get the password.
Step 2: Change the password to make it easier to you to remember but harder for other people to guess.
To access official Ubuntu documentation, please visit:http://help.ubuntu.com/
root@ubuntu-pristine:~# passwd
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
root@ubuntu-pristine:~#
Step 3: Add a new user specially for SSH connection, I would give it a name "onin".
root@ubuntu-pristine:~# adduser onin
Adding user `onin' ...
Adding new group `onin' (1000) ...
Adding new user `onin' (1000) with group `onin' ...
Creating home directory `/home/onin' ...
Copying files from `/etc/skel' ...
Enter new UNIX password:
Retype new UNIX password:
password updated successfully
Changing the user information for onin
Enter the new value, or press ENTER for the default
Full Name []: Onin
Room Number []:
Work Phone []:
Home Phone []:
Other []:
Is the information correct? [y/N] y
root@ubuntu-pristine:~#
Step 4: Change SSH setting.
root@ubuntu-pristine:~# vim /etc/ssh/sshd_config
Set these values to:
Port 2987(change to your choiche, on mine it is on line #5 )
PermitRootLogin no (line #26)
X11Forwarding no (line #62)
UsePAM no (line #77)
AllowUsers onin (added new on line #78)
Step 4: Restart SSH server. Do not close this session, for backup connection if somehow your new ssh setting does not work.
a. Test to connect to the server again using old setting, result: does not work! (as expected).
b. Login to the server again to the port 2987 user "root": does not work! (as expected).
login as: root
root@ppa16.vpsfarm.com's password:
Access denied
c. Login to the server using port 2987 and user "onin" : WORKING (hurray!).
Step 5: Now, you are on the server. You have a choice to :
a. sudo su
b. create another user and give this user "admin" rights (the reason, ubuntu usually discourage you work as root and prefer we work using a user with admin rights):
root@ubuntu-pristine:~# su -l root
root@ubuntu-pristine:~# adduser cath
Adding user 'cath' ...
Adding new group 'cath' (1001) ...
Adding new user 'cath' (1001) with group `cath' ...
Creating home directory `/home/cath' ...
Copying files from `/etc/skel' ...
Enter new UNIX password:
Retype new UNIX password:
password updated successfully
Changing the user information for cath
Enter the new value, or press ENTER for the default
Full Name []: Cath
Room Number []:
Work Phone []:
Home Phone []:
Other []:
Is the information correct? [y/N] y
root@ubuntu-pristine:~# visudo
The content of mine
# /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the man page for details on how to write a sudoers file.
#
Defaults env_reset
# Uncomment to allow members of group sudo to not need a password
# %sudo ALL=NOPASSWD: ALL
# Host alias specification
# User alias specification
# Cmnd alias specification
# User privilege specification
root ALL=(ALL) ALL
cath ALL=(ALL) ALL <-- add "cath" to here!
I opt b) for future references. That's all for today. See you next time!
Today, I will redirect the SSH to use other port. The idea behind it is that they way to login to the server needs IP Address (hostname), port number, username and password. IP Address/hostname you cannot do anything with this since this is the location of the server. Barebone VPS will use default values for port number (=22) and username (=root). There only left the password is unknown to the public. However, if we change the port number and not permitting root to login via ssh, instead using other user. We can DELAY people to get into your server. I said DELAY because it would be not too dificult to get the port number.
Step 1: login to your vps. I am using VPSFarm again. Check you email to get the password.
Step 2: Change the password to make it easier to you to remember but harder for other people to guess.
To access official Ubuntu documentation, please visit:http://help.ubuntu.com/
root@ubuntu-pristine:~# passwd
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
root@ubuntu-pristine:~#
Step 3: Add a new user specially for SSH connection, I would give it a name "onin".
root@ubuntu-pristine:~# adduser onin
Adding user `onin' ...
Adding new group `onin' (1000) ...
Adding new user `onin' (1000) with group `onin' ...
Creating home directory `/home/onin' ...
Copying files from `/etc/skel' ...
Enter new UNIX password:
Retype new UNIX password:
password updated successfully
Changing the user information for onin
Enter the new value, or press ENTER for the default
Full Name []: Onin
Room Number []:
Work Phone []:
Home Phone []:
Other []:
Is the information correct? [y/N] y
root@ubuntu-pristine:~#
Step 4: Change SSH setting.
root@ubuntu-pristine:~# vim /etc/ssh/sshd_config
Set these values to:
Port 2987(change to your choiche, on mine it is on line #5 )
PermitRootLogin no (line #26)
X11Forwarding no (line #62)
UsePAM no (line #77)
AllowUsers onin (added new on line #78)
Step 4: Restart SSH server. Do not close this session, for backup connection if somehow your new ssh setting does not work.
a. Test to connect to the server again using old setting, result: does not work! (as expected).
b. Login to the server again to the port 2987 user "root": does not work! (as expected).
login as: root
root@ppa16.vpsfarm.com's password:
Access denied
c. Login to the server using port 2987 and user "onin" : WORKING (hurray!).
Step 5: Now, you are on the server. You have a choice to :
a. sudo su
b. create another user and give this user "admin" rights (the reason, ubuntu usually discourage you work as root and prefer we work using a user with admin rights):
root@ubuntu-pristine:~# su -l root
root@ubuntu-pristine:~# adduser cath
Adding user 'cath' ...
Adding new group 'cath' (1001) ...
Adding new user 'cath' (1001) with group `cath' ...
Creating home directory `/home/cath' ...
Copying files from `/etc/skel' ...
Enter new UNIX password:
Retype new UNIX password:
password updated successfully
Changing the user information for cath
Enter the new value, or press ENTER for the default
Full Name []: Cath
Room Number []:
Work Phone []:
Home Phone []:
Other []:
Is the information correct? [y/N] y
root@ubuntu-pristine:~# visudo
The content of mine
# /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the man page for details on how to write a sudoers file.
#
Defaults env_reset
# Uncomment to allow members of group sudo to not need a password
# %sudo ALL=NOPASSWD: ALL
# Host alias specification
# User alias specification
# Cmnd alias specification
# User privilege specification
root ALL=(ALL) ALL
cath ALL=(ALL) ALL <-- add "cath" to here!
I opt b) for future references. That's all for today. See you next time!
Friday, May 30, 2008
ISPConfig preparation
I am trying to install ISPConfig, see this link for the preparation. http://www.howtoforge.org/perfect-server-ubuntu8.04-lts-p4. I start at step 9.
I got trouble in step 12. Since this is VPS and the filesystem used is weird to me, I skip it first, see whether ISPConfig can still work without installing quota.
Today, I stopped at step 14. Continue later......
I got trouble in step 12. Since this is VPS and the filesystem used is weird to me, I skip it first, see whether ISPConfig can still work without installing quota.
Today, I stopped at step 14. Continue later......
Monday, May 26, 2008
Upgrade dapper to hardy
After dapper image is loaded to my server, now the time for upgrade begin:
1. root@server:~# vim /etc/apt/sources.list
delete all lines, then type these:
deb http://us.archive.ubuntu.com/ubuntu dapper main restricted multiverse universe
deb http://us.archive.ubuntu.com/ubuntu dapper-updates main restricted multiverse universe
deb http://us.archive.ubuntu.com/ubuntu dapper-security main restricted multiverse universe
deb-src http://us.archive.ubuntu.com/ubuntu dapper main restricted multiverse universe
deb-src http://us.archive.ubuntu.com/ubuntu dapper-updates main restricted multiverse universe
deb-src http://us.archive.ubuntu.com/ubuntu dapper-security main restricted multiverse universe
2. run these commands to update your changes above.
root@server:~# apt-get update
root@server:~# apt-get upgrade
root@server:~# apt-get dist-upgrade
3. install update-manager-core.
root@server:~# apt-get install update-manager-core
4. do the upgrade, and follow the instructions there.
root@server:~# do-release-upgrade -d
5. you may clean up the packages archive using:
root@server:~# apt-get clean
Now, you have dapper upgraded to hardy. Time to play with my upgraded vps now!
Note:
There is a locale setting error occurs like in the previous vps provider. However, the soltion I wrote in the past is not working this time. I found new solution here: https://bugs.launchpad.net/ubuntu/+source/langpack-locales/+bug/63687
Don't forget, in vps usually you access the server using root. If you have access other than root, don't forget to put sudo before the commands or sudo password root and sudo su.
1. root@server:~# vim /etc/apt/sources.list
delete all lines, then type these:
deb http://us.archive.ubuntu.com/ubuntu dapper main restricted multiverse universe
deb http://us.archive.ubuntu.com/ubuntu dapper-updates main restricted multiverse universe
deb http://us.archive.ubuntu.com/ubuntu dapper-security main restricted multiverse universe
deb-src http://us.archive.ubuntu.com/ubuntu dapper main restricted multiverse universe
deb-src http://us.archive.ubuntu.com/ubuntu dapper-updates main restricted multiverse universe
deb-src http://us.archive.ubuntu.com/ubuntu dapper-security main restricted multiverse universe
2. run these commands to update your changes above.
root@server:~# apt-get update
root@server:~# apt-get upgrade
root@server:~# apt-get dist-upgrade
3. install update-manager-core.
root@server:~# apt-get install update-manager-core
4. do the upgrade, and follow the instructions there.
root@server:~# do-release-upgrade -d
5. you may clean up the packages archive using:
root@server:~# apt-get clean
Now, you have dapper upgraded to hardy. Time to play with my upgraded vps now!
Note:
There is a locale setting error occurs like in the previous vps provider. However, the soltion I wrote in the past is not working this time. I found new solution here: https://bugs.launchpad.net/ubuntu/+source/langpack-locales/+bug/63687
Don't forget, in vps usually you access the server using root. If you have access other than root, don't forget to put sudo before the commands or sudo password root and sudo su.
Change VPS provider!
Since somehow paypal refused my payment to vpsfarm. I need to find new vps provider. I choose ihostvps.com. Quite good offer and great in handling tickets.
I start again my experience with vps. First of all, i install the ubuntu image. Old version, dapper, but I am planning it to upgrade to hardy.
Wait and see! ihost comes with LXAdmin cp, so i can just set my root password directly. Now, I could not wait to start my project with it.
I start again my experience with vps. First of all, i install the ubuntu image. Old version, dapper, but I am planning it to upgrade to hardy.
Wait and see! ihost comes with LXAdmin cp, so i can just set my root password directly. Now, I could not wait to start my project with it.
Thursday, August 23, 2007
installing ldap server
Easy steps to install LDAP Server:
% apt-get install slapd ldap-utils
Towards the end of the installation process you are asked to answer some configurations questions, if you get errors, just skipped the configuration process then use below command to configure it:
% dpkg-reconfigure slapd
Omit OpenLDAP server configuration? ... No
DNS domain name: ... [enter your domain name here, say example.com]
Name of your organization: ... [enter your organization name here]
Admin Password: XXXXX
Confirm Password: XXXXX
OK
choose Berkeley DB --> BDB
Do you want your database to be removed when slapd is purged? ... No
Move old database? ... Yes
Allow LDAPv2 Protocol? ... Yes/No [Depends on your situation]
To test it use:
% ldapsearch -x -b dc=example,dc=com
If you encountered this error message: ldap_bind: Can't contact LDAP server (-1)
it may caused by the ldap server not started yet, so try to start it using:
% /etc/init.d/slapd start
% apt-get install slapd ldap-utils
Towards the end of the installation process you are asked to answer some configurations questions, if you get errors, just skipped the configuration process then use below command to configure it:
% dpkg-reconfigure slapd
Omit OpenLDAP server configuration? ... No
DNS domain name: ... [enter your domain name here, say example.com]
Name of your organization: ... [enter your organization name here]
Admin Password: XXXXX
Confirm Password: XXXXX
OK
choose Berkeley DB --> BDB
Do you want your database to be removed when slapd is purged? ... No
Move old database? ... Yes
Allow LDAPv2 Protocol? ... Yes/No [Depends on your situation]
To test it use:
% ldapsearch -x -b dc=example,dc=com
If you encountered this error message: ldap_bind: Can't contact LDAP server (-1)
it may caused by the ldap server not started yet, so try to start it using:
% /etc/init.d/slapd start
locales problem
During my revisited to my vps, I encountered this error:
perl: warning: Please check that your locale settings:
LANGUAGE = (unset),
LC_ALL = (unset),
LANG = "en_US"
are supported and installed on your system.
perl: warning: Falling back to the standard locale ("C").
After googling, I found out that the problem is with the locales being not installed on the system. In order to install it:
% apt-get install locales
% dpkg-reconfigure locales
just choose everything started with en_US, and choose the default as en_US.
That's it, no more locales error message!
perl: warning: Please check that your locale settings:
LANGUAGE = (unset),
LC_ALL = (unset),
LANG = "en_US"
are supported and installed on your system.
perl: warning: Falling back to the standard locale ("C").
After googling, I found out that the problem is with the locales being not installed on the system. In order to install it:
% apt-get install locales
% dpkg-reconfigure locales
just choose everything started with en_US, and choose the default as en_US.
That's it, no more locales error message!
Friday, June 29, 2007
vps: ftp server
second things that is checked by isponfig installation is ftp server. I will install proftpd:
debian:~# apt-get install proftpd ucf
[choose standalone when asked inetd / standalone]
debian:~# vim /etc/proftpd/proftpd.conf
in line 10: set
UseIPv6 off
add in line 12:
DefaultRoot ~
IdentLookups off
ServerIdent on "FTP Server ready."
create a link in /etc as ispconfig need it, then restart proftpd:
debian:~# ln -s /etc/proftpd/proftpd.conf /etc/proftpd.conf
debian:~# /etc/init.d/proftpd restart
Stopping ftp server: proftpd.
Starting ftp server: proftpd.
debian:~#
Now, finish with the proftpd installation.
debian:~# apt-get install proftpd ucf
[choose standalone when asked inetd / standalone]
debian:~# vim /etc/proftpd/proftpd.conf
in line 10: set
UseIPv6 off
add in line 12:
DefaultRoot ~
IdentLookups off
ServerIdent on "FTP Server ready."
create a link in /etc as ispconfig need it, then restart proftpd:
debian:~# ln -s /etc/proftpd/proftpd.conf /etc/proftpd.conf
debian:~# /etc/init.d/proftpd restart
Stopping ftp server: proftpd.
Starting ftp server: proftpd.
debian:~#
Now, finish with the proftpd installation.
vps: quota
Other requirements to install ispconfig is quota. To install quota, run:
debian:~# apt-get install quota
Edit /etc/fstab:
debian:~# vim /etc/fstab
Add usrquota,grpquota to partition with the mount point "/", in my case: /dev/sda1.
/dev/sda1 / ext3 defaults,usrquota,grpquota 1 1
Enable quota by:
debian:~# touch /aquota.user /aquota.group
debian:~# chmod 600 /aquota.*
[this is from my experience, somehow it is best to turn quota off before doing checking
and use aquota.user and aquota.group, if we use quota.user and quota.group, sometimes the kernel unsupported error message will be appeared]
debian:~# quotaoff -a
debian:~# quotacheck -avugm
quotacheck: Scanning /dev/sda1 [/] done
quotacheck: Checked 9318 directories and 80043 files
debian:~# quotaon -avug
Finish, with the quota problem.
debian:~# apt-get install quota
Edit /etc/fstab:
debian:~# vim /etc/fstab
Add usrquota,grpquota to partition with the mount point "/", in my case: /dev/sda1.
/dev/sda1 / ext3 defaults,usrquota,grpquota 1 1
Enable quota by:
debian:~# touch /aquota.user /aquota.group
debian:~# chmod 600 /aquota.*
[this is from my experience, somehow it is best to turn quota off before doing checking
and use aquota.user and aquota.group, if we use quota.user and quota.group, sometimes the kernel unsupported error message will be appeared]
debian:~# quotaoff -a
debian:~# quotacheck -avugm
quotacheck: Scanning /dev/sda1 [/] done
quotacheck: Checked 9318 directories and 80043 files
debian:~# quotaon -avug
Finish, with the quota problem.
vps: sendmail
In order to be able to install ispconfig, we need to have mail transfer agent (MTA). I choode to install sendmail for this case.
debian:~# apt-get install sendmail
that's all you need!
debian:~# apt-get install sendmail
that's all you need!
Thursday, June 28, 2007
vps: webmin and usermin
Most people think that a console is the sys admin only tools. I am disagree with that. GUI is not that bad. Especially, for occasional sys admin like me :)
Webmin and Usermin are one of many good tools to do that. To install it do:
1. Get the latest debian packages, by simply run:
debian:~# wget http://prdownloads.sourceforge.net/webadmin/webmin_1.350_all.deb
debian:~# wget http://prdownloads.sourceforge.net/webadmin/usermin_1.280_all.deb
2. Then install their dependent packages:
debian:~# apt-get install openssl libnet-ssleay-perl libauthen-pam-perl libio-pty-perl libmd5-perl
[openssl is required in my vps, while I don't find it in the instruction.]
3. Now, you can install webmin/usermin package without error message:
debian:~# dpkg -i webmin_1.350_all.deb usermin_1.280_all.deb
4. also update your rc*.d and so webmin/usermin will startup correctly, and able to manage by using rcconf:
debian:~# rm -rvf /etc/rc*d/S*webmin*
debian:~# rm -rvf /etc/rc*d/K*webmin*
debian:~# rm -rvf /etc/rc*d/S*usermin*
debian:~# rm -rvf /etc/rc*d/K*usermin*
debian:~# update-rc.d -f webmin defaults 99 01
debian:~# update-rc.d -f usermin defaults 99 01
5. you can now log into your webmin interface by
https://www.example.com:10000 for webmin, and
https://www.example.com:20000 for usermin
Enjoy the GUI Server Management!
sources: http://edin.no-ip.com/html/?q=webmin_usermin_debian_etch_mini_howto
Webmin and Usermin are one of many good tools to do that. To install it do:
1. Get the latest debian packages, by simply run:
debian:~# wget http://prdownloads.sourceforge.net/webadmin/webmin_1.350_all.deb
debian:~# wget http://prdownloads.sourceforge.net/webadmin/usermin_1.280_all.deb
2. Then install their dependent packages:
debian:~# apt-get install openssl libnet-ssleay-perl libauthen-pam-perl libio-pty-perl libmd5-perl
[openssl is required in my vps, while I don't find it in the instruction.]
3. Now, you can install webmin/usermin package without error message:
debian:~# dpkg -i webmin_1.350_all.deb usermin_1.280_all.deb
4. also update your rc*.d and so webmin/usermin will startup correctly, and able to manage by using rcconf:
debian:~# rm -rvf /etc/rc*d/S*webmin*
debian:~# rm -rvf /etc/rc*d/K*webmin*
debian:~# rm -rvf /etc/rc*d/S*usermin*
debian:~# rm -rvf /etc/rc*d/K*usermin*
debian:~# update-rc.d -f webmin defaults 99 01
debian:~# update-rc.d -f usermin defaults 99 01
5. you can now log into your webmin interface by
https://www.example.com:10000 for webmin, and
https://www.example.com:20000 for usermin
Enjoy the GUI Server Management!
sources: http://edin.no-ip.com/html/?q=webmin_usermin_debian_etch_mini_howto
Wednesday, June 27, 2007
vps: installing name server, bind9
Name server is needed to manage the hostname to ip address matching. Usually, we use BIND in linux. To install it in my vps, I follow the instructions in http://www.howtoforge.com/perfect_setup_debian_etch_p4 :
debian:~# apt-get install bind9
For security reasons, run BIND chrooted:
debian:~# /etc/init.d/bind9 stop
Stopping domain name service...: bind.
debian:~# vim /etc/default/bind9
edit line 1, so become:
OPTIONS="-u bind -t /var/lib/named"
Create some necessary directories under /var/lib:
debian:~# mkdir -p /var/lib/named/etc
debian:~# mkdir /var/lib/named/dev
debian:~# mkdir -p /var/lib/named/var/cache/bind
debian:~# mkdir -p /var/lib/named/var/run/bind/run
Then move the configuration directory from /etc to /var/lib/named/etc:
debian:~# mv /etc/bind /var/lib/named/etc
Create a symbolic link to the new configuration directory from the old location (to avoid problems when bind gets updated in the future):
debian:~# ln -s /var/lib/named/etc/bind /etc/bind
Make null and random devices, and fix permissions of the directories:
debian:~# mknod /var/lib/named/dev/null c 1 3
debian:~# mknod /var/lib/named/dev/random c 1 8
debian:~# chmod 666 /var/lib/named/dev/null /var/lib/named/dev/random
debian:~# chown -R bind:bind /var/lib/named/var/*
debian:~# chown -R bind:bind /var/lib/named/etc/bind
We need to modify /etc/default/syslogd so that we can still get important messages logged to the system logs.
debian:~# vim /etc/default/syslogd
edit line 13, so become:
SYSLOGD="-a /var/lib/named/dev/log"
Restart the logging daemon:
debian:~# /etc/init.d/sysklogd restart
Restarting system log daemon: syslogd.
Start up BIND, and check /var/log/syslog for errors:
debian:~# /etc/init.d/bind9 start
Starting domain name service...: bind.
debian:~#
sources: http://www.howtoforge.com/perfect_setup_debian_etch_p4
debian:~# apt-get install bind9
For security reasons, run BIND chrooted:
debian:~# /etc/init.d/bind9 stop
Stopping domain name service...: bind.
debian:~# vim /etc/default/bind9
edit line 1, so become:
OPTIONS="-u bind -t /var/lib/named"
Create some necessary directories under /var/lib:
debian:~# mkdir -p /var/lib/named/etc
debian:~# mkdir /var/lib/named/dev
debian:~# mkdir -p /var/lib/named/var/cache/bind
debian:~# mkdir -p /var/lib/named/var/run/bind/run
Then move the configuration directory from /etc to /var/lib/named/etc:
debian:~# mv /etc/bind /var/lib/named/etc
Create a symbolic link to the new configuration directory from the old location (to avoid problems when bind gets updated in the future):
debian:~# ln -s /var/lib/named/etc/bind /etc/bind
Make null and random devices, and fix permissions of the directories:
debian:~# mknod /var/lib/named/dev/null c 1 3
debian:~# mknod /var/lib/named/dev/random c 1 8
debian:~# chmod 666 /var/lib/named/dev/null /var/lib/named/dev/random
debian:~# chown -R bind:bind /var/lib/named/var/*
debian:~# chown -R bind:bind /var/lib/named/etc/bind
We need to modify /etc/default/syslogd so that we can still get important messages logged to the system logs.
debian:~# vim /etc/default/syslogd
edit line 13, so become:
SYSLOGD="-a /var/lib/named/dev/log"
Restart the logging daemon:
debian:~# /etc/init.d/sysklogd restart
Restarting system log daemon: syslogd.
Start up BIND, and check /var/log/syslog for errors:
debian:~# /etc/init.d/bind9 start
Starting domain name service...: bind.
debian:~#
sources: http://www.howtoforge.com/perfect_setup_debian_etch_p4
Tuesday, June 26, 2007
securing vps[4]: turn off directory browsing
Directory browsing is good for intranet with low security, as you do not need separate html coding to produce indexes. But for a web server it is not a good practice. In order to turn it off, edit default file in /etc/apache2/sites-available:
debian:~# cd /etc/apache2/sites-available/
debian:/etc/apache2/sites-available# vim default
add "-" before Indexes in line 11,
Options -Indexes FollowSymLinks MultiViews
don't forget to restart the apache.,
debian:/etc/apache2/sites-available# /etc/init.d/apache2 restart
Forcing reload of web server (apache2)....
debian:/etc/apache2/sites-available#
Now, you will get 403 Forbidden instead of the indexes page.
debian:~# cd /etc/apache2/sites-available/
debian:/etc/apache2/sites-available# vim default
add "-" before Indexes in line 11,
Options -Indexes FollowSymLinks MultiViews
don't forget to restart the apache.,
debian:/etc/apache2/sites-available# /etc/init.d/apache2 restart
Forcing reload of web server (apache2)....
debian:/etc/apache2/sites-available#
Now, you will get 403 Forbidden instead of the indexes page.
Saturday, June 23, 2007
securing vps[3]: hide apache version
It's apache turn. The web server still showing its identity when we telnet it. Edit apache2.conf in /etc/apache2/apache2.conf
debian:~# cd /etc/apache2/
debian:/etc/apache2# ls
apache2.conf envvars mods-available ports.conf sites-enabled
conf.d httpd.conf mods-enabled sites-available
debian:/etc/apache2# vi apache2.conf
# only display 'apache'
ServerTokens ProductOnly
# do not display additional information
ServerSignature Off
Don't forget to restart the web service,
debian:/etc/apache2# /etc/init.d/apache2 restart
Forcing reload of web server (apache2)....
debian:/etc/apache2#
The output become:
daniel-adinugrohos-computer:~ adinugro$ telnet xxxx.vpsfarm.com 80
Trying 209.9.228.xxx...
Connected to xxxx.vpsfarm.com.
Escape character is '^]'.
HEAD / HTTP/1.1
HTTP/1.1 400 Bad Request
Date: Sat, 23 Jun 2007 14:05:04 GMT
Server: Apache
Connection: close
Content-Type: text/html; charset=iso-8859-1
Connection closed by foreign host.
daniel-adinugrohos-computer:~ adinugro$
See the differences!
debian:~# cd /etc/apache2/
debian:/etc/apache2# ls
apache2.conf envvars mods-available ports.conf sites-enabled
conf.d httpd.conf mods-enabled sites-available
debian:/etc/apache2# vi apache2.conf
# only display 'apache'
ServerTokens ProductOnly
# do not display additional information
ServerSignature Off
Don't forget to restart the web service,
debian:/etc/apache2# /etc/init.d/apache2 restart
Forcing reload of web server (apache2)....
debian:/etc/apache2#
The output become:
daniel-adinugrohos-computer:~ adinugro$ telnet xxxx.vpsfarm.com 80
Trying 209.9.228.xxx...
Connected to xxxx.vpsfarm.com.
Escape character is '^]'.
HEAD / HTTP/1.1
HTTP/1.1 400 Bad Request
Date: Sat, 23 Jun 2007 14:05:04 GMT
Server: Apache
Connection: close
Content-Type: text/html; charset=iso-8859-1
Connection closed by foreign host.
daniel-adinugrohos-computer:~ adinugro$
See the differences!
securing vps[2]: secure php version information
Knowing the version of php is big advantage for a hacker. He or she can use the unpatched hole to attack the web server. Try this (see the bold words):
daniel-adinugrohos-computer:~ adinugro$ telnet xxxx.vpsfarm.com 80
Trying 209.9.228.xxx...
Connected to xxxx.vpsfarm.com.
Escape character is '^]'.
GET / HTTP/1.1 [type enter twice here]
[the output will be:]
HTTP/1.1 400 Bad Request
Date: Fri, 22 Jun 2007 23:05:06 GMT
Server: Apache/2.2.3 (Debian) PHP/5.2.0-8+etch4
Content-Length: 335
Connection: close
Content-Type: text/html; charset=iso-8859-1
In order to secure this, we must edit the php setting in php.ini. Do this:
debian:~# cd /etc/php5/apache2/
debian:/etc/php5/apache2# ls
conf.d php.ini
debian:/etc/php5/apache2# vi php.ini
# remove X-Powered-By
expose_php = Off [in line 260]
# also turn of the error information, it is the best practice for production server.
display_errors= Off [in line 323]
# don't forget to restart the web server:
debian:~# /etc/init.d/apache2 restart
Forcing reload of web server (apache2)....
debian:~#
Now, try again the testing:
daniel-adinugrohos-computer:~ adinugro$ telnet xxxx.vpsfarm.com 80
Trying 209.9.228.xxx...
Connected to xxxx.vpsfarm.com.
Escape character is '^]'.
GET / HTTP/1.1 [type enter twice here]
HTTP/1.1 400 Bad Request
Date: Fri, 22 Jun 2007 23:51:10 GMT
Server: Apache/2.2.3 (Debian)
Connection: close
Content-Type: text/html; charset=iso-8859-1
Connection closed by foreign host.
daniel-adinugrohos-computer:~ adinugro$
See the differences! It is not finish yet as the apache version is still shown. Next post will be how to turn off that!
daniel-adinugrohos-computer:~ adinugro$ telnet xxxx.vpsfarm.com 80
Trying 209.9.228.xxx...
Connected to xxxx.vpsfarm.com.
Escape character is '^]'.
GET / HTTP/1.1 [type enter twice here]
[the output will be:]
HTTP/1.1 400 Bad Request
Date: Fri, 22 Jun 2007 23:05:06 GMT
Server: Apache/2.2.3 (Debian) PHP/5.2.0-8+etch4
Content-Length: 335
Connection: close
Content-Type: text/html; charset=iso-8859-1
In order to secure this, we must edit the php setting in php.ini. Do this:
debian:~# cd /etc/php5/apache2/
debian:/etc/php5/apache2# ls
conf.d php.ini
debian:/etc/php5/apache2# vi php.ini
# remove X-Powered-By
expose_php = Off [in line 260]
# also turn of the error information, it is the best practice for production server.
display_errors= Off [in line 323]
# don't forget to restart the web server:
debian:~# /etc/init.d/apache2 restart
Forcing reload of web server (apache2)....
debian:~#
Now, try again the testing:
daniel-adinugrohos-computer:~ adinugro$ telnet xxxx.vpsfarm.com 80
Trying 209.9.228.xxx...
Connected to xxxx.vpsfarm.com.
Escape character is '^]'.
GET / HTTP/1.1 [type enter twice here]
HTTP/1.1 400 Bad Request
Date: Fri, 22 Jun 2007 23:51:10 GMT
Server: Apache/2.2.3 (Debian)
Connection: close
Content-Type: text/html; charset=iso-8859-1
Connection closed by foreign host.
daniel-adinugrohos-computer:~ adinugro$
See the differences! It is not finish yet as the apache version is still shown. Next post will be how to turn off that!
Friday, June 22, 2007
vps: remove default apache redirection
Apache has default page to tell us that the installation was succesful. Once, we are satisfy with the result, remove the redirection by doing this:
debian:~# cd /etc/apache2/sites-available/
debian:/etc/apache2/sites-available# ls
default
debian:/etc/apache2/sites-available# vi default
find the RedirectMatch line, in my case it is in line 46. Comment it out by placing '#' in front of it:
#RedirectMatch ^/$ /apache2-default/
Finally, check whether the redirection is removed by creating a simple index.php, don't forget to restart the apache, then go to your web browser to check whether you are redirected or not.
debian:/etc/apache2/sites-available# /etc/init.d/apache2 restart
Forcing reload of web server (apache2)....
You can simply remove the apache-default directory as it is unused anymore.
debian:/var/www# rm -rf apache2-default/
Now, your web server ready to serve!
debian:~# cd /etc/apache2/sites-available/
debian:/etc/apache2/sites-available# ls
default
debian:/etc/apache2/sites-available# vi default
find the RedirectMatch line, in my case it is in line 46. Comment it out by placing '#' in front of it:
#RedirectMatch ^/$ /apache2-default/
Finally, check whether the redirection is removed by creating a simple index.php, don't forget to restart the apache, then go to your web browser to check whether you are redirected or not.
debian:/etc/apache2/sites-available# /etc/init.d/apache2 restart
Forcing reload of web server (apache2)....
You can simply remove the apache-default directory as it is unused anymore.
debian:/var/www# rm -rf apache2-default/
Now, your web server ready to serve!
Thursday, June 21, 2007
securing vps[1]: change mysql password
Installing phpmyadmin will help us in managing our mysql database. In my opinion, it is not only for beginner, but for advanced user as well.
Our mysql server has no password for root. It is very dangerous! We can change the password via mysql client [why I chose to install mysql-client], but I like to use phpmyadmin.
1. First thing first, go to the phpmyadmin on our server, login as root with blank password.
2. Choose mysql(17) database on the left menu.
3. Find user table, and click on it.
4. Click on Browse tab, to get the content of this table.
5. In order to change the password, click the pen picture on the row which has user = root and Host = localhost.
6. On the next window, type your password and don't forget to apply Password on the Function field. Click on Go button to save the changes.
7. Apply the same changes to the all root account. You can use the same password for all of the root password depend on your situation.
8. Now, I have changed the password. Choose the Home button on the left side menu. Then, Choose Reload Privileges to flush all the privileges, and click on Go button.
9. We will forward to the login page again. Try to login using root with blank password, your login will be failed.
10. Try with the new password and you can use phpmyadmin again.
Next, I am tending to change the name of phpmyadmin as well. This is just to hide my phpmyadmin from outsiders. By doing this, they have to guess where is the phpmyadmin and the password for root. If you still use phpmyamdmin directory, hackers only need to guess or crack the root password. The way to do it is just renaming the phpmyadmin directory with other name, for example: nasicampur, basisdata, etc.
debian:~# cd /var/www/
debian:/var/www# ls
apache2-default phpmyadmin test.php
debian:/var/www# mv phpmyadmin nasipadang
debian:/var/www# ls
apache2-default nasipadang test.php
debian:/var/www#
Test by go to the your server with nasipadang directory. You will get the phpmyadmin login page.
[Again, for security reason, I has changed again the directory's name.]
Our mysql server has no password for root. It is very dangerous! We can change the password via mysql client [why I chose to install mysql-client], but I like to use phpmyadmin.
1. First thing first, go to the phpmyadmin on our server, login as root with blank password.
2. Choose mysql(17) database on the left menu.
3. Find user table, and click on it.
4. Click on Browse tab, to get the content of this table.
5. In order to change the password, click the pen picture on the row which has user = root and Host = localhost.
6. On the next window, type your password and don't forget to apply Password on the Function field. Click on Go button to save the changes.
7. Apply the same changes to the all root account. You can use the same password for all of the root password depend on your situation.
8. Now, I have changed the password. Choose the Home button on the left side menu. Then, Choose Reload Privileges to flush all the privileges, and click on Go button.
9. We will forward to the login page again. Try to login using root with blank password, your login will be failed.
10. Try with the new password and you can use phpmyadmin again.
Next, I am tending to change the name of phpmyadmin as well. This is just to hide my phpmyadmin from outsiders. By doing this, they have to guess where is the phpmyadmin and the password for root. If you still use phpmyamdmin directory, hackers only need to guess or crack the root password. The way to do it is just renaming the phpmyadmin directory with other name, for example: nasicampur, basisdata, etc.
debian:~# cd /var/www/
debian:/var/www# ls
apache2-default phpmyadmin test.php
debian:/var/www# mv phpmyadmin nasipadang
debian:/var/www# ls
apache2-default nasipadang test.php
debian:/var/www#
Test by go to the your server with nasipadang directory. You will get the phpmyadmin login page.
[Again, for security reason, I has changed again the directory's name.]
Wednesday, June 20, 2007
installing LAMP on vps
Nowadays, Linux is becoming easier to install. More supports and wider community means more people are willing to help you out there.
Me next task is setting up LAMP on my vps. Being a debian 4 server, I will use the magic of apt-get.
# just to update the package system
debian:~# apt-get update
# install mysql first, to be able to be picked up by Apache
# also install the client, for debugging purpose
# use meta package mysql-server and mysql-client to get the newest version
debian:~# apt-get install mysql-server mysql-client
# for basic apache+php5 install, do this!
# don't forget to install mpm-prefork to get better multi-threaded support
debian:~# apt-get install apache2 apache2-mpm-prefork php5
# don't forget to install phpmyadmin, to manage your mysql easily.
debian:~# apt-get install phpmyadmin
Testing my setup by open it in the web browser shows, the apache default message "It works!", Also, test the phpmyadmin by open it in the web browser. [At the moment, I don't publish the url as the server has not been secured yet.]
That's all for today. But my jobs has not finished yet. Next is how to secure the LAMP server.
Me next task is setting up LAMP on my vps. Being a debian 4 server, I will use the magic of apt-get.
# just to update the package system
debian:~# apt-get update
# install mysql first, to be able to be picked up by Apache
# also install the client, for debugging purpose
# use meta package mysql-server and mysql-client to get the newest version
debian:~# apt-get install mysql-server mysql-client
# for basic apache+php5 install, do this!
# don't forget to install mpm-prefork to get better multi-threaded support
debian:~# apt-get install apache2 apache2-mpm-prefork php5
# don't forget to install phpmyadmin, to manage your mysql easily.
debian:~# apt-get install phpmyadmin
Testing my setup by open it in the web browser shows, the apache default message "It works!", Also, test the phpmyadmin by open it in the web browser. [At the moment, I don't publish the url as the server has not been secured yet.]
That's all for today. But my jobs has not finished yet. Next is how to secure the LAMP server.
Tuesday, June 19, 2007
vps, first thing to do!
More than a month, I have been toying around with the vps. Now, I just want to record my activities with it. I think it is very easy. I use vpsfarm @ www.vpsfarm.com. I think they don't have any machines left at the moment.
I choose debian as it is the root of ubuntu. Five minutes after installation, they send me the password via email.
First thing to do, change the password. it must be unique, between 8-12 characters, combination of upper case, lower case and numbers.
the command is:
debian:~# passwd
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
debian:~#
You must enter the same password twice, to avoid mistyping the password as the character you typed is not shown in the screen.
It's all done! Next is how we install LAMP into it.
I choose debian as it is the root of ubuntu. Five minutes after installation, they send me the password via email.
First thing to do, change the password. it must be unique, between 8-12 characters, combination of upper case, lower case and numbers.
the command is:
debian:~# passwd
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
debian:~#
You must enter the same password twice, to avoid mistyping the password as the character you typed is not shown in the screen.
It's all done! Next is how we install LAMP into it.
Subscribe to:
Posts (Atom)