PFSense – An Awesome Firewall

pfSense is an open source firewall/router distribution based on FreeBSD. pfSense is meant to be installed on a personal computer and is noted for its reliability and offering features often only found in expensive commercial firewalls. It can be configured and upgraded through a web-based interface, and requires no knowledge of the underlying FreeBSD system to manage. pfSense is commonly deployed as a Perimeter Firewall, router, wireless access point, DHCP server, DNS server, and as a VPN endpoint.

The name was derived from the fact that it helps make the OpenBSD packet-filtering tool pf make more sense to non-technical users.

PFSense Download : http://mirror.myip.be/pub/pfsense/downloads/
Full Installation Guide : http://www.impromptu-it.com/?p=179

Trojans and Rootkit Detector – Rootcheck Installation and Configuration

RootCheck is an Open Source software that scans all the system looking for possible problems (RootKit Detection), system auditing and policy monitoring parts of OSSEC. The result of the scan can be sent to an e-mail and you can choose between the html or text format.

It is a very simple software. Just download, unpack, compile and execute it. It will scan the whole system and print if it founds or not anything.

Installation of RootCheck,

# wget http://www.ossec.net/rootcheck/files/rootcheck-2.0.tar.gz

# tar -zxvf rootcheck-2.0.tar.gz

# cd rootcheck-2.0

# make

#  ./ossec-rootcheck

DoS Attack Detection In Linux

You can simply use netstat command to print out a list of all open connection to your Linux box. The list will be sorted out using sort command including total number of connections from a specific IP address.

Login as the root user and type the following command,

# netstat -ntu | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n

Disable The Ping Response On Linux?

Sometimes you may want to disable ping response for many reasons, may be for a security reason… This article explains how do I disable the ping response on Linux ?

Disable ping response Temporarily

To disable the PING response, login as root and type the following command

# echo 1 >/proc/sys/net/ipv4/icmp_echo_ignore_all

To reenable the PING response do this:

# echo 0 >/proc/sys/net/ipv4/icmp_echo_ignore_all

Disable ping response Permanently

Edit the /etc/sysctl.conf file and add the following line

net.ipv4.conf.icmp_echo_ignore_all = 1

Execute sysctl -p to enforce this setting immediately

# sysctl -p

Redhat / CentOS / Fedora Linux Open Port

Q. I’ve Redhat Enterprise Linux 5 server with Iptabeles firewall enabled. By default it is only allowing port 22. How do I open port 80 / 143 / 110 on Linux? I've started all services but don't know how to open port using iptables.

A. By default iptables firewall stores its configuration at /etc/sysconfig/iptables file. You need to edit this file and add rules to open port number. This file only avilable under
Red Hat Enterprise Linux 3 / 4 / 5 and above
=> Old Red hat Linux version
=> CentOS 4 and above
=> Fedora Linux

Open port 80

Open flle /etc/sysconfig/iptables:
[root@daddylinux~]# vi /etc/sysconfig/iptables
 

Append rule as follows:
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
 
Save and close the file. Restart iptables:
[root@daddylinux~]# /etc/init.d/iptables restart

Fedora 10 Enable GUI Root Login

Q. How do I enable root login under Fedora 10 Gnome GUI login screen / manager?

A. Fedora 10 uses pam module called pam_succeed_if.so. This module is designed to succeed or fail authentication based on characteristics of the account belonging to the user being authenticated. One use is to select whether to load other modules based on this test. This module blocks root login using GUI.

Login as root

01. Then open GUI terminal (bash prompt) and type the following command to become root user:

[uddika@daddylinux~]$ su –

How to Backup MBR - Master Boot Record

The MBR (master boot record) is located at cylinder 0, head 0, and sector 1. It's the very first sector of the hard drive and it is 512 bytes in size. When the BIOS boot your machine it looks in the MBR for information on your partitions and the initial boot loader. The MBR contains a partition table and boot code. The boot code executes and then transfers the process to the boot loader program on your active (bootable) partition.

We can take the backup of MBR either to a floppy disk or to a CDROM.

01. Backup to a floppy:

[root@daddylinux~]# dd if=/dev/hda of=/dev/fd0 bs=512 count=1

02. Backup to CDR:

First, create the MBR backup to a file on your hard drive.

[root@daddylinux~]#dd if=/dev/hda of=mbr.bak bs=512 count=1

Now, burn the file you just created to CDR.

Creating a super user with root rights

Sudo is a program which can be used by normal users to execute programs as super user or any other user. Sudo access is controlled by /etc/sudoers. The users listed in /etc/sudoers file can execute commands with an effective user id of 0 and a group id of root's group.

The file '/etc/sudoers' should be edited with the editor "visudo".

01. First, create a user called "uddika"

[root@daddylinux~]#useradd uddika
[root@daddylinux~]#passwd uddika

02. To give a specific group of users limited root privileges, edit the file with visudo as follows:

[root@daddylinux~]# visudo

03. Go down to the line ‘# User privilege specification‘and add the following line.

uddika ALL=(ALL) ALL

How to disable direct root login.

Direct login for the root user is a major security issue. We can disable direct login access to reduce the security risk. This way we can have two separate passwords for root access which makes the box more secure. Also we are using the protocol 2 which is newer and more secure.

01. SSH into your server as 'admin' and gain root access by su

02. Copy and paste this line to edit the file for SSH logins

[root@daddylinux~]# nano /etc/ssh/sshd_config

03. Find the line

Protocol 2, 1

04. Uncomment it and change it to look like

Protocol 2

05. Next, find the line

PermitRootLogin yes

06. Uncomment it and make it look like PermitRootLogin no

07. Save the file Ctrl+o then Ctrl+x then enter

08. Now you can restart SSH

[root@daddylinux~]#/etc/rc.d/init.d/sshd restart

Now, no one will be able to login to root with out first loggin in as admin and 'su -' to root.

Be sure that you remember both the passwords!

How to Disable Telnet access on the server

Telnet sends password in plain text passwords and usernames through logins, and hackers can obtain these passwords easily as compared to SSH. TELNET server listens for incoming messages on port 23, and sends outgoing messages to port 23.

01. Login to your server through SSH as a root user.

02. Open file

[root@daddylinux~]#nano /etc/xinetd.d/telnet

03. Look for the line: disable = no and replace with disable = yes

04. Now restart the inetd service:

[root@daddylinux~]#/etc/rc.d/init.d/xinetd restart

05. Make sure it is turned through chkconfig as well because it can still start through that.

[root@daddylinux~]#/sbin/chkconfig telnet off

06. Scan your server to ensure port 23 is closed.

[root@daddylinux~]#nmap -sT -O localhost

Also run ps -aux | grep telnet and if you find anything other than “grep telnet” as result kill the process.

How to setup auto logout time in a CLI

We can set up automatic logout for root session so that session gets logged off, if it is idle for a while. It is important to know this as any sneaker can misuse the situation, when a root user leaves the session idle. The method is very simple and as follows:

01. Locate the system file

[root@daddylinux~]#nano .bashrc

02. Go to under the #user specific aliases and functions line and then type

TMOUT=60

03. Save this file

Ctrl + O

04. Exit the file

Ctrl + X

Here TMOUT is an environment variable which instructs the bash shell to exit if the session is idle. Here timeout is set as 300 seconds (5 minutes).

How to disable interactive startup in Linux

Fedora, CentOS and RHEL allow the console user to perform an interactive system start-up by pressing [I] key. Using interactive boot, attacker can disable the security services and may get access to system then better to disable this service.

01. Login as root

02. Edit this system file

[root@daddylinux~]# nano /etc/sysconfig/init

03. Go to end of the file
You will see PROMPT=yes it’s change to PROMPT=no

04. Save this file

Ctrl + O

05. Exit the file

Ctrl + X

How to change the grub password

If you don't want someone booting your machine without permission, you can add a password to your GRUB entries. You can add a password only to specific entries if you wish; this will require a user to enter a password before loading only those boot entries you protect. This method very useful for your server security. But if u forgot your GRUB password you can proceed bellow steps.


01. Login as root

02. create an new encrypted password for grub
[root@daddylinux~]#grub-md5-crypt
Password: ****** (uddika)
Encrypted: $1$ZWnke0$1fzDBVjUcT1Mpdd4u/T961 (encrypted password)

03. copy the new encrypted password by highlighting it using the mouse

04. Open the grub configuration file for editing

[root@daddylinux~]#nano /etc/grub.conf

05. Find this line

password --md5 $1$gLhU0/$aW78kHK1QfV3P2b2znUoe/

06. Replace with the following line (Right click the mouse to paste new password)
password --md5 $1$ZWnke0$1fzDBVjUcT1Mpdd4u/T961 (encrypted password above)

07. Save this file

Ctrl + O

08. Exit the file

Ctrl + X

Enable user authentication for single user mode

By default you will be automatically logged in to single user mode as root, this can be security risk so better to enable a user login add the single user mode

Note - Debian and therefore Ubuntu both require root password when booting into single user mode or recovery mode. RHEL and CentOS allows access from the console into single user mode without a password. This is handy when things get messed up preventing access to the auth subsystems. To accomplish the same behavior under Ubuntu, edit the /etc/inittab file and change the line

01. To edit this system file

[root@daddylinux~] #nano /etc/inittab

02. Go to a new line at the end of file then type

sum:S:wait:/sbin/sulogin

03. Save this file

Ctrl + O

04. Exit the file

Ctrl + X

Recover root password

It happens sometime that you can't remember root password. On Linux, recovering root password can be done by booting Linux under a specific mode: single user mode.
This tutorial will show how to boot Linux in single user mode when using GRUB and finally how to change root password.

During normal usage, a Linux OS runs under runlevels between 3 and 5 which correspond to various multi-user modes. Booting Linux under runlevel 1 will allow one to enter into a specific mode, single user mode. Under such a level, you directly get a root prompt. From there, changing root password is a piece of cake.

Disable Ctrl + ALT + Del restart

Hitting CTRL-ALT-DELETE on most Linux distributions will start the soft reboot process. Normally I like to disable this (at least on production systems) because someone might make a mistake and reboot the system. Also what I don’t like about this shortcut is that you don’t need to be logged in (no user/password needed – but only console access) to reboot the system.

01. Login as root

02. Edit the following system file (inittab)

03. To locate the system file

[root@daddylinux~]#whereis inittab

04. To find out the file type

[root@daddylinux~]#file /etc/inittab

Changing Run Level of Linux in CentOS

During the boot process for RHEL and CentOS systems the init command opens the /etc/inittab file to decide what "runlevel" the system should be booted to. The /etc/inittab file is a plain text file that can be opened with your favorite text editor.

01. Login as a root

02. Locate the following system file "inittab" (Initialization Table Tab)

03. Places --> Search for File --> Give a file name and select a looking folder for root

04. To edit the system file double click

This tells the init process that the default run level for the system is run level 5. To change to a different run level simply change the number and save the /etc/inittab file. Before doing this, however, be absolutely sure you know which run level you want. Selecting the wrong run level can have serious consequences. To help with this a detailed description of the individual run levels is outlined below: