HowTo: Change Speed and Duplex of Ethernet card in Linux

Posted on by admin

To change Speed and Duplex of an ethernet card, we can use ethtool – a Linux utility for Displaying or Changing ethernet card settings.

1. Install ethtool

You can install ethtool by typing one of the following commands, depending upon your Linux distribution.

Install ethtool in Fedora, CentOS, RHEL etc.:

# yum install ethtool

Install ethtool in Ubuntu, Debian etc.:

# sudo apt-get install ethtool

2. Get the Speed, Duplex and other information for the interface eth0

To get speed, duplex and other information for the network interface eth0, type the following command as root.

# ethtool eth0

Sample output:

Settings for eth0:
	Supported ports: [ MII ]
	Supported link modes:   10baseT/Half 10baseT/Full 
	                        100baseT/Half 100baseT/Full 
	                        1000baseT/Half 1000baseT/Full 
	Supports auto-negotiation: Yes
	Advertised link modes:  10baseT/Half 10baseT/Full 
	                        100baseT/Half 100baseT/Full 
	                        1000baseT/Half 1000baseT/Full 
	Advertised auto-negotiation: Yes
	Speed: 100Mb/s
	Duplex: Half
	Port: Twisted Pair
	PHYAD: 1
	Transceiver: internal
	Auto-negotiation: on
	Supports Wake-on: g
	Wake-on: d
	Current message level: 0x000000ff (255)
	Link detected: yes

3. Change the Speed and Duplex settings

The following changes are temporary and they’ll stop working after reboot. Read the next section, to make settings permanent.

The next command enables Auto-Negotiate feature:

# ethtool -s eth0 autoneg on

The next command disables Auto-Negotiation, enables Half Duplex and sets up Speed to 10 Mb/s:

# ethtool -s eth0 speed 10 duplex half autoneg off

The next command disables Auto-Negotiation, enables Full Duplex and sets up Speed to 100 Mb/s:

# ethtool -s eth0 speed 100 duplex full autoneg off

4. Change the Speed and Duplex settings Permanently on CentOS/RHEL

To make settings permanent, you need to edit /etc/sysconfig/network-scripts/ifcfg-eth0 file for eth0 interface. This file is used by RHEL, CentOS, Fedora etc.

# vi /etc/sysconfig/network-scripts/ifcfg-eth0

Append the line as follows to disable Auto-Negotiation, enable Full Duplex and set up Speed to 100 Mb/s:

ETHTOOL_OPTS="speed 100 duplex full autoneg off"

Restart the interface to apply changes:

# ifdown eth0 && ifup eth0
7 Comments

Detecting FTP Brute Force Attack

Posted on by admin

Here are some simple commands that may help to detect attempts to hack your FTP server with a brute-force “password guessing” attack.

1. Count the number of running FTP processes.

This number may be much higher than usual during brute-force attack.

$ ps -ef | grep -i ftp | grep -v grep -c

2. Check, in real time, if brute-force attempts persist.

$ tail -f /var/log/vsftpd.log | grep -i "FAIL LOGIN"

NOTE: The next parameters may be different, depending on your system:

  • /var/log/vsftpd.log – path to FTP logs;
  • FAIL LOGIN – message that detects an attempt to log into the ftp server with a wrong login or password;
  • OK LOGIN – message that detects successful authentication.

3. Get the attacker’s IP address by counting “FAIL LOGIN” answers.

$ grep -i "FAIL LOGIN" /var/log/vsftpd.log | grep -Eo '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort | uniq -c | sort -rn | more

4. Check if attack was succeed by parsing the log file with “OK LOGIN” answer and attacker’s IP address e.g. 192.168.1.2.

$ grep -i "OK LOGIN" /var/log/vsftpd.log | grep 192.168.1.2

5. Block the attacker’s IP address.

The easiest way is to add the attackers IP address to ‘/etc/hosts.deny’ file.

See examples below:

Block all services for IP address ‘192.168.1.2’.

ALL: 192.168.1.2

Block all services for IP addresses ‘192.168.1.2’ and ‘192.168.1.3’.

ALL: 192.168.1.2 192.168.1.3
No comments yet

Writing a Message to Logged in Users through the Terminal

Posted on by admin

To write a message to logged in users, you can use a write command. The write utility allows you to communicate with other users, by copying lines from your terminal to theirs.

First of all you need to check who is currently logged in, and which terminal he is logged in to.

$ who
root     pts/0        2012-04-25 12:57 (192.168.0.207)
john     pts/1        2012-04-25 13:20 (192.168.0.101)

Now you can write a messages to the user John. For example:

$ write john pts/1
Hello!

When you hit ‘Enter’, your message will be sent to that terminal.

Use Ctrl + D to terminate write

Also you can cat a file and pipe it to the write command too: 

$ cat file.txt | write stan pts/1

To broadcast your message to all logged in users you can use a wall command (wall = write to all):

$ wall
Hey you people!

For wall, the message will be sent only after you hit Ctrl + D

Or you can cat a file and pipe it to the wall command:

$ cat announcement.txt | wall
1 Comment

Checking MySQL Replication Status

Posted on by admin

The most common task when managing a replication process is to ensure that the replication is taking place and that there have been no errors between the slave and the master.

The primary statement for this is ‘SHOW SLAVE STATUS‘, which must be executed on each slave.

mysql> SHOW SLAVE STATUS\G

The key fields from the status report to examine are:

  • Slave_IO_State – the current status of the slave;
  • Slave_IO_Running – whether the I/O thread for reading the master’s binary log is running. Normally, you want this to be ‘Yes’ unless you have not yet started replication or have explicitly stopped it with ‘STOP SLAVE’;
  • Slave_SQL_Running – whether the SQL thread for executing events in the relay log is running. As with the I/O thread, this should normally be ‘Yes’;
  • Last_IO_Error, Last_SQL_Error – the last errors registered by the I/O and SQL threads when processing the relay log. Ideally these should be blank, indicating no errors;
  • Seconds_Behind_Master – the number of seconds that the slave SQL thread is behind processing the master binary log. A high number (or an increasing one) can indicate that the slave is unable to handle events from the master in a timely fashion.

Several pairs of fields provide information about the progress of the slave in reading events from the master binary log and processing them in the relay log:

  • Master_Log_file, Read_Master_Log_Pos – coordinates in the master binary log indicating how far the slave I/O thread has read events from that log;
  • Relay_Master_Log_File, Exec_Master_Log_Pos – coordinates in the master binary log indicating how far the slave SQL thread has executed events received from that log;
  • Relay_Log_File, Relay_Log_Pos – coordinates in the slave relay log indicating how far the slave SQL thread has executed the relay log. These correspond to the preceding coordinates, but are expressed in slave relay log coordinates rather than master binary log coordinates.

On the SLAVE, you can check running processes using ‘SHOW PROCESSLIST‘ command.

mysql> SHOW PROCESSLIST\G

On the MASTER, you can also check the status of connected slaves using ‘SHOW PROCESSLIST‘ to examine the list of running processes.

mysql> SHOW PROCESSLIST\G

Because it is the slave that drives the replication process, very little information is available in this report.

No comments yet

HowTo: Install LAMP on CentOS/RHEL

Posted on by admin

In this guide, I will show you, how to install LAMP (Linux, Apache, MySQL, PHP) – a stack of free, open source software for building a web server for general purpose.

1. Install Apache HTTP Server

yum install httpd

Backup the apache configuration file ‘httpd.conf’.

cp /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf.backup

Set the apache service to start at boot.

chkconfig httpd on

Open the httpd configuration file and un-comment the line, containing the text “NameVirtualHost *:80”.

vi /etc/httpd/conf/httpd.conf

Add the rules to IPTABLES.

vi /etc/sysconfig/iptables

Append the following lines before the REJECT line, to open http and https ports 80 and 443:

-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT

Save and close the file. Restart the firewall.

service iptables restart

Start the Apache HTTP Server daemon.

service httpd start

Visit http://localhost/ in your web browser, if you’ve installed server on your local machine, or enter the server’s IP address. You should see an Apache Test Page.

2. Install MySQL

yum install mysql-server

Set the MySQL service to start at boot.

chkconfig mysqld on

Start the MySQL service.

service mysqld start

Set the root password for MySQL.

mysqladmin -u root password NEWPASSWORD

Test connectivity to MySQL.

mysql -u root -p

3. Install PHP

yum install php php-mysql

Restart Apache.

service httpd restart

You should now have the latest PHP installed:

php -v
No comments yet

Configuring Network on CentOS/RHEL — Basic Configuration

Posted on by admin

Interface configuration files control the software interfaces for individual network devices.

As the system boots, it uses these files to determine what interfaces to bring up and how to configure them.

These files are usually named ifcfg-<name>, where <name> refers to the name of the device that the configuration file controls.

Because each device has its own configuration file, an administrator can control how each interface functions individually.

Configure Network Interface Settings

You can configure network interface by editing configuration files stored in /etc/sysconfig/network-scripts/ directory.

Lets configure the first network interface eth0. Edit the interface configuration file.

# vi /etc/sysconfig/network-scripts/ifcfg-eth0

Append/Modify as follows:

For a system using a Static IP Address

DEVICE="eth0"
BOOTPROTO="none"
ONBOOT="yes"
IPADDR="192.168.1.15"
NETMASK="255.255.255.0"
GATEWAY="192.168.1.1"

For a system using a DHCP

DEVICE="eth0"
BOOTPROTO="dhcp"
ONBOOT="yes"

Parameter

Description

DEVICE=<name> Name of the physical device
BOOTPROTO=<none|bootp|dhco> Protocol to use.
none – No boot-time protocol should be used
bootp – The BOOTP protocol should be used
dhcp – The DHCP protocol should be used
ONBOOT=<yes|no> Should the device be activated at boot-time
IPADDR=<address> IP address
GATEWAY=<address> Gateway IP address
NETMASK=<mask> Netmask value

Configure Networking

Edit the main network configuration file:

# vi /etc/sysconfig/network

Append the following settings:

NETWORKING="yes"
HOSTNAME="Your.Server.Name"

Restart networking:

# /etc/init.d/network restart

If the modifying of the file /etc/sysconfig/network is not needed, then you can restart only the interface:

# ifdown eth0 && ifup eth0

Configure DNS settings

Edit ‘resolv.conf’ file:

# vi /etc/resolv.conf

Append your DNS servers:

nameserver 192.168.1.2
nameserver 192.168.1.3

If you don’t have private DNS servers, you can pick them from a list of Free Fast Public DNS Servers

Test Your Settings

Check if the Gateway is reachable:

# ping 192.168.1.1

Check if the Public IPs are reachable:

# ping 8.8.8.8

Check if DNS works:

# nslookup google.com
No comments yet

10 Examples: Copying Files over SSH

Posted on by admin

SCP (Secure CoPy) – is a remote file copy program, that copies files between hosts on a network.

It uses SSH for data transfer, and uses the same authentication and provides the same security as SSH.

When copying a source file to a target file which already exists, SCP will replace the contents of the target file. If the target file does not yet exist, an empty file with the target file name is created, then filled with the source file contents.

Example 1: Copy the file “file.txt” from a remote host to the local host.

$ scp user@remote.host:file.txt /some/local/directory

Example 2: Copy the file “file.txt” from the local host to a remote host.

$ scp file.txt user@remote.host:/some/remote/directory

Example 3: Copy the directory “dir1” from the local host to a remote host’s directory “dir2”.

$ scp -r dir1 user@remote.host:/some/remote/directory/dir2

Example 4: Copy the file “file.txt” from remote host “remote.host1” to remote host “remote.host2”.

$ scp user@remote.host1:/directory/file.txt user@remote.host2:/some/directory/

Example 5: Copy the files “file1.txt” and “file2.txt” from the local host to your home directory on the remote host.

$ scp file1.txt file2.txt user@remote.host:~

Example 6: Copy the file “file.txt” from the local host to a remote host using port 2222.

$ scp -P 2222 file.txt user@remote.host:/some/remote/directory

Example 7: Copy the file “file.txt” from the local host to a remote host’s home directory. Preserve the modification and access times, as well as the permissions of the source-file in the destination-file.

$ scp -p file.txt user@remote.host:~

Example 8: Copy the file “file.txt” from the local host to a remote host’s home directory. Increase SCP speed by changing the cipher from the default AES-128 to Blowfish.

$ scp -c blowfish file.txt user@remote.host:~

Example 9: Copy the file “file.txt” from the local host to a remote host’s home directory. limit the bandwidth used by SCP command to 100 Kbit/s.

$ scp -l 100 file.txt user@remote.host:~

Example 10: Copy multiple files from the remote host to your current directory on the local host.

$ scp user@remote.host:~/\{file1,file2,file3\} .
4 Comments

Changing Permissions of Files and Folders in Linux – Chmod Basics

Posted on by admin

The сhmod (change mode) command changes the access mode of files and directories.

Syntax

Syntax of the chmod command is the following:

$ chmod [options] permissions file[s]

Options:

  • -R, –recursive – Change files and directories recursively;
  • -f, –silent, –quiet – Suppress most error messages.

View the current file / directory mode using ls command:

$  ls -l MyFile.txt
-rw-r--r-- 1 john admin 0 2012-12-02 04:30 MyFile.txt
$ ls -ld MyDir
drwxr-xr-x 2 john admin 4096 2012-12-02 04:29 MyDir

or using stat command:

$  stat -c '%A %a %n' MyFile.txt
-rw-r--r-- 644 MyFile.txt
$ stat -c '%A %a %n' MyDir
drwxr-xr-x 755 MyDir

Classes

The references (or classes) are used to distinguish the users to whom the permissions apply. If no references are specified it defaults to “all”. The references are represented by one or more of the following letters:

Reference Class Description
u user the owner of the file (folder)
g group users who are members of the file’s (folders’s) group
o others users who are not the owner of the file (folder) or members of the group
a all all three of the above, is the same as ugo

Operators

The chmod program uses an operator to specify how the modes of a file (folder) should be adjusted. The following operators are accepted:

Operator Description
+ adds the specified modes to the specified classes
– removes the specified modes from the specified classes
= the modes specified are to be made the exact modes for the specified classes

Modes

The modes indicate which permissions are to be granted or taken away from the specified classes. There are three basic modes which correspond to the basic permissions:

Mode Name Description
r read permitted to read the contents of file or directory (view files and sub-directories in that directory)
w write permitted to write to the file or in to the directory (create files and sub-directories in that directory)
x execute permitted to execute the file as a program/script or enter into that directory
X special execute applies execute permissions to directories regardless of their current permissions and applies execute permissions to a file which already has at least 1 execute permission bit already set (either user, group or other).

[X] Is not a permission in itself but rather can be used instead of x. It is only really useful when used with ‘+’ and usually in combination with the -R option for giving group or other access to a big directory tree without setting execute permission on normal files (such as text files), which would normally happen if you just used ‘chmod -R a+rx’, whereas with ‘X’ you can do ‘chmod -R a+rX’ instead.

Numerical permissions

You can use either the octal representation or symbolic representation to change the permission of a file or directory.

Octal representation for permissions:

  • First number is for user
  • Second number is for group
  • Third number is for others
# Mode Description
7 rwx read, write, execute
6 rw- read, write
5 r-x read, execute
4 r– read
3 -wx write, execute
2 -w- write
1 –x execute
0 — no permissions

10 Simple Examples:

1. Read permission is added for all:

$ chmod a+r file

2. Execute permission is removed for all:

$ chmod a-x file

3. Change the permissions of the file to read and write for all:

$ chmod a+rw file

4. Read and write permissions are set for the owner, all permissions are cleared for the group and others:

$ chmod u=rw,go= file

5. Change the permissions of the directory and all its contents to add write access for the user, and deny write access for everybody else:

$ chmod -R u+w,go-w directory

6. Removes all privileges for all:

$ chmod file

7. Change the permissions of the file to read, write, and execute for all:

$ chmod 777 file

8. Sets read, write and no execution access for the owner and group, read only for all others:

$ chmod 664 file

9. Set a directory tree to ‘-rwx’ for owner directories, ‘-rw’ for owner files, ‘—‘ for group and others:

$ chmod -R u+rwX,g-rwx,o-rwx directory

10. Remove the execute permission on all files in a directory tree, while allowing for directory browsing:

$ chmod -R a-x+X directory
No comments yet

Creating Certificate Signing Request — CSR Generation

Posted on by admin

A Certificate Authority will use a CSR to create your SSL certificate.

What is a CSR? A CSR or ‘Certificate Signing Request’ is a block of encrypted text, that is generated on the server that the certificate will be used on.

It contains information that will be included in your certificate, such as your organization name, common name (domain name), locality, and country. It also contains the public key that will be included in your certificate.

Run these OpenSSL commands, to generate your Certificate Signing Request.

Step 1: Generate a Private Key

$ openssl genrsa -out shellhacks.com.key 2048

If you need just to renew existence certificate and you already have the private key, you can skip this step and use it, instead of generating new one.

The number 2048 is the size of the key, in bits. Today, 2048 or higher is recommended for RSA keys, as fewer amount of bits is consider insecure or to be insecure pretty soon.

Step 2: Generate the CSR

$ openssl req -new -key shellhacks.com.key -out shellhacks.com.csr

The fields, required in a Certificate Signing Request, are listed below with explanations and examples :

Distinguished Name Field Explanation Example
Common Name The fully qualified domain name (FQDN) for your web server. This must be an exact match. If you intend to secure the URL https://www.shellhacks.com/, then your CSR’s common name must be: www.shellhacks.com
Organisation The exact legal name of your organisation. Do not abbreviate your organisation name. ShellHacks Ltd.
Organisation Unit Section of the organisation, can be left empty if this does not apply to your case. Development department
City/Locality The city where your organisation is legally located. Balham
State/County/Region The state/county/region where your organisation is legally located. Must not be abbreviated. London
Country The two-letter ISO abbreviation for your country. GB
Email address The email address used to contact your organisation. info@shellhacks.com
No comments yet

Installing the Check_MK Agent on CentOS/RHEL — Manual Install

Posted on by admin

Step 1: Download and uncompress the latest version of check_mk agent.

The check_mk agent for Linux consists of only two files: a shell script called ‘check_mk_agent.linux’ and a configuration file for ‘xinetd.conf’. They both can be found in the downloaded archive.

Example:

# cd /tmp
# wget http://mathias-kettner.de/download/check_mk-1.1.12p7.tar.gz
# tar -xvzf check_mk-1.1.12p7.tar.gz

Step 2: Installing ‘xinetd’.

Make sure ‘xinetd’ is installed

# rpm -qa | grep -i xinetd

If ‘xinetd’ is not installed then install it.

# yum install xinetd

Step 3: Copy the files and give the execute permissions for ‘check_mk_agent’.

# cd /tmp/check_mk-x.x.x
# tar -xvzf agents.tar.gz
# cp check_mk_agent.linux /usr/bin/check_mk_agent
# cp xinetd.conf /etc/xinetd.d/check_mk
# chmod +x /usr/bin/check_mk_agent

Step 4: Set the IP address of the monitoring server.

Set the IP in ‘/etc/xinetd.d/check_mk’ file.

"only from = IP_OF_MONITORING_SERVER"

Add the IP to ‘/etc/hosts.allow’.

"check_mk_agent : IP_OF_MONITORING_SERVER"

Step 5: Reload ‘xinetd’.

# service xinetd reload

In case if ‘xinetd’ has just been installed:

# service xinetd stop && service xinetd start

Step 6: Set the ‘xinetd’ to start at boot.

# chkconfig xinetd on

Step 7: Check that ‘xinetd’ is listening to port 6556.

# netstat -lpn | grep 6556

Example:

# netstat -lpn | grep 6556
tcp        0      0:::6556                    :::*                        LISTEN      28273/xinetd

Step 8: Add the rule to IPTABLES, if you use the firewall.

# vi /etc/sysconfig/iptables

Append the following line before the REJECT line, to open port 6556.

# iptables -I INPUT -p tcp --dport 6556 -j ACCEPT

Save and close the file. Restart the firewall.

# service iptables restart

Step 9: Test the connection.

If the agent is running properly, you should be able to connect to your Linux host.

Test the connection locally.

# telnet localhost 6556
<<<check_mk>>>
Version: 1.1.12p7
AgentOS: linux
***

Test the connection remotely from your monitoring server.

# telnet your.server.com 6556
<<<check_mk>>>
Version: 1.1.12p7
AgentOS: linux
***
1 Comment