iptables rules:
#iptables -A INPUT -p tcp --dport 22 -i ethx -m state --state NEW -m recent --set
#iptables -A INPUT -p tcp --dport 22 -i ethx -m state --state NEW -m recent --update --seconds 60 --hitcount 5 -j DROP
如此一來,本機於1分鐘內收到超過5個以上的SSH連線需求時,第5個SSH connection就會被drop掉.
緊接著用hping測試連續送出n個TCP port 22 SYN,看看第5個SSH connection是否會被drop:
Reference:
http://www.cyberciti.biz/tips/linux-unix-bsd-openssh-server-best-practices.html
http://tuxtraining.com/2009/06/23/stop-ssh-brute-force-attack-using-susefirewall
Thursday, July 30, 2009
Deny SSH brute attack via iptables
Thursday, July 23, 2009
Suspend Linux to swap
分享一個在console下將Linux系統休眠到swap的方法:
Tested on CentOS5.3:
Step1. 設定STD(suspend to disk)到swap:
[root@localhost ~]# fdisk -l
Disk /dev/hda: 8589 MB, 8589934592 bytes
255 heads, 63 sectors/track, 1044 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Device Boot Start End Blocks Id System
/dev/hda1 * 1 13 104391 83 Linux
/dev/hda2 14 842 6658942+ 83 Linux
/dev/hda3 843 907 522112+ 82 Linux swap / Solaris
/dev/hda4 908 1044 1100452+ 5 Extended
/dev/hda5 908 972 522081 83 Linux
[root@localhost ~]# ls -ld /dev/hda3
brw-r----- 1 root disk 3, 3 Jul 23 2009 /dev/hda3
由此得知swap partition的major與minor ID是3.3，接著修改參數如下 (預設是0:0):
[root@localhost power]# echo "3:3" > /sys/power/resume
Step2. 啟動休眠:
[root@localhost ~]# echo "disk" > /sys/power/state
此時系統將立刻進入休眠狀態，並於下次重開機時回到剛剛的環境。
Step3. 設定永久suspend到swap:
修改/boot/grub/grub.conf並設定Kernel參數如下:
kernel /vmlinuz-2.6.18-128.2.1.el5 ro root=LABEL=/ rhgb quiet resume=/dev/hda3
Tuesday, July 14, 2009
善用tmpfs當Firefox的cache
現在的電腦記憶體很夠用, Redhat/CentOS預設又將/dev/shm當成tmpfs掛載起來, 所以也就別辜負了它的美意吧! 把它拿來當成Firefox cache的RAMDisk用吧!
至於如何將Firefox的cache指定到/dev/shm呢? 實作上非常簡單, 只要開啟Firefox並於網址列上輸入about:config, 然後點擊滑鼠右鍵->新增->字串後輸入: browser.cache.disk.parent_directory, 內容則輸入/dev/shm就完成了.
成功的話, 當使用Firefox瀏覽網頁時就會看到/dev/shm會新增Cache目錄.
當然系統重新開機後, cache就會消失了!
Note: Redhat/CentOS預設並不特別指定/dev/shm的大小為何, 記憶體剩下多少就允許/dev/shm使用, 如果想要改變此行為的話可開啟/dev/fstab,找到mount /dev/shm的那一列並修改如下:
tmpfs /dev/shm tmpfs defaults,size=100M 0 0
以上希望對大家使用Linux有幫助.
Thursday, July 02, 2009
Compress and encrypt directory in Linux
直接進入實作步驟~
Compress tools: tarData encrypt tools: AES Crypt (http://www.aescrypt.com/)
Objective-1, To backup /etc and encrypt it:
1. 壓縮並加密/etc:
# tar cvf - /etc | aescrypt -e -p 123456 -> etc.tar.aes
(-e: encrypt, -p password)
2. 測試etc.tar.aes是否有加密:
[root@localhost ~]# file etc.tar.aes
etc.tar.aes: data
[root@localhost ~]# tar tvf etc.tar.aes
tar: This does not look like a tar archive
tar: Skipping to next header
tar: Archive contains obsolescent base-64 headers
tar: Read 300 bytes from etc.tar.aes
tar: Error exit delayed from previous errors
測試結果發現到etc.tar.aes已經被AES加密了，故無法直接以tar觀看壓縮檔的內容。
Objective-2 To decrypt and uncompress data:
1. 將壓縮檔解密:
# aescrypt -d -p 123456 etc.tgz.aes
解密後會新增一檔案為etc.tar
2. 解壓縮:
# tar xvf etc.tar
如此一來便可解開加密過後的壓縮檔了。
其它在Linux上常見的加密工具還有openssl與gpg。
Monday, June 29, 2009
Sunday, June 21, 2009
Free online file conversion: Zamzar
很多人為了轉換檔案格式，總是會在電腦上裝載各種轉換的軟體，甚至有時收到了不能讀取的檔案時就更是令人感到心煩了，比如Office 2007的docx，像我的Linux與OSX都沒辦法讀取docx的文件，偏偏有人就是很喜歡寄給我但也總不能去請人家去轉換好再寄給我吧，此時只好自己開啟Windows的office 2007來看，挺浪費時間，嘿嘿～不過今天真是個好日子，讓我發現了一個能解決我這種困擾的服務，Zamzar!
Zamzar它是一個免費的線上格式轉換的服務，不論您使用那種OS（事實上跟OS一點關係都沒有），只要將檔案透過Web browser上傳後，選擇想轉換成的檔案格式，它就會幫你將檔案轉換好並透過mail告訴你檔案下載的連結，真的是非常之方便呀！目前檔案的上限為100MB，而能轉換的格式真是包山包海呀！
Wednesday, June 10, 2009
[Shell script] Remote Services watchdog
以下的script是針對偵測到對方的service沒有正常運作時則發mail給所指定的使用者，請參考:
#!/bin/bash
SRVLIST='192.168.0.100:80
192.168.0.100:53'
MAILACCOUNT="root@server1.example.com"
for SRV in `echo $SRVLIST`
do
IP=`echo $SRV | cut -d: -f1`
PORT=`echo $SRV | cut -d: -f2`
nc -w 1 $IP $PORT > /dev/null 2>&1 || echo "Port $PORT on Server $IP is failed" | mail -s "Error: Service failed" $MAILACCOUNT
done
Monday, June 08, 2009
Install AWstats on CentOS 5.x
What's AWstats?
AWStats is a free powerful and featureful tool that generates advanced web, streaming, ftp or mail server statistics, graphically. This log analyzer works as a CGI or from command line and shows you all possible information your log contains, in few graphical web pages. It uses a partial information file to be able to process large log files, often and quickly. It can analyze log files from all major server tools like Apache log files (NCSA combined/XLF/ELF log format or common/CLF log format), WebStar, IIS (W3C log format) and a lot of other web, proxy, wap, streaming servers, mail servers and some ftp servers.
http://awstats.sourceforge.net/
安裝步驟:
1. 於rpmfind.net 搜尋並下載awstat*rpm for RHEL5.x (awstats-6.9-2.el5.rf.noarch.rpm)
AWStats is a free powerful and featureful tool that generates advanced web, streaming, ftp or mail server statistics, graphically. This log analyzer works as a CGI or from command line and shows you all possible information your log contains, in few graphical web pages. It uses a partial information file to be able to process large log files, often and quickly. It can analyze log files from all major server tools like Apache log files (NCSA combined/XLF/ELF log format or common/CLF log format), WebStar, IIS (W3C log format) and a lot of other web, proxy, wap, streaming servers, mail servers and some ftp servers.
http://awstats.sourceforge.net/
安裝步驟:
1. 於rpmfind.net 搜尋並下載awstat*rpm for RHEL5.x (awstats-6.9-2.el5.rf.noarch.rpm)
2. # rpm -ivh awstat*rpm
3. 修改/etc/httpd/conf/httpd.conf:
AddHandler cgi-script .cgi .pl
4. 修改/etc/httpd/conf.d/awstats.conf :
Alias /awstats/icon/ /var/www/awstats/icon/
ScriptAlias /awstats/ /var/www/awstats/
DirectoryIndex awstats.pl
Options ExecCGI
Order allow,deny
Allow from all
# order deny,allow
# deny from all
# allow from 127.0.0.1
5. 將/etc/awstats/awstats.localhost.localdomain.conf改成/etc/awstats/awstats.IPADDRESS.conf (e.g., IPADDRESS=192.168.0.1)
6.手動執行/etc/cron.hourly/00awstats
如此一來就馬上有資料產生了，之後就交給system crontable更新吧！
7. 開啟瀏覽器並輸入 http://192.168.0.1/awstats/awstats.pl，成功的話應該會看到以下的畫面:
Note: awstats.IPADDRESS.conf 有許多參數可調整，請參考裡面的說明。
Sunday, June 07, 2009
Saturday, June 06, 2009
[Shell script] Services watchdog
這隻script的功能就是當偵測到所指定的port於本機沒有啟動的話，就會將它自動重啟，放在cron table裡定時檢查吧！
#!/bin/bash
SRVLIST='80:/etc/init.d/httpd
25:/etc/init.d/postfix
22:/etc/init.d/sshd
110:/etc/init.d/dovecot'
for SRV in `echo $SRVLIST`
do
nc -w 1 localhost `echo $SRV | cut -d: -f1` > /dev/null 2>&1 && echo "Port $SRV fine" || `echo $SRV|cut -d: -f2` restart
done
[Shell script] Monitor process cpu loading and count
1. 當process CPU loading超過90%, 就先行刪除:
#!/bin/bash
CPULOADING=90
ps auxh | \
while read pro
do
set -- $pro
if [ `echo $3 | cut -d"." -f1` -gt $CPULOADING ]; then
kill $2
fi
done
2.當process數目超過50時, 就先行刪除:
#!/bin/bash
PSCOUNT=50
ps axh -o "cmd" | sort | uniq -d -c | \
while read ps
do
set -- $ps
if [ $1 -gt $PSCOUNT ]; then
killall $2
fi
done
Reference: Linux網路安全管理與監控
#!/bin/bash
CPULOADING=90
ps auxh | \
while read pro
do
set -- $pro
if [ `echo $3 | cut -d"." -f1` -gt $CPULOADING ]; then
kill $2
fi
done
2.當process數目超過50時, 就先行刪除:
#!/bin/bash
PSCOUNT=50
ps axh -o "cmd" | sort | uniq -d -c | \
while read ps
do
set -- $ps
if [ $1 -gt $PSCOUNT ]; then
killall $2
fi
done
Reference: Linux網路安全管理與監控
Friday, June 05, 2009
[Shell script] Monitor Disk space
#!/bin/bash
USAGE_SPACE=20
USAGE_SPACE=20
df | grep '[0-9]%' | egrep 'sd|hd' | \
while read line
do
# if [ `echo $line | awk -F" " '{ print $5 }' | cut -d% -f1` -gt "$USAGE_SPACE" ]; then
# echo "Disk space of `echo $line | awk -F" " '{ print $6}'` belongs to `hostname` is over $USAGE_SPACE%" | mail -s "HD DISK is not enough" $USER
# fi
set -- $line
if [ `echo $5 | cut -d% -f1` -gt $USAGE_SPACE ]; then
echo "Disk space of `echo $6` belongs to `hostname` is over $USAGE_SPACE%" | mail -s "HD DISK is not enough" $USER
fi
done
Sunday, May 31, 2009
Eason Chen Moving on stage 21 part II
昨晚陪老婆去台北小巨蛋聽陳奕迅Moving on stage 21 part II的演唱會，老實說我並非Eason的歌迷，對他的歌比較熟悉的是只有K歌之王，你的背包，婚禮的祝福(這張專輯我有買)。
整體聽下來我可以了解為何老婆這麼喜歡Eason了，他真的很有實力，歌曲確實能打動人心， 感覺上他真的唱得很賣力，連唱了四個小時吧！有幸能參加這種實力派歌手的演唱會真是我們的幸福，可惜我只聽到11:00多就先行離場回家去哄小朋友睡覺了，不然真的很想跟Eason待到最後。
Anyway Eason期待你下一次再來台北開唱！婚禮的祝福真是太好聽了！
Wednesday, May 20, 2009
Moving SUSE Linux to another system
工作用的一台PC可能太過老舊,常常跑到一半就system freeze,懷疑是熱當,然而剛好有一台idle的機器,想說就將hard drive換到那台機器就好了,本以為應該會很順利,沒想到系統重開時SUSE回報:
waiting for device /dev/hda2 to appear
waiting for device /dev/hda4 to appear
然後整個系統就停止了.... 事情似乎沒有我想像得單純..... :p
進入rescue mode查看hard drive也沒損壞呀? 只好上google查看看吧~
後來查到原來是當更換到另一台機器時,由於主機板上的controller是不一樣的! SUSE需要重新make initrd, Redhat不用! 呵呵.... 整個救援的方法如下:
hard drive partition information:
/dev/hda1 -> /boot
/dev/hda2 -> swap
/dev/hda3 -> /home
/dev/hda4 -> /
1. 利用SUSE安裝光碟進入rescue mode
2. 將root partition掛載: mount /dev/hda4 /mnt
3. 將rescue mode的/dev與/proc分別掛載到 /mnt/dev與/mnt/proc: mount --bind /dev /mnt/dev; mount --bind /proc /mnt/proc
4. 將目前的rescue mode的single-root轉成實際上的root partition: chroot /mnt
5. 將/boot掛載: mount /dev/hda1 /boot
6. 切換到/boot目錄,並執行mkinitrd: cd /boot; mkinitrd
Accomplished!
waiting for device /dev/hda2 to appear
waiting for device /dev/hda4 to appear
然後整個系統就停止了.... 事情似乎沒有我想像得單純..... :p
進入rescue mode查看hard drive也沒損壞呀? 只好上google查看看吧~
後來查到原來是當更換到另一台機器時,由於主機板上的controller是不一樣的! SUSE需要重新make initrd, Redhat不用! 呵呵.... 整個救援的方法如下:
hard drive partition information:
/dev/hda1 -> /boot
/dev/hda2 -> swap
/dev/hda3 -> /home
/dev/hda4 -> /
1. 利用SUSE安裝光碟進入rescue mode
2. 將root partition掛載: mount /dev/hda4 /mnt
3. 將rescue mode的/dev與/proc分別掛載到 /mnt/dev與/mnt/proc: mount --bind /dev /mnt/dev; mount --bind /proc /mnt/proc
4. 將目前的rescue mode的single-root轉成實際上的root partition: chroot /mnt
5. 將/boot掛載: mount /dev/hda1 /boot
6. 切換到/boot目錄,並執行mkinitrd: cd /boot; mkinitrd
Accomplished!
Monday, May 18, 2009
快速取得路由路徑資訊
在Linux下,要確定或查看到某一個destination的方法,比較傳統的方法是執行route -n 或是netstat -rn取得routing table後,再以肉眼判斷讀出,不過我看過有些人管控的機器其routing table內容非常之可怕! 眼睛可能會看到"脫窗", 所幸我今天發現到了一個新的指令可以幫助苦命的IT/MIS.
# ip route get x.x.x.x
-> 系統就會回報到x.x.x.x會經由哪個gateway出去, e.g.,
ip route get 168.95.1.1
168.95.1.1 via 192.168.1.254 dev br0 src 192.168.1.100
cache mtu 1500 advmss 1460 hoplimit 64
解讀: 從src 192.168.1.100到dst 168.95.1.1是透過192.168.1.254出去
# ip route get x.x.x.x
-> 系統就會回報到x.x.x.x會經由哪個gateway出去, e.g.,
ip route get 168.95.1.1
168.95.1.1 via 192.168.1.254 dev br0 src 192.168.1.100
cache mtu 1500 advmss 1460 hoplimit 64
解讀: 從src 192.168.1.100到dst 168.95.1.1是透過192.168.1.254出去
Tuesday, May 12, 2009
[Shell script] 讓/etc/passwd更利於閱讀
#!/bin/bash
IFS=:
echo "System User list:"
echo "-------------------------------------"
while read username shapass uid gid comm home shell
do
echo "UserName:$username"
echo " 1.password:$shapass"
echo " 2.uid:$uid"
echo " 3.gid:$gid"
echo " 4.comment:$comm"
echo " 5.home:$home"
echo " 6.default shell:$shell"
echo "------------------------------------"
done < /etc/passwd
參考Linux-101 Hacks, hack 88. Read data file fields inside a shell script
IFS=:
echo "System User list:"
echo "-------------------------------------"
while read username shapass uid gid comm home shell
do
echo "UserName:$username"
echo " 1.password:$shapass"
echo " 2.uid:$uid"
echo " 3.gid:$gid"
echo " 4.comment:$comm"
echo " 5.home:$home"
echo " 6.default shell:$shell"
echo "------------------------------------"
done < /etc/passwd
參考Linux-101 Hacks, hack 88. Read data file fields inside a shell script
Monday, May 11, 2009
Get Ready for openSUSE Community Week!
The first openSUSE Community Week is just around the corner. May 11 through May 17 we’ll be hosting live sessions in IRC to help grow the openSUSE Community.
Community week is all about helping new contributors get started with openSUSE and getting existing contributors together to mentor new contributors, and working together on major projects.
We’ll be hosting a week of IRC tutorials, Q&A’s, and jam sessions on a number of topics. Learn to work with the testing/QA team, create packages, work with the openSUSE Build Service, help work on the wiki, or get involved with the GNOME and KDE teams. There’s something for everybody.
Schedule:
http://en.opensuse.org/Community_Week
Community week is all about helping new contributors get started with openSUSE and getting existing contributors together to mentor new contributors, and working together on major projects.
We’ll be hosting a week of IRC tutorials, Q&A’s, and jam sessions on a number of topics. Learn to work with the testing/QA team, create packages, work with the openSUSE Build Service, help work on the wiki, or get involved with the GNOME and KDE teams. There’s something for everybody.
Schedule:
http://en.opensuse.org/Community_Week
Tuesday, May 05, 2009
Ubuntu and Upstart
Ubuntu與Fedora都採用了upstart模擬跑SysV. 但是OpenSUSE11.1/SLES11 whereas.... 還是採用大家熟悉的SysV, 讓我們來看看Novell的concern吧:
http://en.opensuse.org/Ubuntu_and_Upstart
是不是差點沒說出脫褲子放屁~ XD
http://en.opensuse.org/Ubuntu_and_Upstart
是不是差點沒說出脫褲子放屁~ XD
Thursday, April 23, 2009
wget useful parameters
遇到了所以在此做個紀錄，雜記一下:
# wget -r -np -A img,txt,gz,pcap,cap http://xxx.xxx.xxx
-r --recursive
-np --no-parent
-A --accept=LIST
-> 如此一來就會對xxx.xxx.xxx的網站以遞迴的方式，抓取以img,txt,gz,pcap與cap類型的檔案，其它的都會忽視。
更多的參數可透過wget --help或是man wget獲得更進一步的資訊。
# wget -r -np -A img,txt,gz,pcap,cap http://xxx.xxx.xxx
-r --recursive
-np --no-parent
-A --accept=LIST
-> 如此一來就會對xxx.xxx.xxx的網站以遞迴的方式，抓取以img,txt,gz,pcap與cap類型的檔案，其它的都會忽視。
更多的參數可透過wget --help或是man wget獲得更進一步的資訊。
Monday, April 13, 2009
忽視記錄指定的指令於history中
上次介紹可用HISTCONTROL="ignorespace"來忽視開頭為"空白"的指令記錄於history中，今天再提供另一種可行的方法，當看到特定的指令時，也將不記錄於history中，實作的方法如下:
Usage: HISTIGNORE="cmd1:cmd2"
Example1: 忽視記錄pwd,useradd,userdel,passwd等指令:
# export HISTIGNORE="pwd:useradd:userdel:passwd"
Example2: 開機即套用:
Redhat/SUSE: echo 'export HISTIGNORE="pwd:useradd:userdel:passwd"' >> /etc/profile
Note: 如果系統不允許重開機，可以透過source /etc/profile來生效。
Subscribe to:
Posts (Atom)