Penoy's Tech Corner

Installing chkrootkit in RHEL/CentOS 4

2007-09-13T12:54:00.000+08:00

Installing chkrootkit in RHEL/CentOS 4

Download and install chkrootkit rpm

# wget http://apt.sw.be/redhat/el4/en/i386/dag/RPMS/chkrootkit-0.47-1.el4.rf.i386.rpm

# rpm –ivh chkrootkit-0.47-1.el4.rf.i386.rpm

Create a rootkitscanner script

# vi rootkitscanner

----------------------------------------------------------------

#/bin/bash

#rootkitscanner script

#by penoytechcentral.blogspot.com

#setting up the date

month=`date "+%m"`

today=`expr \`date "+%d"\``

year=`date "+%y"`

dirdate=$month-$today-$year

#delete the previous log

rm -f /var/log/chkrootkit_*.log

#scan the server for rootkits

/usr/bin/chkrootkit > /var/log/chkrootkit_$dirdate.log

SUBJECT=`hostname`" Automated Security Alert"

TO="your-email@domain.com"

mail -s "$SUBJECT" "$TO" < /var/log/chkrootkit_$dirdate.log

-----------------------------------------------------------------

Give and execute permission and copy the script to weekly cron

#chmod +x rootkitscanner

#cp rootkitscanner /etc/cron.weekly

SSH RSA Authentication

2007-09-12T22:04:00.000+08:00

#ssh-keygen -t rsa
#scp .ssh/id_rsa.pub root@remote-host:/root/
#ssh root@remote-host
#cat id_rsa.pub >> .ssh/authorized_keys

Cannot upload large files in Eventum

2007-09-12T17:59:00.000+08:00

Problem: Cannot upload large files in Eventum

Solution:
--php.ini
--memory_limit = 256M
--max_execution_time = 300
--max_input_time = 600
--post_max_size = 64M
--upload_max_filesize = 10M

-httpd.conf
--timeout = 120

-my.cnf
--max_allowed_packet: 8MB

Installing rkhunter

2007-09-11T21:00:00.000+08:00

Rootkit scanner is scanning tool to ensure you for about 99.9%* you're clean of nasty tools. This tool scans for rootkits, backdoors and local exploits by running tests like:

- MD5 hash compare
- Look for default files used by rootkits
- Wrong file permissions for binaries
- Look for suspected strings in LKM and KLD modules
- Look for hidden files
- Optional scan within plaintext and binary files

Rootkit Hunter is released as GPL licensed project and free for everyone to use.

* No, not really 99.9%.. It's just another security layer

Installing rkhunter

# wget http://jaist.dl.sourceforge.net/sourceforge/rkhunter/rkhunter-1.3.0.tar.gz
# tar xvzf rkhunter-1.3.0.tar.gz
# cd rkhunter-1.3.0
# ./install.sh --layout default --install
# rkhunter --propupd
# rkhunter --check

MySQL "Ignoring query to other database"

2007-09-02T08:24:00.000+08:00

"Ignoring query to other database"

[root@localhost]# mysql -v -u root -p
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 8 to server version: 4.1.20

Reading history-file /root/.mysql_history
Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> show databases;
--------------
show databases
--------------

+----------+
| Database |
+----------+
| mysql |
| test |
+----------+

Snortalog script

2007-07-17T14:35:00.000+08:00

#/bin/bash
#Logfile rotation script snort written by jameso@elwood.net
#modified by penoi

snortbase=/var/log/snort
logdir=$snortbase
oldlogs=$snortbase/oldlogs
weeklogs=$snortbase/weeklogs

#setting up the date
month=`date "+%m"`
yesterday=`expr \`date "+%d"\` - 1`
eightday=`expr \`date "+%d"\` - 8`
year=`date "+%y"`
dirdate=$month-$yesterday-$year
olddirdate=$month-$eightday-$year

./snortalog.pl -file /var/log/snort/alert -r -report -o $dirdate.html

# Create the Dir for todays logs.
if [ ! -d $weeklogs/$dirdate ]
then
mkdir $weeklogs/$dirdate
fi

for logitem in `ls $logdir` ; do
mv /var/log/snort/$logitem $weeklogs/$dirdate
done

#kill snort
#pid=`ps -ef | grep 'snort -c /etc/snort/snort.conf -i eth1' | grep -v grep| awk '{print $2}'`
pid=`ps -ef | grep 'snort -i eth1' | grep -v grep | awk '{print $2}'`
kill $pid

#Restart snort
/usr/local/bin/snort -i eth1 -c /etc/snort/snort.conf -D &

# Delete any uncompressed log files that over a week old.
if [ -d $weeklogs/$olddirdate ]
then
rm -r $weeklogs/$olddirdate
fi

#Compressed and save the log files to save for aslong as you want
cd $weeklogs; tar zcvf $oldlogs/$dirdate.tgz $dirdate > /dev/null 2>&1

Forcing SSL in Apache

2007-06-06T14:31:00.000+08:00

RewriteEngine on
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]

Backtrack V2.0 Final

2007-03-09T20:17:00.000+08:00

Backtrack V2.0 Final is now available at remote-exploit.

Installing Screen in Centos 4.4

2007-02-27T19:22:00.000+08:00

Screen lets you have multiple virtual window in one physical terminal. Screen lets you detach and reattach to your virtual windows, which is good if you are compiling remotely.

Download the latest Screen RPM

http://www.rpmfind.net/linux/rpm2html/search.php?query=screen

Install Screen dependencies

#yum -y install ncurses-devel texinfo pam-devel libtool

Install Screen

#rpmbuild --rebuild screen-4.0.2-5.src.rpm
#rpm -ivh /usr/src/redhat/RPMS/i386/screen-4.0.2-5.src.rpm

Show Screen

#screen -ls

Create Screen Session

#screen

Create Screen Virtual window

press ctrl+a,c

Change between Screens

press ctrl+a, 0 Session 0
press ctrl+a, 1 Session 1
press ctrl+a, 2 Session 2

To resume a Screen session

#screen -r session name

Aptana

2007-02-18T09:16:00.000+08:00

The Aptana IDE is a free, open-source, cross-platform, JavaScript-focused development environment for building Ajax applications. It features code assist on JavaScript, HTML, and CSS languages, FTP/SFTP support and a JavaScript debugger to troubleshoot your code.

Globe Innove using Transparent proxy??

2007-01-23T15:34:00.000+08:00

if you are a Globe Innove internet subscriber and has a static ip address, Check out your ip address at whatismyip . As of this writing, it seems Globe is using Transparent Proxy. Request to www.google.com is redirected to www.google.com.ph. Rapidshare downloads will prompt that you are currently downloading a file though you are not.

Slow Internet Connection in the Philippines

2007-01-02T15:38:00.000+08:00

After the Taiwan earthquake, the Philippines still experiencing slow internet connection. According to the news, it will take weeks before they can fully restore the damaged submarine cables in Taiwan. So in the meantime, it will be a dialup speed connection for us.
So far, during the holidays and after the earthquake, my Smartbro Wireless Internet Broadband connection was very efficient. I can do torrents, http download, browse the internet, and do my work at the same time. Kudos to Smartbro for a good service in my area. I hope their service will stay that way.

Installing Banshee: Linux Alternative to iTunes on Fedora Core 6

2006-12-30T08:17:00.000+08:00

Banshee can be found on Fedora Core 6 Extra repository

1. # yum -y install banshee

Banshee by default doesnt have gstreamer mp3 plugin support. First install gstreamer-plugins-bad and gstreamer-plugins-ugly. We must have the repository from Freshrpms

2. wget http://ftp.freshrpms.net/pub/freshrpms/fedora/linux/6/
freshrpms-release/freshrpms-release-1.1-1.fc.noarch.rpm

3. rpm -ihv freshrpms-release-1.1-1.fc.noarch.rpm

4. yum -y install gstreamer-plugins-bad

5. yum -y install gstreamer-plugins-ugly

That's it!!! You have now mp3 support!!!

Banshee Playlist

Synchronizing Ipod using Banshee

7.1 Taiwan Earthquake Damages Philippines Internet Link

2006-12-27T15:17:00.000+08:00

THE 7.1 magnitude earthquake that struck Taiwan early Wednesday damaged the Philippines internet link. This causes some services to be unaccessible.. even internet cafe's were forced to close their shops.

Affected telecommunications companies/ISP were Globe Telecommunications, BayanTel, Digitel, Philippine Long Distance Telephone Co., Pacific Internet, and Eastern Telecom.

It seems that even the internet is vulnerable to disruption of service. As of 12:40pm, some of the connections was restored and some still experiencing intermittent internet connections.

TuxPaint on Fedora Core 6

2006-12-25T20:25:00.000+08:00

Whenever Im on my computer, my nephew and niece always bugs me and want to play Paint on my computer...

Its a headache so i issue the command : #yum -y install tuxpaint

and their life is never the same again....

My nephew and niece playing Tuxpaint on Fedora Core 6

Installing and Updating Metasploit Framework version 2

2006-12-17T20:00:00.000+08:00

Metasploit Framework version 2

1. download and untar metasploit framework
$ wget http://metasploit.com/tools/framework-2.7.tar.gz
$ tar xvzf framework-2.7.tar.gz
$ cd framework*

2. install ruby
# yum -y install ruby

3. install subversion-perl
# yum -y install subversion-perl

4. $svn update

Edited: Dec 18, 2006 ... Thanks HD Moore for the comment...

Running Internet Explorer on Fedora Core 6 Linux

2006-12-17T00:15:00.000+08:00

Why would i need an Internet Explorer when there is Firefox?? nah, JobsDB does'nt run on Firefox... so i have to install IE on Linux....

Fedora Core 6 Zod, CentOS Enterprise Linux 4.4 and SNORT Intrusion Detection System

2006-12-13T12:15:00.000+08:00

Last night I burned DVD copy of Fedora core 6 and CentOS 4.4 installers. i will install(nth time) a dual boot system of a Windows and Fedora OS. As soon as my common apps will run on Linux.. i will ditch my Windows installation. I'm not that novice on using Linux as a desktop.
I've posted a Howto in Batangas Open Source Society Tech Blog on how to generate a pdf log report of SNORT using SnortAlog and will rotate your Snort log automatically.

Ubuntu Linux Version 6.06 LTS

2006-12-09T12:46:00.000+08:00

My computer's harddisk got busted last month. I dont have enough budget to buy new harddisk. Im using right now LiveCD of Ubuntu Linux version 6.06 LTS on AMD Duron 1299.295MHz 1GB mb memory.

Public Beta Release - BackTrack v2.0

2006-12-07T17:40:00.000+08:00

I havent tried the Public beta release of Backtrack v2.0... im been using this livecd on some of my system penetration testing.. got to download the iso... :)

Burn CD/DVD's for FREE !!!

2006-11-07T12:16:00.000+08:00

CD Burner XP Pro Site

Writes all kind of mediums apart from double-layer DVD (follows in next version). Burning video-DVDs is limited.
Burn audio-CDs with and without gaps between tracks
Burn on the fly / Burn-proof
Supports most IDE, USB, Firewire and SCSI drives
Rip Audio-CDs to harddrive, obtain track-information (ID3-tags) from Internet
Burn and create ISO-files
Customizeable with many settings
Data verification after burn, create bootable discs
(will be) available in multiple languages
100% freeware - no adware or restrictions
bin/nrg->ISO converter, simple cover printing and much more!
Operating systems: Windows 98/ME/2000/XP/2003 Server

Download CD Burner XP Pro

SPAMASSASSIN RBL List

2006-06-28T12:28:00.000+08:00

Here are some of the RBL that i used on my spamassassin

relays.ordb.org
bl.spamcannibal.org
list.dsbl.org
bl.spamcop.net
dnsbl.njabl.org
cbl.abuseat.org
opm.blitzed.org
sbl.spamhaus.org

I also add cf files from Rulesemporium and McFadden

CEH as a Security Jumpstart

2006-06-28T12:22:00.000+08:00

My saturday CEh Class was changed to Saturday and Sunday.... still has four meetings left... 5 modules per class... i have to browse and make some advance study.... 10 modules per week...

My comment on the ceh bootcamp was the 5days training is not enough to fully cover the topics extensively... we skip some of the topics since i've used it on my day to day admin works....

Will be Busy again

2006-06-08T13:38:00.000+08:00

Will be busy again. I enrolled in a Saturday bootcamp training on ECCouncil Certified Ethical Hacker and Countermeasure.
This training will focus on computer and network securities. Will keep posting on how the class will gonna be. :)

Spamassassin and Viagra

2006-05-08T14:41:00.000+08:00

Eventhough im using the latest version of Spamassassin on my test/backup server.. still the viagra spams are getting through... the viagra spams is within a jpeg or gif that are attached on the email...
Anyway, let's see if the bayesian learning really works...

Instant Messaging Server

2006-04-26T14:41:00.000+08:00

Currently testing Wildfire Instant Messenger Server and NeoS as the IM Client. Hopefully this solution be implemented on our company. So far the messaging and the voice message is working. Have to test the video messaging. Wildfire Instant Messenger Server was installed on CentOS 4.3 and NeoS IM client on Windows XP.
Good thing about this solution, everything is free.

RHCE JUMPSTART TRAINING PACKAGE IN PHILIPPINES

2006-04-24T17:10:00.000+08:00

Touch Solutions Inc is now offering a RHCE JumpStart Training Package for only PHP 79,375 (regular price: PHP 93,250).

This package is ideal for students with some Linux/Unix experience and includes a complete Red Hat Enterprise Linux Training Bundle for System Administrator with RHCE Certification Examination.

Bundle details:

RH133 – Red Hat Enterprise Linux System Administration (includes the RH202 RHCT Certification Lab Exam)

Gain intensive hands-on systems administration training. Learn to install and configure a Linux system and attach it to an existing network. This course includes the RHCT certification exam on the last half-day. Duration: 5 days.

RH253 - Networking and Security Administration

Learn how to configure network services and perform security administration. This course prepares someone for the RHCE course (RH300) or the RHCE exam (RH302) if they have significant on-the-job training. Duration: 5 days.

RH302 – Red Hat Certified Engineer (RHCE)

"The crown jewel of Linux certifications" and industry-acclaimed as the number one among all IT certifications by Certcities.com. Performance-based to test your Linux competency on real world systems.

So find out if you've got what it takes to qualify for this bundle. Take Red Hat's free online pre-assessment test today.

Inquiries

Available Schedules: April, May, June 2006.
Contact Mr. Robinson Qua at (632) 705-1421 to 24 loc 109 or email RobinsonQ@touchgroup.net

from : http://www.apac.redhat.com/training/promos/touch-ph.php3

Comment: As expected, the RHCE training and certification cost is so high for a normal IT individual.

Pfsense Beta 3 Released!!!

2006-04-19T10:48:00.000+08:00

PfSense 1.0 Beta 3 is now available @ Pfsense website. Changelog can be viewed here. Can't wait for the final release of this firewall distro.

Default Password List

2006-04-19T08:05:00.000+08:00

This site contains some of the default passwords for most of the IT equipments. Updated daily.

BackTrack Live CD

2006-04-17T12:34:00.000+08:00

I will try to learn Security and Penetration testing using BackTrack live CD. it includes all the nifty tools for penetration testing.

Follett Library Automation Automatic Backup

2006-04-12T16:35:00.000+08:00

I once handle the Follett Library Automation years back. Most of our clients are schools and universities all over the Philippines.. I have written a simple How-to on how to automate the backup procedure on Faircom database using simple batch file on DOS...

Read the how to here.

Training Spamassassin

2006-04-12T11:00:00.000+08:00

Command that i used on Bayes Learning on Spamassassin

sa-learn --spam -C /etc/mail/spamassassin --showdots --dir 
/home/dom/popoy.com/users/spamlearning/cur

for more information visit Training Spamassassin on QVCS

New post

2006-04-12T10:50:00.000+08:00

its been a while since my last post on my Tech Corner... anyways, i will see to it that this blog will be updated as possible...
Im currently reviewing myself on the EC-Council Certified Ethical Hacking and Countermeasure. Though if i have the enough budget on my sleeve, i will enroll my self on a bootcamp.
The CEH study guide has now version4.x.. the only available downloads on the net was their version 3.x
the course is more interesting than the one that i've finished on Cisco, since security is one of my favorite on the field of Information Technology but still newbie though....

DDD (Defunct Disk Drive) or DHS (Defunct Hot Spare)

2005-12-13T10:25:00.000+08:00

Gently unlatch the hard disk drive tray latch fully, but do not slide it any further from the drive bay.
Wait at least 20 seconds to allow the hard disk drive to spin down.
Carefully slide the hard disk drive from the bay without inducing shocks or jolts on the hard disk drive.
Wait at least 30 seconds from the time the hard disk drive was unlatched before installing a hard disk drive back into the bay.

Note: If the logical drive is not offline, a rebuild automatically occurs when a good hard disk drive is installed in the bay.

from IBM Support Site

Symantec Sending Virus???

2005-12-13T10:19:00.000+08:00

11/12/2005 20:01:35 127.0.0.1
http://liveupdate.symantecliveupdate.com/1132200683jtun_encfull2.x86
Virus: Trojan.Aavirus

is symantec sends virus from their liveupdate??????

IBM Defunct disk and Globe Downtime

2005-12-08T10:53:00.000+08:00

We have a service downtime on our user because of the defunct SCSI on our EXP300. I asked the support of our vendor and ask a technical support from IBM Philippines, still waiting on their calls.
Globe experienced a fiber cut which result on the downtime on our frame relay last night. The connection was restored this morning. A rebate will be given to us.

Micronet VOIP

2005-12-05T16:51:00.000+08:00

I'm configuring MicroNet SP5050 VOIP box for our VOIP project connecting Palawan and Makati office... Have to Read the Fuckin Manual.

BOSS site Down

2005-12-01T17:38:00.000+08:00

The Batangas Open Source Society website is offline for quite a long time. I hope Jun have time to fix the problem.
Our supplier on our radio link can not fix radio's signal. Still the interference causes the problem. Hmmm, using radio on WAN link is not advisable after all. I will still stick on using Frame Relay.

Radio GAGA

2005-12-01T10:49:00.000+08:00

Our remote office radio link is still fucked up. My bosses is killing me. A possible problem was the interference of the new Smart WIFI service.

Work Around on QVCS SpamAssassin

2005-11-30T13:55:00.000+08:00

This is my workaround... im not good in scripting though.....

First, i make a script that will first call Spamassassin before my
mailserver antivirus


*************************************************************************

#!/bin/sh

#file:/var/qmail/bin/spam-script

/usr/local/bin/spamc -f | /var/qmail/bin/qmail-scanner-queue.pl

**************************************************************************

_____________________________________________________________________________


to make it executable

#chmod +x /var/qmail/bin/spam-script*
______________________________________________________________________________

change the ownership to qscand

#chown qscand:qscand spam-script

______________________________________________________________________________

edit the /etc/hosts.allow

tcp-env: ALL: setenv QMAILQUEUE /var/qmail/bin/spam-script

_____________________________________________________________________________

Edit the  */var/spool/qmailscan/quarantine-attachments.txt* and add

*SPAM.*                 Virus-Subject:  Spam detected by SA

to quarantine the suspected SPAMS




*****************************************************************************

2 Exams on Saturday

2005-11-30T13:45:00.000+08:00

I will take 2 module exam on Saturday. Module 1 will be on Network Address Translatio(NAT) and DHCP. Module 2 will be on WAN Technologies. There will be a Pasay City day on Friday, so i will have enough time to review and answer our Review 3 assignment.
The Palawan office and Head Office is pressured on the test of the VPN connection. We will be using VPN for the connection of the VOIP box on both office. Its hard to teach Linux on the MIS of our Palawan office using Yahoo Messenger.

IPCOP 1.4.10

2005-11-29T17:49:00.000+08:00

i've just updated our firewall using IPCOP... so far the most exciting part of the update was the scheduled reboot of the box, which in version 1.4.9, i have to reboot it manually because of the 100% usage of the SWAP memory... i've also upgrade its 256mb memory to 512mb.....

Absent in my CCNA class

2005-11-26T14:32:00.000+08:00

Our Radio link in one of our offices still fucked up. Have to skip my CCNA class and troubleshoot the problem with our vendor.
Hopefully we can finish the modules for the Semester 4 of the Cisco Networking Academy and take up the CCNA certification exam next year. Kinda crammed now.... everynight i have to browse all my books and notes, and review all the Cisco Router's command....
After the CCNA if i have the budget, i'm planning to take the Total Linux of Bluepoint.. Cost for about 40k+ but its worth it....

Microsoft SQL, Visual Studio and Biztalk Launch

2005-11-25T13:07:00.000+08:00

I've attended the Microsoft SQL 2005, Visual Studio 2005 and Biztalk 2006 launch. The venue is crowded with developers and IT afficionados. The conference kit includes a demo version of SQL and Visual Studio which i handed to our System Developer. The event was in to heat when Geneva Cruz do her number.
I have to cut my seminar and went back to the office because of the problem on our WAN link. Better luck next time on the Xbox 360.

Worm.Sober.U

2005-11-24T16:38:00.000+08:00

My email server blocks a huge number of Worm.Sober.U infected emails. Im also receiving spoof email of the postmaster of my domain that's been sending viruses on the net. Good thing that im using Clamav Antivirus on my server.

Penoycentral Already Used

2005-11-24T16:26:00.000+08:00

Someone used my internet screen name Penoycentral on blogspot.... so i have to use a different URL and username for my Penoy's Tech Corner. This blog is intended for my documentation on System Administration and Network Administration for my future reference. Hope this blog will also be a good use to you.