sudo nano /etc/security/limits.confAppend the following lines at the end of the file.
* soft nproc 10240
root soft nproc 10240You can replace "10240" up to "65535".
That's all! See you.
Monday, June 19, 2017
HOWTO : Lower CPU Loading With ulimit on Ubuntu 16.04 LTS
ulimit can change the number of process on Linux. One of the features is to lower the CPU loading with it when you have a low end CPU. The lower the CPU loading the lower the CPU temperature.
Append the following lines at the end of the file.
You can replace "10240" up to "65535".
That's all! See you.
Append the following lines at the end of the file.
You can replace "10240" up to "65535".
That's all! See you.
Sunday, June 04, 2017
HOWTO : Update Ubuntu 16.04 LTS
sudo nano ~/update_ubuntuAppend the following lines to the file :
export DEBIAN_FRONTEND=noninteractive
sudo apt update
sudo apt -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -o APT::Get::Assume-Yes="true" -y dist-upgrade
sudo apt -y autoclean
sudo apt -y --purge autoremoveSave it and make it executable.
chmod +x ~/update_ubuntuTo run it :
sudo ~/update_ubuntuThat's all! See you.
Saturday, June 03, 2017
HOWTO : Apache Guacamole Remote Desktop Gateway On Ubuntu 16.04 LTS
Apache Guacamole is a HTML5 remote desktop gateway. It supports VNC, RDP and SSH protocols. You can access your remote desktop or server by using standard browser. You are required a dedicate computer or virtual machine to setup the Guacamole server. This guide will use database authentication for the operation.
Step 1 :
Install Ubuntu Server 16.04.2 LTS as usual. It is recommended to install OpenSSH also.
Step 2 :
Step 3 :
Append the following lines at the end of the file :
Step 4 :
Step 5 :
Step 6 :
Step 7 :
Step 8 :
The content of the file is :
Step 9 :
Step 10 :
Step 11 : (The following Step 11 to 14 are for setting up VNC server on Ubuntu Desktop)
The Ubuntu Desktop will be accessed via VNC. Therefore, we need to install related packages on Ubuntu Desktop.
The file content will be looking like :
Reconfigure the session manager :
Select :
Step 12 :
The file content will be looking like below. Making sure to replace "samiux" to your username :
Step 13 :
Enter the password of VNC server when prompt and then answer "n" to the last question.
To start VNC server at port 5901 :
Step 14 :
For streaming audio from Ubuntu Desktop :
Append the following line at the end of the file :
To restart PulseAudio :
Port 4713 should be listening for connection. However, it is not very stable at my side.
Step 15 : (The following Step 15 is for setting up RDP on Kali Linux Xfce)
Install Kali Linux Xfce version, Gnome does not work. Lxde may works.
Make sure it is selected :
Step 16 :
To access the Guacamole, you point the browser to the Guacamole box, e.g. http://192.168.20.99:8080. The username and password are both "guacadmin".
When accessing the remote desktop or server, you can launch the submenu by pressing :
Reference
Apache Guacamole Manual
How to install SSH ( secure shell ) service on Kali Linux
That's all! See you.
Step 1 :
Install Ubuntu Server 16.04.2 LTS as usual. It is recommended to install OpenSSH also.
sudo apt-get -y install libcairo2-dev libjpeg-turbo8-dev libpng12-dev libossp-uuid-dev libavcodec-dev libavutil-dev libswscale-dev libfreerdp-dev libpango1.0-dev libssh2-1-dev libtelnet-dev libvncserver-dev libpulse-dev libssl-dev libssh2-1-dev libvorbis-dev libwebp-dev autoconf autotools-dev libtool build-essential maven default-jdk mysql-common mysql-server mysql-client mysql-utilities tomcat8 tomcat8-admin tomcat8-common tomcat8-docs tomcat8-user ghostscript gsfonts gsfonts-otherStep 2 :
sudo mkdir -p /etc/guacamole
sudo mkdir -p /etc/guacamole/lib
sudo mkdir -p /etc/guacamole/extensionsStep 3 :
sudo nano /etc/default/tomcat8Append the following lines at the end of the file :
# GUACAMOLE ENV VARIABLE
GUACAMOLE_HOME=/etc/guacamoleStep 4 :
cd ~
git clone git://github.com/apache/incubator-guacamole-server.git
cd incubator-guacamole-server
autoreconf -fi
./configure --with-init-dir=/etc/init.d
make
sudo make install
sudo ldconfigsudo systemctl enable guacdStep 5 :
cd ~
git clone git://github.com/apache/incubator-guacamole-client.git
cd incubator-guacamole-client
mvn package
sudo cp ~/incubator-guacamole-client/guacamole/target/guacamole-0.9.12-incubating.war /etc/guacamole/
sudo ln -s /etc/guacamole/guacamole-0.9.12-incubating.war /var/lib/tomcat8/webapps/
sudo cp ~/incubator-guacamole-client/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/target/guacamole-auth-jdbc-mysql-0.9.12-incubating.jar /etc/guacamole/extensions/Step 6 :
wget https://dev.mysql.com/get/Downloads/Connector-J/mysql-connector-java-5.1.42.tar.gz
tar -xvzf mysql-connector-java-5.1.42.tar.gz
sudo cp mysql-connector-java-5.1.42/mysql-connector-java-5.1.42-bin.jar /etc/guacamole/lib/sudo mkdir -p /usr/lib/x86_64-linux-gnu/freerdp
sudo ln -s /usr/local/lib/freerdp/* /usr/lib/x86_64-linux-gnu/freerdp/Step 7 :
sudo mysql -u root -p
CREATE DATABASE guacamole_db;
CREATE USER 'guacamole_user'@'localhost' identified by '[GUACAMOLE_USER_PASSWORD]';
GRANT SELECT,INSERT,UPDATE,DELETE ON guacamole_db.* TO 'guacamole_user'@'localhost';
flush privileges;
quitcd ~
cat ~/incubator-guacamole-client/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/schema/*.sql | mysql -u root -p[MYSQL_ROOT_PASSWORD] guacamole_dbStep 8 :
sudo nano /etc/guacamole/guacamole.propertiesThe content of the file is :
# Hostname and port of guacamole proxy
guacd-hostname: localhost
guacd-port: 4822
# MySQL Authentication
mysql-hostname: localhost
mysql-port: 3306
mysql-database: guacamole_db
mysql-username: guacamole_user
mysql-password: [GUACAMOLE_USER_PASSWORD]Step 9 :
sudo ln -s /var/lib/tomcat8/webapps/guacamole-0.9.12-incubating.war /var/lib/tomcat8/webapps/ROOT.warStep 10 :
sudo systemctl restart guacd
sudo systemctl restart tomcat8Step 11 : (The following Step 11 to 14 are for setting up VNC server on Ubuntu Desktop)
The Ubuntu Desktop will be accessed via VNC. Therefore, we need to install related packages on Ubuntu Desktop.
sudo apt-get install ubuntu-desktop gnome-panel gnome-settings-daemon metacity nautilus gnome-terminal tightvncservernano ~/.vnc/xstartupThe file content will be looking like :
#!/bin/sh
xrdb $HOME/.Xresources
xsetroot -solid grey
#x-terminal-emulator -geometry 80x24+10+10 -ls -title "$VNCDESKTOP Desktop" &
#x-window-manager &
# Fix to make GNOME work
export XKL_XMODMAP_DISABLE=1
/etc/X11/Xsession
unset SESSION_MANAGER
vncconfig -iconic &
x-terminal-emulator -geometry 80x24+10+10 -ls -title "$VNCDESKTOP Desktop" &
x-window-manager &
gnome-panel &
gnome-settings-daemon &
nautilus &
metacity &
gnome-session-flashback &Reconfigure the session manager :
sudo update-alternatives --config x-session-managerSelect :
/usr/lib/gnome-flashback/gnome-flashback-metacityStep 12 :
sudo nano /lib/systemd/system/vncserver@.serviceThe file content will be looking like below. Making sure to replace "samiux" to your username :
[Unit]
Description=Start TightVNC server at startup
After=syslog.target network.target
[Service]
Type=forking
User=samiux
PAMName=login
PIDFile=/home/samiux/.vnc/%H:%i.pid
ExecStartPre=-/usr/bin/vncserver -kill :%i > /dev/null 2>&1
ExecStart=/usr/bin/vncserver -depth 24 -geometry 1280x800 :%i
ExecStop=/usr/bin/vncserver -kill :%i
[Install]
WantedBy=multi-user.targetStep 13 :
vncserverEnter the password of VNC server when prompt and then answer "n" to the last question.
vncserver -kill :1sudo systemctl daemon-reload
sudo systemctl enable vncserver@1.serviceTo start VNC server at port 5901 :
sudo systemctl start vncserver@1Step 14 :
For streaming audio from Ubuntu Desktop :
sudo nano /etc/pulse/default.paAppend the following line at the end of the file :
load-module module-native-protocol-tcp auth-anonymous=1To restart PulseAudio :
pulseaudio -kPort 4713 should be listening for connection. However, it is not very stable at my side.
Step 15 : (The following Step 15 is for setting up RDP on Kali Linux Xfce)
Install Kali Linux Xfce version, Gnome does not work. Lxde may works.
apt-get xrdp
systemctl enable xrdp
systemctl enable xrdp-sesman
systemctl start xrdp
systemctl start xrdp-sesmanupdate-alternatives --config x-session-managerMake sure it is selected :
/usr/bin/startxfce4Step 16 :
To access the Guacamole, you point the browser to the Guacamole box, e.g. http://192.168.20.99:8080. The username and password are both "guacadmin".
When accessing the remote desktop or server, you can launch the submenu by pressing :
ctrl+alt+shiftReference
Apache Guacamole Manual
How to install SSH ( secure shell ) service on Kali Linux
That's all! See you.
Thursday, May 04, 2017
HOWTO : OwnCloud 10.0.0 and Hiawatha 10.6 on Ubuntu 16.04 LTS
Step 1 - Update Ubuntu :
Step 2 - Hiawatha Installation :
Add "SocketSendTimeout" just before "Binding Setting" :
Add "MaxRequestSize" to "Binding Settings" :
Append the following line at the end of the file :
Create "owncloud" file at /etc/hiawatha/enable-sites :
Append the following lines at the end of the file :
Step 3 - MySQL Setting :
Step 4 - OwnCloud Installation :
The content of the file may looking like this one :
sudo apt-get update
sudo apt-get dist-upgrade
sudo apt-get autoclean
sudo apt-get --purge autoremoveStep 2 - Hiawatha Installation :
sudo apt-get install libc6-dev libssl-dev dpkg-dev debhelper fakeroot libxml2-dev libxslt1-devwget https://cmake.org/files/v3.5/cmake-3.8.1.tar.gz
tar -xvzf cmake-3.8.1.tar.gz
cd cmake-3.8.1
./configure
make
sudo make installwget https://github.com/hsleisink/hiawatha/archive/v10.6.tar.gz
tar -xzvf v10.6.tar.gz
cd hiawatha-10.6/extra
./make_debian_package
cd ..
sudo dpkg -i hiawatha_10.6_amd64.debsudo mkdir /etc/hiawatha/enable-sitessudo nano /etc/hiawatha/hiawatha.confAdd "SocketSendTimeout" just before "Binding Setting" :
SocketSendTimeout = 240Add "MaxRequestSize" to "Binding Settings" :
# BINDING SETTINGS
# A binding is where a client can connect to.
#
Binding {
Port = 80
# MaxRequestSize is 100GB
MaxRequestSize = 104857600
MaxUploadSize = 2047
TimeForRequest = 24,100
MaxKeepAlive = 72000000
}Append the following line at the end of the file :
Include /etc/hiawatha/enable-sites/Create "owncloud" file at /etc/hiawatha/enable-sites :
sudo nano /etc/hiawatha/enable-sites/owncloud
VirtualHost {
Hostname = [your domain or IP address here]
WebsiteRoot = /var/www/owncloud
StartFile = index.php
AccessLogfile = /var/log/hiawatha/owncloud-access.log
ErrorLogfile = /var/log/hiawatha/owncloud-error.log
TimeForCGI = 72000000
WebDAVapp = yes
UseFastCGI = PHP70
UseToolkit = denyData
EnablePathInfo = yes
AllowDotFiels = yes
HTTPAuthToCGI = yes
}
UrlToolkit {
ToolkitID = denyData
Match ^/data DenyAccess
}
FastCGIserver {
FastCGIid = PHP70
ConnectTo = /var/run/php/php7.0-fpm.sock
Extension = php
SessionTimeout = 72000000
}sudo nano /etc/php/7.0/fpm/php-fpm.confAppend the following lines at the end of the file :
; for OwnCloud
env[HOSTNAME] = $HOSTNAME
env[PATH] = /usr/local/bin:/usr/bin:/bin
env[TMP] = /tmp
env[TMPDIR] = /tmp
env[TEMP] = /tmp
[www]
pm=dynamic
pm.max_children=1000
pm.start_servers=50
pm.min_spare_servers=25
pm.max_spare_servers=75Step 3 - MySQL Setting :
sudo mysql -u root -pcreate database owncloud;
GRANT ALL ON owncloud.* TO owncloud@'127.0.0.1' IDENTIFIED BY '[your password here]';
flush privileges;
quitStep 4 - OwnCloud Installation :
wget -nv https://download.owncloud.org/download/repositories/stable/Ubuntu_16.04/Release.key -O Release.key
sudo apt-key add - < Release.key
rm Release.key
sudo sh -c "echo 'deb http://download.owncloud.org/download/repositories/stable/Ubuntu_16.04/ /' >> /etc/apt/sources.list.d/owncloud.list"
sudo apt-get update
sudo apt-get install owncloud-filessudo apt-get install exim4 exim4-base exim4-config exim4-daemon-light libapr1 libaprutil1 libaprutil1-dbd-sqlite3 libaprutil1-ldap liblua5.1-0 s-nail php-common php7.0-cli php7.0-common php7.0-curl php7.0-gd php7.0-imap php7.0-intl php7.0-json php7.0-mbstring php7.0-mcrypt php7.0-mysql php7.0-readline php7.0-xml php7.0-zip php7.0-pgsql php7.0-sqlite3 php7.0-fpm php-apcu mysql-server mysql-client php7.0-cgi php7.0-mbstringsudo nano /var/www/owncloud/.user.iniThe content of the file may looking like this one :
upload_max_filesize=100G
post_max_size=100G
memory_limit=12G
mbstring.func_overload=0
always_populate_raw_post_data=-1
default_charset='UTF-8'
output_buffering=0
max_input_time=3600
max_execution_time=3600
upload_tmp_dir='/tmp/'
max_file_upload=5000
Open browser and point to http://[your owncloud server IP] and create your admin user and password. Then select database on the same page. Otherwise, it will use SQLite by default.
After that, do the following :
sudo nano /var/www/owncloud/config/config.php
Insert the following line into the end of the block of the code :
'memcache.local' => '\OC\Memcache\APCu',
To restart OwnCloud and Hiawatha services :
sudo systemctl restart php7.0-fpm
sudo systemctl restart hiawatha
sudo systemctl enable php7.0-fpm
sudo systemctl enable hiawatha
Then, you can install the desktop sync client to sync your desktop to ownCloud.
Remarks :
If you want to have https connection, you need to generate the private SSL certificate or purchase one. You can also use Let's Encrypt when necessary. If so, the "binding settings" at Hiawatha should be "Port 443".
That's all! See you.
Wednesday, May 03, 2017
[RESEARCH] How Secure of HSBC and DBS Web Sites Are?
Last year, I wrote an article about the SSL certificate grading of banks in Hong Kong. This time, I would like to choose DBS and HSBC for the research. It is because DBS was the highest SSL certificate grading at that time - Grade A while HSBC is the largest bank in Hong Kong even it was Grade C.
The Research
Since pentesting a target without written authorization is illegal, this research is only done on recon phase only. Therefore, it is an incomplete research. Be keep in mind that it is for reference only.
I have written an article about security headers of a web site, such as HSTS, HPKP and XSS Protection. You can refer to it if you do not know what securty headers are. The control web site for this research is my personal site which is consider to be secured.
DBS Bank (Hong Kong) 星展銀行（香港）
The ebanking login page (https://internet-banking.hk.dbs.com/IB/Welcome) is tested and find out that it is upgraded from A to A+ as HSTS security header is set properly this time. The cookie is also set to be secured. Meanwhile, it is still protected by Akamai (WAF/DDoS).
However, HPKP and XSS protection security headers are missing and setting not properly respectively. The site may be vulnerable to XSS and Man-In-The-Middle (MiTM) attack even HSTS is enforced.
Hongkong and Shanghai Banking Corporation (HSBC) 滙豐銀行
The ebanking login page (https://www.ebanking.hsbc.com.hk/1/2/logon?LANGTAG=en&COUNTRYTAG=US) is tested and find out that the grading is remained unchange - Grade C as TLS 1.2 is not set and RC4 cipher is used for older protocols as well as the VeriSign, Inc / Class 3 Public Primary Certification Authority is not set properly.
Meanwhile, HSTS, HPKP and XSS protection security headers are missing. Cookie is not security set properly. Therefore, it may be vulnerable to MiTM and XSS attacks.
Conclusion
If not set properly, HPKP will cause error when browsing. Therefore, most webmasters will not touch it in order to prevent the downtime. HSTS and XSS protection security headers as well as cookie secure settings are not difficult and there is no side effect. However, most webmasters are ignored those settings due to misconcept.
In my opinion, ebanking sites should be very secured in order to prevent the attacks.
Reference
Qualys SSL Labs
Security Headers
[RESEARCH] SSL Certificate Grading of Banks in Hong Kong
HOWTO : Secure Surfing
Green PadLock is Safe?
That's all! See you.
The Research
Since pentesting a target without written authorization is illegal, this research is only done on recon phase only. Therefore, it is an incomplete research. Be keep in mind that it is for reference only.
I have written an article about security headers of a web site, such as HSTS, HPKP and XSS Protection. You can refer to it if you do not know what securty headers are. The control web site for this research is my personal site which is consider to be secured.
DBS Bank (Hong Kong) 星展銀行（香港）
The ebanking login page (https://internet-banking.hk.dbs.com/IB/Welcome) is tested and find out that it is upgraded from A to A+ as HSTS security header is set properly this time. The cookie is also set to be secured. Meanwhile, it is still protected by Akamai (WAF/DDoS).
However, HPKP and XSS protection security headers are missing and setting not properly respectively. The site may be vulnerable to XSS and Man-In-The-Middle (MiTM) attack even HSTS is enforced.
Hongkong and Shanghai Banking Corporation (HSBC) 滙豐銀行
The ebanking login page (https://www.ebanking.hsbc.com.hk/1/2/logon?LANGTAG=en&COUNTRYTAG=US) is tested and find out that the grading is remained unchange - Grade C as TLS 1.2 is not set and RC4 cipher is used for older protocols as well as the VeriSign, Inc / Class 3 Public Primary Certification Authority is not set properly.
Meanwhile, HSTS, HPKP and XSS protection security headers are missing. Cookie is not security set properly. Therefore, it may be vulnerable to MiTM and XSS attacks.
Conclusion
If not set properly, HPKP will cause error when browsing. Therefore, most webmasters will not touch it in order to prevent the downtime. HSTS and XSS protection security headers as well as cookie secure settings are not difficult and there is no side effect. However, most webmasters are ignored those settings due to misconcept.
In my opinion, ebanking sites should be very secured in order to prevent the attacks.
Reference
Qualys SSL Labs
Security Headers
[RESEARCH] SSL Certificate Grading of Banks in Hong Kong
HOWTO : Secure Surfing
Green PadLock is Safe?
That's all! See you.
HOWTO : Highest Secured Hiawatha Web Server 10.6 on Ubuntu Server 16.04 LTS
(A) Introduction
Hiawatha Web Server is designed with security in mind. It already built-in some security features to protect common attacks, such as SQLi, XSS, CSRF. Meanwhile, it can be configured to prevent scanning from vulnerability scanners too.
Hiawatha is a light weight and fast as well as secure web server in the market. Hiawatha is working well with PHP and MySQL. The following guide is showing how to configure Hiawatha in a very high secure way on Ubuntu Server LTS.
(B) Software Prerequisite
The current version as at the time of this writing :
(1) Ubuntu Server 16.04.2 LTS
(2) CMake 3.8.1
(3) Hiawatha 10.6
(C) Installation of PHP7.0 and MySQL
(D) Installation of Hiawatha
(a) Install CMake
(b) Install Hiawatha
(E) Configuration of PHP7.0
Make changes as is.
* [EXIST_FUNCTION] is the functions that already at "disable_functions" of php.ini
(F) Let's Encrypt on Hiawatha
(a) Configuration of Hiawatha
Edit "cgi-wrapper.conf".
Change the following as is.
Change the ownership of the log files.
Change the ownership of the web application files.
The following are examples of "hiawatha.conf" and "mysite.com".
/etc/hiawatha/hiawatha.conf example :
/etc/hiawatha/enable-sites/mysite.com example :
(b) Self Signed SSL Certificate Generation
To generate SSL certificate for the web root.
(c) Let's Encrypt Generation and Configuration
(1) First time install Let's Encrypt :
Make sure port 80 is workable as Let's Encrypt script will use it to generate the SSL/TLS certificates.
Change ~/hiawatha-10.6/extra/letsencrypt/letsencrypt.conf :
Change "ACCOUNT_EMAIL_ADDRESS" to your email address. Let's Encrypt will alert you when the SSL/TLS certificate is going to expire via this email address.
Change "CERTIFICATE_RSA_KEY_SIZE" to 4096.
Change "RENEWAL_REUSE_KEY" to true. The server private key/public key will be used for the SSL/TLS certificate renewal.
Comment out the "Testing" LE_CA_HOSTNAME and uncomment "Production" LE_CA_HOSTNAME.
Run the Hiawatha 10.6 letsencrypt script to generate server private key and server certificate as well as Let's Encrypt X3 certificate :
A "account.key" will be generated at the ~/hiawatha-10.6/extra/letsencrypt. Make sure keep this "account.key" in a safe space.
Then generate the SSL/TLS certificate of your server :
A "www.mysite.com.pem" will be generated at /etc/hiawatha/tls/.
Rename the generated file :
Make sure keep the private key file in a safe space and generate the server public key :
Replace pubkey.pem content to the first block of code "PRIVATE KEY" at www.mysite.com.pem.
Insert Let's Encrypt X4 certificate :
Then configure VirtualHost at /etc/hiawatha/enable-sites/mysite.com.
Add the following to the VirtualHost at /etc/hiawatha/enable-sites/mysite.com :
Make sure to delete the private key at www.mysite.com.pem file
(2) Renew SSL/TLS certificate :
Make sure your proxy setting is not set and port 80 can be accessed. Meanwhile, make sure disable TLS related setting before renew. You need to reset the TLS setting back after the renew.
Make sure to delete the private key at www.mysite.com.pem file
* You can consider to write an auto renew script on cronjob for automatically update.
(3) Revoke SSL/TLS certificate : (Optional)
Hiawatha Web Server is designed with security in mind. It already built-in some security features to protect common attacks, such as SQLi, XSS, CSRF. Meanwhile, it can be configured to prevent scanning from vulnerability scanners too.
Hiawatha is a light weight and fast as well as secure web server in the market. Hiawatha is working well with PHP and MySQL. The following guide is showing how to configure Hiawatha in a very high secure way on Ubuntu Server LTS.
(B) Software Prerequisite
The current version as at the time of this writing :
(1) Ubuntu Server 16.04.2 LTS
(2) CMake 3.8.1
(3) Hiawatha 10.6
(C) Installation of PHP7.0 and MySQL
sudo apt-get install php7.0-cgi php7.0 php7.0-cli php7.0-mysql php7.0-curl php7.0-gd php7.0-intl php7.0-imap php7.0-mcrypt php7.0-pspell php7.0-recode php7.0-sqlite3 php7.0-tidy php7.0-xmlrpc php7.0-xsl apache2-utils php7.0-fpm php-memcache php-imagick php-cache mysql-server mysql-client php7.0-mbstring(D) Installation of Hiawatha
sudo apt-get install libc6-dev libssl-dev dpkg-dev debhelper fakeroot libxml2-dev libxslt1-dev(a) Install CMake
wget https://cmake.org/files/v3.8/cmake-3.8.1.tar.gz
tar -xvzf cmake-3.8.1.tar.gz
cd cmake-3.8.1
./configure
make
sudo make install(b) Install Hiawatha
wget https://github.com/hsleisink/hiawatha/archive/v10.6.tar.gz
tar -xzvf v10.6.tar.gz
cd hiawatha-10.6/extra
./make_debian_package
cd ..
sudo dpkg -i hiawatha_10.6_amd64.deb(E) Configuration of PHP7.0
sudo nano /etc/php/7.0/fpm/php.iniMake changes as is.
allow_url_fopen = Off
session.cookie_httponly = 1
disable_functions = [EXIST_FUNCTION],system, show_source, symlink, exec, dl, shell_exec, passthru, phpinfo, escapeshellarg, escapeshellcmd,* [EXIST_FUNCTION] is the functions that already at "disable_functions" of php.ini
(F) Let's Encrypt on Hiawatha
(a) Configuration of Hiawatha
sudo mkdir -p /etc/hiawatha/enable-sites
sudo mkdir -p /etc/hiawatha/disable-sitesEdit "cgi-wrapper.conf".
sudo nano /etc/hiawatha/cgi-wrapper.confChange the following as is.
CGIhandler = /usr/bin/perl
CGIhandler = /usr/sbin/php7.0-fpm
CGIhandler = /usr/bin/python
CGIhandler = /usr/bin/ruby
CGIhandler = /usr/bin/ssi-cgi
Wrap = jail_mysite ; /var/www/mysite ; www-data:www-dataChange the ownership of the log files.
cd /var/log/hiawatha
sudo chown www-data:www-data access.log
sudo chown www-data:www-data error.log
sudo chown www-data:www-data exploit.log
sudo chown www-data:www-data garbage.log
sudo chown root:root system.logChange the ownership of the web application files.
cd /var/www/mysite
sudo chown -R root:root *The following are examples of "hiawatha.conf" and "mysite.com".
/etc/hiawatha/hiawatha.conf example :
/etc/hiawatha/enable-sites/mysite.com example :
sudo systemctl restart php7.0-fpm
sudo systemctl restart hiawatha
sudo systemctl enable php7.0-fpm
sudo systemctl enable hiawatha(b) Self Signed SSL Certificate Generation
To generate SSL certificate for the web root.
openssl genrsa -out default.pem 4096
openssl req -new -x509 -days 3650 -key default.pem -out server.crt
echo "" >> default.pem
cat server.crt >> default.pem
echo "" >> default.pem
rm -f server.crt
sudo mkdir -p /etc/hiawatha/tls
sudo cp default.pem /etc/hiawatha/tls
sudo chown root:root /etc/hiawatha/tls/default.pem
sudo chmod 600 /etc/hiawatha/tls/default.pem
sudo chmod 600 -R /etc/hiawatha/tls(c) Let's Encrypt Generation and Configuration
(1) First time install Let's Encrypt :
Make sure port 80 is workable as Let's Encrypt script will use it to generate the SSL/TLS certificates.
Change ~/hiawatha-10.6/extra/letsencrypt/letsencrypt.conf :
nano ~/hiawatha-10.6/extra/letsencrypt/letsencrypt.confChange "ACCOUNT_EMAIL_ADDRESS" to your email address. Let's Encrypt will alert you when the SSL/TLS certificate is going to expire via this email address.
ACCOUNT_EMAIL_ADDRESS = samiux@gmail.comChange "CERTIFICATE_RSA_KEY_SIZE" to 4096.
CERTIFICATE_RSA_KEY_SIZE = 4096Change "RENEWAL_REUSE_KEY" to true. The server private key/public key will be used for the SSL/TLS certificate renewal.
RENEWAL_REUSE_KEY = trueComment out the "Testing" LE_CA_HOSTNAME and uncomment "Production" LE_CA_HOSTNAME.
LE_CA_HOSTNAME = acme-v01.api.letsencrypt.org # Production
#LE_CA_HOSTNAME = acme-staging.api.letsencrypt.org # TestingRun the Hiawatha 10.6 letsencrypt script to generate server private key and server certificate as well as Let's Encrypt X3 certificate :
cd ~/hiawatha-10.6/extra/letsencrypt
sudo ./letsencrypt registerA "account.key" will be generated at the ~/hiawatha-10.6/extra/letsencrypt. Make sure keep this "account.key" in a safe space.
Then generate the SSL/TLS certificate of your server :
sudo ./letsencrypt www.mysite.comA "www.mysite.com.pem" will be generated at /etc/hiawatha/tls/.
Rename the generated file :
sudo -sH
cd /etc/hiawatha/tls
mv www.mysite.com.pem www.mysite.com-privkey.pem
cp www.mysite.com-privkey.pem www.mysite.com.pemMake sure keep the private key file in a safe space and generate the server public key :
openssl rsa -in www.mysite.com-privkey.pem -pubout -out pubkey.pemReplace pubkey.pem content to the first block of code "PRIVATE KEY" at www.mysite.com.pem.
Insert Let's Encrypt X4 certificate :
wget https://letsencrypt.org/certs/lets-encrypt-x4-cross-signed.pem.txt
echo "" >> www.mysite.com.pem
cat lets-encrypt-x4-cross-signed.pem.txt >> www.mysite.com.pemchmod 600 www.mysite.com.pem
chmod 600 www.mysite.com-privkey.pemThen configure VirtualHost at /etc/hiawatha/enable-sites/mysite.com.
Add the following to the VirtualHost at /etc/hiawatha/enable-sites/mysite.com :
RequireTLS = yes, 180d; includeSubDomains; preload
TLScertFile = /etc/hiawatha/tls/www.mysite.com-privkey.pem
PublicKeyPins = /etc/hiawatha/tls/www.mysite.com.pem,60dMake sure to delete the private key at www.mysite.com.pem file
sudo cp /etc/hiawatha/tls/www.mysite.com.pem /etc/hiawatha/tls/www.mysite.com.pem-BACKUP
sudo sed '/-----BEGIN PRIVATE KEY-----/,/-----END PRIVATE KEY-----/d' /etc/hiawatha/tls/www.mysite.com.pemsudo systemctl restart hiawatha(2) Renew SSL/TLS certificate :
Make sure your proxy setting is not set and port 80 can be accessed. Meanwhile, make sure disable TLS related setting before renew. You need to reset the TLS setting back after the renew.
cd ~/hiawatha-10.6/extra/letsencrypt
sudo ./letsencrypt renewMake sure to delete the private key at www.mysite.com.pem file
sudo cp /etc/hiawatha/tls/www.mysite.com.pem /etc/hiawatha/tls/www.mysite.com.pem-BACKUP
sudo sed '/-----BEGIN PRIVATE KEY-----/,/-----END PRIVATE KEY-----/d' /etc/hiawatha/tls/www.mysite.com.pemsudo systemctl restart hiawatha* You can consider to write an auto renew script on cronjob for automatically update.
(3) Revoke SSL/TLS certificate : (Optional)
cd ~/hiawatha-10.6/extra/letsencrypt
sudo ./letsencrypt revoke /etc/hiawatha/tls/www.mysite.com.pemsudo systemctl restart php7.0-fpm
sudo systemctl restart hiawatha/code>
(G) Hardening of Ubuntu Server
(a) sysctl
sudo nano /etc/sysctl.d/60-hiawatha.conf
sudo sysctl /etc/sysctl.d/60-hiawatha.conf -p
(b) Apparmor
sudo apt-get install apparmor-profiles apparmor-utils
sudo nano /etc/apparmor.d/usr.sbin.hiawatha
sudo aa-enforce hiawatha
If you have change some settings, you should reload the profile.
sudo apparmor_parser -r < /etc/apparmor.d/usr.sbin.hiawatha
If you want to disable this profile.
sudo ln -s /etc/apparmor.d/usr.sbin.hiawatha /etc/apparmor.d/disable/
sudo apparmor_parser -R < /etc/apparmor.d/usr.sbin.hiawatha
If you want to re-enable this profile after it has been disabled.
sudo rm /etc/apparmor.d/disable/usr.sbin.hiawatha
sudo apparmor_parser -r < /etc/apparmor.d/usr.sbin.hiawatha
Remarks :
If you encounter "500 Internal Server Error", you may consider to make the Apparmor to "Complain mode".
sudo aa-complain hiawatha
After several days browsing the website, you may consider to turn the Apparmor to "Enforce mode".
sudo aa-logprof
sudo aa-enforce hiawatha
It is because the captioned usr.sbin.hiawatha may not 100% work for you.
(c) Linux Malware Detect (Optional)
Linux Malware Detect Installation
* the captioned link may be out-dated and it is for your reference only
(d) MySQL
Create Normal User on MySQL
(e) fail2ban
sudo apt-get install fail2ban
Change the setting at /etc/fail2ban/jail.conf when necessary.
(H) Storage Performance Tuning
It is recommended to use SSD for the storage instead of hard drive for the excellent performance.
(a) SSD
Verify TRIM is supported :
sudo hdparm -I /dev/sda | grep TRIM
If the output is similar to the below which is supported :
* Data Set Management TRIM supported (limit 1 block)
If you install your Ubuntu in LVM, the TRIM is usually enabled by default. You can confirm it :
cat /etc/lvm/lvm.conf | grep issue_discards
If the output is similar to the below which is enabled :
issue_discards = 1
Then set the following to "deadline" if it is not done yet.
cat /sys/block/sda/queue/scheduler
noop [deadline] cfq
If not, set it :
sudo nano /etc/rc.local
Insert the following before "exit 0" :
echo 2048 > /sys/block/sda/queue/read_ahead_kb
echo 2048 > /sys/block/sda/queue/nr_requests
echo deadline > /sys/block/sda/queue/scheduler
* make sure your device is sda (or sdb ...)
To reload it or reboot your system :
sudo bash /etc/rc.local
After that, you need to edit the partition table (/etc/fstab) :
To make it looks like the following :
/dev/mapper/ubuntu--vg-root / ext4 noatime,nodiratime,norelatime,errors=remount-ro 0 1
sudo mount -a
sudo mount -o remount /
If you have an error after running the captioned commands, DO NOT reboot your system. You should correct the typo before doing so; otherwise, you cannot boot to your system again.
(b) Hard Drive
sudo nano /etc/rc.local
Insert the following before "exit 0" :
echo 2048 > /sys/block/sda/queue/read_ahead_kb
echo 2048 > /sys/block/sda/queue/nr_requests
* make sure your device is sda (or sdb ...)
To reload it or reboot your system :
sudo bash /etc/rc.local
After that, you need to edit the partition table (/etc/fstab) :
To make it looks like the following :
ext4 noatime,nodiratime,norelatime,errors=remount-ro 0 1
sudo mount -a
sudo mount -o remount /
If you have an error after running the captioned commands, DO NOT reboot your system. You should correct the typo before doing so; otherwise, you cannot boot to your system again.
(I) Redis for PHP Session
The PHP sessions are stored in the memory will increase the speed of a web site.
sudo apt-get install php-redis redis-server
sudo nano /etc/php/7.0/fpm/php.ini
Change to following to :
session.save_handler = redis
session.save_path = "tcp://127.0.0.1:6379"
To restart Hiawatha and PHP :
sudo systemctl restart hiawatha
sudo systemctl restart php7.0-fpm
To confirm if it is working or not :
redis-cli
127.0.0.1:6379> keys *
The result will be similar to :
1) "PHPREDIS_SESSION:038gl83953j9bfnf02ksts52q5"
2) "PHPREDIS_SESSION:p53j1t43mbdp49cvaq1nv37o97"
3) "PHPREDIS_SESSION:kuop27qq6g6q265gu29000ee21"
4) "PHPREDIS_SESSION:84n96cba8colp73td8mslnjgq2"
Type "quit" to exit.
(J) Optional
To further hardening Ubuntu Server, you may consider to set up firewall (UFW/iptables) and place the Ubuntu Server behind Unified Threats Management System (UTM) or Intrusion Prevention System (IPS).
Reference
Qualys SSL Labs
High-Tech Bridge
securityheaders.io
URL Rewrite for Hiawatha
That's all! See you.
Monday, April 17, 2017
HOWTO : Secure Surfing
According to OWASP Secure Headers Project, Secure Headers are setting response headers from the web server that can restrict modern browsers from running into easily preventable vulnerabilities.
The following are some of the Secure Headers description that from OWASP Secure Headers Project :
HTTP Strict Transport Security (HSTS)
"HTTP Strict Transport Security (HSTS) is a web security policy mechanism which helps to protect websites against protocol downgrade attacks and cookie hijacking. It allows web servers to declare that web browsers (or other complying user agents) should only interact with it using secure HTTPS connections, and never via the insecure HTTP protocol."
Public Key Pinning Extension for HTTP (HPKP)
"HTTP Public Key Pinning (HPKP) is a security mechanism which allows HTTPS websites to resist impersonation by attackers using mis-issued or otherwise fraudulent certificates."
X-XSS-Protection
"This header enables the Cross-site scripting (XSS) filter in your browser."
Content-Security-Policy
"Content Security Policy (CSP) requires careful tuning and precise definition of the policy. If enabled, CSP has significant impact on the way browser renders pages (e.g., inline JavaScript disabled by default and must be explicitly allowed in policy). CSP prevents a wide range of attacks, including Cross-site scripting and other cross-site injections."
When secure headers are set in the web servers, it is showing that the sysadmins/developers are concerning about the security of their clients/users. Most attacks, such as XSS and MITM attack, today are via browsers and targetted users.
We can learn more about the web servers response headers setting by using an online tool - Analyse your HTTP response headers. It is recommended to have Grade A or A+ for the testing. However, Grade B may be acceptable.
For the client side, it is recommended to install some add-ons or plugins for the browser security. Firefox is recommended as there are a lot of such kind of add-ons for the purpose. The following are the add-ons that to be recommended.
NoScript
Allow active content to run only from sites you trust, and protect yourself against XSS and Clickjacking attacks.
* You are not required to enable it as it will block the javascript that most modern websites are using. You need to disable it globally to make the XSS attack protection by default.
uBlock Origin
Finally, an efficient blocker. Easy on CPU and memory. (Please refer to the official site for details)
WebRTC Control
Have control over WebRTC (disable or enable) and protect your IP address.
Self-Destructing Cookies
Self-Destructing Cookies automatically removes cookies when they are no longer used by open browser tabs. With the cookies, lingering sessions, as well as information used to spy on you, will be expunged. Websites will only be permitted to identify you while you actually use them and can not stalk you across the entire web. This is the closest you will get to cookieless browsing without breaking every second site or tedious micromanaging.
HTTPS Everywhere
Encrypt the web! HTTPS Everywhere is a Firefox extension to protect your communications by enabling HTTPS encryption automatically on sites that are known to support it, even when you type URLs or follow links that omit the https: prefix.
If you are a Ubnutu user, you can implement the Apparmor for Firefox to further hardening.
When both server side and client side are secured, it is very hard to be attacked by XSS and MITM attack or some other attacks.
Happy surfing!
That's all! See you.
The following are some of the Secure Headers description that from OWASP Secure Headers Project :
HTTP Strict Transport Security (HSTS)
"HTTP Strict Transport Security (HSTS) is a web security policy mechanism which helps to protect websites against protocol downgrade attacks and cookie hijacking. It allows web servers to declare that web browsers (or other complying user agents) should only interact with it using secure HTTPS connections, and never via the insecure HTTP protocol."
Public Key Pinning Extension for HTTP (HPKP)
"HTTP Public Key Pinning (HPKP) is a security mechanism which allows HTTPS websites to resist impersonation by attackers using mis-issued or otherwise fraudulent certificates."
X-XSS-Protection
"This header enables the Cross-site scripting (XSS) filter in your browser."
Content-Security-Policy
"Content Security Policy (CSP) requires careful tuning and precise definition of the policy. If enabled, CSP has significant impact on the way browser renders pages (e.g., inline JavaScript disabled by default and must be explicitly allowed in policy). CSP prevents a wide range of attacks, including Cross-site scripting and other cross-site injections."
When secure headers are set in the web servers, it is showing that the sysadmins/developers are concerning about the security of their clients/users. Most attacks, such as XSS and MITM attack, today are via browsers and targetted users.
We can learn more about the web servers response headers setting by using an online tool - Analyse your HTTP response headers. It is recommended to have Grade A or A+ for the testing. However, Grade B may be acceptable.
For the client side, it is recommended to install some add-ons or plugins for the browser security. Firefox is recommended as there are a lot of such kind of add-ons for the purpose. The following are the add-ons that to be recommended.
NoScript
Allow active content to run only from sites you trust, and protect yourself against XSS and Clickjacking attacks.
* You are not required to enable it as it will block the javascript that most modern websites are using. You need to disable it globally to make the XSS attack protection by default.
uBlock Origin
Finally, an efficient blocker. Easy on CPU and memory. (Please refer to the official site for details)
WebRTC Control
Have control over WebRTC (disable or enable) and protect your IP address.
Self-Destructing Cookies
Self-Destructing Cookies automatically removes cookies when they are no longer used by open browser tabs. With the cookies, lingering sessions, as well as information used to spy on you, will be expunged. Websites will only be permitted to identify you while you actually use them and can not stalk you across the entire web. This is the closest you will get to cookieless browsing without breaking every second site or tedious micromanaging.
HTTPS Everywhere
Encrypt the web! HTTPS Everywhere is a Firefox extension to protect your communications by enabling HTTPS encryption automatically on sites that are known to support it, even when you type URLs or follow links that omit the https: prefix.
If you are a Ubnutu user, you can implement the Apparmor for Firefox to further hardening.
When both server side and client side are secured, it is very hard to be attacked by XSS and MITM attack or some other attacks.
Happy surfing!
That's all! See you.
Saturday, April 15, 2017
Green PadLock is Safe?
According to Wikipedia, HTTPS is only to encrypt the communication traffic between browsers and web servers in order to prevent Man-In-The-Middle (MITM) attack. HTTPS is not indicating that the websites are bearing a green padlock being "safe".
Many people are misinterpreted that if a website is bearing a green padlock with HTTPS URL, it is a "safe" website. The "safe" here is referring to the website that not doing any malicious activities against the users.
Recently, I read an article "When the 'S' in HTTPS also stands for shady". That is also showing that even information security guys and gals may misinterpreted the purpose of the HTTPS.
Since users can revoke and regenerate the Let's Encrypt SSL certificates themselves, to revoke the SSL certificate of malicious websites by Let's Encrypt is meaningless. Without Let's Encrypt, malicious hackers can purchase SSL certificate from others sources to complete the task without any problem.
Ten odd years ago, many experts stated that if the the browser is showing a locked padlock, you are "safe" and the website is "safe". It is misleading for sure.
We should educate the users that even the websites are looking legit and bearing a valid SSL certificate, they should think more before clicking any link on the site. It is because most phishing sites are looking legit and have valid SSL certificate. They should check the URL address of the website before going further especially for banking and payment sites. Beware of the website is being redirected to other URL too.
By the way, malicious hackers can impersonate the HTTPS traffic and doing MITM attack at ease today! No system is safe!
That's all! See you.
Many people are misinterpreted that if a website is bearing a green padlock with HTTPS URL, it is a "safe" website. The "safe" here is referring to the website that not doing any malicious activities against the users.
Recently, I read an article "When the 'S' in HTTPS also stands for shady". That is also showing that even information security guys and gals may misinterpreted the purpose of the HTTPS.
Since users can revoke and regenerate the Let's Encrypt SSL certificates themselves, to revoke the SSL certificate of malicious websites by Let's Encrypt is meaningless. Without Let's Encrypt, malicious hackers can purchase SSL certificate from others sources to complete the task without any problem.
Ten odd years ago, many experts stated that if the the browser is showing a locked padlock, you are "safe" and the website is "safe". It is misleading for sure.
We should educate the users that even the websites are looking legit and bearing a valid SSL certificate, they should think more before clicking any link on the site. It is because most phishing sites are looking legit and have valid SSL certificate. They should check the URL address of the website before going further especially for banking and payment sites. Beware of the website is being redirected to other URL too.
By the way, malicious hackers can impersonate the HTTPS traffic and doing MITM attack at ease today! No system is safe!
That's all! See you.
Wednesday, April 12, 2017
[RESEARCH] Information Security Scammers?
What Attracted Me
Recently, Nexus Guard and Zenedge catch my eyes. They provide similar products/services, such as DDoS Protection by Content Delivery Network (CDN) and Web Application Firewall (WAF).
Nexus Guard website saying that they are the leader in the market :
"As a longtime leader in DDoS defense, Nexusguard is at the forefront of the fight against malicious Internet attacks, protecting organizations worldwide from threats to their websites, services, and reputations."
Zenedge website provides a free vulnerability and threat assessment for their potential clients :
"The report is produced by our team of cybersecurity experts bring a collective 200 years of cybersecurity experience and have been responsible for mitigating some of the largest attacks. Ever."
Basic and Fast Research
I wonder why there are so many CDN providers recently. CDN requires a lot of proxies around the world in order to absorb very large amount of DDoS traffic. They need to invest a lot on the infrastructure. Therefore, I did some basic and fast research on them.
I find out that they both use Let's Encrypt free SSL/TLS certificates on their official websites. Meanwhile, their official websites are hosting (or domains hosting on proxy) on akamaitechnologies.com.
I further find out that akamaitechnologies.com is registered by akamai.com - Akamai. Akamai provides CDN and cloud computing services which is including WAF. She is one of the famous CDN and WAF providers in the market since 1998. I confirmed that akamai.com is hosting (or hosting the domain on the proxy) on akamaitechnologies.com too on different IP address/subnet with Nexus Guard and Zenedge. Meanwhile, Nexus Guard and Zenedge are in the same subnet.
Nexus Guard
Nexus Guard conducted an unprofessional research on Android TV boxes with 3 popular anti-virus programs, such as Dr. Web and ESET in July 2014 and posted on a Hong Kong local magazine - East Week Vol. 568. They just posted the results of the scanning and misled the readers that some Android TV boxes are vulnerable to so-called backdoors. However, they did not confirm if the so-called backdoors are exploitable or not.
Nexus Guard also released an article about DDoS in May 2016 where they mentioned that DDoS by NTP is on the top of the list of the attacks. However, it seems that they do not know that the NTP attacks at that time is because of the zero day vulnerability on NTP protocol.
Most of their reports, threat advisories and whitepapers are restate the information security news that are all available in the public. Thinking of writing so many reports, threat advisories and whitepapers will make them more looking like a professional information security firm?
Zenedge
Since Zenedge provides free vulnerability and threat assessment on their website, I tried to contact the sales agent on the Zenedge site and he redirect me to contact Nelson Chen who is CISSP, CISA, CISM and Director Security Solutions of Zenedge. I requested a free vulnerability and threat assessment on my personal site on April 10, 2017 via direct email with Nelson. However, I did not have any reply from him since then (3 days at the time of this writing).
That make me thinking that they are pretending to provide free service in order to obtain information of their potential clients for their promotion purpose? Or, Neslon is thinking too much when an infosec (information security) guy is approaching them as they are thinking that their customers should be noob? Or, they do not have any professional infosec guy to do assessment on my personal site? Or, my personal site is too lame that they disdain to do the job?
Questions in Mind
If Nexus Guard and Zenedge have their own CDN and products/services, why their official websites are hosting (or hosting the domains on proxy) on Akamai? They do not believe that their products/services are better than Akamai? Nexus Guard and Zenedge are resellers/Value Added Resellers of Akamai? They are all information security scammers?
Conclusion
Think carefully before you purchase information security services or products. Do more researches on the providers/vendors of infosec before making any decision. Finally, it is difficult to determine professional and unprofessional in general.
Reference
Distributed Denial-of-Service Attack
Content Delivery Network
Web Application Firewall
(a) Nexus Guard - https://www.nexusguard.com/
Domain is registered on Sept 9, 2008
Server common name : secure0009.hubspot.com
Server domain #1 : a184-50-88-78.deploy.static.akamaitechnologies.com (184.50.88.78)
Server domain #2 : a184-50-88-3.deploy.static.akamaitechnologies.com (184.50.88.3)
Server IP : 128.177.173.177:443
(b) Zenedge - https://www.zenedge.com/
Domain is registered on Jan 7, 2013
Server common name : secure0004.hubspot.com
Server domain #1 : a184-50-88-76.deploy.static.akamaitechnologies.com (184.50.88.76)
Server domain #2 : a184-50-88-3.deploy.static.akamaitechnologies.com (184.50.88.3)
Server IP : 69.31.76.226:443
(c) Akamai - https://www.akamai.com/
(Akamai Technologies - akamaitechnologies.com)
Domain is registered on Aug 17, 1998
Server domain : a23-75-36-144.deploy.static.akamaitechnologies.com (23.75.36.144)
That's all! See you.
Recently, Nexus Guard and Zenedge catch my eyes. They provide similar products/services, such as DDoS Protection by Content Delivery Network (CDN) and Web Application Firewall (WAF).
Nexus Guard website saying that they are the leader in the market :
"As a longtime leader in DDoS defense, Nexusguard is at the forefront of the fight against malicious Internet attacks, protecting organizations worldwide from threats to their websites, services, and reputations."
Zenedge website provides a free vulnerability and threat assessment for their potential clients :
"The report is produced by our team of cybersecurity experts bring a collective 200 years of cybersecurity experience and have been responsible for mitigating some of the largest attacks. Ever."
Basic and Fast Research
I wonder why there are so many CDN providers recently. CDN requires a lot of proxies around the world in order to absorb very large amount of DDoS traffic. They need to invest a lot on the infrastructure. Therefore, I did some basic and fast research on them.
I find out that they both use Let's Encrypt free SSL/TLS certificates on their official websites. Meanwhile, their official websites are hosting (or domains hosting on proxy) on akamaitechnologies.com.
I further find out that akamaitechnologies.com is registered by akamai.com - Akamai. Akamai provides CDN and cloud computing services which is including WAF. She is one of the famous CDN and WAF providers in the market since 1998. I confirmed that akamai.com is hosting (or hosting the domain on the proxy) on akamaitechnologies.com too on different IP address/subnet with Nexus Guard and Zenedge. Meanwhile, Nexus Guard and Zenedge are in the same subnet.
Nexus Guard
Nexus Guard conducted an unprofessional research on Android TV boxes with 3 popular anti-virus programs, such as Dr. Web and ESET in July 2014 and posted on a Hong Kong local magazine - East Week Vol. 568. They just posted the results of the scanning and misled the readers that some Android TV boxes are vulnerable to so-called backdoors. However, they did not confirm if the so-called backdoors are exploitable or not.
Nexus Guard also released an article about DDoS in May 2016 where they mentioned that DDoS by NTP is on the top of the list of the attacks. However, it seems that they do not know that the NTP attacks at that time is because of the zero day vulnerability on NTP protocol.
Most of their reports, threat advisories and whitepapers are restate the information security news that are all available in the public. Thinking of writing so many reports, threat advisories and whitepapers will make them more looking like a professional information security firm?
Zenedge
Since Zenedge provides free vulnerability and threat assessment on their website, I tried to contact the sales agent on the Zenedge site and he redirect me to contact Nelson Chen who is CISSP, CISA, CISM and Director Security Solutions of Zenedge. I requested a free vulnerability and threat assessment on my personal site on April 10, 2017 via direct email with Nelson. However, I did not have any reply from him since then (3 days at the time of this writing).
That make me thinking that they are pretending to provide free service in order to obtain information of their potential clients for their promotion purpose? Or, Neslon is thinking too much when an infosec (information security) guy is approaching them as they are thinking that their customers should be noob? Or, they do not have any professional infosec guy to do assessment on my personal site? Or, my personal site is too lame that they disdain to do the job?
Questions in Mind
If Nexus Guard and Zenedge have their own CDN and products/services, why their official websites are hosting (or hosting the domains on proxy) on Akamai? They do not believe that their products/services are better than Akamai? Nexus Guard and Zenedge are resellers/Value Added Resellers of Akamai? They are all information security scammers?
Conclusion
Think carefully before you purchase information security services or products. Do more researches on the providers/vendors of infosec before making any decision. Finally, it is difficult to determine professional and unprofessional in general.
Reference
Distributed Denial-of-Service Attack
Content Delivery Network
Web Application Firewall
(a) Nexus Guard - https://www.nexusguard.com/
Domain is registered on Sept 9, 2008
Server common name : secure0009.hubspot.com
Server domain #1 : a184-50-88-78.deploy.static.akamaitechnologies.com (184.50.88.78)
Server domain #2 : a184-50-88-3.deploy.static.akamaitechnologies.com (184.50.88.3)
Server IP : 128.177.173.177:443
(b) Zenedge - https://www.zenedge.com/
Domain is registered on Jan 7, 2013
Server common name : secure0004.hubspot.com
Server domain #1 : a184-50-88-76.deploy.static.akamaitechnologies.com (184.50.88.76)
Server domain #2 : a184-50-88-3.deploy.static.akamaitechnologies.com (184.50.88.3)
Server IP : 69.31.76.226:443
(c) Akamai - https://www.akamai.com/
(Akamai Technologies - akamaitechnologies.com)
Domain is registered on Aug 17, 1998
Server domain : a23-75-36-144.deploy.static.akamaitechnologies.com (23.75.36.144)
That's all! See you.
Sunday, April 09, 2017
Catch Me If You Can 4
It is the fourth article in "Catch Me If You Can" series. The previous three articles were talking about how to prevent from being catch. However, this article is talking about once you have been arrested what can you do to prevent from being charged for hacking.
Once you have been arrested, your digital devices (such as personal computers, laptops, smartphones and other devices) should be seized. The "device" below is applied to Personal Computers and Laptops only. Laws enforcement would conduct digital forensic on all your devices in order to seek any evidence of cyber crime that you have conducted. However, if your devices are still switching on when you are arrested, laws enforcement would not turn your device off and would conduct the digital forensic right away.
You can use Bleachbit to delete all deleted files, logs and backups. However, some valuable files may not be deleted. Therefore, Bleachbit may not be a very good solution even it is good practice to use it for the purpose.
Offense Security's Kali Linux development team ported a Self-Destruction Luks encryption on Kali Linux since version 1.0.6 that allows the hard drive (or SSD) to be encrypted fully with normal and nuke passphrases. Once the nuke passphrase is entered, all the passphrase for the decryption will be deleted and the hard drive (or SSD) cannot be recovered. Therefore, the hard drive (SSD) is safe for being digital forensic. If you are not using Kali Linux for the hacking, you can apply self-destruction Luks encryption for some other Linux distributions.
It is recommended that the self-destruction nuke passphrase is much shorter than the normal passphrase in order to prevent your device from being brute forcing. Meanwhile, it is not recommended to backup your normal passphrases somewhere.
How about the device is still switching on? It is recommended to force turn off the device by long pressing the power button or unplug the power supply if you can while you are being arrested. Make sure you setup your device to turn off when the power button is long pressed instead of suspension.
Difference countries should have difference cyber crime laws. Even laws enforcement cannot get any evidence from your devices but you may be charged for other offences under the laws of your country.
That's all! See you.
Reference
Emergency Sef-destruction Luks in Kali
Luks and Nuke Key Installation on Ubuntu
Bleachbit
See Also
Catch Me If You Can
Catch Me If You Can 2
Catch Me If You Can 3
Once you have been arrested, your digital devices (such as personal computers, laptops, smartphones and other devices) should be seized. The "device" below is applied to Personal Computers and Laptops only. Laws enforcement would conduct digital forensic on all your devices in order to seek any evidence of cyber crime that you have conducted. However, if your devices are still switching on when you are arrested, laws enforcement would not turn your device off and would conduct the digital forensic right away.
You can use Bleachbit to delete all deleted files, logs and backups. However, some valuable files may not be deleted. Therefore, Bleachbit may not be a very good solution even it is good practice to use it for the purpose.
Offense Security's Kali Linux development team ported a Self-Destruction Luks encryption on Kali Linux since version 1.0.6 that allows the hard drive (or SSD) to be encrypted fully with normal and nuke passphrases. Once the nuke passphrase is entered, all the passphrase for the decryption will be deleted and the hard drive (or SSD) cannot be recovered. Therefore, the hard drive (SSD) is safe for being digital forensic. If you are not using Kali Linux for the hacking, you can apply self-destruction Luks encryption for some other Linux distributions.
It is recommended that the self-destruction nuke passphrase is much shorter than the normal passphrase in order to prevent your device from being brute forcing. Meanwhile, it is not recommended to backup your normal passphrases somewhere.
How about the device is still switching on? It is recommended to force turn off the device by long pressing the power button or unplug the power supply if you can while you are being arrested. Make sure you setup your device to turn off when the power button is long pressed instead of suspension.
Difference countries should have difference cyber crime laws. Even laws enforcement cannot get any evidence from your devices but you may be charged for other offences under the laws of your country.
That's all! See you.
Reference
Emergency Sef-destruction Luks in Kali
Luks and Nuke Key Installation on Ubuntu
Bleachbit
See Also
Catch Me If You Can
Catch Me If You Can 2
Catch Me If You Can 3
Wednesday, March 29, 2017
HOWTO : Highest secured Hiawatha Web Server 10.5 on Ubuntu Server 16.04 LTS
(A) Introduction
Hiawatha Web Server is designed with security in mind. It already built-in some security features to protect common attacks, such as SQLi, XSS, CSRF. Meanwhile, it can be configured to prevent scanning from vulnerability scanners too.
Hiawatha is a light weight and fast as well as secure web server in the market. Hiawatha is working well with PHP and MySQL. The following guide is showing how to configure Hiawatha in a very high secure way on Ubuntu Server LTS.
(B) Software Prerequisite
The current version as at the time of this writing :
(1) Ubuntu Server 16.04.2 LTS
(2) CMake 3.7.2
(3) Hiawatha 10.5
(C) Installation of PHP7.0 and MySQL
(D) Installation of Hiawatha
(a) Install CMake
(b) Install Hiawatha
(E) Configuration of PHP7.0
Make changes as is.
* [EXIST_FUNCTION] is the functions that already at "disable_functions" of php.ini
(F) Let's Encrypt on Hiawatha
(a) Configuration of Hiawatha
Edit "cgi-wrapper.conf".
Change the following as is.
Change the ownership of the log files.
Change the ownership of the web application files.
The following are examples of "hiawatha.conf" and "mysite.com".
/etc/hiawatha/hiawatha.conf example :
/etc/hiawatha/enable-sites/mysite.com example :
(b) Self Signed SSL Certificate Generation
To generate SSL certificate for the web root.
(c) Let's Encrypt Generation and Configuration
To generate SSL certificate for the www.mysite.com.
Change the email "info@example.org" to your email as Let's Encrypt bot will inform you about the expire date of the certificate :
Change the RSA Key size from "2048" to "4096" :
Uncomment "Production" and comment out "Testing" :
Make sure Port 80 is working and run the following command.
For the first time, you need to register to Let's Encrypt. Make sure keep the generated "account.key" in a safe place. "account.key" should be in the original place when doing SSL certificate renewal.
To generate the SSL certificate.
To revoke the SSL certificate (Optional).
To renew SSL certificate (Optional).
To get the Let's Encrypt X3 certificate at https://letsencrypt.org/certificates/ and select :
Let’s Encrypt Authority X3 (IdenTrust cross-signed)
https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem.txt
To generate sha256 base64 hash of the certificates. The first one is the "mysite.com" SSL certification and the second one is the SSL certification for web root directory.
Then change "CustomHeaderClient = Public-Key-Pins:" values at "/etc/hiawatha/enable-sites/mysite.com". The first "pin-sha256" is for "mysite.com" and the second "pin-sha256" is for web root. The others "pin-sha256" are get from Qualys SSL Labs Test site (see below).
With the help of Qualys SSL Labs, you can further configure the HPKP and test the grading of your site. The highest grade is A+.
The grade of the site are A+ on both Qualys SSL Labs and High-Tech Bridge SSL certificate testings. Meanwhile, it is also compliance with PCI DSS 3.1 Requirements that reported by High-Tech Bridge.
The Let's Encrypt SSL Certificate will be expired about 28 days and it requires to be renewed. Make sure you update "CustomHeaderClient = Public-key-Pins:" at /etc/hiawatha/enable-sites/mysite.com (as example). The first "pin-sha256" is required to be updated. After that, restart Hiawatha.
(G) Hardening of Ubuntu Server
(a) sysctl
(b) Apparmor
If you have change some settings, you should reload the profile.
If you want to disable this profile.
If you want to re-enable this profile after it has been disabled.
Remarks :
If you encounter "500 Internal Server Error", you may consider to make the Apparmor to "Complain mode".
After several days browsing the website, you may consider to turn the Apparmor to "Enforce mode".
It is because the captioned usr.sbin.hiawatha may not 100% work for you.
(c) Linux Malware Detect (Optional)
Linux Malware Detect Installation
* the captioned link may be out-dated and it is for your reference only
(d) MySQL
Create Normal User on MySQL
(e) fail2ban
Change the setting at /etc/fail2ban/jail.conf when necessary.
(H) Storage Performance Tuning
It is recommended to use SSD for the storage instead of hard drive for the excellent performance.
(a) SSD
Verify TRIM is supported :
If the output is similar to the below which is supported :
If you install your Ubuntu in LVM, the TRIM is usually enabled by default. You can confirm it :
If the output is similar to the below which is enabled :
Then set the following to "deadline" if it is not done yet.
If not, set it :
Insert the following before "exit 0" :
* make sure your device is sda (or sdb ...)
To reload it or reboot your system :
After that, you need to edit the partition table (/etc/fstab) :
To make it looks like the following :
If you have an error after running the captioned commands, DO NOT reboot your system. You should correct the typo before doing so; otherwise, you cannot boot to your system again.
(b) Hard Drive
Insert the following before "exit 0" :
* make sure your device is sda (or sdb ...)
To reload it or reboot your system :
After that, you need to edit the partition table (/etc/fstab) :
To make it looks like the following :
If you have an error after running the captioned commands, DO NOT reboot your system. You should correct the typo before doing so; otherwise, you cannot boot to your system again.
(I) Optional
To further hardening Ubuntu Server, you may consider to set up firewall (UFW/iptables) and place the Ubuntu Server behind Unified Threats Management System (UTM) or Intrusion Prevention System (IPS).
Reference
Qualys SSL Labs
High-Tech Bridge
securityheaders.io
URL Rewrite for Hiawatha
That's all! See you.
Hiawatha Web Server is designed with security in mind. It already built-in some security features to protect common attacks, such as SQLi, XSS, CSRF. Meanwhile, it can be configured to prevent scanning from vulnerability scanners too.
Hiawatha is a light weight and fast as well as secure web server in the market. Hiawatha is working well with PHP and MySQL. The following guide is showing how to configure Hiawatha in a very high secure way on Ubuntu Server LTS.
(B) Software Prerequisite
The current version as at the time of this writing :
(1) Ubuntu Server 16.04.2 LTS
(2) CMake 3.7.2
(3) Hiawatha 10.5
(C) Installation of PHP7.0 and MySQL
sudo apt-get install php7.0-cgi php7.0 php7.0-cli php7.0-mysql php7.0-curl php7.0-gd php7.0-intl php7.0-imap php7.0-mcrypt php7.0-pspell php7.0-recode php7.0-sqlite3 php7.0-tidy php7.0-xmlrpc php7.0-xsl apache2-utils php7.0-fpm php-memcache php-imagick php-cache mysql-server mysql-client(D) Installation of Hiawatha
sudo apt-get install libc6-dev libssl-dev dpkg-dev debhelper fakeroot libxml2-dev libxslt1-dev(a) Install CMake
wget https://cmake.org/files/v3.7/cmake-3.7.2.tar.gz
tar -xvzf cmake-3.7.2.tar.gz
cd cmake-3.7.2
./configure
make
sudo make install(b) Install Hiawatha
wget http://www.hiawatha-webserver.org/files/hiawatha-10.5.tar.gz
tar -xzvf hiawatha-10.5.tar.gz
cd hiawatha-10.5/extra
./make_debian_package
cd ..
sudo dpkg -i hiawatha_10.5_amd64.deb(E) Configuration of PHP7.0
sudo nano /etc/php/7.0/fpm/php.iniMake changes as is.
allow_url_fopen = Off
session.cookie_httponly = 1
disable_functions = [EXIST_FUNCTION],system, show_source, symlink, exec, dl, shell_exec, passthru, phpinfo, escapeshellarg, escapeshellcmd,* [EXIST_FUNCTION] is the functions that already at "disable_functions" of php.ini
(F) Let's Encrypt on Hiawatha
(a) Configuration of Hiawatha
sudo mkdir -p /etc/hiawatha/enable-sites
sudo mkdir -p /etc/hiawatha/disable-sitesEdit "cgi-wrapper.conf".
sudo nano /etc/hiawatha/cgi-wrapper.confChange the following as is.
CGIhandler = /usr/bin/perl
CGIhandler = /usr/sbin/php7.0-fpm
CGIhandler = /usr/bin/python
CGIhandler = /usr/bin/ruby
CGIhandler = /usr/bin/ssi-cgi
Wrap = jail_mysite ; /var/www/mysite ; www-data:www-dataChange the ownership of the log files.
cd /var/log/hiawatha
sudo chown www-data:www-data access.log
sudo chown www-data:www-data error.log
sudo chown www-data:www-data exploit.log
sudo chown www-data:www-data garbage.log
sudo chown root:root system.logChange the ownership of the web application files.
cd /var/www/mysite
sudo chown -R root:root *The following are examples of "hiawatha.conf" and "mysite.com".
/etc/hiawatha/hiawatha.conf example :
/etc/hiawatha/enable-sites/mysite.com example :
(b) Self Signed SSL Certificate Generation
To generate SSL certificate for the web root.
openssl genrsa -out default.pem 4096
openssl req -new -x509 -days 3650 -key default.pem -out server.crt
echo "" >> default.pem
cat server.crt >> default.pem
echo "" >> default.pem
rm -f server.crt
sudo mkdir -p /etc/hiawatha/tls
sudo cp default.pem /etc/hiawatha/tls
sudo chown www-data:www-data /etc/hiawatha/tls/default.pem
sudo chmod 400 /etc/hiawatha/tls/default.pem
sudo chmod 400 -R /etc/hiawatha/tls(c) Let's Encrypt Generation and Configuration
To generate SSL certificate for the www.mysite.com.
wget https://www.hiawatha-webserver.org/files/letsencrypt.tar.gz
tar -xvzf letsencrypt.tar.gz
cd letsencrypt
nano letsencrypt.confChange the email "info@example.org" to your email as Let's Encrypt bot will inform you about the expire date of the certificate :
ACCOUNT_EMAIL_ADDRESS = samiux@gmail.comChange the RSA Key size from "2048" to "4096" :
CERTIFICATE_RSA_KEY_SIZE = 4096Uncomment "Production" and comment out "Testing" :
LE_CA_HOSTNAME = acme-v01.api.letsencrypt.org # Production
#LE_CA_HOSTNAME = acme-staging.api.letsencrypt.org # TestingMake sure Port 80 is working and run the following command.
For the first time, you need to register to Let's Encrypt. Make sure keep the generated "account.key" in a safe place. "account.key" should be in the original place when doing SSL certificate renewal.
./letsencrypt registerTo generate the SSL certificate.
sudo ./letsencrypt www.mysite.comTo revoke the SSL certificate (Optional).
sudo ./letsencrypt /etc/hiawatha/tls/www.mysite.com.pemTo renew SSL certificate (Optional).
sudo ./letsencrypt renewTo get the Let's Encrypt X3 certificate at https://letsencrypt.org/certificates/ and select :
Let’s Encrypt Authority X3 (IdenTrust cross-signed)
https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem.txt
wget https://letsencrypt.org/certs/letsencryptauthorityx3.pem.txt
echo "" >> www.mysite.com.pem
cat lets-encrypt-x3-cross-signed.pem.txt >> www.mysite.com.pem
echo "" >> default.pem
cat lets-encrypt-x3-cross-signed.pem.txt >> default.pemTo generate sha256 base64 hash of the certificates. The first one is the "mysite.com" SSL certification and the second one is the SSL certification for web root directory.
openssl x509 -in /etc/hiawatha/tls/www.mysite.com.pem -pubkey -noout | openssl rsa -pubin -outform der | openssl dgst -sha256 -binary | base64
openssl x509 -in /etc/hiawatha/tls/default.pem -pubkey -noout | openssl rsa -pubin -outform der | openssl dgst -sha256 -binary | base64Then change "CustomHeaderClient = Public-Key-Pins:" values at "/etc/hiawatha/enable-sites/mysite.com". The first "pin-sha256" is for "mysite.com" and the second "pin-sha256" is for web root. The others "pin-sha256" are get from Qualys SSL Labs Test site (see below).
With the help of Qualys SSL Labs, you can further configure the HPKP and test the grading of your site. The highest grade is A+.
The grade of the site are A+ on both Qualys SSL Labs and High-Tech Bridge SSL certificate testings. Meanwhile, it is also compliance with PCI DSS 3.1 Requirements that reported by High-Tech Bridge.
The Let's Encrypt SSL Certificate will be expired about 28 days and it requires to be renewed. Make sure you update "CustomHeaderClient = Public-key-Pins:" at /etc/hiawatha/enable-sites/mysite.com (as example). The first "pin-sha256" is required to be updated. After that, restart Hiawatha.
(G) Hardening of Ubuntu Server
(a) sysctl
sudo nano /etc/sysctl.d/60-hiawatha.confsudo sysctl /etc/sysctl.d/60-hiawatha.conf -p(b) Apparmor
sudo apt-get install apparmor-profiles apparmor-utils
sudo nano /etc/apparmor.d/usr.sbin.hiawathasudo aa-enforce hiawathaIf you have change some settings, you should reload the profile.
sudo apparmor_parser -r < /etc/apparmor.d/usr.sbin.hiawathaIf you want to disable this profile.
sudo ln -s /etc/apparmor.d/usr.sbin.hiawatha /etc/apparmor.d/disable/
sudo apparmor_parser -R < /etc/apparmor.d/usr.sbin.hiawathaIf you want to re-enable this profile after it has been disabled.
sudo rm /etc/apparmor.d/disable/usr.sbin.hiawatha
sudo apparmor_parser -r < /etc/apparmor.d/usr.sbin.hiawathaRemarks :
If you encounter "500 Internal Server Error", you may consider to make the Apparmor to "Complain mode".
sudo aa-complain hiawathaAfter several days browsing the website, you may consider to turn the Apparmor to "Enforce mode".
sudo aa-logprof
sudo aa-enforce hiawathaIt is because the captioned usr.sbin.hiawatha may not 100% work for you.
(c) Linux Malware Detect (Optional)
Linux Malware Detect Installation
* the captioned link may be out-dated and it is for your reference only
(d) MySQL
Create Normal User on MySQL
(e) fail2ban
sudo apt-get install fail2banChange the setting at /etc/fail2ban/jail.conf when necessary.
(H) Storage Performance Tuning
It is recommended to use SSD for the storage instead of hard drive for the excellent performance.
(a) SSD
Verify TRIM is supported :
sudo hdparm -I /dev/sda | grep TRIMIf the output is similar to the below which is supported :
* Data Set Management TRIM supported (limit 1 block)If you install your Ubuntu in LVM, the TRIM is usually enabled by default. You can confirm it :
cat /etc/lvm/lvm.conf | grep issue_discardsIf the output is similar to the below which is enabled :
issue_discards = 1Then set the following to "deadline" if it is not done yet.
cat /sys/block/sda/queue/schedulernoop [deadline] cfqIf not, set it :
sudo nano /etc/rc.localInsert the following before "exit 0" :
echo 2048 > /sys/block/sda/queue/read_ahead_kb
echo 2048 > /sys/block/sda/queue/nr_requests
echo deadline > /sys/block/sda/queue/scheduler* make sure your device is sda (or sdb ...)
To reload it or reboot your system :
sudo bash /etc/rc.localAfter that, you need to edit the partition table (/etc/fstab) :
To make it looks like the following :
/dev/mapper/ubuntu--vg-root / ext4 noatime,nodiratime,norelatime,errors=remount-ro 0 1sudo mount -a
sudo mount -o remount /If you have an error after running the captioned commands, DO NOT reboot your system. You should correct the typo before doing so; otherwise, you cannot boot to your system again.
(b) Hard Drive
sudo nano /etc/rc.localInsert the following before "exit 0" :
echo 2048 > /sys/block/sda/queue/read_ahead_kb
echo 2048 > /sys/block/sda/queue/nr_requests* make sure your device is sda (or sdb ...)
To reload it or reboot your system :
sudo bash /etc/rc.localAfter that, you need to edit the partition table (/etc/fstab) :
To make it looks like the following :
ext4 noatime,nodiratime,norelatime,errors=remount-ro 0 1sudo mount -a
sudo mount -o remount /If you have an error after running the captioned commands, DO NOT reboot your system. You should correct the typo before doing so; otherwise, you cannot boot to your system again.
(I) Optional
To further hardening Ubuntu Server, you may consider to set up firewall (UFW/iptables) and place the Ubuntu Server behind Unified Threats Management System (UTM) or Intrusion Prevention System (IPS).
Reference
Qualys SSL Labs
High-Tech Bridge
securityheaders.io
URL Rewrite for Hiawatha
That's all! See you.
Monday, March 06, 2017
HOWTO : Install Go Language 1.8 on Ubuntu 16.04 LTS
The current Go version is 1.6 on Ubuntu 16.04. However, the official Go version is 1.8 as of this writing. We need to install Gophers Ubuntu PPA to complete the task.
Step 1 :
Step 2 :
The workspace is "go" at your working directory by default (such as /home/samiux/go).
Append the following lines at the end of the file :
Step 3 :
Log out and re-login.
or
Step 4 :
To test if it is working properly :
Step 5 :
Make sure you create the following directories at the "go" workspace :
You build your project, for example "erp", at "~/go/src/erp".
That's all! See you.
Step 1 :
sudo add-apt-repository ppa:gophers/archive
sudo apt update
sudo apt install golang-1.8Step 2 :
The workspace is "go" at your working directory by default (such as /home/samiux/go).
nano ~/.profileAppend the following lines at the end of the file :
export PATH=$PATH:/usr/lib/go-1.8/bin:$HOME/go/binStep 3 :
Log out and re-login.
or
source ~/.profileStep 4 :
To test if it is working properly :
go version
go envStep 5 :
Make sure you create the following directories at the "go" workspace :
mkdir -p {,~/go/bin,~/go/pkg,~/go/src}You build your project, for example "erp", at "~/go/src/erp".
That's all! See you.
Wednesday, March 01, 2017
HOWTO : Watching China and Hong Kong Online TV on Ubuntu Desktop 16.04 LTS
Step 1 :
Step 2 :
(A1) Watch CCTV (China) [Most Updated Method]
If you select this method, you are NOT required to do the "Step 1" and "Step 2".
The "CNTVLive2 plugin for 64BitLinux v2.0.0.3" is updated on March 3, 2017 and it solved the force close problem. It plays CCTV Online TV smoothly. After the plugin is installed, you need to bypass the signed add-on problem by using the following way.
WARNING : After doing the following steps, you have a RISK to install malicious Firefox add-on by accident!
At the URL field at the Firefox, type :
Look for the following and double click it to turn it to "false" :
You can click on one of the following links to install the plugin when prompted.
CCTV Live Channel 1
CCTV Live Channel 2
CCTV Live Channel 3
CCTV Live Channel 4
CCTV Live Channel 5
CCTV Live Channel 6
CCTV Live Channel 7
CCTV Live Channel 8
CCTV Live Channel 9
CCTV Live Channel 10
CCTV Live Channel 11
CCTV Live Channel 12
CCTV Live Channel 13
CCTV Live Channel 14
CCTV Live Channel 15
CCTV Live Channel 5+
* make sure Flash is installed and enabled
* some channels are copyrighted and only plays in China Region
(A2) Watch CCTV (China) [Outdated Method]
If you select this method, you need to do "Step 1" and "Step 2".
You need to install Firefox add-ons, namely watch-with-mpv.
https://addons.mozilla.org/en-US/firefox/addon/watch-with-mpv/
CCTV Live Channel 1
CCTV Live Channel 2
CCTV Live Channel 3
CCTV Live Channel 4
CCTV Live Channel 5
CCTV Live Channel 6
CCTV Live Channel 7
CCTV Live Channel 8
CCTV Live Channel 9
CCTV Live Channel 10
CCTV Live Channel 11
CCTV Live Channel 12
CCTV Live Channel 13
CCTV Live Channel 14
CCTV Live Channel 15
CCTV Live Channel 5+
Optional settings :
Preferences -- Additional playr parameters
* make sure Flash is installed and enabled
* some channels are copyrighted and only plays in China Region
(B) Watch ViuTV (Hong Kong)
If you select this option, you need to do "Step 2" only.
Append with the following content and save it.
To run :
Enjoy!!!
That's all! See you.
wget http://archive.getdeb.net/install_deb/getdeb-repository_0.1-1~getdeb1_all.deb
sudo dpkg -i getdeb-repository_0.1-1~getdeb1_all.deb
sudo apt-get update
sudo apt-get install youtube-dlStep 2 :
sudo add-apt-repository ppa:djcj/vapoursynth
sudo apt-get update
sudo apt-get install mpv(A1) Watch CCTV (China) [Most Updated Method]
If you select this method, you are NOT required to do the "Step 1" and "Step 2".
The "CNTVLive2 plugin for 64BitLinux v2.0.0.3" is updated on March 3, 2017 and it solved the force close problem. It plays CCTV Online TV smoothly. After the plugin is installed, you need to bypass the signed add-on problem by using the following way.
WARNING : After doing the following steps, you have a RISK to install malicious Firefox add-on by accident!
At the URL field at the Firefox, type :
about:configLook for the following and double click it to turn it to "false" :
xpinstall.signatures.requiredYou can click on one of the following links to install the plugin when prompted.
CCTV Live Channel 1
CCTV Live Channel 2
CCTV Live Channel 3
CCTV Live Channel 4
CCTV Live Channel 5
CCTV Live Channel 6
CCTV Live Channel 7
CCTV Live Channel 8
CCTV Live Channel 9
CCTV Live Channel 10
CCTV Live Channel 11
CCTV Live Channel 12
CCTV Live Channel 13
CCTV Live Channel 14
CCTV Live Channel 15
CCTV Live Channel 5+
* make sure Flash is installed and enabled
* some channels are copyrighted and only plays in China Region
(A2) Watch CCTV (China) [Outdated Method]
If you select this method, you need to do "Step 1" and "Step 2".
You need to install Firefox add-ons, namely watch-with-mpv.
https://addons.mozilla.org/en-US/firefox/addon/watch-with-mpv/
CCTV Live Channel 1
CCTV Live Channel 2
CCTV Live Channel 3
CCTV Live Channel 4
CCTV Live Channel 5
CCTV Live Channel 6
CCTV Live Channel 7
CCTV Live Channel 8
CCTV Live Channel 9
CCTV Live Channel 10
CCTV Live Channel 11
CCTV Live Channel 12
CCTV Live Channel 13
CCTV Live Channel 14
CCTV Live Channel 15
CCTV Live Channel 5+
Optional settings :
Preferences -- Additional playr parameters
--buffer-size 2048 --no-check-certificate --skip-unavailable-fragments --sleep-interval 0.05 --max-sleep-interval 0.5 --limit-rate 2M* make sure Flash is installed and enabled
* some channels are copyrighted and only plays in China Region
(B) Watch ViuTV (Hong Kong)
If you select this option, you need to do "Step 2" only.
nano viutvAppend with the following content and save it.
To run :
./viutvEnjoy!!!
That's all! See you.
Friday, February 10, 2017
HOWTO : Ajenti 1.x on Ubuntu Server 16.04 LTS
Ajenti is an Admin Control Panel for your Linux server. However, Ajenti 2.x is buggy and it is not working properly when I am testing it. Fortunately, Ajenti 1.x still working for Ubuntu 16.04 LTS even it's documentation is written for Ubuntu 12.04.
You can access your Linux server via web browser instead of SSH.
Step 1 :
Step 2 :
Step 3 :
Step 4 :
To access Ajenti, you open the broswer and point it to your server IP. Username is "root" and password is "admin".
That's all! See you.
You can access your Linux server via web browser instead of SSH.
Step 1 :
wget http://repo.ajenti.org/debian/key -O- | sudo apt-key add -Step 2 :
sudo touch /etc/apt/sources.list.d/ajenti.list
echo "deb http://repo.ajenti.org/ng/debian main main ubuntu" | sudo tee -a /etc/apt/sources.list.d/ajenti.listStep 3 :
sudo apt-get update && sudo apt-get install ajentisudo systemctl restart ajentiStep 4 :
To access Ajenti, you open the broswer and point it to your server IP. Username is "root" and password is "admin".
https://[server_ip]:8000That's all! See you.
Tuesday, February 07, 2017
HOWTO : Optimize Ubuntu 16.04 LTS and Kali Linux 2016.2 with jemalloc
jemalloc is a general purpose malloc(3) implementation that emphasizes
fragmentation avoidance and scalable concurrency support. It is the best allocators for a broad range of demanding applications, and
eliminating/mitigating weaknesses that have practical repercussions for real
world applications.
Step 1 :
Option 1 : Compile from source (latest version)
*** This option is not recommended for Ubuntu 16.04 LTS Desktop and Kali Linux 2016.2. When using in Ubuntu 16.04 LTS Desktop, Firefox will be crashed when 2 or more instances are opened. Meanwhile, Kali Linux 2016.2 requires redis-server which is using stock version of libjemalloc1 by default. redis-server for Ubuntu 16.04 also requires stock version of libjemalloc1.
The final files "libjemalloc.*" are located at "/usr/local/lib/".
Option 2 : Install package (usually older version)
This option is recommended for Ubuntu 16.04 LTS and Kali Linux 2016.2.
The final files "libjemalloc.*" are located at "/usr/lib/x86_64-linux-gnu/".
Step 2 :
Reboot your box.
Step 3 :
To confirm it is running properly (for example, firefox is running with it) :
That's all! See you.
Step 1 :
Option 1 : Compile from source (latest version)
*** This option is not recommended for Ubuntu 16.04 LTS Desktop and Kali Linux 2016.2. When using in Ubuntu 16.04 LTS Desktop, Firefox will be crashed when 2 or more instances are opened. Meanwhile, Kali Linux 2016.2 requires redis-server which is using stock version of libjemalloc1 by default. redis-server for Ubuntu 16.04 also requires stock version of libjemalloc1.
git clone https://github.com/jemalloc/jemalloc.git
cd jemalloc
./autogen.sh
make dist
make
sudo make installThe final files "libjemalloc.*" are located at "/usr/local/lib/".
touch /etc/ld.so.preloadecho "/usr/local/lib/libjemalloc.so" | sudo tee --append /etc/ld.so.preloadOption 2 : Install package (usually older version)
This option is recommended for Ubuntu 16.04 LTS and Kali Linux 2016.2.
sudo apt-get install libjemalloc1 libjemalloc-devThe final files "libjemalloc.*" are located at "/usr/lib/x86_64-linux-gnu/".
touch /etc/ld.so.preloadecho "/usr/lib/x86_64-linux-gnu/libjemalloc.so" | sudo tee --append /etc/ld.so.preloadsudo ln -s /usr/lib/x86_64-linux-gnu/libjemalloc.so.1 /usr/lib/x86_64-linux-gnu/libjemalloc.soStep 2 :
Reboot your box.
Step 3 :
To confirm it is running properly (for example, firefox is running with it) :
sudo lsof -E | grep libjemalloc | grep firefoxThat's all! See you.
Thursday, January 26, 2017
HOWTO : Configure Network Interface For Better Performance on Ubuntu 16.04 LTS
Intel network interface card is configurable. Some other brands can but Realtek do not.
(0) You need to install ethtool if it is not :
(1) List out the available network interface on your system :
(2) To see if the network interface can pause the transmission when neccessary or not in order to prevent packet drop :
If the values are not "on", you can set it to :
(3) To see if the buffer is at the maximum value or not :
If the current hardware settings values are not as the Pre-set maximums, you can set them to be :
(4) If your network interface cannot be configure like Intel, you may see the following result :
(5) Finally, you can put those commands at /etc/rc.local and run the following command to activate the values :
That's all! See you.
(0) You need to install ethtool if it is not :
sudo apt-get install ethtool(1) List out the available network interface on your system :
ls /sys/class/netenp1s0f0 enp1s0f1 enp7s0 enp8s0 lo(2) To see if the network interface can pause the transmission when neccessary or not in order to prevent packet drop :
ethtool -a enp1s0f0Pause parameters for enp1s0f0:
Autonegotiate: on
RX: on
TX: onIf the values are not "on", you can set it to :
sudo ethtool -A enp1s0f0 rx on tx on(3) To see if the buffer is at the maximum value or not :
ethtool -g enp1s0f0Ring parameters for enp1s0f0:
Pre-set maximums:
RX: 4096
RX Mini: 0
RX Jumbo: 0
TX: 4096
Current hardware settings:
RX: 4096
RX Mini: 0
RX Jumbo: 0
TX: 4096If the current hardware settings values are not as the Pre-set maximums, you can set them to be :
sudo ethtool -G enp1s0fo rx 4096 tx 4096(4) If your network interface cannot be configure like Intel, you may see the following result :
ls /sys/class/netenp2s0 enp3s0 lo wlp4s0ethtool -a enp2s0Pause parameters for enp2s0:
Cannot get device pause settings: Operation not supported(5) Finally, you can put those commands at /etc/rc.local and run the following command to activate the values :
sudo bash /etc/rc.localThat's all! See you.
Thursday, December 29, 2016
HOWTO : Configure OpenVPN on Ubuntu 16.04
There is a very good article by Digital Ocean for setting up OpenVPN on Ubuntu 16.04. After the above setup, you are required to further configure it to make it working properly.
The following additional settings is to allow all VPN clients can use the same certificate to login the VPN server. Meanwhile, it also allow the maximum concurrent users to 100.
Uncomment (remove ";") the following :
That's all! See you.
The following additional settings is to allow all VPN clients can use the same certificate to login the VPN server. Meanwhile, it also allow the maximum concurrent users to 100.
sudo nano /etc/openvpn/server.confUncomment (remove ";") the following :
duplicate-cn
max-clients 100That's all! See you.
Wednesday, December 28, 2016
HOWTO : Build An Affordable Intrusion Detection And Prevention System For Home Users
What is Intrusion Detection And Prevention System?
Intrusion detection and prevention system (IDPS) monitors incoming and outgoing traffic on your network and blocks the malicious traffic (packets) based on rules (blacklists).
Why home users need IDPS?
Not only big companies need IDPS but also home users as long as they are connecting to the internet. Almost all home users installed anti-virus but it is not enough. They do need more protection against the cyber criminals.
However, most IDPS appliances are very expensive for home users. Most open source solutions are also demanding for them as they do not familiar with networking and technology.
What is Almond Croissants and Why?
Almond Croissants is an open source intrusion detection and prevention system which is based on Suricata engine. Suricata is the next-generation IDPS engine with a lot of outstanding features.
Users of Almond Croissants are not required to be familiar with networking and technology. It is designed for them in mind. Not only that, it is designed for low-end hardware too. It is really "Plug, Play and Forget!".
What are the key features of Almond Croissants?
- Block ports and vulnerabilities scanning
- Block known exploitation on vulnerable systems
- Block known malicious IP addresses to access your systems
- Block known source of Secure Shell (SSH) brute forcing
- Block The Onion Router (TOR) to access your systems
- Prevent from accessing known malicious sites with Secure Sockets Layer (SSL) certificates
- Prevent from being infected by known virus and malware
- Block known annoying advertising servers
- Easy and straight forward analysis with charts on web interfaces
- Compatible with Bittorrent and 4K video streaming
- Ultra-low latency for online gaming
- Compatible with Windows, Linux, macOS, Apple iOS and Android
- Ultra-low latency throughput that drives your network to a limit
- No subscription fee
- More protection for web servers
- More protection from known malware
- Block known phishing sites
- Automatically update and upgrade
- Plug, Play and Forget!
What hardware is required?
If you have a small family with 4 members and have about 200-250Mbps bandwidth, Zotac Mini PC CI323 (Intel Celeron N3150 with 16GB RAM) is recommended. Meanwhile, you may also require a USB 3.0 Gigabit Ethernet dongle. Yes, 16GB RAM. The vendor states that it supports up to 8GB RAM, however, you can install a total of 16GB RAM on it. A 320GB hard drive is also required. It requires a total of 3 network interface cards. The price of the system is below $400-USD. It is low power consumption for long run.
More powerful CPU and more memory are recommended for demanding situation. Almond Croissants is running on dedicated hardware. The minimum requirements for Almond Croissants is 2-4 CPU threads and 16GB RAM.
How to install?
Since ultra-low latency of Almond Croissants, it is recommended to put Almond Croissants between modem and router. Furthermore, you can install it between router and switch too. However, if you have a wireless router, it is recommended to put Almond Croissants in front of the wireless router.
First of all, you need to install Ubuntu Server (LTS edition) on the box. SSH server is recommended to be installed for remote management inside your network. It may need 8 or more hours to install Almond Croissants on Zotac Mini PC CI323. Make sure the box is connecting to the internet as it fetches the packages and data from various servers in the internet.
The installation procedure is well documented on the Almond Croissants official site. It is easy but it kills time.
After the installation, you can plug the Zotac Mini PC CI323 between modem and router. The USB Ethernet Card is connecting to switch. A reboot is required. It needs about 10 minutes to let all the rules and data load into the memory once boot up.
What's next?
Make sure firewall on your router is enabled and do not allow SSH port to be accessed outside your network unless it is well protected. Anti-virus program to be installed on every computer is optional but is recommended.
For further protection on your laptop and smartphone outside your home, you are required to setup a VPN inside your network. When you are using laptop at coffee shop or using smartphone on the road, you can connect to your VPN and your connection will be protected by Almond Croissants.
All rules and upgrade will be conducted during mid-night between 0100 and 0800 hours. Therefore, the box requires running 24/7/365 and server grade hardware is recommended.
See also
Almond Croissants - Intrusion Detection And Prevention System
Zotac Mini PC C Series
Suricata IDPS Engine
Hardening Mobile Devices with Intrusion Prevention System
Know Your Enemies and Know Yourself
OpenVPN official site
How To Set Up an OpenVPN Server on Ubuntu 16.04
Configure OpenVPN on Ubuntu 16.04
Intel Celeron N3150 Specifications
That's all! See you.
Intrusion detection and prevention system (IDPS) monitors incoming and outgoing traffic on your network and blocks the malicious traffic (packets) based on rules (blacklists).
Why home users need IDPS?
Not only big companies need IDPS but also home users as long as they are connecting to the internet. Almost all home users installed anti-virus but it is not enough. They do need more protection against the cyber criminals.
However, most IDPS appliances are very expensive for home users. Most open source solutions are also demanding for them as they do not familiar with networking and technology.
What is Almond Croissants and Why?
Almond Croissants is an open source intrusion detection and prevention system which is based on Suricata engine. Suricata is the next-generation IDPS engine with a lot of outstanding features.
Users of Almond Croissants are not required to be familiar with networking and technology. It is designed for them in mind. Not only that, it is designed for low-end hardware too. It is really "Plug, Play and Forget!".
What are the key features of Almond Croissants?
- Block ports and vulnerabilities scanning
- Block known exploitation on vulnerable systems
- Block known malicious IP addresses to access your systems
- Block known source of Secure Shell (SSH) brute forcing
- Block The Onion Router (TOR) to access your systems
- Prevent from accessing known malicious sites with Secure Sockets Layer (SSL) certificates
- Prevent from being infected by known virus and malware
- Block known annoying advertising servers
- Easy and straight forward analysis with charts on web interfaces
- Compatible with Bittorrent and 4K video streaming
- Ultra-low latency for online gaming
- Compatible with Windows, Linux, macOS, Apple iOS and Android
- Ultra-low latency throughput that drives your network to a limit
- No subscription fee
- More protection for web servers
- More protection from known malware
- Block known phishing sites
- Automatically update and upgrade
- Plug, Play and Forget!
What hardware is required?
If you have a small family with 4 members and have about 200-250Mbps bandwidth, Zotac Mini PC CI323 (Intel Celeron N3150 with 16GB RAM) is recommended. Meanwhile, you may also require a USB 3.0 Gigabit Ethernet dongle. Yes, 16GB RAM. The vendor states that it supports up to 8GB RAM, however, you can install a total of 16GB RAM on it. A 320GB hard drive is also required. It requires a total of 3 network interface cards. The price of the system is below $400-USD. It is low power consumption for long run.
More powerful CPU and more memory are recommended for demanding situation. Almond Croissants is running on dedicated hardware. The minimum requirements for Almond Croissants is 2-4 CPU threads and 16GB RAM.
How to install?
Since ultra-low latency of Almond Croissants, it is recommended to put Almond Croissants between modem and router. Furthermore, you can install it between router and switch too. However, if you have a wireless router, it is recommended to put Almond Croissants in front of the wireless router.
First of all, you need to install Ubuntu Server (LTS edition) on the box. SSH server is recommended to be installed for remote management inside your network. It may need 8 or more hours to install Almond Croissants on Zotac Mini PC CI323. Make sure the box is connecting to the internet as it fetches the packages and data from various servers in the internet.
The installation procedure is well documented on the Almond Croissants official site. It is easy but it kills time.
After the installation, you can plug the Zotac Mini PC CI323 between modem and router. The USB Ethernet Card is connecting to switch. A reboot is required. It needs about 10 minutes to let all the rules and data load into the memory once boot up.
What's next?
Make sure firewall on your router is enabled and do not allow SSH port to be accessed outside your network unless it is well protected. Anti-virus program to be installed on every computer is optional but is recommended.
For further protection on your laptop and smartphone outside your home, you are required to setup a VPN inside your network. When you are using laptop at coffee shop or using smartphone on the road, you can connect to your VPN and your connection will be protected by Almond Croissants.
All rules and upgrade will be conducted during mid-night between 0100 and 0800 hours. Therefore, the box requires running 24/7/365 and server grade hardware is recommended.
See also
Almond Croissants - Intrusion Detection And Prevention System
Zotac Mini PC C Series
Suricata IDPS Engine
Hardening Mobile Devices with Intrusion Prevention System
Know Your Enemies and Know Yourself
OpenVPN official site
How To Set Up an OpenVPN Server on Ubuntu 16.04
Configure OpenVPN on Ubuntu 16.04
Intel Celeron N3150 Specifications
That's all! See you.
Tuesday, December 13, 2016
Know Your Enemies and Know Yourself
Quotations
Sun Tzu's The Art of War (孙子兵法) says "If you know your enemies and know yourself, you will not be put at risk even in a hundred battles. If you only know yourself, but not your opponent, you may win or may lose. If you know neither yourself nor your enemy, you will always endanger yourself." (知彼知己，百战不殆；不知彼而知己，一胜一负；不知彼，不知己，每战必殆。) [source : Wikipedia]
Sun Tzu's The Art of War also says "All warfare is based on deception. Hence, when we are able to attack, we must seem unable; when using our forces, we must appear inactive; when we are near, we must make the enemy believe we are far away; when far away, we must make him believe we are near." (兵者，诡道也。故能而示之不能，用而示之不用，近而示之远，远而示之近。) [source : Wikipedia]
Reconnaissance
Most internet attack activities based on recon on the target. Recon can be conducted by active and passive methods. Active recon will cause a lot of noise to the target as it will collect information from the target directly while passive recon does not.
Once attackers gathered valuable information about the target, such as running services and versions on the target. They will launch exploits when there are vulnerable services running on the target. Once success, the target will be compromised and under the control of the attackers.
On the other hand, if there is no running vulnerable services on the target, attackers may launch social engineering attacks against the target, such as phishing mails, phishing sites, phishing phone calls, phishing downloads and etc. Social engineering may lead to compromise of the target as a result.
The captioned mention attacks can be based on randomly selected target or targeted victim. Furthermore, some attacks are directly by botnets which randomly selecting the targets and aimed to the vulnerable running services. Botnet attacks also have active recon stage as mentioned before.
Possible Defense
Besides some of social engineering attacks, we all know that all almost all attacks are following by recon. If attackers cannot get any valuable information from us, we can delay or even prevent the attack.
We all know that nmap can obtain information of the running services on the opening ports. If we can block nmap scanning from the beginning, attackers are required to guess which ports are opened and which services and versions are running on that ports. They cannot go further when they have no valuable information about us. If so, we can delay or even prevent the attacks. However, social engineering attacks may be launched soon by the attackers.
Commercial Solution
Some anti-virus for Windows system and some Unified Threats Management System (UTM) as well as some Intrusion Prevention System (IPS) can block port scanning. However, some of them failed to detect and block the nmap scan when it is scanning with special command flags. Meanwhile, anti-virus software and UTM as well as IPS may require to subscribe the signatures annually. In addition, commercial UTM and IPS are very expensive. It may cost a lot when long run.
Open Source Solution
Suricata and Snort are very famous Intrusion Detection and Prevention engines (IDPS). They are running based on blacklisting. Those blacklists are rules to alert or block the traffic when the traffic meets the criteria. There are open rules and paid rules available in the market. Some IDPS engines users can write their own rules to meet their requirements. However, some of the rules are written wrongly that causing false positive alert or even cannot detect the activities.
Not everyone is IDPS expert. Setting up a working Suricata or Snort appliance is painful. Users are required to troubleshoot all the problems that they are encountered. Sometimes are hardware limitations. Sometimes are false positive alerts/drops. Sometimes are IDPS engines limitations.
Plug, Play and Forget!
Almond Croissants is an open source IDPS based on Suricata engine. It is released under GPLv3 by Samiux since 2012. It is well tested on Windows, macOS, Linux, Apple iOS and Android. Engine and rules are updated automatically when they are available. Users are not required to be very familiar with IDPS. It not only can detect and block nmap scanning without pain but also have many outstanding features that most IDPS omitted. It is tasty and really "Plug, Play and Forget!"
That's all! See you.
Sun Tzu's The Art of War (孙子兵法) says "If you know your enemies and know yourself, you will not be put at risk even in a hundred battles. If you only know yourself, but not your opponent, you may win or may lose. If you know neither yourself nor your enemy, you will always endanger yourself." (知彼知己，百战不殆；不知彼而知己，一胜一负；不知彼，不知己，每战必殆。) [source : Wikipedia]
Sun Tzu's The Art of War also says "All warfare is based on deception. Hence, when we are able to attack, we must seem unable; when using our forces, we must appear inactive; when we are near, we must make the enemy believe we are far away; when far away, we must make him believe we are near." (兵者，诡道也。故能而示之不能，用而示之不用，近而示之远，远而示之近。) [source : Wikipedia]
Reconnaissance
Most internet attack activities based on recon on the target. Recon can be conducted by active and passive methods. Active recon will cause a lot of noise to the target as it will collect information from the target directly while passive recon does not.
Once attackers gathered valuable information about the target, such as running services and versions on the target. They will launch exploits when there are vulnerable services running on the target. Once success, the target will be compromised and under the control of the attackers.
On the other hand, if there is no running vulnerable services on the target, attackers may launch social engineering attacks against the target, such as phishing mails, phishing sites, phishing phone calls, phishing downloads and etc. Social engineering may lead to compromise of the target as a result.
The captioned mention attacks can be based on randomly selected target or targeted victim. Furthermore, some attacks are directly by botnets which randomly selecting the targets and aimed to the vulnerable running services. Botnet attacks also have active recon stage as mentioned before.
Possible Defense
Besides some of social engineering attacks, we all know that all almost all attacks are following by recon. If attackers cannot get any valuable information from us, we can delay or even prevent the attack.
We all know that nmap can obtain information of the running services on the opening ports. If we can block nmap scanning from the beginning, attackers are required to guess which ports are opened and which services and versions are running on that ports. They cannot go further when they have no valuable information about us. If so, we can delay or even prevent the attacks. However, social engineering attacks may be launched soon by the attackers.
Commercial Solution
Some anti-virus for Windows system and some Unified Threats Management System (UTM) as well as some Intrusion Prevention System (IPS) can block port scanning. However, some of them failed to detect and block the nmap scan when it is scanning with special command flags. Meanwhile, anti-virus software and UTM as well as IPS may require to subscribe the signatures annually. In addition, commercial UTM and IPS are very expensive. It may cost a lot when long run.
Open Source Solution
Suricata and Snort are very famous Intrusion Detection and Prevention engines (IDPS). They are running based on blacklisting. Those blacklists are rules to alert or block the traffic when the traffic meets the criteria. There are open rules and paid rules available in the market. Some IDPS engines users can write their own rules to meet their requirements. However, some of the rules are written wrongly that causing false positive alert or even cannot detect the activities.
Not everyone is IDPS expert. Setting up a working Suricata or Snort appliance is painful. Users are required to troubleshoot all the problems that they are encountered. Sometimes are hardware limitations. Sometimes are false positive alerts/drops. Sometimes are IDPS engines limitations.
Plug, Play and Forget!
Almond Croissants is an open source IDPS based on Suricata engine. It is released under GPLv3 by Samiux since 2012. It is well tested on Windows, macOS, Linux, Apple iOS and Android. Engine and rules are updated automatically when they are available. Users are not required to be very familiar with IDPS. It not only can detect and block nmap scanning without pain but also have many outstanding features that most IDPS omitted. It is tasty and really "Plug, Play and Forget!"
That's all! See you.
Monday, December 12, 2016
HOWTO : Traffic and Attack Map for Suricata
"Traffic & Attack Map for Suricata" is forked from Matthew May's Attack Map at GitHub
"Traffic & Attack Map for Suricata" is modified to work with Suricata's eve.json file. It shows the inbound traffic only which includes normal and attack traffic. It is designed for Python 3 and Ubuntu Server 16.04 LTS. It is also designed to install on the box of Suricata.
The map shows "DROP" or "ALERT" when the traffic is dropped or alerted by Suricata. Meanwhile, other traffic will be shown as its nature (Event Type), such as DNS, TLS, FILEINFO and etc.
License
"Traffic & Attack Map for Suricata" is released under GPLv3 by Samiux.
Requirements
(1) Working Suricata dedicate server as IDPS on Ubuntu Server
(2) Python 3.x
(3) Web server with websocket function
(4) Redis server
Package
Installation
Step 1 :
Change from :
To :
Step 2 :
Step 3 :
Step 4 :
Go to :
Go to :
replace the "192.168.20.180" with your Suricata IP.
Go to :
replace the value of L.LatLng with your location. You can go to http://latitudelongitude.org to find your Latitude and Longitude values.
Then configure your web server to point the root directory to "/var/www/geoip-attack-map/AttackMap". Make sure you have enabled "websocket" module or function on your web server. Meanwhile, the port for the websocket is 8888 by default.
*** Setting up web server to work with this project is out of scope of this guide.
Step 5 :
Since Redis server requires this setting to avoid performance issue, you need to edit the boot parameter in Grub.
Step 6 :
Once boot up, you can point your browser to the IP address that you entered in the above steps.
Troubleshooting
If there is no traffic on the map, it is properly the DataServer.py not working. Restart it is required.
*** Please note that it needs time to read the eve.json file from the beginning of the file on every restart.
Please also note that do not refresh or reload the page as it will corrupt the map. You need to restart the browser.
REFERENCE
Traffic and Attack Map for Suricata
That's all! See you!
"Traffic & Attack Map for Suricata" is modified to work with Suricata's eve.json file. It shows the inbound traffic only which includes normal and attack traffic. It is designed for Python 3 and Ubuntu Server 16.04 LTS. It is also designed to install on the box of Suricata.
The map shows "DROP" or "ALERT" when the traffic is dropped or alerted by Suricata. Meanwhile, other traffic will be shown as its nature (Event Type), such as DNS, TLS, FILEINFO and etc.
License
"Traffic & Attack Map for Suricata" is released under GPLv3 by Samiux.
Requirements
(1) Working Suricata dedicate server as IDPS on Ubuntu Server
(2) Python 3.x
(3) Web server with websocket function
(4) Redis server
Package
sha256sum fda369bd246048ce883fabb16e085caa022a492a7e188b4f0c99f37ea4bc8bdb attack-map-0.0.1.tar.gzInstallation
Step 1 :
sudo apt-get install python3-pip redis-server
sudo pip3 install tornado tornado-redis redis maxminddbsudo nano /etc/redis/redis.confChange from :
bind 127.0.0.1To :
bind 0.0.0.0Step 2 :
wget https://www.infosec-ninjas.com/files/attack-map-0.0.1.tar.gz
tar -xvzf attack-map-0.0.1.tar.gz
cd attack-map/geoip-attack-map
./db-dl.sh
cd ..
sudo cp -R geoip-attack-map /var/wwwStep 3 :
cd ..
sudo cp attackmap.service /lib/systemd/system/
sudo cp dataserver.service /lib/systemd/system/
sudo systemctl enable attackmap.service
sudo systemctl enable dataserver.serviceStep 4 :
cd /var/www/geoip-attack-map/DataServer
sudo nano DataServer.pyGo to :
hq_ip = '8.8.8.8' replace "hq_ip" with your external IP address.cd /var/www/geoip-attack-map/AttackMap
sudo nano trafficline.jsGo to :
var webSock = new WebSocket("ws://192.168.20.180:8888/websocket");replace the "192.168.20.180" with your Suricata IP.
Go to :
var hqLatLng = new L.LatLng(33.936051, -81.048565);replace the value of L.LatLng with your location. You can go to http://latitudelongitude.org to find your Latitude and Longitude values.
Then configure your web server to point the root directory to "/var/www/geoip-attack-map/AttackMap". Make sure you have enabled "websocket" module or function on your web server. Meanwhile, the port for the websocket is 8888 by default.
*** Setting up web server to work with this project is out of scope of this guide.
Step 5 :
Since Redis server requires this setting to avoid performance issue, you need to edit the boot parameter in Grub.
sudo nano /etc/default/grub
GRUB_CMDLINE_LINUX_DEFAULT="transparent_hugepage=never"
sudo update-grub
sudo rebootStep 6 :
Once boot up, you can point your browser to the IP address that you entered in the above steps.
Troubleshooting
If there is no traffic on the map, it is properly the DataServer.py not working. Restart it is required.
sudo systemctl restart dataserver*** Please note that it needs time to read the eve.json file from the beginning of the file on every restart.
Please also note that do not refresh or reload the page as it will corrupt the map. You need to restart the browser.
REFERENCE
Traffic and Attack Map for Suricata
That's all! See you!
Subscribe to:
Posts (Atom)