1.How to take the backup and restore MBR? Why do you require to take the backup of your MBR?Ans : MBR (Master Boot Recorder) is a vital part of your hard disk which contains booting information, without it its difficult to boot the system. Suppose you have windows and Linux duel boot on your machine and as you know windows is more prone to virus attacks. So it’s always better to backup your MBR to be in safe place.
2. How to take backup of your MBR?Ans : Using dd command (dataset definition). Here are the steps to take backup of you MBR and keep it in safe place to restore your system if it get corrupted.
#dd if=/dev/hdx of=/safe/location bs=512 count=1
Let me explain the above command how it will work.“If” in the command is nothing but to specify Input File, here we are specifying our input file as hard disk(if the hard disk is /dev/hda it is primary master, so for general purpose I given 'x'). “of” in the command is nothing but to specify Output File, here we are specifying our output file as /safe/location. Then “bs” this is nothing but block size to write in to hard disk. And then “count” nothing but how many times you want to write date this many block sizes. Here in this example count=1 that means first 512 bytes of the hard disk is copied to the specified location.
3.How to restore the MBR?#dd if=/safe/location of=/dev/hdx bs=512 count=1
Note : Please replace “hdx” with your hard disk name.
This is bit complex, Is there any other way to restore MBR?Yes, if you have Linux or Windows bootable CD, we can easily restore your MBR if you forgot to take backup(And this method is very much easy to do restoration of MBR when compared to previous method).
Method1 : With Redhat Linux bootable CD.
For this you have to boot your system to rescue mode, then mount your file system to rescue mode and execute below command to restore your MBR
#grub-install /dev/hdx
Note : Please replace hdx with your hard disk name. After that you just reboot your system. Your system will be live and working.
Method2 : With Windows XP bootable CD.
Step1 : Boot the system with XP bootable cd
Step2 : Press f8 to go to repair mode in Windows
Step3 : Once you got the c drive prompt just type below commandFixmbrThis command will fix the MBR record.
Some FAQ’s1. What is the MBR size?Ans : MBR size is just 512 bytes.
2.What MBR conations?
Ans : Mainly MBR can be divided in two parts
a.Boot loader information block(which is of 448 bytes)
b. Partition table information(which is of just 64 bytes)
3.How many partition we can create on a hard disk?Ans : Totally we can create four partitions as below
a.Four primary parathions.
b.Three primary and one extended partition.
c.Two primary and one extended parathion.
d.One primary and one extended parathion.
Note : In extended parathion we can create logical partitions up to 24 in number.
4.Why we cannot create more then 4 partition as mention above?Ans : In MBR, the partition table info is just stored in 64 bytes, and one parathion information to store in MBR requires 16 bytes of space. So at most you can create only 4 partitions as mention above.
Wednesday, August 11, 2010
Disabling SELinux
How to disable SElinux?
SElinux is a security feature which was shipped with RHEL5, it is much secure than any other security priviously such as PAM and Initd
Here we are going to see some basics of SElinux.
Step1:Seeing whether SELinux is enabled or not ?
#getenforce
Step2:To see SELinux status in elaborated way you can use sestatus
#sestatus
SElinux status : enabled
SELinux mount : /selinux
Current mode : enforcing
Mode from config file : enforcing
Policy version : 21
Policy from config file : targeted
From the above output we can see that SElinux is enabled and its in enforced mode.
and to see detailed status you can use -b option, this will give which service are SElinux enabled and which services are disabled.
setenforce
/etc/grub.conf and /etc/selinux/config
Step3:disabling SElinux
We can do it in two ways
1)Perminant way : edit /etc/selinux/config
change the status from enable to disable and selinux type from strict to targeted, after changes are made we have to restart, if the server's are in production and don't want to restart the server follow the temporary way of disabling it.
2)Temporary way : echo 0 > /selinux/enforceFor your info if you want to enable it again, try below commandecho 1 > /selinux/enforce.
Selinux is a vast subject and can not deal in one post, see for my other posts regarding Selinux.
SElinux is a security feature which was shipped with RHEL5, it is much secure than any other security priviously such as PAM and Initd
Here we are going to see some basics of SElinux.
Step1:Seeing whether SELinux is enabled or not ?
#getenforce
Step2:To see SELinux status in elaborated way you can use sestatus
#sestatus
SElinux status : enabled
SELinux mount : /selinux
Current mode : enforcing
Mode from config file : enforcing
Policy version : 21
Policy from config file : targeted
From the above output we can see that SElinux is enabled and its in enforced mode.
and to see detailed status you can use -b option, this will give which service are SElinux enabled and which services are disabled.
setenforce
/etc/grub.conf and /etc/selinux/config
Step3:disabling SElinux
We can do it in two ways
1)Perminant way : edit /etc/selinux/config
change the status from enable to disable and selinux type from strict to targeted, after changes are made we have to restart, if the server's are in production and don't want to restart the server follow the temporary way of disabling it.
2)Temporary way : echo 0 > /selinux/enforceFor your info if you want to enable it again, try below commandecho 1 > /selinux/enforce.
Selinux is a vast subject and can not deal in one post, see for my other posts regarding Selinux.
How To Reduce Delay Getting SSH Login Prompt
Recently we have installed a new RHEL5.4 machine. Its located just few kilometres from our office. But when I have observed at the time of logging in the shell prompt is taking considerable time to appear(though connection is taking a fraction of second, after entering the password its taking more time). So we did some tweeking and found out this is related to DNS. We have to change dns related entries in ssh config file to reduce this delay.
Note : Be careful when doing this on production servers. This activity may disconnect all the users from the system who are logged in to that machine using SSH.
By default UseDNS option in this file is disable. We have to uncommet this option and then edit this entry to no. As below..
Just search for UseDNS..
[root@tst ~]#vi /etc/ssh/sshd_config
before config
#UseDNS yes
After config
UseDNS no
save and exit the file and then just reload ssh service to take effect what ever changes we did..
#service sshd reload.
Now try to login and observe, delay will be reduced.
Please share your thoughts on this..
Note : Be careful when doing this on production servers. This activity may disconnect all the users from the system who are logged in to that machine using SSH.
By default UseDNS option in this file is disable. We have to uncommet this option and then edit this entry to no. As below..
Just search for UseDNS..
[root@tst ~]#vi /etc/ssh/sshd_config
before config
#UseDNS yes
After config
UseDNS no
save and exit the file and then just reload ssh service to take effect what ever changes we did..
#service sshd reload.
Now try to login and observe, delay will be reduced.
Please share your thoughts on this..
Hardening SSH Server In The DMZ(De Militarised Zone)
Its good to harden your box which is in DMZ.
What is DMZ?
Ans : DMZ is a De Militarised Zone where we will be keeping our servers, so that they can be access by out side people. Let me explain more about this DMZ. Who are not familiarise(And this activity is most of the time a Network admin work).
1. DMZ is a place where we will be isolate machines from companies local LAN.
2. These DMZ machines will have different IP address range and subnet.
3. The communication between two machines in DMZ is blocked for security reasons.
4. We cannot login to Local LAN machine from a DMZ machine, but we can login to DMZ machine from local LAN(only one way communication from LAN).
5. Ping to these machines will be disabled(most of the companies will do this for security reasons).
6. The way these machines communicate totally depends on network team what type of rule they set on their routers.
7. The security of DMZ machines are more when compared to local LAN machines(in other ways every thing is restricted to DMZ machines).
8. Only required ports are opened on DMZ machines and remaining ports are in closed or reject state(This should be done on system by Linux admin and on network level done by companies network engineer).
Once you keep your Linux machine in DMZ first and far-most thing to do is to secure SSH logins to the server.
In this post we will see some security measures for SSH to be taken when system is kept in DMZ. Most of the SSH settings are located in /etc/ssh/sshd_config (Red hat/Debian based systems).
1. Set Maximum failed login attempts, so after that many login attempts connection to the server is reseted and once again we have to connect to server.
MaxAuthTries 3
Here I have set failed login attempts to 3.
2. Disable root to login through SSH. This is a good option to force the user not to use root user to login to the server
PermitRootLogin no
Here we set it to no which indicates root can not login.
3. We should disable logging of users who donot have passwords.
PermitEmptyPasswords no
4. Allow only users who have passwords.
PasswordAuthentication yes
5. Specify who should access this server. I can say this one is more secure because SSH will allow only the users who are specified here.
AllowUsers test1 test2
Here I have allowed only two users i.e. test1 and test2.
6. Set-up a login banner to give warnings to the users how are logging in to that server
Banner /etc/ssh-banner
Please specify the warning message in /etc/ssh-banner.
Once done the above changes in /etc/ssh/sshd_config file just reload the ssh server.
Note : Don't restart SSH service on production servers. Its not advisable to do it. so in-order to update your changes always use reload option. Most of the services will support reload option with service command.
#service sshd reload
What is DMZ?
Ans : DMZ is a De Militarised Zone where we will be keeping our servers, so that they can be access by out side people. Let me explain more about this DMZ. Who are not familiarise(And this activity is most of the time a Network admin work).
1. DMZ is a place where we will be isolate machines from companies local LAN.
2. These DMZ machines will have different IP address range and subnet.
3. The communication between two machines in DMZ is blocked for security reasons.
4. We cannot login to Local LAN machine from a DMZ machine, but we can login to DMZ machine from local LAN(only one way communication from LAN).
5. Ping to these machines will be disabled(most of the companies will do this for security reasons).
6. The way these machines communicate totally depends on network team what type of rule they set on their routers.
7. The security of DMZ machines are more when compared to local LAN machines(in other ways every thing is restricted to DMZ machines).
8. Only required ports are opened on DMZ machines and remaining ports are in closed or reject state(This should be done on system by Linux admin and on network level done by companies network engineer).
Once you keep your Linux machine in DMZ first and far-most thing to do is to secure SSH logins to the server.
In this post we will see some security measures for SSH to be taken when system is kept in DMZ. Most of the SSH settings are located in /etc/ssh/sshd_config (Red hat/Debian based systems).
1. Set Maximum failed login attempts, so after that many login attempts connection to the server is reseted and once again we have to connect to server.
MaxAuthTries 3
Here I have set failed login attempts to 3.
2. Disable root to login through SSH. This is a good option to force the user not to use root user to login to the server
PermitRootLogin no
Here we set it to no which indicates root can not login.
3. We should disable logging of users who donot have passwords.
PermitEmptyPasswords no
4. Allow only users who have passwords.
PasswordAuthentication yes
5. Specify who should access this server. I can say this one is more secure because SSH will allow only the users who are specified here.
AllowUsers test1 test2
Here I have allowed only two users i.e. test1 and test2.
6. Set-up a login banner to give warnings to the users how are logging in to that server
Banner /etc/ssh-banner
Please specify the warning message in /etc/ssh-banner.
Once done the above changes in /etc/ssh/sshd_config file just reload the ssh server.
Note : Don't restart SSH service on production servers. Its not advisable to do it. so in-order to update your changes always use reload option. Most of the services will support reload option with service command.
#service sshd reload
How To Use IPtables to Block ICMP (Internet Control Message Protocol) Requests?
How to use IPtables to block ICMP (Internet Control Message Protocol) requests?
Ans : To do this we have understand why we require this thing should be done.
When Hackers try to hack in to any machine first thing they will do is a basic ping test.
Code :#ping target-machine
If this is succeed they will come to a conclusion that system is up and they can go forward and they can do DDOSattacks or try to find some other open ports using NMAP command.
Code :#nmap target-machineSo if you are exposing a machine to outer world from your network, first disable incoming ping requests to your machine as follows.
So this can be done by two ways through IPtables
If this is succeed they will come to a conclusion that system is up and they can go forward and they can do DDOSattacks or try to find some other open ports using NMAP command.
Code :#nmap target-machineSo if you are exposing a machine to outer world from your network, first disable incoming ping requests to your machine as follows.
So this can be done by two ways through IPtables
1. Reject the ICMP packets.
2. Drop the ICMP packets.
In the above mentioned methods best thing is to drop the ICMP packets, by doing this we are not giving any clue to hacker whether the system is alive or not. Where as if we do reject definitely hacker will come to know that ICMPpackets are blocked and the system is live.
Step1 : Executing following command to drop all the incoming ICMP packets
#iptables –A INPUT –p icmp --icmp-type echo-request –j DROP
Let me explain this command
-A is to append this rule to already existing one.
INPUT specifies that it’s a
Step2 : Save this changes to IPtables file (/etc/sysconfig/iptables), restart the IPtables service and check your IPtables status whether your IPtables chain is updated or not.#service iptables save
#service iptables restart
#iptables –L
How to allow icmp ping request in case you want them,First we have to remove the rule which we created for blocking the icmp ping.
#iptables –D INPUT –p icmp --icmp-type echo-request –j DROP
Then execute the following commands
#iptables –A INPUT –p icmp --icmp-type echo-request –j ACCEPT
#service iptables save
#service iptables restart
Some points to be notedWhat are the methods used by hackers using this ICMP ping?Though these are old denial-of-service attack (DoS attack), worth to learn themPing flood
Smurf attack
Ping to death
#service iptables restart
#iptables –L
How to allow icmp ping request in case you want them,First we have to remove the rule which we created for blocking the icmp ping.
#iptables –D INPUT –p icmp --icmp-type echo-request –j DROP
Then execute the following commands
#iptables –A INPUT –p icmp --icmp-type echo-request –j ACCEPT
#service iptables save
#service iptables restart
Some points to be notedWhat are the methods used by hackers using this ICMP ping?Though these are old denial-of-service attack (DoS attack), worth to learn themPing flood
Smurf attack
Ping to death
IPTables In Linux Explained
IPtables (Netfilter) :IPtables is the default firewall for Linux. Its a vast subject which can not be covered in one post. I will try to give as much info as possible at the same time not to make it complex. Lets start with basics.
What is a firewall?Ans : A firewall is a part of a computer system or network that is designed to block unauthorized access while permitting authorized communications --Wikipedia.org
A IPtables firewall contains tables which in tern contains rules to block or unblock a perticular communication.A table can be a1.Filter table -- Used to filter packets.2.NAT(Network Adress Translator) table -- Used for NATing of source and destination ip address(Used for sharing internet)
3.Mangale table -- Its a combination of Filter and NAT tables
4.RAW table -- Used to for marking packets not to track.
1.Filter table : This is the default table which contaions three chains.a.INPUT Chain : To apply a rule on packets which are coming into the system.
b.FORWARD Chain : For packets being routed through the system
c.OUTPUT Chain : For packets locally generated which are going out from the system.
2.NAT table : This table is having three chains.
a.PREROUTING Chain : For altering the packets as soon as they come in to the system
b.OUTPUT Chain : For packets locally generated which are going out from the system.
c.POSTROUTING Chain : For altering the packets which are about to go out from the system.
3.MANGLE Table : This is a combination of forwording, security and translating packets. We can say this one as hybride table of both FILTER and NAT table. This contains five chains.1.PREROUTING
2.OUTPUT
3.INPUT
4.FORWARD
5.POSTROUTING
4.RAW Table : Contaions two chains.1.PREROUTING
2.OUTPUT
So lets go to the configuration of IPTables : In the following examples I will be taking FILTER Table to explain.
Example1 : To see/list what are the rules configured in the system
#iptables -L -t filter
This will list all the rules which are created under FILTER Table
-L for listing
-t for specifying table type(here table type is FILTER)#iptables -L -t nat
#iptables -L -t mangle
#iptables -L -t rawThese three iptables are self explantory.
Example2 : Inserting a rule in to a table#iptables -I INPUT 2 -t filter -s 192.168.0.1/24 -j DROP
-I for inserting a rule in to a table, so in this example I am inserting an INPUT rule and position two(2). So depending on number we can insert a rule in any position of a table.
-s for specifying the source of this packet. This source may be a IP adress/netmaks or a network-adress/netmask. -j for specifying what to do on the target packet. Here we specified to drop any packet which comes from 192.168.0.1, so there is no reply to the source about the packet status. With -j these are the options we can specify.
1.DROP -- For droping a packet with out informing the status of this packets to the source/destination. So there is no inforamtion to source/destination about the status of the packet.
2.REJECT -- Will reject the packets and information is sent to source/destantion about the rejection of packet by the server.
3.ACCEPT -- Will accpet for the delevery of the packet to designated destination.
4.QUEUE -- this is used to queue the packets to user space. Let me put in this way.. this is just to forward all the packets to some other utility(such as SNORT) which take care of packet filtering.
What actually this rule is specifying?Ans : This rule specifies its an input rule at second position of the filter table to drop all the communication which is originating from 192.168.0.1
Example3 : To append a rule in to a table#iptables -A INPUT -t filter -d 132.160.0.0/16 -j REJECT
-A for append a rule at the end of a table
-d for specifying the destination of this packet. This destination may be a IP adress/netmaks or a network-adress/netmask.What actually this rule is specifing?Ans : This rule specifies its an input rule which is appended to a filter table to reject all the packets which are destinated to 132.160.0.0 network.
Example4 : Deleting perticular rule#iptables -D INPUT 3 -t filter
-D for specifing deletion of a rule
What actually this rule is specifing?Ans : This rule specifies delete an input rule which is in third position of the filter table.
Example5 : Flushing/removeing entire table
#iptables -F -t filter
-F for specifing to flush/remove a table from iptables configuration.
What actually this rule is specifing?Ans : This rule specifies flush/remove all the rules which are in filter table.
From here we will see how to block a1.Blocking network
2.Blocking an ip address
3.Blockign Entire protocal stack4.Blocking protocol
5.Blocking port(source port or Destination port)
Example6 : Blocking(Rejecting) a perticular network#iptables -A INPUT -t filter -s 192.168.0.0/24 -j REJECTWhat actually this rule do?Ans : This rule specifies under filter table please block(REJECT) all traffic from 192.168.0.0 to 192.168.0.225ip addresses, nothing but entire 192.168.0.0/24 network.
Example7 : Blocking(Rejecting) a perticular ip address
#iptables -A INPUT -t filter -s 123.45.0.1 -j REJECTWhat acutally this rule do?Ans : This rule specifies under filter table please block(REJECT) all the traffic originating from 192.168.0.1 ip address.
Example8 : Blocking(Rejecting) entire protocol stack.#iptables -A INPUt -t filter -s 192.168.0.1 -p all -j REJECTWhat acutally this rule do?Ans : This rule specifies under filter table please block all the traffic with all the protocols(such as TCP,UDP,ICMP etc) which are origenating from 192.168.0.1 ip address.
Example9 : Blocking a perticular protocol
#iptables -A INPUT -t filter -s 192.168.0.1 -p tcp -j REJECT
What acutally this rule do?Ans : This rule specifies under filter table please block all the traffic which uses tcp protocol to communicate from192.168.0.1 ip address.
Example10 : Blocking perticular destination port
#iptables -A INPUT -t filter -s 192.168.0.1 -p tcp -dport 21 -s 192.168.0.1 -j REJECT
What acutally this rule do?Ans : This rule specifies under filter table please block all the FTP(port no:21) traffic orignating from192.168.0.1 ip address.
Example11 : Blocking perticular source port#iptables -A OUTPUT -t filter -d 192.168.0.1 -p udp -sport 1929 -j REJECTWhat acutally this rule do?Ans : This rule specifies under filter table please block all the traffic which is origanting from server through port 1929 destinated to 192.168.0.1 to be blocked.
5.Saving iptable :#service iptables save
Why we actually require to save iptables?Ans : Most of the services in linux have their own configuration files so same will be applicable for the iptables. So when ever we do iptables save the configuration by default will be saved to /etc/sysconfig/iptables6.Satrting iptables :
#service iptables start
7.Restarting iptables :#service iptables restartChecking wether iptables is running or not#service iptables status
What is a firewall?Ans : A firewall is a part of a computer system or network that is designed to block unauthorized access while permitting authorized communications --Wikipedia.org
A IPtables firewall contains tables which in tern contains rules to block or unblock a perticular communication.A table can be a1.Filter table -- Used to filter packets.2.NAT(Network Adress Translator) table -- Used for NATing of source and destination ip address(Used for sharing internet)
3.Mangale table -- Its a combination of Filter and NAT tables
4.RAW table -- Used to for marking packets not to track.
1.Filter table : This is the default table which contaions three chains.a.INPUT Chain : To apply a rule on packets which are coming into the system.
b.FORWARD Chain : For packets being routed through the system
c.OUTPUT Chain : For packets locally generated which are going out from the system.
2.NAT table : This table is having three chains.
a.PREROUTING Chain : For altering the packets as soon as they come in to the system
b.OUTPUT Chain : For packets locally generated which are going out from the system.
c.POSTROUTING Chain : For altering the packets which are about to go out from the system.
3.MANGLE Table : This is a combination of forwording, security and translating packets. We can say this one as hybride table of both FILTER and NAT table. This contains five chains.1.PREROUTING
2.OUTPUT
3.INPUT
4.FORWARD
5.POSTROUTING
4.RAW Table : Contaions two chains.1.PREROUTING
2.OUTPUT
So lets go to the configuration of IPTables : In the following examples I will be taking FILTER Table to explain.
Example1 : To see/list what are the rules configured in the system
#iptables -L -t filter
This will list all the rules which are created under FILTER Table
-L for listing
-t for specifying table type(here table type is FILTER)#iptables -L -t nat
#iptables -L -t mangle
#iptables -L -t rawThese three iptables are self explantory.
Example2 : Inserting a rule in to a table#iptables -I INPUT 2 -t filter -s 192.168.0.1/24 -j DROP
-I for inserting a rule in to a table, so in this example I am inserting an INPUT rule and position two(2). So depending on number we can insert a rule in any position of a table.
-s for specifying the source of this packet. This source may be a IP adress/netmaks or a network-adress/netmask. -j for specifying what to do on the target packet. Here we specified to drop any packet which comes from 192.168.0.1, so there is no reply to the source about the packet status. With -j these are the options we can specify.
1.DROP -- For droping a packet with out informing the status of this packets to the source/destination. So there is no inforamtion to source/destination about the status of the packet.
2.REJECT -- Will reject the packets and information is sent to source/destantion about the rejection of packet by the server.
3.ACCEPT -- Will accpet for the delevery of the packet to designated destination.
4.QUEUE -- this is used to queue the packets to user space. Let me put in this way.. this is just to forward all the packets to some other utility(such as SNORT) which take care of packet filtering.
What actually this rule is specifying?Ans : This rule specifies its an input rule at second position of the filter table to drop all the communication which is originating from 192.168.0.1
Example3 : To append a rule in to a table#iptables -A INPUT -t filter -d 132.160.0.0/16 -j REJECT
-A for append a rule at the end of a table
-d for specifying the destination of this packet. This destination may be a IP adress/netmaks or a network-adress/netmask.What actually this rule is specifing?Ans : This rule specifies its an input rule which is appended to a filter table to reject all the packets which are destinated to 132.160.0.0 network.
Example4 : Deleting perticular rule#iptables -D INPUT 3 -t filter
-D for specifing deletion of a rule
What actually this rule is specifing?Ans : This rule specifies delete an input rule which is in third position of the filter table.
Example5 : Flushing/removeing entire table
#iptables -F -t filter
-F for specifing to flush/remove a table from iptables configuration.
What actually this rule is specifing?Ans : This rule specifies flush/remove all the rules which are in filter table.
From here we will see how to block a1.Blocking network
2.Blocking an ip address
3.Blockign Entire protocal stack4.Blocking protocol
5.Blocking port(source port or Destination port)
Example6 : Blocking(Rejecting) a perticular network#iptables -A INPUT -t filter -s 192.168.0.0/24 -j REJECTWhat actually this rule do?Ans : This rule specifies under filter table please block(REJECT) all traffic from 192.168.0.0 to 192.168.0.225ip addresses, nothing but entire 192.168.0.0/24 network.
Example7 : Blocking(Rejecting) a perticular ip address
#iptables -A INPUT -t filter -s 123.45.0.1 -j REJECTWhat acutally this rule do?Ans : This rule specifies under filter table please block(REJECT) all the traffic originating from 192.168.0.1 ip address.
Example8 : Blocking(Rejecting) entire protocol stack.#iptables -A INPUt -t filter -s 192.168.0.1 -p all -j REJECTWhat acutally this rule do?Ans : This rule specifies under filter table please block all the traffic with all the protocols(such as TCP,UDP,ICMP etc) which are origenating from 192.168.0.1 ip address.
Example9 : Blocking a perticular protocol
#iptables -A INPUT -t filter -s 192.168.0.1 -p tcp -j REJECT
What acutally this rule do?Ans : This rule specifies under filter table please block all the traffic which uses tcp protocol to communicate from192.168.0.1 ip address.
Example10 : Blocking perticular destination port
#iptables -A INPUT -t filter -s 192.168.0.1 -p tcp -dport 21 -s 192.168.0.1 -j REJECT
What acutally this rule do?Ans : This rule specifies under filter table please block all the FTP(port no:21) traffic orignating from192.168.0.1 ip address.
Example11 : Blocking perticular source port#iptables -A OUTPUT -t filter -d 192.168.0.1 -p udp -sport 1929 -j REJECTWhat acutally this rule do?Ans : This rule specifies under filter table please block all the traffic which is origanting from server through port 1929 destinated to 192.168.0.1 to be blocked.
5.Saving iptable :#service iptables save
Why we actually require to save iptables?Ans : Most of the services in linux have their own configuration files so same will be applicable for the iptables. So when ever we do iptables save the configuration by default will be saved to /etc/sysconfig/iptables6.Satrting iptables :
#service iptables start
7.Restarting iptables :#service iptables restartChecking wether iptables is running or not#service iptables status
How To Use VNSTAT To Monitor Bandwidth Usage
There are so many tools to monitor network such as MRTG, now I am going to explain such tool which monitors bandwidth for a system, ie vnstat(view network statistics). Its very much easy to install and configure.
This tool can give you full details about how much bandwidth used on the basics of,
Per month.
Per week.
Per day.
Per hour.
Per second.
Even we can see live traffic. This is awesome tool .
So all the tools will not only have advantages but also disadvantages, here are they:
1)Can not monitor multiple interfaces at a time.
2)Can not monitor remote host.
3)Can not monitor per host statistics(which is verymuch useful to find the network hogger, if you want per host bandwidth analyser then use iptables counters for it).
Before configuring vnstat, one thing we have to keep in mind that vnstat is a aggregating tool which is required to run at regular intervals to monitor network bandwidth. So by default when we install vnstat acron job is created at /etc/cron.d folder.
Step1 : installing vnstat
#rpm –ivh vnstat-1.6-2.fc9.i386.rpm
Step2 : Configuring vnstat.
As I mention earlier that vnstat is an aggregate tool so it should run background by using crontab, Sofirst edit the cron job
Vi /etc/cron.d/vnstat
*/5 * * * * vnstat /usr/sbin/vnstat.cron
Add the above line to the file, then save it and exit.
Step3 : Specifying which interface to monitor
#vnstat –I interfacename
Example :
[root@test ~]# vnstat -i eth0
Error :
Unable to read database "/var/lib/vnstat/eth0".
eth0: Not enough data available yet.
Don’t worry about error intitially it will show error because it’s the first time you are executing that command, so it has to create DB.
Step4 : Monitoring bandwidth with different intervals
Type1 : For live traffic
#vmstat –l
-l is nothing but live
Example:
[root@test ~]# vnstat -l
Monitoring eth0... (press CTRL-C to stop)
rx: 8.32 kB/s 30 p/s tx: 0.19 kB/s 0 p/s
eth0 / traffic statistics
rx tx
--------------------------------------+----------------------------------------
bytes 206 kB 4 kB
--------------------------------------+----------------------------------------
max 11.19 kB/s 0.24 kB/s
average 7.96 kB/s 0.19 kB/s
min 6.35 kB/s 0.11 kB/s
--------------------------------------+----------------------------------------
packets 695 16
--------------------------------------+----------------------------------------
max 61 p/s 2 p/s
average 26 p/s 0 p/s
min 9 p/s 0 p/s
--------------------------------------+----------------------------------------
time 26 seconds
Type2 :For monitoring traffic per second
#vmstat –tr 5
This command will monitor bandwidth for 5 seconds and give you the output.
Type3 : For hourly
#vmstat –h
Example :
[root@test ~]# vnstat -h
eth0 21:00
^ r
r
r
r
r
r
r
r
r
r
-+--------------------------------------------------------------------------->
22 23 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21
h rx (kB) tx (kB) h rx (kB) tx (kB) h rx (kB) tx (kB)
22 0 0 06 0 0 14 0 0
23 0 0 07 0 0 15 0 0
00 0 0 08 0 0 16 0 0
01 0 0 09 0 0 17 0 0
02 0 0 10 0 0 18 0 0
03 0 0 11 0 0 19 0 0
04 0 0 12 0 0 20 12,614 41
05 0 0 13 0 0 21 0 0
Type4:For dialy
#vmstat –d
Example :
[root@test ~]# vnstat -d
eth0 / daily
day rx tx total
------------------------+-------------+----------------------------------------
09.09. 12.32 MB 41 kB 12.36 MB %%%%%%%%%%%%%%%%%%%%%%%%%
------------------------+-------------+----------------------------------------
estimated -- -- --
Type5 : For weekly
#vmstat –w
Example :
[root@test ~]# vnstat -w
eth0 / weekly
rx tx total
----------------------------+---------------+--------------
last 7 days 12.32 MB 41 kB 12.36 MB
current week 12.32 MB 41 kB 12.36 MB
----------------------------+---------------+--------------
estimated -- -- --
Type6 : For monthly
#vmstat –m
Example :
[root@test ~]# vnstat -m
eth0 / monthly
month rx tx total
-------------------------+--------------+--------------------------------------
Sep '09 12.32 MB 41 kB 12.36 MB %%%%%%%%%%%%%%%%%%%%%%
-------------------------+--------------+--------------------------------------
Please comment your thoughts about VNSTAT.
lsof Command
Today I came across ISOF command in one interview, the interviewer of this interview is a tricky guy and a great Linux/nix guru. He asked me many questions which I can’t answer, in that lsof command is one. This command really impressed me and this is one of the most powerful command i ever come across till this point in Linux. So I did some research on this command and come across numerous examples for making network/system admin work bit more simple and meaning full.
So what is lsof command?
lsof is nothing but LiSt Open Files, which will show all the open files by
1. a process in system.
2. a user.
3. a command.
4. a network service.
5. a regular file.
6. a directory
7. a block special file
8. a character special file
9. an executing text reference
10. a library
11. a stream or
So where we will use this lsof command? In many situations such as when troubleshooting network related issues, file related issues and process related issue.
USAGE1 : To see all the open files in system with out filtering which lists all open files belonging to all active processes.
#lsof
USAGE2 : Some times we will face an issue like, some service will not bind to a port and cannot start the service, this is due to some process already using that port(though the process died). So we have to see which process is using this port and kill that process. this will eliminate restarting the server. Suppose we want to start ftp server which will not starting due to above problem.
#lsof -i TCP:ftp
here -i is used to specify Internet
USAGE3 : To see what files are opened when you execute a command
#lsof -c httpd
here -c is for specifying command.
USAGE4 : To see which file opened for a device
#lsof /dev/hdc
USAGE5 : To see which procces or user is accessing the file.
#lsof -f filename
Example:
[root@v-test Script]# lsof -f passwd
[root@v-test Script]# lsof -f passwd
vim 14122 root 4u REG 253,0 12288 234655 /etc/.passwd.swp
[root@v-test Script]#
USAGE6 : To monitor network, what people are doing with what network services
#watch lsof -i
Note:watch is an excellent command to repeate a command execution on a regular interval please have a look in to my other blog post about this watch command.
USAGE7 : To see all open internet files
#lsof -i -U
USAGE8 : To see Ports either its TCP or UDP
#lsof -i TCP:22
For checking all the connection for ssh port
#lsof -i UDP: 69
This is for tftp connections to the machine.
USAGE9:To watch all the actually by a user in live..?
#watch lsof –u username
A good link for learning more about lsof command link1 some sister commands for this command are pstree, ps and netstat
NOTE : Some strange things I observed about this command is
1.Till this point I know that to use any commands options we have to use - but for this command there are both + and - options too.
2.In linux every thing is considered as files even a network socket, hardware device for some examples.
Linux Interview Questions: Sendmail
The below questions are not my own, you can reach the author at
-Ian! D. Allen - idallen@idallen.ca - http://www.idallen.com/
A common misconception: the place/protocol you use to fetch your email
is the same place/protocol that you use to send your email:
- sending email uses SMTP
- reading email uses POP3 or IMAP
- they can be completely separate machines
http://wiki.mutt.org/?MailConcept
Q: T/F, unlike POP3, SMTP can be used to both send and receive email.
Q: T/F, unlike SMTP, POP3 can be used to both receive and send email.
- may be completely different servers
- though note POP-before-SMTP (SMTP-after-POP) requires coupling:
http://tools.ietf.org/html/rfc2476 (section 3.3)
"Requiring a POP [POP3] authentication (from the same IP address)
within some amount of time (for example, 20 minutes) prior to the
start of a message submission session has also been used, but this
does impose restrictions on clients as well as servers which may
cause difficulties. Specifically, the client must do a POP
authentication before an SMTP submission session, and not all clients
are capable and configured for this. Also, the MSA must coordinate
with the POP server, which may be difficult. There is also a window
during which an unauthorized user can submit messages and appear to
be a prior authorized user."
Q: Describe briefly how POP-before-SMTP works to authenticate an SMTP session.
MUA - Mail User Agent (email client)
- the user's interface to the protocols - "presentation layer"
- usually gives access to functionality of both MTA and MRA/MAA
- but may not itself implement any protocols (may read/write file system)
http://en.wikipedia.org/wiki/Mail_user_agent
"An e-mail client, also called a Mail User Agent (MUA), is a computer
program that is used to read and send e-mail.
Originally, the MUA was intended to be a simple program to read the user's
mail messages, which the mail delivery agent (MDA) in conjunction with
the mail transfer agent (MTA) would transfer into a local mailbox.
The most important mailbox formats are mbox and Maildir. These rather
simple protocols for locally storing e-mails make import, export and
backup of mailfolders quite easy.
E-mails to be sent would be handed over to the MTA, perhaps via
a mail submission agent [MSA], therefore an MUA would not have to
provide any transport-related functions.
*Since the various Microsoft Windows versions intended for home use never
*provided an MTA, most modern MUAs have to support protocols like POP3
*and Internet Message Access Protocol (IMAP) to communicate with a remote
*MTA located at the e-mail providers machine."
- user agents (MUAs) are user-visible email clients of all descriptions
- e.g. mutt, "mail", "Mail", "mailx", pine, elm
- e.g. KMail, Eudora, MS Outlook
- e.g. web-browser email (Netscape Messenger,Mozilla,Thunderbird)
- e.g. webmail, Horde, SqurrelMail
http://en.wikipedia.org/wiki/List_of_mail_servers#POP.2FIMAP
Q: Briefly describe the function of a mail system MUA.
MSA - Mail Submission Agent
http://tools.ietf.org/html/rfc2476
"acts as a submission server to accept messages from MUAs, and either
delivers them or acts as an SMTP client to relay them to an MTA."
- enforce policy (no open relay)
- enforce standards (no forged headers, etc.)
- enforce filtering (SpamAssassin, etc.)
- may modify messages (section 8 of RFC)
http://en.wikipedia.org/wiki/List_of_mail_servers#Mail_filtering
Q: Briefly describe the function of a mail system MSA.
MTA - Mail Transfer Agent (mail server, mail exchange server)
"A process which conforms to [SMTP-MTA], which acts as an SMTP server to
accept messages from an MSA or another MTA, and either delivers them or
acts as an SMTP client to relay them to another MTA."
http://en.wikipedia.org/wiki/Mail_transfer_agent
"It receives messages from another MTA (relaying), a mail
submission agent (MSA) that itself got the mail from a mail user
agent (MUA), or directly from an MUA, thus acting as an MSA
itself. The MTA works behind the scenes, while the user usually
interacts with the MUA. The delivery of e-mail to a user's
mailbox typically takes place via a mail delivery agent (MDA);
many MTAs have basic MDA functionality built in, but a dedicated
MDA like procmail can provide more sophistication."
- transfers email between machines (other MTAs) via SMTP
- Internet-facing, open ports: security issues
- sendmail, postfix, qmail, exim
- may have MDA ability to transfer email to user's mailbox
http://en.wikipedia.org/wiki/List_of_mail_servers#SMTP
Q: Briefly describe the function of a mail system MTA.
MDA - Mail Delivery Agent
http://en.wikipedia.org/wiki/Mail_delivery_agent
"A Mail Delivery Agent (MDA) is software that accepts incoming e-mail
messages and distributes them to recipients' individual mailboxes
(if the destination account is on the local machine), or forwards
back to an SMTP server (if the destination is on a remote server).
A mail delivery agent is not necessarily a mail transfer agent (MTA),
although on many systems the two functions are implemented by the
same program."
- Unix/Linux: /bin/mail, procmail
Q: Briefly describe the function of a mail system MDA.
MRA/MAA - Mail Retrieval Agent / Mail Access Agent
http://tools.ietf.org/html/rfc1939 - POP3 port 110
http://tools.ietf.org/html/rfc3501 - IMAP-V4-R1 port 143
- often built-in to mail clients (MUAs)
- can be stand-alone
- e.g. fetchmail gets the mail; MUA reads mail from file system
Q: Briefly describe the function of a mail system MRA/MAA.
Mail server comparison
----------------------
http://en.wikipedia.org/wiki/List_of_mail_servers
- see comparison near bottom
- PUSH protocols - sending email: MTA - SMTP
- PULL protocols - reading email: MRA/MAA - POP3, IMAP
MDAs write local mailboxes; they may not implement Internet protocols
(unless they have to forward off-machine without benfit of an MTA).
Single-user PCs often don't run separate MTA or MRA/MAA programs.
Your chose of mail reader (e.g. Pine, Elm, Outlook) itself PULLs your
incoming email from a remote server (acting as an MRA/MAA) and then
PUSHes your outgoing email to the remote server (acting as an MTA).
Q: What is the difference between a PUSH protocol and a PULL protocol?
Q: T/F, SMTP is a PUSH protocol.
Q: T/F, POP3 is a PUSH protocol.
Q: T/F, HTTP is a PUSH protocol.
A History of MTAs
-----------------
I. Incoming - delivering your incoming email via SMTP:
* Sending email into Unix/Linux machines:
Unix/Linux was traditionally multi-user and ran its own MTA
(e.g. sendmail) that accepted incoming SMTP connections. Remote systems
could use SMTP to drop off your email with your local MTA (sendmail),
and the MTA would hand the email to an MDA (/bin/mail, procmail)
to put it in your mailbox in the local file system. Your MUA
(e.g. /usr/ucb/Mail) would read the mail from your inbox (no need
for POP3 or IMAP in any MUA). There are a few different conventions
for inbox formats so that many different MUAs can read your email,
all without knowing POP or IMAP.
- sendmail (running as root!) has had many security patches
- the first Morris Internet worm (Nov 1988) used sendmail security holes
- http://en.wikipedia.org/wiki/Morris_worm
Q: Why don't many Unix MUAs need to know how to run POP or IMAP?
Current single-user Unix/Linux PCs often have a local-only MTA
that handles the sending and delivery of local on-machine email but
doesn't accept SMTP from off-site. (Best to keep ports closed on
Internet-facing machines!)
On recent single-user Unix/Linux workstations, the MUAs mimic their
Windows counterparts and include MRA/MAA features. Your chosen MUA
(e.g. Elm, Pine, Mutt) is responsible for fetching your email via POP3
or IMAP (this is an MRA/MAA function); or, you use an intermediate
MRA/MAA program such as "fetchmail" and your MUA reads the mail out
of the local file system after the MRA/MAA has put it there.
- no Internet-facing MTA means fewer open ports and fewer attacks
- don't run an Internet-facing MTA if you don't need it
* Sending email into MS Windows machines (or not):
Windows had (has?) no MTA - you can't send an email to a Windows PC
using SMTP. Your personal Windows MUA has to fetch the email itself
via POP3 or IMAP and keep a copy in the local file system.
- no open ports for incoming email; no open mail port security issues
* Note that MUAs that implement POP/IMAP typically store the email in
the local file system in a format that only that MUA can handle.
(Thunderbird can't use an Outlook mail folder, and vice-versa.)
The concept of a common inbox format usable by different MUAs was lost.
Q: T/F, the standards for inbox formats developed under Unix were adopted
by MUAs on PCs, so that different MUAs can read the same inbox.
II. Outgoing - sending your outgoing email via SMTP:
* Unix/Linux machines have traditionally each had their own MTA (sendmail)
that could directly deliver email on the Internet using MX record lookup.
Every local Unix MUA would put email into a directory where the MTA
(sendmail) would eventually pick it up and transfer it, retrying as
necessary. No MUA needed to know how to do SMTP; only the MTA did that.
You could optionally tell your machine's MTA not to send mail directly
to its destination via SMTP over the Internet, but to use a remote
"smart" MTA that could accept your outgoing email and figure out
how to deliver it. (You have to use such a "smart" host here at
Algonquin; since, you cannot connect to any off-campus SMTP servers.)
The MTA on your machine would use SMTP to drop off the queued mail at
the smart host, and the smart host would do the MX record lookup and
final SMTP delivery.
Since the local Unix MTAs were separately scheduled programs, you could
queue email from a MUA into the file system even when your machine was
not connected to the Internet. The MUA or local MTA would queue up
your email in the file system until your MTA was finally able to make
a connection to deliver it off-machine. (In the days of modems, the
Internet connection was often made late at night when rates were lower.)
Q: Why don't most Unix MUAs need to know SMTP?
Current single-user Unix/Linux PCs now have MUAs that mimic their
Windows counterparts - the MUAs ignore the file system and the local
MTA and expect you to give the name of a remote "smart" MTA to which
all email will be sent via SMTP for actual delivery.
The Algonquin Linux lab has both types of mail systems: Command-line
email (e.g. the "mail" command) queues up mail for the local
MTA (sendmail) to send. (This is currently broken.) GUI MTAs
(e.g. Thunderbird, Mozilla) ignore the local file system and the local
MTA and use a "smart" remote MTA (e.g. outmail.algonquincollege.com)
to deliver the mail. (This supposedly still works.)
* MS Windows has no local MTA - no program exists whose job it is just
to deliver queued email. Each MUA has to know how to do its own
SMTP connection and each MUA has to be configured (separately!) with
the address of a smart MTA to which it connects. MUAs on Windows
machines all contain networking code to drop off email at some "smart"
MTA that does the actual delivery. There is no local MTA queue and
much duplication of SMTP code in all the MUAs.
On Windows, it is up to each MUA to deal with what happens if the
message being composed can't be dropped off right away at the remote
smart MTA. Better MUAs will queue the email for later transmission.
Poor MUAs will tell you that your mail can't be sent.
Q: Why do MUAs on Windows all need to know how to talk SMTP?
Q: Unix/Linux mail user agents didn't need to know how to talk to SMTP
servers - you never had to configure your "outgoing mail" preferences.
All the Windows MUAs need to be configured with a mail server. Why?
Subscribe to:
Posts (Atom)