WiFi Adapter Packet Injection Test latest

Questions about if a certain Wifi adapter is compatible with the Aircrack-ng suite or what Wifi card is capable of packet injection and operating monitoring mode are commonly asked at discussion boards and social media. A Wifi adapter that is capable of packet injection and monitoring mode is trivial and important functionality to be successful in Wifi hacking. 

Wireless packet injection is spoofing packets on a network to appear as if they are part of the regular network communication stream. Packet injection allows to intercept, disrupt and manipulate network communication. 

An example of this is sending an authentication message from an unknown party outside the network to a connected client as if it was sent to the wireless router. This will result in the client disconnecting from the router. 

Monitoring mode is one of the six modes a Wifi card can operate in which allows you to capture network packets without having to associate with the access point. If you are looking to buy a Wifi card which is capable of packet injection using the Aircrack-NG suite you can have a look at the following list of supported Wifi adapters:

http://www.aircrack-ng.org/doku.php?id=compatible_cards

WiFi Adapter Packet Injection Test 2016

Wifi adapter packet injection test

Performing a Wifi adapter packet injection test to see whether your Wifi adapter is capable of injection can be done easily with Aireplay-ng. Aireplay-ng is the great tool to generate traffic for cracking WEP and WPA keys.

First we need to put the Wifi adapter in Monitoring mode using the following command:

airmon-ng start wlan0

If necessary kill the processes Kali is complaining about:

Testing if your Wifi adapter support packet injection can be done using the following command:

aireplay-ng –test wlan0mon

Packet Injection is working for this card!

In Kali Linux ‘iwconfig’ will show you the operating mode of your Wifi card:

Read More

How To Boot Ubuntu From A USB Flash Drive

Below are the three methods, that can be adopted to boot Ubuntu OS from a USB Flash Drive!

Option 1: Boot Ubuntu as a Live CD from a USB Flash Drive

Use this option to install Ubuntu as a Live Install, which allows you to boot from the USB flash drive in Ubuntu, experience the Linux environment but will not retain any changes or settings after you shut down. This is a great way to get a feel for the OS, test some of it's capabilities as well as typical hardware compatibility.

Programs you may need to download:

1. Ubuntu 10.04 Live CD ISO available at ubuntu.com.
2. Universal USB Installer available at pendrivelinux.com.

What you will need:

1. Computer Running Windows XP/Vista/7.
2. Fat32 Formatted USB 2.0 Flash Drive, at least 1GB.
3. PC with a Bios that can boot from USB.

Now with all of the necessary components in place, we can begin to setup our Ubuntu Live USB Drive,

1. Run the Universal USB Installer by Pendrivelinux.com that you downloaded earlier.
2. Choose Ubuntu 9.10/10.04.1 Desktop i386.
3. Select the Ubuntu Live CD that you downloaded earlier.
4. Choose your Flash Drive.
5. In this instance, we are going leave the persistence option unchecked.

This can take anywhere from 15 minutes to 30 minutes depending on the speed of your system. At one point the progress bar will freeze until it is done, and this is the lengthiest wait of the process.

Once complete, you can reboot your computer with the USB flash drive in the USB port, press F12 for the Boot Menu and choose the removable media to boot from and you are in.

As this is a Live USB, any changes you make to the Ubuntu environment will not persist through a reboot. This is because running in this mode, Ubuntu uses available RAM in place of Swap and Hard Disk space. This option also contains the install files needed to install Ubuntu directly to your desktop if you should so desire.


Option 2: Boot Ubuntu as a Live CD with Persistence from a USB Flash Drive

This option will install Ubuntu Linux onto your flash drive with an area for persistent storage. You will be able to restart the computer, boot back into the Linux environment and all settings or changes made previously will persist.

Note: This option is particularly hard on Flash Memory, as there can be quite a bit of reading and writing to the Flash Memory.

What you will need:

1. Computer Running Windows XP/Vista/7.
2. Fat32 Formatted USB 2.0 Flash Drive, at least 2GB.
3. PC with a Bios that can boot from USB.

Now with all of the necessary components in place, we can begin to setup our Ubuntu Live USB Drive,

1. Run the Universal USB Installer by Pendrivelinux.com that you downloaded earlier.
2. Choose Ubuntu 9.10/10.04.1 Desktop i386.
3. Select the Ubuntu Live CD that you downloaded earlier.
4. Choose your Flash Drive.
5. Select the Persistence Option of 1GB Casper-RW.

This can take anywhere from 15 minutes to 30 minutes depending on the speed of your system. At one point the progress bar will freeze until it is done, and this is the lengthiest wait of the process.

Once complete, you can reboot your computer with the USB flash drive in the USB port, press F12 for the Boot Menu and choose the removable media to boot from and you are in.

As this is a Live USB with Persistence, any changes you make to the Ubuntu environment will keep through a reboot. This option also contains the install files needed to install Ubuntu directly to your desktop if you should so desire.


Option 3: Install Ubuntu directly to a USB flash Drive

This option works through installing Ubuntu to the flash drive as a complete installation. It does not retain the installation files to install on another system. This will allow you to use Ubuntu exactly as if it were installed alone on the hard disk. You can boot from it with any computer that can boot from a USB flash drive.

Note: This method requires that you disable your hard drive in BIOS to prevent overwriting your current operating system and force the install onto the USB drive.

What you will need:

1. USB 2.0 Flash Drive, at least 4GB.
2. PC with a BIOS that can boot from USB.
3. Blank CD.
4. A Computer with the ability to Burn CD/DVD.

Now with all of the necessary components in place, we can begin the process,

1. First, you will need to burn your Ubuntu ISO to CD using a program like ImgBurn available atImgBurn.com.
2. Boot your computer and press F2 to enter the system BIOS. Within here you will want to disable your Hard Drive. If this is not an option in your BIOS, I would suggest shutting down your computer and unplugging the power and data cables from your hard drive before proceeding. Note: If you choose not to disable your hard drive, you run the risk of installing Ubuntu on top of your current OS and can lose valuable information.
3. After you have disabled your hard drive, place the Ubuntu Live CD into your computer and boot from this.
4. At the initial boot screen, choose to try Ubuntu, not install.
5. Once Ubuntu loads, plug in the desired flash drive into the computer.
6. Now, double click on the Install Ubuntu icon that appears on the desktop.
7. The first 3 screens are language, time zone, and keyboard layout.
8. Now Ubuntu will notify you that there is a disk mounted, and asks to unmount it. This is your flash drive. Give it permission to unmount.
9. This is the prepare disk space screen. I chose to leave mine at default and let the installer handle the partitions needed by Linux.
10. Now you will see the login and user information screen.
11. Now you are ready to install, click install.
12. At one point during the installation, you may notice a skip button appear on the bottom left. This is to skip the auto update, and finally the language packs. I chose to skip language packs update.
13. This may take a while, mine took atbout 35 minutes to complete. When it is done, eject the disk and shut down the computer. Plug your hard drive back in if necessary, or boot your computer into bios and re-enable it. Reboot your computer and press F12 to enter the boot menu, choose the flash drive and boot into Ubuntu.

Read More

Time-Saving Tricks on the Command Line

I remember the first time a friend of mine introduced me to Linux and showed me how I didn't need to type commands and path names fully—I could just start typing and use the Tab key to complete the rest. That was so cool. I think everybody loves Tab completion because it's something you use pretty much every minute you spend in the shell. Over time, I discovered many more shortcuts and time-saving tricks, many of which I have come to use almost as frequently as Tab completion.
In this article, I highlight a set of tricks for common situations that make a huge difference for me:

• Working in screen sessions: core features that will get you a long way.
• Editing the command line: moving around quickly and editing quickly.
• Viewing files or man pages using less.
• E-mailing yourself relevant log snippets or alerts triggered by events.

While reading the article, it would be best to have a terminal window open so you can try using the tips right away. All the tips should work in Linux, UNIX and similar systems without any configuration.

Working in Screen Sessions

Screen has been covered in Linux Journal before (see Resources), but to put it simply, screen lets you have multiple "windows" within a single terminal application. The best part is that you can detach and reattach to a running screen session at any time, so you can continue your previous work exactly where you left off. This is most useful when working on a remote server.
Luckily, you really don't need to master screen to benefit from it greatly. You already can enjoy its most useful benefits by using just a few key features, namely the following:

• screen -R projectx: reattach to the screen session named "projectx" or create it fresh now.
• Ctrl-a c: create a new window.
• Ctrl-a n: switch to the next window.
• Ctrl-a p: switch to the previous window.
• Ctrl-a 0: switch to the first window; use Ctrl-a 1 for the second window, and so on.
• Ctrl-a w: view the list of windows.
• Ctrl-a d: detach from this screen session.
• screen -ls: view the list of screen sessions.

Note: in the above list, "Ctrl-a c" means pressing the Ctrl and a keys at the same time, followed by c. Ctrl-a is called the command key, and all screen commands start with this key sequence.
Let me show all of these in the context of a realistic example: debugging a Django Web site on my remote hosting server, which usually involves the following activities:

• Editing the configuration file.
• Running some commands (performing Django operations).
• Restarting the Web site.
• Viewing the Web site logs.

Of course, I could do all these things one by one, but it's a lot more practical to have multiple windows open for each. I could use multiple real terminal windows, but reopening them every time I need to do this kind of work would be tedious and slow. Screen can make this much faster and easier.
Starting Screen:
Before you start screen, it's good to navigate to the directory where you expect to do most of your work first. This is because new windows within screen will all start in that directory. In my example, I first navigate to my Django project's directory, so that when I open new screen windows, the relevant files will be right there in front of me.
There are different ways of starting screen, but I recommend this one:

screen -R mysite

When you run this the first time, it creates a screen session named "mysite". Later you can use this same command to reconnect to this session again. (The -R flag stands for reattach.)
Creating Windows:
Now that I'm in screen, let's say I start editing the configuration of the Django Web site:

vim mysite/settings.py

Let's say I made some changes, and now I want to restart the site. I could exit vim or put it in the background in order to run the command to restart the site, but I anticipate I will need to make further changes right here. It's easier just to create a new window now, using the screen command Ctrl-a c.
It's easy to create another window every time you start doing something different from your current activity. This is especially useful when you need to change the directory between commands. For example, if you have script files in /some/long/path/scripts and log files in /other/long/path/logs, then instead of jumping between directories, just keep a separate window for each.
In this example, first I started looking at the configuration files. Next, I wanted to restart the Web site. Then I wanted to run some Django commands, and then I wanted to look at the logs. All these are activities I tend to do many times per debugging session, so it makes sense to create a separate window for each activity.
The cost of creating a new window is so small, you can do it without thinking. Don't interrupt your current activity; fire up another window with Ctrl-a c and rock on.
Switching between Windows:
The windows you create in screen are numbered starting from zero. You can switch to a window by its number—for example, jump to the first window with Ctrl-a 0, the second window with Ctrl-a 1 and so on. It's also very convenient to switch to the next and previous windows with Ctrl-a n and Ctrl-a p, respectively.
Listing Your Windows:
If you're starting to lose track of which window you are in, check the list of windows with Ctrl-a w or Ctrl-a ". The former shows the list of windows in the status line (at the bottom) of the screen, showing the current window marked with a *. The latter shows the list of windows in a more user-friendly format as a menu.
Detaching from and Reattaching to a Session:
The best time-saving feature of screen is reattaching to existing sessions. You can detach cleanly from the current screen session with Ctrl-a d. But you don't really need to. You could just as well simply close the terminal window.
The great thing about screen sessions is that whatever way you disconnected from them, you can reattach later. At the end of the day, you can shut down your local PC without closing a remote screen session and come back to it the next day by running the same command you used to start it, as in this example with screen -R mysite.
You might have multiple screen sessions running for different purposes. You can list them all with:

screen -ls

If you are disconnected from screen abruptly, sometimes it may think you are still in an attached state, which will prevent you from reattaching with the usual command screen -R label. In that case, you can append a -D flag to force detach from any existing connections—for example:

screen -R label -D

Learning More about Screen:
If you want to learn more, see the man page and the links in the Resources section. The built-in cheat sheet of shortcuts also comes handy, and you can view it with Ctrl-a ?.
I also should mention one of screen's competitor: tmux. I chose screen in this article because in my experience, it is more available in systems I cannot control. You can do everything I covered above with tmux as well. Use whichever is available in the remote system in which you find yourself.
Finally, you can get the most out of screen when working on a remote system—for example, over an SSH session. When working locally, it's probably more practical to use a terminal application with tabs. That's not exactly the same thing, but probably close enough.

Editing the Command Line

Many highly practical shortcuts can make you faster and more efficient on the command line in different ways:

• Find and re-run or edit a long and complex command from the history.
• Edit much more quickly than just using the backspace key and retyping text.
• Move around much faster than just using the left- and right-arrow keys.

Finding a Command in the History:
If you want to repeat a command you executed recently, it may be easy enough just to press the up-arrow key a few times until you find it. If the command was more than only a few steps ago though, this becomes unwieldy. Very often, it's much more practical to use the Ctrl-r shortcut instead to find a specific command by a fragment.
To search for a command in the past, press Ctrl-r and start typing any fragment you remember from it. As you type, the most recent matching line will appear on the command line. This is an incremental search, which means you can keep typing or deleting letters, and the matched command will change dynamically.
Let's try this with an example. Say I ran these commands yesterday, which means they are still in my recent history but too far away simply to use the up arrow:

...
cd ~/dev/git/github/bashoneliners/
. ~/virtualenv/bashoneliners/bin/activate
./run.sh pip install --upgrade django
git push beta master:beta
git push release master:release
git status
...

Let's say I want to activate the virtualenv again. That's a hassle to type again, because I have to type at least a few characters at each path segment, even with Tab completion. Instead, it's a lot easier to press Ctrl-r and start typing "activate".
For a slightly more complex example, let's say I want to run a git push command again, but I don't remember exactly which one. So I press Ctrl-r and start typing "push". This will match the most recent command, but I actually want the one before that, and I don't remember a better fragment to type. The solution is to press Ctrl-r again, in the middle of my current search, as that jumps to the next matching command.
This is really extremely useful, saving not only the time of typing, but also often the time of thinking too. Imagine one of those long one-liners where you processed a text file through a long sequence of pipes with sed, awk, Perl and whatnot; or an rsync command with many flags, filters and exclusions; or complex loops using "for" and "while". You can bring those back to your command line quickly using Ctrl-r and some fragment you remember from them.
Here are a few other things to note:

• The search is case-sensitive.
• You can abort the search with Ctrl-c.
• To edit the line before running it, press any of the arrow keys.

This trick can be even more useful if you pick up some new habits. For example, when referring to a path you use often, type the absolute path rather than a relative path. That way, the command will be reusable later from any directory.
Moving Around Quickly and Editing Quickly:
Basic editing on the command line involves moving around with the arrow keys and deleting characters with Backspace or Delete. When there are more than only a few characters to move or delete, using these basic keys is just too slow. You can do the same much faster by knowing just a handful of interesting shortcuts:

• Ctrl-w: cut text backward until space.
• Esc-Backspace: cut one word backward.
• Esc-Delete: cut one word forward.
• Ctrl-k: cut from current position until the end of the line.
• Ctrl-y: paste the most recently cut text.

Not only is it faster to delete portions of a line chunk by chunk like this, but an added bonus is that text deleted this way is saved in a register so that you can paste it later if needed. Take, for example, the following sequence of commands:

git init --bare /path/to/repo.git
git remote add origin /path/to/repo.git

Notice that the second command uses the same path at the end. Instead of typing that path twice, you could copy and paste it from the first command, using this sequence of keystrokes:

1. Press the up arrow to bring back the previous command.
2. Press Ctrl-w to cut the path part: "/path/to/repo.git".
3. Press Ctrl-c to cancel the current command.
4. Type git remote add origin, and press Ctrl-y to paste the path.

Some of the editing shortcuts are more useful in combination with moving shortcuts:

• Ctrl-a: jump to the beginning of the line.
• Ctrl-e: jump to the end of the line.
• Esc-b: jump one word backward.
• Esc-f: jump one word forward.

Jumping to the beginning is very useful if you mistype the first words of a long command. You can jump to the beginning much faster than with the left-arrow key.
Jumping forward and backward is very practical when editing the middle part of a long command, such as the middle of long path segments.

Read More

Linux shell tips and tricks

I’m using Linux shell (Bash) on daily basis, but I often forgot some useful command or shell tip. Yes, I can remember commands, but I can’t say that if I used it just once for specific task. Then I started to write Linux shell tips in text file on my Dropbox account and now I decided to share that. This list will be updated over time. Also keep in mind that for some tips you will need to install additional software on your Linux distribution.
UPDATE: November 25, 2013
Check if remote port is open with bash:

echo >/dev/tcp/8.8.8.8/53 && echo "open"

Suspend process:

Ctrl + z 

Move process to foreground:

fg

Generate random hex number where n is number of characters:

openssl rand -hex n

Execute commands from a file in the current shell:

source /home/user/file.name

Substring for first 5 characters:

${variable:0:5}

SSH debug mode:

ssh -vvv user@ip_address

SSH with pem key:

ssh user@ip_address -i key.pem

Get complete directory listing to local directory with wget:

wget -r --no-parent --reject "index.html*" http://hostname/ -P /home/user/dirs

Create multiple directories:

mkdir -p /home/user/{test,test1,test2}

List processes tree with child processes:

ps axwef

Create war file:

jar -cvf name.war file

Test disk write speed:

dd if=/dev/zero of=/tmp/output.img bs=8k count=256k conv=fdatasync; rm -rf /tmp/output.img

Test disk read speed:

hdparm -Tt /dev/sda

Get md5 hash from text:

echo -n "text" | md5sum

Check xml syntax:

xmllint --noout file.xml

Extract tar.gz in new directory:

tar zxvf package.tar.gz -C new_dir

Get HTTP headers with curl:

curl -I http://www.example.com

Modify timestamp of some file or directory (YYMMDDhhmm):

touch -t 0712250000 file

Download from ftp using wget:

wget -m ftp://username:password@hostname

Generate random password (16 char long in this case):

LANG=c < /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c${1:-16};echo;

Quickly create a backup of a file:

cp some_file_name{,.bkp}

Access Windows share:

smbclient -U "DOMAIN\user" //dc.domain.com/share/test/dir

Run command from history (here at line 100):

!100

Unzip to directory:

unzip package_name.zip -d dir_name

Multiline text (CTRL + d to exit):

cat > test.txt

Create empty file or empty existing one:

> test.txt

Update date from Ubuntu NTP server:

ntpdate ntp.ubuntu.com

netstat show all tcp4 listening ports:

netstat -lnt4 | awk '{print $4}' | cut -f2 -d: | grep -o '[0-9]*'

Convert image from qcow2 to raw:

qemu-img convert -f qcow2 -O raw precise-server-cloudimg-amd64-disk1.img \
                                 precise-server-cloudimg-amd64-disk1.raw

Run command repeatedly, displaying it's output (default every two seconds):

watch ps -ef

List all users:

getent passwd

Mount root in read/write mode:

mount -o remount,rw /

Mount a directory (for cases when symlinking will not work):

mount --bind /source /destination

Send dynamic update to DNS server:

nsupdate < <EOF
update add $HOST 86400 A $IP
send
EOF

Recursively grep all directories:

grep -r "some_text" /path/to/dir

List ten largest open files:

lsof / | awk '{ if($7 > 1048576) print $7/1048576 "MB "$9 }' | sort -n -u | tail

Show free RAM in MB:

free -m | grep cache | awk '/[0-9]/{ print $4" MB" }'

Open Vim and jump to end of file:

vim + some_file_name

Git clone specific branch (master):

git clone git@github.com:name/app.git -b master

Git switch to another branch (develop):

git checkout develop

Git delete branch (myfeature):

git branch -d myfeature

Git delete remote branch:

git push origin :branchName

Git push new branch to remote:

git push -u origin mynewfeature

Print out the last cat command from history:

!cat:p

Run your last cat command from history:

!cat

Find all empty subdirectories in /home/user:

find /home/user -maxdepth 1 -type d -empty

Get all from line 50 to 60 in test.txt:

< test.txt sed -n '50,60p'

Run last command (if it was: mkdir /root/test, below will run: sudo mkdir /root/test):

sudo !!

Create temporary RAM filesystem - ramdisk (first create /tmpram directory):

mount -t tmpfs tmpfs /tmpram -o size=512m

Grep whole words:

grep -w "name" test.txt

Append text to a file that requires raised privileges:

echo "some text" | sudo tee -a /path/file

List all supported kill signals:

kill -l

Generate random password (16 characters long in this case):

openssl rand -base64 16

Do not log last session in bash history:

kill -9 $$

Scan network to find open port:

nmap -p 8081 172.20.0.0/16

Set git email:

git config --global user.email "me@example.com"

To sync with master if you have unpublished commits:

git pull --rebase origin master

Move all files with "txt" in name to /home/user:

find -iname "*txt*" -exec mv -v {} /home/user \;

Put the file lines side by side:

paste test.txt test1.txt

Progress bar in shell:

pv data.log

Send the data to server with netcat:

echo "hosts.sampleHost 10 `date +%s`" | nc 192.168.200.2 3000

Convert tabs to spaces:

expand test.txt > test1.txt

Skip bash history:

< <space>>cmd

Go to the previous working directory:

cd -

Split large tar.gz archive (100MB each) and put it back:

split –b 100m /path/to/large/archive /path/to/output/files
cat files* > archive

Get HTTP status code with curl:

curl -sL -w "%{http_code}\\n" www.example.com -o /dev/null

When Ctrl + c not works:

Ctrl + \

Get file owner:

stat -c %U file.txt

List block devices:

lsblk -f

Find files with trailing spaces:

find . -type f -exec egrep -l " +$" "{}" \;

Find files with tabs indentation:

find . -type f -exec egrep -l $'\t' "{}" \;

Print horizontal line with "=":

printf '%100s\n' | tr ' ' =

Read More

25 Hardening Security Tips for Linux Servers

Everybody says that Linux is secure by default and agreed to some extend (It’s debatable topics). However, Linux has in-built security model in place by default. Need to tune it up and customize as per your need which may help to make more secure system. Linux is harder to manage but offers more flexibility and configuration options.

25 Linux Security and Hardening Tips

Securing a system in a production from the hands of hackers and crackers is a challenging task for a System Administrator. This is our first article related to “How to Secure Linux box” or “Hardening a Linux Box“. In this post We’ll explain 25 useful tips & tricks to secure your Linux system. Hope, below tips & tricks will help you some extend to secure your system.

1. Physical System Security

Configure the BIOS to disable booting from CD/DVD, External Devices, Floppy Drive in BIOS. Next, enable BIOS password & also protect GRUB with password to restrict physical access of your system.

1. Set GRUB Password to Protect Linux Servers

2. Disk Partitions

It’s important to have different partitions to obtain higher data security in case if any disaster happens. By creating different partitions, data can be separated and grouped. When an unexpected accident occurs, only data of that partition will be damaged, while the data on other partitions survived. Make sure you must have following separate partitions and sure that third party applications should be installed on separate file systems under /opt.

/
/boot
/usr
/var
/home
/tmp
/opt

3. Minimize Packages to Minimize Vulnerability

Do you really want all sort of services installed?. It’s recommended to avoid installing useless packages to avoid vulnerabilities in packages. This may minimize risk that compromise of one service may lead to compromise of other services. Find and remove or disable unwanted services from the server to minimize vulnerability. Use the ‘chkconfig‘ command to find out services which are running on runlevel 3.

# /sbin/chkconfig --list |grep '3:on'

Once you’ve find out any unwanted service are running, disable them using the following command.

# chkconfig serviceName off

Use the RPM package manager such as “yum” or “apt-get” tools to list all installed packages on a system and remove them using the following command.

# yum -y remove package-name

# sudo apt-get remove package-name

1. 5 chkconfig Command Examples
2. 20 Practical Examples of RPM Commands
3. 20 Linux YUM Commands for Linux Package Management
4. 25 APT-GET and APT-CACHE Commands to Manage Package Management

4. Check Listening Network Ports

With the help of ‘netstat‘ networking command you can view all open ports and associated programs. As I said above use ‘chkconfig‘ command to disable all unwanted network services from the system.

# netstat -tulpn

1. 20 Netstat Commands for Network Management in Linux

5. Use Secure Shell(SSH)

Telnet and rlogin protocols uses plain text, not encrypted format which is the security breaches. SSH is a secure protocol that use encryption technology during communication with server.
Never login directly as root unless necessary. Use “sudo” to execute commands. sudo are specified in /etc/sudoers file also can be edited with the “visudo” utility which opens in VI editor.
It’s also recommended to change default SSH 22 port number with some other higher level port number. Open the main SSH configuration file and make some following parameters to restrict users to access.

# vi /etc/ssh/sshd_config

Disable root Login

PermitRootLogin no

Only allow Specific Users

AllowUsers username

Use SSH Protocol 2 Version

Protocol 2

1. 5 Best Practices to Secure and Protect SSH Server

6. Keep System updated

Always keep system updated with latest releases patches, security fixes and kernel when it’s available.

# yum updates
# yum check-update

7. Lockdown Cronjobs

Cron has it’s own built in feature, where it allows to specify who may, and who may not want to run jobs. This is controlled by the use of files called /etc/cron.allow and /etc/cron.deny. To lock a user using cron, simply add user names in cron.deny and to allow a user to run cron add in cron.allow file. If you would like to disable all users from using cron, add the ‘ALL‘ line to cron.deny file.

# echo ALL >>/etc/cron.deny

1. 11 Cron Scheduling Examples in Linux

8. Disable USB stick to Detect

Many times it happens that we want to restrict users from using USB stick in systems to protect and secure data from stealing. Create a file ‘/etc/modprobe.d/no-usb‘ and adding below line will not detect USB storage.

install usb-storage /bin/true

9. Turn on SELinux

Security-Enhanced Linux (SELinux) is a compulsory access control security mechanism provided in the kernel. Disabling SELinux means removing security mechanism from the system. Think twice carefully before removing, if your system is attached to internet and accessed by the public, then think some more on it.
SELinux provides three basic modes of operation and they are.

1. Enforcing: This is default mode which enable and enforce the SELinux security policy on the machine.
2. Permissive: In this mode, SELinux will not enforce the security policy on the system, only warn and log actions. This mode is very useful in term of troubleshooting SELinux related issues.
3. Disabled: SELinux is turned off.

You can view current status of SELinux mode from the command line using ‘system-config-selinux‘, ‘getenforce‘ or ‘sestatus‘ commands.

# sestatus

If it is disabled, enable SELinux using the following command.

# setenforce enforcing

It also can be managed from ‘/etc/selinux/config‘ file, where you can enable or disable it.

10. Remove KDE/GNOME Desktops

There is no need to run X Window desktops like KDE or GNOME on your dedicated LAMP server. You can remove or disable them to increase security of server and performance. To disable simple open the file ‘/etc/inittab‘ and set run level to 3. If you wish to remove it completely from the system use the below command.

# yum groupremove "X Window System"

11. Turn Off IPv6

If you’re not using a IPv6 protocol, then you should disable it because most of the applications or policies not required IPv6 protocol and currently it doesn’t required on the server. Go to network configuration file and add followings lines to disable it.

# vi /etc/sysconfig/network

NETWORKING_IPV6=no
IPV6INIT=no

12. Restrict Users to Use Old Passwords

This is very useful if you want to disallow users to use same old passwords. The old password file is located at /etc/security/opasswd. This can be achieved by using PAM module.
Open ‘/etc/pam.d/system-auth‘ file under RHEL / CentOS / Fedora.

# vi /etc/pam.d/system-auth

Open ‘/etc/pam.d/common-password‘ file under Ubuntu/Debian/Linux Mint.

# vi /etc/pam.d/common-password

Add the following line to ‘auth‘ section.

auth        sufficient    pam_unix.so likeauth nullok

Add the following line to ‘password‘ section to disallow a user from re-using last 5 password of his or her.

password   sufficient    pam_unix.so nullok use_authtok md5 shadow remember=5

Only last 5 passwords are remember by server. If you tried to use any of last 5 old passwords, you will get an error like.

Password has been already used. Choose another.

13. How to Check Password Expiration of User

In Linux, user’s passwords are stored in ‘/etc/shadow‘ file in encrypted format. To check password expiration of user’s, you need to use ‘chage‘ command. It displays information of password expiration details along with last password change date. These details are used by system to decide when a user must change his/her password.
To view any existing user’s aging information such as expiry date and time, use the following command.

#chage -l username

To change password aging of any user, use the following command.

#chage -M 60 username
#chage -M 60 -m 7 -W 7 userName

Parameters

1. -M Set maximum number of days
2. -m Set minimum number of days
3. -W Set the number of days of warning

14. Lock and Unlock Account Manually

The lock and unlock features are very useful, instead of removing an account from the system, you can lock it for an week or a month. To lock a specific user, you can use the follow command.

# passwd -l accountName

Note : The locked user is still available for root user only. The locking is performed by replacing encrypted password with an (!) string. If someone trying to access the system using this account, he will get an error similar to below.

# su - accountName
This account is currently not available.

To unlock or enable access to an locked account, use the command as. This will remove (!) string with encrypted password.

# passwd -u accountName

15. Enforcing Stronger Passwords

A number of users use soft or weak passwords and their password might be hacked with a dictionary based or brute-force attacks. The ‘pam_cracklib‘ module is available in PAM (Pluggable Authentication Modules) module stack which will force user to set strong passwords. Open the following file with an editor.
Read Also:

# vi /etc/pam.d/system-auth

And add line using credit parameters as (lcredit, ucredit, dcredit and/or ocredit respectively lower-case, upper-case, digit and other)

/lib/security/$ISA/pam_cracklib.so retry=3 minlen=8 lcredit=-1 ucredit=-2 dcredit=-2 ocredit=-1

16. Enable Iptables (Firewall)

It’s highly recommended to enable Linux firewall to secure unauthorised access of your servers. Apply rules in iptables to filters incoming, outgoing and forwarding packets. We can specify the source and destination address to allow and deny in specific udp/tcp port number.

1. Basic IPTables Guide and Tips

17. Disable Ctrl+Alt+Delete in Inittab

In most Linux distributions, pressing ‘CTRL-ALT-DELETE’ will takes your system to reboot process. So, it’s not a good idea to have this option enabled at least on production servers, if someone by mistakenly does this.
This is defined in ‘/etc/inittab‘ file, if you look closely in that file you will see a line similar to below. By default line is not commented out. We have to comment it out. This particular key sequence signalling will shut-down a system.

# Trap CTRL-ALT-DELETE
#ca::ctrlaltdel:/sbin/shutdown -t3 -r now

18. Checking Accounts for Empty Passwords

Any account having an empty password means its opened for unauthorized access to anyone on the web and it’s a part of security within a Linux server. So, you must make sure all accounts have strong passwords and no one has any authorized access. Empty password accounts are security risks and that can be easily hackable. To check if there were any accounts with empty password, use the following command.

# cat /etc/shadow | awk -F: '($2==""){print $1}'

19. Display SSH Banner Before Login

It’s always a better idea to have an legal banner or security banners with some security warnings before SSH authentication. To set such banners read the following article.

1. Display SSH Warning Message to Users

20. Monitor User Activities

If you are dealing with lots of users, then its important to collect the information of each user activities and processes consumed by them and analyse them at a later time or in case if any kind of performance, security issues. But how we can monitor and collect user activities information.
There are two useful tools called ‘psacct‘ and ‘acct‘ are used for monitoring user activities and processes on a system. These tools runs in a system background and continuously tracks each user activity on a system and resources consumed by services such as Apache, MySQL, SSH, FTP, etc. For more information about installation, configuration and usage, visit the below url.

1. Monitor User Activity with psacct or acct Commands

21. Review Logs Regularly

Move logs in dedicated log server, this may prevents intruders to easily modify local logs. Below are the Common Linux default log files name and their usage:

1. /var/log/message – Where whole system logs or current activity logs are available.
2. /var/log/auth.log – Authentication logs.
3. /var/log/kern.log – Kernel logs.
4. /var/log/cron.log – Crond logs (cron job).
5. /var/log/maillog – Mail server logs.
6. /var/log/boot.log – System boot log.
7. /var/log/mysqld.log – MySQL database server log file.
8. /var/log/secure – Authentication log.
9. /var/log/utmp or /var/log/wtmp : Login records file.
10. /var/log/yum.log: Yum log files.

22. Important file Backup

In a production system, it is necessary to take important files backup and keep them in safety vault, remote site or offsite for Disasters recovery.

23. NIC Bonding

There are two types of mode in NIC bonding, need to mention in bonding interface.

1. mode=0 – Round Robin
2. mode=1 – Active and Backup

NIC Bonding helps us to avoid single point of failure. In NIC bonding, we bond two or more Network Ethernet Cards together and make one single virtual Interface where we can assign IP address to talk with other servers. Our network will be available in case of one NIC Card is down or unavailable due to any reason.
Read Also : Create NIC Channel Bonding in Linux

24. Keep /boot as read-only

Linux kernel and its related files are in /boot directory which is by default as read-write. Changing it to read-only reduces the risk of unauthorized modification of critical boot files. To do this, open “/etc/fstab” file.

# vi /etc/fstab

Add the following line at the bottom, save and close it.

LABEL=/boot     /boot     ext2     defaults,ro     1 2

Please note that you need to reset the change to read-write if you need to upgrade the kernel in future.

25. Ignore ICMP or Broadcast Request

Add following line in “/etc/sysctl.conf” file to ignore ping or broadcast request.

Ignore ICMP request:
net.ipv4.icmp_echo_ignore_all = 1

Ignore Broadcast request:
net.ipv4.icmp_echo_ignore_broadcasts = 1

Load new settings or changes, by running following command

#sysctl -p

If you’ve missed any important security or hardening tip in the above list, or you’ve any other tip that needs to be included in the list. Please drop your comments in our comment box. TecMint is always interested in receiving comments, suggestions as well as discussion for improvement.

Read More

13 Basic Cat Command Examples in Linux

The cat (short for “concatenate“) command is one of the most frequently used command in Linux/Unix like operating systems. cat command allows us to create single or multiple files, view contain of file, concatenate files and redirect output in terminal or files. In this article, we are going to find out handy use of cat commands with their examples in Linux.

13 Basic Linux Cat Commands

General Syntax

cat [OPTION] [FILE]...

1. Display Contains of File

In the below example, it will show contains of /etc/passwd file.

# cat /etc/passwd

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
narad:x:500:500::/home/narad:/bin/bash

2. View Contains of Multiple Files in terminal

In below example, it will display contains of test and test1 file in terminal.

# cat test test1

Hello everybody
Hi world,

3. Create a File with Cat Command

We will create a file called test2 file with below command.

# cat >test2

Awaits input from user, type desired text and press CTRL+D (hold down Ctrl Key and type ‘d‘) to exit. The text will be written in test2 file. You can see contains of file with following cat command.

# cat test2

hello everyone, how do you do?

4. Use Cat Command with More & Less Options

If file having large number of contains that won’t fit in output terminal and screen scrolls up very fast, we can use parameters more and less with cat command as show above.

# cat song.txt | more
# cat song.txt | less

5. Display Line Numbers in File

With -n option you could see the line numbers of a file song.txt in the output terminal.

# cat -n song.txt

1  "Heal The World"
2  There's A Place In
3  Your Heart
4  And I Know That It Is Love
5  And This Place Could
6  Be Much
7  Brighter Than Tomorrow
8  And If You Really Try
9  You'll Find There's No Need
10  To Cry
11  In This Place You'll Feel
12  There's No Hurt Or Sorrow

6. Display $ at the End of File

In the below, you can see with -e option that ‘$‘ is shows at the end of line and also in space showing ‘$‘ if there is any gap between paragraphs. This options is useful to squeeze multiple lines in a single line.

# cat -e test

hello everyone, how do you do?$
$
Hey, am fine.$
How's your training going on?$
$

7. Display Tab separated Lines in File

In the below output, we could see TAB space is filled up with ‘^I‘ character.

# cat -T test

hello ^Ieveryone, how do you do?

Hey, ^Iam fine.
^I^IHow's your training ^Igoing on?
Let's do ^Isome practice in Linux.

8. Display Multiple Files at Once

In the below example we have three files test, test1 and test2 and able to view the contains of those file as shown above. We need to separate each file with ; (semi colon).

# cat test; cat test1; cat test2

This is test file
This is test1 file.
This is test2 file.

9. Use Standard Output with Redirection Operator

We can redirect standard output of a file into a new file else existing file with ‘>‘ (greater than) symbol. Careful, existing contains of test1 will be overwritten by contains of test file.

# cat test > test1

10. Appending Standard Output with Redirection Operator

Appends in existing file with ‘>>‘ (double greater than) symbol. Here, contains of test file will be appended at the end of test1 file.

# cat test >> test1

11. Redirecting Standard Input with Redirection Operator

When you use the redirect with standard input ‘<‘ (less than symbol), it use file name test2 as a input for a command and output will be shown in a terminal.

# cat < test2

This is test2 file.

12. Redirecting Multiple Files Contain in a Single File

This will create a file called test3 and all output will be redirected in a newly created file.

# cat test test1 test2 > test3

13. Sorting Contains of Multiple Files in a Single File

This will create a file test4 and output of cat command is piped to sort and result will be redirected in a newly created file.

# cat test test1 test2 test3 | sort > test4

This article shows the basic commands that may help you to explore cat command. You may refer man page of cat command if you want to know more options. In out next article we will cover more advanced cat commands. Please share it if you find this article useful through our comment box below.

Read More