Encrypt DNS Traffic With DNSCrypt

This tutorial describes how to install and set up DNSCrypt on Debian based systems, like Linux Mint, Ubuntu etc.

DNSCrypt Proxy – is a tool for securing communications between a client and a DNS resolver.

It encrypts DNS requests using the DNSCrypt Protocol and pass them to an upstream server, by default OpenDNS.

Resolving dependencies

Install the packages necessary to compile DNSCrypt.

$ sudo apt-get install build-essential

Download and extract the latest libsodium library:

$ wget http://download.libsodium.org/libsodium/releases/libsodium-0.4.2.tar.gz  -O - | tar -xz

Install the library:

$ cd libsodium-0.4.2/
$ ./configure && make
$ sudo make install
$ sudo ldconfig
$ cd ..
$ rm -rf libsodium*

DNSCrypt Proxy Installation

Download and extract the latest DNSCrypt Proxy:

$ wget http://download.dnscrypt.org/dnscrypt-proxy/dnscrypt-proxy-1.3.3.tar.gz  -O - | tar -xz

Install the DNSCrypt Proxy:

$ cd dnscrypt-proxy-1.3.3/
$ ./configure  && make
$ sudo make install
$ cd ..
$ rm -rf dnscrypt-proxy*

Run the following command to start DNSCrypt:

$ sudo /usr/local/sbin/dnscrypt-proxy --daemonize --pidfile=/run/dnscrypt-proxy.pid --edns-payload-size=4096

Reconfigure Network Manager to use DNSCrypt:

  • Open Network Connections from the menu.
  • On the Wired or Wireless tab highlight your active Internet connection.
  • Click “Edit”.
  • On the IPv4 Settings tab, set Method to “Automatic (DHCP) addresses only” and set DNS servers to “127.0.0.1”.
  • Click “Save”.
  • Click “Close”.

Restart Network Manager:

$ sudo restart network-manager

Final Test

Visit http://www.opendns.com/welcome page to test your connection.

You should be welcomed to OpenDNS.

Run DNSCrypt Proxy at System Startup

Once everything works as expected, it is necessary to include dnscrypt-proxy to our rc.local to run automatically whenever the system boots.

To do this open the /etc/rc.local file:

$ sudo vi /etc/rc.local

Paste the following line before the line where exit 0 appears.

exec /usr/local/sbin/dnscrypt-proxy --daemonize --pidfile=/run/dnscrypt-proxy.pid --edns-payload-size=4096

More info about DNSCrypt

CISCO: [No] Shutdown Command – Enable/Disable Interface

Below you will find the examples of how to bring up and down an interface on a CISCO switch or router.

On the CISCO command-line interface, there is the shutdown interface configuration command to disable an interface and the no shutdown command to enable it.

I will show the examples of these commands, as well as how to check an interface status using the show interfaces status command. (more…)

Postfix: Gmail as Relay – Linux Mint/Ubuntu/Debian

Many ISPs block sending email over port 25. This means that you won’t be able to send mail directly from your Linux server.

A good way to get around this limitation is to set up a relay through a Gmail account.

1. Install the Required Packages

Execute the following command to install required packages:

$ sudo apt-get install mailutils

During the installation, a popup box may display. If it does, select your server as Internet Site and for FQDN use something like domain.tld

2. Configure Postfix to use Gmail as Relay

Edit the Postfix configuration file:

$ sudo vi /etc/postfix/main.cf

Add the following lines:

# Relaying Postfix SMTP via GMAIL
relayhost = [smtp.gmail.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_CAfile = /etc/postfix/cacert.pem
smtp_use_tls = yes

3. Setup Gmail Credentials

Open (create) the file sasl_passwd:

$ sudo vi /etc/postfix/sasl_passwd

Add the following line (set your Gmail username and password):

[smtp.gmail.com]:587    USERNAME@gmail.com:PASSWORD

Set the permissions and tell Postfix to use the sasl_passwd file:

$ sudo chmod 400 /etc/postfix/sasl_passwd
$ sudo postmap /etc/postfix/sasl_passwd

4. Validate the Certificate

Add the certificate to Postfix, as follows:

$ cat /etc/ssl/certs/Thawte_Premium_Server_CA.pem | sudo tee -a /etc/postfix/cacert.pem

5. Test Postfix with Gmail SMTP Realy

Restart Postfix to apply all changes.

$ sudo service postfix restart

Try to send an email.

$ echo "Hello World" | mail -s "Test Message" you@example.com

Check the mail log:

$ tail /var/log/mail.log

If all goes well, you should not see any errors.

Once configured, all emails from your server will be sent via Gmail.

The Gmail’s SMTP Server has a limit of 500 emails per day. So use it wisely!

HowTo: Find Out Top Processes By Memory Usage In Linux

It is quite a common situation when your server is out of memory and you want to check what processes are using all the RAM and swap.

In this small note you’ll find two similar commands that can find out and sort top processes by memory usage on your Linux system.

I’ve successfully used these commands on: Linux Mint, Ubuntu, Debian, CentOS, RHEL.

Use any of the following commands to display top 10 processes (including child processes) that use the most memory on your Linux machine.

Show What Processes Are Using All The RAM in Linux

Use the following command to find out top processed sorted by memory usage, in megabytes (MB):

ps axo rss,comm,pid \
| awk '{ proc_list[$2]++; proc_list[$2 "," 1] += $1; } \
END { for (proc in proc_list) { printf("%d\t%s\n", \
proc_list[proc "," 1],proc); }}' | sort -n | tail -n 10 | sort -rn \
| awk '{$1/=1024;printf "%.0fMB\t",$1}{print $2}'

Example: Just copy/paste the above command to your terminal and press ENTER to display top 10 processes, sorted by memory usage. You should get the similar output:

admin@phantom ~ $ ps axo rss,comm,pid \
| awk '{ proc_list[$2]++; proc_list[$2 "," 1] += $1; } \
END { for (proc in proc_list) { printf("%d\t%s\n", \
proc_list[proc "," 1],proc); }}' | sort -n | tail -n 10 | sort -rn \
| awk '{$1/=1024;printf "%.0fMB\t",$1}{print $2}'

1047MB	firefox
648MB	VirtualBox
177MB	thunderbird
119MB	Xorg
82MB	python
82MB	remmina
60MB	pidgin.orig
48MB	caja
47MB	apache2
33MB	puppet

Display Processes Sorted By Memory Usage in Linux

Use the following command to display processes that are using all the memory, in megabytes (MB):

ps axo rss,comm,pid \
| awk '{ proc_list[$2] += $1; } END \
{ for (proc in proc_list) { printf("%d\t%s\n", proc_list[proc],proc); }}' \
| sort -n | tail -n 10 | sort -rn \
| awk '{$1/=1024;printf "%.0fMB\t",$1}{print $2}'

Example: Just copy/paste the above command to your terminal and press ENTER to check what processes are using all the RAM and swap. You should get the similar output:

admin@phantom ~ $ ps axo rss,comm,pid \
| awk '{ proc_list[$2] += $1; } END \
{ for (proc in proc_list) { printf("%d\t%s\n", proc_list[proc],proc); }}' \
| sort -n | tail -n 10 | sort -rn \
| awk '{$1/=1024;printf "%.0fMB\t",$1}{print $2}'

1022MB	firefox
648MB	VirtualBox
177MB	thunderbird
119MB	Xorg
82MB	python
82MB	remmina
60MB	pidgin.orig
48MB	caja
47MB	apache2
33MB	puppet

HowTo: Extract Archives [tar|gz|bz2|rar|zip|7z|tbz2|tgz|Z]

A small note about how to unpack and uncompress the most popular types of archives from the Linux command line.

Unpack [tar|tar.gz|tgz|tar.bz2|tbz2] Files in Linux

Use the following commands to extract TAR archives compressed with GZIP and BZIP2:

$ tar xvf file.tar
$ tar xvzf file.tar.gz
$ tar xvzf file.tar.tgz
$ tar xvjf file.tar.bz2
$ tar xvjf file.tar.tbz2

Uncompress [zip|rar|bz2|gz|Z|7z] Files in Linux

Use the following commands to uncompress archives or files, compressed with ZIP, GUNZIP, RAR, BUNZIP2, COMPRESS and 7Z programs:

$ unzip file.zip
$ gunzip file.gz
$ unrar x file.rar
$ bunzip2 file.bz2
$ uncompress file.Z
$ 7z x file.7z

Extract Archives with Shell Function

You can create a bash shell function as follows (add to your ~/.bashrc):

function extract {
 if [ -z "$1" ]; then
    # display usage if no parameters given
    echo "Usage: extract ."
 else
if [ -f $1 ] ; then
        # NAME=${1%.*}
        # mkdir $NAME && cd $NAME
        case $1 in
          *.tar.bz2) tar xvjf ../$1 ;;
          *.tar.gz) tar xvzf ../$1 ;;
          *.tar.xz) tar xvJf ../$1 ;;
          *.lzma) unlzma ../$1 ;;
          *.bz2) bunzip2 ../$1 ;;
          *.rar) unrar x -ad ../$1 ;;
          *.gz) gunzip ../$1 ;;
          *.tar) tar xvf ../$1 ;;
          *.tbz2) tar xvjf ../$1 ;;
          *.tgz) tar xvzf ../$1 ;;
          *.zip) unzip ../$1 ;;
          *.Z) uncompress ../$1 ;;
          *.7z) 7z x ../$1 ;;
          *.xz) unxz ../$1 ;;
          *.exe) cabextract ../$1 ;;
          *) echo "extract: '$1' - unknown archive method" ;;
        esac
else
echo "$1 - file does not exist"
    fi
fi
}

Source: https://github.com/xvoland/Extract

Reload .bashrc file.

$ . ~/.bashrc

Now use extract command for unpacking and uncompressing the most popular archive types:

$ extract file.rar
$ extract file.tar.gz2
$ extract file.7z

CASE Statement in Bash [Example]

The following article describes the basic syntax and includes a simple example of the BASH CASE statement usage.

The CASE statement is the simplest form of the IF-THEN-ELSE statement in BASH.

You may use the CASE statement if you need the IF-THEN-ELSE statement with many ELIF elements.

With the BASH CASE statement you take some value once and then test it multiple times.

Basic Syntax of the CASE Statement

case $variable in
     pattern-1)      
          commands
          ;;
     pattern-2)      
          commands
          ;;
     pattern-3|pattern-4|pattern-5)
          commands
          ;; 
     pattern-N)
          commands
          ;;
     *)
          commands
          ;;
esac

Example of a BASH Script with the CASE Statement

#!/bin/bash
printf 'Which Linux distribution do you know? '
read DISTR

case $DISTR in
     ubuntu)
          echo "I know it! It is an operating system based on Debian."
          ;;
     centos|rhel)
          echo "Hey! It is my favorite Server OS!"
          ;;
     windows)
          echo "Very funny..."
          ;; 
     *)
          echo "Hmm, seems i've never used it."
          ;;
esac

Run the script as follows:

$ ./testcase.sh
Which Linux distribution do you know? centos
Hey! It is my favorite Server OS!
$ ./testcase.sh
Which Linux distribution do you know? rhel
Hey! It is my favorite Server OS!
$ ./testcase.sh
Which Linux distribution do you know? ubuntu
I know it too! It is an operating system based on Debian.
$ ./testcase.sh
Which Linux distribution do you know? pfff
Hmm, seems i've never used it.

OpenSSL: Check SSL Certificate Expiration Date and More

From this article you will learn how to connect to a website over HTTPS and check its SSL certificate expiration date from the Linux command-line.

Besides of validity dates, i’ll show how to view who has issued an SSL certificate, whom is it issued to, its SHA1 fingerprint and the other useful information.

Linux users can easily check an SSL certificate from the Linux command-line, using the openssl utility, that can connect to a remote website over HTTPS, decode an SSL certificate and retrieve the all required data. (more…)

AWK: Print Column – Change Field Separator – Linux Bash

The awk is a powerful Linux command line tool, that can process the input data as columns.

In the following note i will show how to print columns by numbers – first, second, last, multiple columns etc.

I will show how to change the default field separator in awk.

At the end of this article i will also show how to print or exclude specific columns or even ranges of columns using awk. (more…)

Setting Up DNS Records — [CNAME] Record (canonical name record)

What is a [CNAME] Record?

A [CNAME] Record or a Canonical Name Record, specifies that the domain name or subdomain is an alias of another, canonical domain name.

The value of a CNAME record is always a domain name.

What does the [CNAME] Record serve for?

[CNAME] Records are useful because they allow you to set up an alias to a server without using its IP address.

For example, www.example.com can have a [CNAME] Record pointing to example.com.

This way when you type in your browser www.example.com, you are actually redirected to CNAMEexample.com.

How to check a [CNAME] Record?

Use the dig command, to check [CNAME] Record:

$ dig CNAME www.example.com +short
example.com.

Adding [CNAME] Record to DNS — Examples

Use the following syntax to add a [CNAME] Record to a Zone File.

Create an Alias for [WWW] with [CNAME] Record

www.example.com. IN CNAME example.com.

Create Multiply Aliases with [CNAME] Records

example.com. IN CNAME example.tld.
www.example.com. IN CNAME example.tld.
test.example.com. IN CNAME example.tld.

Setting Up DNS Records — [A] Record (address record)

What is an [A] Record?

An [A] Record or an Address Record, assigns an IP address to a domain or subdomain name.

The value of an A record is always an IP address.

How to check an [A] Record?

Use the dig command, to check which IP address is assigned to the domain name.

$ dig A centos.org +short
72.232.194.162
$ dig A wiki.centos.org +short
72.232.194.162

Adding [A] Record to DNS — Examples

Use the following syntax to add an [A] Record to a Zone File.

[A] Record for Domain

The following example indicates that the IP Address for the domain example.com is 192.168.0.100:

example.com. IN A 192.168.0.100

[A] Record for SubDomain

The following example indicates that the IP Address for the subdomain www.example.com is 192.168.0.100:

www.example.com. IN A 192.168.0.100

Wildcard [A] Record

The following example indicates that the IP Address for any subdomain of the domain example.com is 192.168.0.100:

*.example.com. IN A 192.168.0.100