Discuss

discuss@lists.centos.org

34758 discussions

Quick demo guide for SPA ( re: the port knocking thread )
by MrKiwi 19 Feb '07

19 Feb '07

For what it's worth to those who want to play with SPA, here is a demo i whipped up. It is very easy to set up, and i almost guarantee anyone can get this running. What we will demonstrate: Bascially: An SPA demo. Requirements: Very little - a minimal setup of centos. This setup will demonstrate a client who initially cannot connect to a an ssh port on the server (the server is DROPing packets and appears to not be running sshd). After a successful encrypted SPA (Single Packet Authorization) packet is sent to the server, in which a shared key and usercode is required, the ssh port is opened for the client IP only, and the client can then continue to connect with the normally required ssh credentials. After a timeout, the port is CLOSED to all traffic from the client IP, however firewall ESTABLISHED and RELATED rules will allow the connected client to continue to communicate. Setup Details; Server; Almost any kind of CentOS, but i use CentOS 4.4 installed on a VM (vmware workstation build 36983) SELinux Disabled Firewall enabled, no services allowed. "Minimal" installation performed. IP=10.1.1.155 Client; Almost any *nix, but i have used CentOS 4.4 installed on a VM (vmware workstation build 36983) SELinux Disabled Firewall enabled, no services allowed. "Minimal" installation performed. IP=10.1.1.8 =================== Setup the server Optional : Update the server; #yum -y update #reboot Install fwknop #cd /tmp #wget http://www.cipherdyne.org/fwknop/download/fwknop-1.0.1-1.i386.rpm #rpm -i fwknop-1.0.1-1.i386.rpm Backup fwknop's access.conf file and make our own. #mv /etc/fwknop/access.conf /etc/fwknop/access.conf.orig #access=/etc/fwknop/access.conf #echo "SOURCE: ANY;">>$access #echo "OPEN_PORTS:tcp/22;">>$access #echo "DATA_COLLECT_MODE: ULOG_PCAP;">>$access #echo "KEY: pkpassword;">>$access #echo "FW_ACCESS_TIMEOUT: 30;">>$access #echo "REQUIRE_USERNAME: mbr;">>$access Note ... the usercode and password we need to tell the client is; usercode:mbr , password:pkpassword Change the firewall (by default in a CentOS build it REJECTS everything. We want it to DROP instead, so that no-one knows if sshd is running or not) (this step is optional) #service iptables stop #joe /etc/sysconfig/iptables change -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited to -A RH-Firewall-1-INPUT -j DROP Restart the firewall #service iptables start Start fwknopd --debug Leave this debug window open, and you will see the rules that fwknop adds to the firewall. Setup the Client; Install fwknop (the same package contains server and client tools) #cd /tmp #wget http://www.cipherdyne.org/fwknop/download/fwknop-1.0.1-1.i386.rpm #rpm -i fwknop-1.0.1-1.i386.rpm Proof : Try to connect to server on port 22 #nc -v 10.1.1.155 nc will apear to hang waiting for a response. -> no response. (unless you skipped the step above for changing the firewall rules, in which case i think you get a 'no route to host' message) Now knock to open the port, using the usercode and password as above; (password will be prompted for ) #fwknop -A tcp/22 -k 10.1.1.155 --Spoof-user mbr -a 10.1.1.8 -A is the port to send the SPA packet to -k is the server to send to --Spoof-user is because we are not mbr (i am root) we wouldnt need this if we were logged on as 'mbr' -a 10.1.1.8 is because i am on a NATed subnet, and without it fwknop will resolve my IP to a public one, and then tell the server to open port 22 to that public IP, which wont help me. You have 30 seconds to try to connect now ... #nc -v 10.1.1.155 22 pc-00155.xx_hidden_xx.org [10.1.1.155] 22 (ssh) open SSH-1.99-OpenSSH_3.9p1 Ctrl-c to kill this. So we have proved that port 22 has been opened by our knock. Watching the servers debug output as mentioned above will show you the exact rule which was added to iptables to achieve this. If you have exceeded your 30 sec, just run the knock again; #fwknop -A tcp/22 -k 10.1.1.155 --Spoof-user mbr -a 10.1.1.8 and then try to connect; #ssh root(a)10.1.1.155 If you are quick enough you can run #service iptables status|grep 10.1.1.8 ACCEPT tcp -- 10.1.1.8 0.0.0.0/0 tcp dpt:22 This shows you the rule which let you in. Note that port 22 is open to *YOUR IP* only. About 30 sec later you will see; # service iptables status|grep 10.1.1.8 # [no output] This shows you that the open port has been closed. Notes: If you get a message like 'remote time stamp is older than 120 second max age.' then you have a clock sync problem. (common when using vmware) Notes: If you have trouble with clock drift and you dont want to be bothered fixing it, you can make fwknop less sensitive; joe /etc/fwknop/fwknop.conf change MAX_SPA_PACKET_AGE 120; to MAX_SPA_PACKET_AGE 1200; or similar (20 minute window) Thanks to Michael Rash for his great pdf (http://www.usenix.org/publications/login/2006-02/pdfs/rash.pdf) which i blatently ripped content from for the good of the world.

1 0

Defending againts simultanious attacks
by Mohd Syakir 18 Feb '07

18 Feb '07

Hi, i have one centos 4.3 box, exposed to the internet. since several weeks ago, i found numerous attemps to connect through SSH, but failed. they tried with many username, including root. it's comes from different IP. some of them are foreign website. How do i make my centos become smarter in handling this kind of attacks. eventhough i've disable all the user accounts, left only the admin accounts. making the password so hard, longer and combining alphabet, numbers and characters... yet i dont want the attackers keep on trying. any suggestions? thanks in advance.

16 25

CentOS (2.6.9-42.0.8.ELsmp) and CentOS (2.6.9-42.0.8.EL)
by Gregory P. Ennis 18 Feb '07

18 Feb '07

List, I am experimenting with a Dual processor Supermicro and plan to use CentOS 5 when it is released. In the meantime I have installed Centos 4.4. Sorry for asking such a basic question but what is the difference between CentOS (2.6.9-42.0.8.ELsmp) and CentOS (2.6.9-42.0.8.EL) Both kernels have been installed, but I have not been able to find which one is best to use for what purposes. Thanks, Greg Ennis

7 7

A full detailed add user script
by Dwi Suharto 18 Feb '07

18 Feb '07

Anyone here have any sample script, using BASH, for adding user. The script can define: - home directory - quota - create public_html folder - update shadow password (in replace to manually using passwd particularly to related user) Thank you. Dwi Suharto Rumahweb's TSO http://www.rumahweb.com

2 1

How can I batch print html pages
by Theo Band 18 Feb '07

18 Feb '07

I thought this was easy, but it turns out to be not so obvious. My problem: I have a database with hour registration. I need to print out about hundreds of pages and have them signed by employees. Of course I want to do this automatically. Up to now I have a collection of html pages (got them using wget). So the final thing I want is to print them all out in one go. How to do that? I search for a command-line option to convert the html to pdf. Or have firefox/konqueror print them directly without user intervention (there is not a switch like "firefox --print <url>"). Note that the pages are off-line, not on the server. The original pages can only retrieved with after authorization. That's why I used wget with a saved session cookie. Anyone got an simple solution? Thanks, Theo

7 11

Starting samba configuration
by Chris Moloney 18 Feb '07

18 Feb '07

After installing samba, "rpm -q" shows me I have samba, samba-common, samba-client and samba-swat installed. However, putting http://localhost:901 in the browser brings up an error that the URL cannot be found. Not sure where to go from here. Appreciate advice Thanks Send instant messages to your online friends http://au.messenger.yahoo.com

4 3

Fwd: Re: Fwd: [CentOS] HOW to enable traceroute with IPTABLES
by Robert Spangler 18 Feb '07

18 Feb '07

Neil, Doesn't look like my original message made it to the mailing list so here you are. ---------- Forwarded Message ---------- Subject: Re: Fwd: [CentOS] HOW to enable traceroute with IPTABLES Date: Sat February 17 2007 10:07 From: Robert Spangler <lazydog(a)zoominternet.net> To: CentOS mailing list <centos(a)centos.org> On Sat February 17 2007 03:11, Indunil Jayasooriya wrote: > > I am setting up a firewall on CENTOS 4.4. > > > > > > I have enabled ICMP to www.google.com > > > > iptables -A OUTPUT -p icmp -d 64.233.189.104 -j ACCEPT > > iptables -A INPUT -p icmp -s 64.233.189.104 -j ACCEPT > > traceroute uses by default UDP with port 33434. While this is true for a starting point, this is not the whole story. Traceroute starts on this port but every time it sends out a packet the port number is increased automatically. Why? Simple, the TTL is exceeded so traceroute sends out on the next port in numerical order. Thus traceroute needs more then 33434 open there should be a range of ports open. Traceroute does not always start on this port either I have found out. Sometimes it starts on a hight port but only by a few hopes. > I wrote below 2 rules > > iptables -A OUTPUT -p udp -d 64.233.189.104 --dport 33434 -j ACCEPT > iptables -A INPUT -p udp -s 64.233.189.104 --sport 33434 -j ACCEPT I have the following ( I do not restrict traceroute destination); -A OUTPUT -o eth0 -p udp --dport 33200:33500 -m state --state NEW -j ACCEPT Also you don't need the INPUT statement if you have ESTABLISHED,RELATED at the top of your INPUT chain. > Then I tried as below [snip] > But Still the same. > > WHY? I placing my money on the port settings > IF my rules are wrong can you rectify it ? See above. -- Regards Robert Smile... it increases your face value! ------------------------------------------------------- -- Regards Robert Smile... it increases your face value!

1 0

Problem with Postgresql
by Matthew Martz 17 Feb '07

17 Feb '07

I know I am probably missing something easy here but I just installed postgresql-7.4.16-1.RHEL4.1 and there is no init script for postgresql. I know in CentOS 3 it was rhdb. Any help is appreciated. Thanks! -- Matthew Martz CentOS Mirror Admin mdmartz(a)gflug.net

4 5

Re: [CentOS] Re: %include command in Kickstart
by Al Sparks 17 Feb '07

17 Feb '07

On 2/16/07, Al Sparks <data345(a)yahoo.com> wrote: >> Al Sparks spake the following on 2/15/2007 6:33 PM: >>>> Al Sparks spake the following on 2/15/2007 4:44 PM: >>>>>> One of the images (in Nahant) is to boot off the CD and install >>>>>> from the network. >>>>>> >>>>>> That should work BUT I've only used it to get the entire ks file >>>>>> off the LAN. Booting from a CD is quick and easy (provided you >>>>>> have a CD drive as in this instance). >>>>>> >>>>>> Probably the %include will work fairly easily if the original ks file's >>>>>> obtained via NFS; otherwise I suspect you'll need to do the mount; >>>>>> in %pre >>>>> How would I access the whole ks.cfg file on an nfs w/o dhcp? >>>>> >>>>> That would be ideal. >>>>> === Al >>>>> >>>>> >>>>> >>>> Assign an ip address during the boot process, and have everything >>>> referenced by ip address, instead of names. >>> >>> At the boot prompt, I did the following: >>> >>> linux ksdevice=eth0 ip=10.254.254.125 >>> netmask=255.255.255.0 gateway=10.254.254.1 >>> dns=10.1.1.21 ks=nfs:10.254.242.33:/vol/updts/staging/CentOS_4.3/ks.cfg >>> >>> I get a blue screen with >>> "Welcome to CentOS-4 i386" >>> in the left upper corner, with the typical navigation key >>> instructions at the bottom. It just hangs there. >>> >>> I ping the IP address above, and get no pongs. >>> >>> Suggestions? >>> === Al >>> >>> >>> >> Dont you also need a >> method=nfs:nfs:10.254.242.33:/vol/updts/staging/CentOS_4.3/ for >> anaconda to get loaded? >> Just a guess as I haven't done any kickstart installs, so no >> flames if I'm talking out of my you know what! > > I'm coming to the conclusion that RH, and by extension, CentOS > just won't allow you to use a kickstart file over the network w/o > DHCP. > > I can and have used NFS as long as I place the kickstart file on > the CD itself. > > That's a pain. > > First look at the debugging screens ALT-F3-> ALT-F6. Is the installer > complaining. We mostly use kickstarts via HTTP so I havent tried NFS > in a long while. The ALT-F2 keys didn't seem to work, and it hung up the install, though I'm willing to try alternative suggestions. CTL-ALT-F2 does get me a shell prompt, if I do it during a pause. What I've finally done is set up a vfat partition on the on the server itself. That way, when I do a clearpart --linux in the ks.cfg it doesn't bother that vfat. Leaving the ks.cfg on there allows me to try different kickstart configurations with that server w/o having to make coasters each time. Once I find kickstarts I like, I don't mind placing them on a CD. Thanks for the help. Even though I didn't accomplish what I was originally looking for, I learned a lot trying everyone's suggestions. === Al

2 1

beta 2
by Jerry Geis 17 Feb '07

17 Feb '07

Hi gang, Was wondering how the beta 2 was going? Last I heard was end a january? Is there a new "projected" date? I did see the RHEL5 beta 2 was actually available for download without a subscription. Thanks, looking forward to playing with CENTOS 5 beta 2. Jerry

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss