DDoS Attack Stats

Udgivet den september 17, 2013 af Brian Lund Klint 
This of course only works, if you still have access to the machine.
Local access or out of band remote access would be required, if you really were under attack.

#!/bin/sh

# Regex that maches the attackers browserstring, 
# or prehaps the URL attacked, if it is possible to match.
BROWSERSTRING="008\/0\.85"
# The current log file
LOGFILE="/var/log/apache/access.log"

echo "List of highest attacking IP's"
grep ${BROWSERSTRING} ${LOGFILE} | awk '{print $1}' | sort | uniq -c | sort | tail -n 10

echo "Total number of attackers"
grep ${BROWSERSTRING} ${LOGFILE} | awk '{print $1}' | sort | uniq -c | sort | wc -l

echo "Time of first contact"
grep ${BROWSERSTRING} ${LOGFILE} | awk -F \  '{print $4 $5}' | sort | head -n 1

echo "Time of last contact"
grep ${BROWSERSTRING} ${LOGFILE} | awk -F \  '{print $4 $5}' | sort | tail -n 1
Udgivet i Knowledge Base | Skriv en kommentar

Find XML part in files

Udgivet den juni 10, 2013 af Brian Lund Klint 
If you have a lot of XML files, like Magento Module Config Files, and need to find a code snippet, like the Crontab definitions in all files, try this:

find . -name '*.xml' | xargs awk '/<crontab>/,/<\/crontab>/{print FILENAME, $0; nextfile}'

It might also come in handy in Apache config files or other XML based config systems...
Udgivet i Knowledge Base | Skriv en kommentar

Find and strip BOM – Byte Order Mark from files

Udgivet den maj 23, 2013 af Brian Lund Klint 
Use this to find and strip those peskey BOM's from your PHP code:

find -type f |while read file; do if [ "`head -c 3 -- "$file"`" == $'\xef\xbb\xbf' ]; then echo "found BOM in: $file"; sed -i -e 's/\xEF\xBB\xBF//' $file; fi; done
Udgivet i Knowledge Base | Skriv en kommentar

Udtræk data fra din Apple Kalender

Udgivet den april 25, 2013 af Brian Lund Klint 
Jeg ville gerne have en oversigt over dagens opgaver op på en af skærmene på kontoret, så jeg har overblik over hvad jeg mangler uden at side med kalenderen åben hele tiden. Men det var ikke til at finde nogle simple API'er til at trække events ud af Apple iCloud, så vi lavede en selv :-)

https://github.com/Mikjaer/iCoudCalView

Et hurtigt eksempel på brug:


<pre><?php
include("iCloudCalView.php");

$iCloud = new iCloudCalView('you@eksempel.dk', 'SecretPassword');

$cals = $iCloud->getCals();

$events = $iCloud->getEvents($cals[0]["href"], mktime(0,0,0,1,1,2012), mktime());

print_r($cals);

print_r($events);
 $cals indeholder et array med en oversigt over tilgængelige kalendere, det kan både være dine egne og dem dine venner / kollegaer har delt med dig. $events indeholder et array med en oversigt over alle events i første kalender (element 0 i $cals) fra 1. Jan 2012 og frem til idag. Have fun :-)
Udgivet i Knowledge Base | Skriv en kommentar

Opsætning af OpenVPN med offentlige IP Adresser

Udgivet den april 20, 2013 af mike

Jeg lægger ud med en nyinstalleret debian på vpn.eksempel.dk og starter ud med at installere lidt grundlæggende værktøjer:

root@vpn:~# apt-get install vim ssh openvpn bridge-utils

Jeg redigerer /etc/network/interfaces

auto lo br0
iface lo inet loopback

allow-hotplug eth0
iface br0 inet static
        address 260.260.260.2
        netmask 255.255.255.0
        gateway 260.260.260.2
        bridge_ports eth0 tap0
        pre-up openvpn --mktun --dev tap0
        post-down openvon --rmtun --dev tap0

For at oprette krypteringsnøgler til serveren og klienten bruger vi et script der følger med OpenVPN ved navn “easy-rsa”:

root@vpn:~# cp -R /usr/share/doc/openvpn/examples/easy-rsa /etc/openvpn

Rediger /etc/openvpn/easy-rsa/2.0/vars , de nederste 4 værdier skal tilpasses, som f.eks:

export KEY_COUNTRY="DK"
export KEY_PROVINCE="DK"
export KEY_CITY="Copenhagen"
export KEY_ORG="Mikjaer ApS"
export KEY_EMAIL="noc@mikjaer.com"

Påbegynd generation af dit CA ved at køre flg.:

#  cd /etc/openvpn/easy-rsa/2.0
# . /etc/openvpn/easy-rsa/2.0/vars
# . /etc/openvpn/easy-rsa/2.0/clean-all
# . /etc/openvpn/easy-rsa/2.0/build-ca

og siden vi har gemt vores ønskede værdier i vars kan vi køre ./build-ca uden at gøre andet end at acceptere alle “standardværdierne” ved at trykke enter ved hver prompt, herefter er vi klar til at lave serverens nøgle:

root@vpn:/etc/openvpn/easy-rsa/2.0# . /etc/openvpn/easy-rsa/2.0/build-key-server server
Generating a 1024 bit RSA private key
..++++++
.........................................++++++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [DK]:
State or Province Name (full name) [DK]:
Locality Name (eg, city) [Copenhagen]:
Organization Name (eg, company) [Mikjaer ApS]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) [server]:
Name []:
Email Address [noc@mikjaer.com]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/openvpn/easy-rsa/2.0/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'DK'
stateOrProvinceName   :PRINTABLE:'DK'
localityName          :PRINTABLE:'Copenhagen'
organizationName      :PRINTABLE:'Mikjaer ApS'
commonName            :PRINTABLE:'server'
emailAddress          :IA5STRING:'noc@mikjaer.com'
Certificate is to be certified until Apr 18 21:30:33 2023 GMT (3650 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

Herefter skal vi bruge (mindst) en klient nøgle:

root@vpn:/etc/openvpn/easy-rsa/2.0# . /etc/openvpn/easy-rsa/2.0/build-key client1
Generating a 1024 bit RSA private key
..++++++
.............++++++
writing new private key to 'client1.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [DK]:
State or Province Name (full name) [DK]:
Locality Name (eg, city) [Copenhagen]:
Organization Name (eg, company) [Mikjaer ApS]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) [client1]:
Name []:
Email Address [noc@mikjaer.com]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/openvpn/easy-rsa/2.0/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'DK'
stateOrProvinceName   :PRINTABLE:'DK'
localityName          :PRINTABLE:'Copenhagen'
organizationName      :PRINTABLE:'Mikjaer ApS'
commonName            :PRINTABLE:'client1'
emailAddress          :IA5STRING:'noc@mikjaer.com'
Certificate is to be certified until Apr 18 21:32:45 2023 GMT (3650 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

Og til sidst skal du også køre flg. for at generere nøgler til SSL/TLS Handshake (Jeg er faktisk ikke sikker på hvor vigtig rækkefølgen er her):

root@vpn:~/easy-rsa# ./build-dh 
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
..........................................................................+.............................+.......................+.
.................+..................................................................................................................
......................................+...........................+...................................................+...........
........................+............+..................+..........+.............................................................
......................................+..........................................................................+.................
........................................................................+...........+..............................................
........................................................+......+...................................................................
......+.............................................................................................................................
...................................................................................+................................................
................+.........................................................................................+........................
....................................................................................+...........................................++
*++*++*

Kopier server-certifikatere på plads:

root@vpn:/etc/openvpn/easy-rsa/2.0/keys# cp ca.crt ca.key dh1024.pem server.crt server.key /etc/openvpn/

Som det sidste skal openvpn.conf tilpasses: vim /etc/openvpn/server.conf:

float
port 1194
proto udp
dev tap0
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server-bridge 260.260.260.1 255.255.255.0 260.260.260.100 260.260.260.200
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 4
mute 10

Server-bridge syntax:

server-bridge <gateway> <netmask> <ip-range-start> <ip-range-stop>

Resten burde du ikke få brug for at rette i lige umiddelbart, på det her tidspunkt plejer jeg at genstarte maskinen, primært for at se at alt kommer op som det skal 🙂

Men så er du tilgengæld også klar til at forbinde dine maskiner med VPN Klienter.

Udgivet i Knowledge Base, Linux, Networking, Old Base | Skriv en kommentar

Figuring out which VID a process belongs to

Udgivet den april 3, 2013 af mike

Not much to tell …

root@prox2:~# ps aux |grep nrpe
nagios 15071 0.0 0.0 25284 648 ? Ss Mar27 0:36 /usr/sbin/nrpe -c /etc/nagios/nrpe.cfg -d
root 438172 0.0 0.0 7796 948 pts/4 S+ 14:16 0:00 grep nrpe
nagios 874676 0.0 0.0 25284 1148 ? Ss Apr01 0:08 /usr/sbin/nrpe -c /etc/nagios/nrpe.cfg -d
root@prox2:~# cat /proc/874676/status | grep envID
envID:	0
root@prox2:~# cat /proc/15071/status | grep envID
envID:	143

 

Udgivet i Knowledge Base, Linux, Old Base | Skriv en kommentar

Overvågning af process og genstart den hvis den vælter

Udgivet den januar 28, 2013 af mike

Hvis du har en process der vælter hele tiden og du ikke lige umiddelbart kan fikse den er her et hurtigt fif til at holde den kørende alligevel.

Opret et script proxhack.sh:

#!/bin/sh
pgrep pvestatd > /dev/null || /etc/init.d/pvestatd start 2>&1 | mail teknik@dig.dk -s "Pvestatd restart `hostname -f`"

og kører det, alt afh. hvor vigtig servicen er, hvert x’tende minut. Hvis pvestatd processen kører sker der intet, hvis processen er forsvundet køres /etc/init.d/pvestatd start og der sendes en mail til teknik@dig.dk 😉

Udgivet i Knowledge Base, Linux, Old Base | Skriv en kommentar

Make SSH stop asking stupid questions

Udgivet den januar 20, 2013 af Brian Lund Klint 
To make your everyday SSH experience a little more enjoyable, use these local config settings:

your local config is in ~/.ssh/config

host *
   ForwardAgent yes
   SendEnv LANG LC_*
   HashKnownHosts no
   ServerAliveInterval 30

host oldhost.example.net
   User myoldusername

host *.companyhosts.example.net
   User root

host *.local
   CheckHostIP no
host 192.168.*
   CheckHostIP no
host 10.*
   CheckHostIP no

---

There is not really any security lost, with 'CheckHostIP no', since the host key is still checked. 
It is only the IP check that is not done.
Also, the 'HashKnownHosts no', will leak a bit of privacy, since others will be able to see, which servers you connected to from this machine. But in my daily work, where host keys change from time to time, I think it is better to be able to look up the host, and delete the correct line, than to have that layer of privacy.

The 'ForwardAgent yes' will make you able to jump from the connected host to another, using your local id_rsa key. This will not work from the 3rd machine to a 4th, unless the second machine also enables agent forward.
Udgivet i Knowledge Base, SSH | Skriv en kommentar

disable password login on SSHD

Udgivet den januar 20, 2013 af Brian Lund Klint 
(openssh)

To disable interactive login and only permit RSA keys:

# Change to no to disable s/key passwords
ChallengeResponseAuthentication no
PasswordAuthentication no
KbdInteractiveAuthentication no
Udgivet i Knowledge Base | Skriv en kommentar

SSH Tunnel in the Background

Udgivet den januar 19, 2013 af Brian Lund Klint 
Use this to make a SSH tunnel in the background:


# nohup ssh -f -N -L 81:target.example.com:81 jumphost.example.com

nohup makes the thing go away in the background
-f makes SSH run in the background
-N tells SSH that it should not expect any command
-L tells SSH to do port forward. 
The first is the local port number to forward, on this machine.
The second is the machine to forward to.
The third is the destination port on the target machine.

The last hostname is the machine we use to jump through. (Exit node)

Actually, nohup is not all that necessary.
Udgivet i Knowledge Base, SSH | Skriv en kommentar