Checking Password Policies in Linux

To check the list of users of  linux machine, check the password or shadow password file.

cat /etc/shadow

cat /etc/passwd

cat /etc/group

cat /etc/aliases

cat /etc/sudoers

To check the policy of a user

chage -l

chage -I -1 -m 9 -M 100 -E -1

NTFS for MAC OS X

Problem

Sometimes if you have an external drive that's NTFS formated and it's not disconnected properly from Windows, it'll come up with this message while trying to mount it in Mac OS X

$LogFile indicates unclean shutdown (0, 0)
Failed to mount '/dev/disk1s1': Operation not supported
Mount is denied because NTFS is marked to be in use. Choose one action:

Choice 1: If you have Windows then disconnect the external devices by
clicking on the 'Safely Remove Hardware' icon in the Windows
taskbar then shutdown Windows cleanly.

Choice 2: If you don't have Windows then you can use the 'force' option for
your own responsibility. For example type on the command line:

mount -t ntfs-3g /dev/disk1s1 /Volumes/WD Passport -o force

Or add the option to the relevant row in the /etc/fstab file:

/dev/disk1s1 /Volumes/WD Passport ntfs-3g defaults,force 0 0
Solution

I just had to force it to mount, and then umount it in Terminal. After unplugging and plugging the drive back in, everything works like it did before:

$>sudo mkdir /Volumes/WD\ Passport
$>sudo /usr/local/bin/ntfs-3g /dev/disk1s1 /Volumes/WD\ Passport -o force
$>sudo umount /Volumes/WD\ Passport

Taken from
http://www.elctech.com/projects/troubles-mounting-ntfs-external-drive-on-mac-os-x

Windows Admin Tricks

Windows SID

This is basically the internal identifier used by Windows to uniquely determine a user/group/machine.

Local machine administrator SID will always end with -500.

Guest SID will end with -501

User SID will end with -1001 (1001 signifies the first user and will auto increment with subsequent user)

This is how ACL determines if a user is allowed access to files/services/etc.

Net use

1) net use \\192.168.1.2\ipc$ password /u:domain\administrator

2) Useful sid tool (user2sid and sid2user)

user2sid \\caesars administrator

sid2user \\caesars 5 21 124532423423 4234234234234 4235234234-500

whoami /user /groups

Windows Impersonation

Let the server notify the subsystem that it is temporarily adopting the token of the client making the resource request.

*Restricted token is assigned to child processes that has more limited access than the parent token.

The token consist of all the SID that the logged user is a member of.

Eg John Smith, who is a member of group Developers, Webmaster and Requester logs into Windows. The token will consist of John Smith's SID, Developers group SID, Webmaster group SID and Requester group SID.

Assuming John tries to access file A (which is assigned to Developers group). The ACL will check if John's token consist of the Developers group SID. If yes, John will have access to file A.

 

Forensics: Filesystem Mount

To see the list of devices detected  by linux, type

ls /dev

Usually, hard disk partitions are labeled sda, sda1, hda, etc

To mount these partitions, first make a path where these partitions are to be accessed.

Eg mkdir  /mnt/mywindrive or sudo mkdir /mnt/mywindrive

Then, associate the device with the mount location.

sudo mount -o ro -t auto /dev/sda1 /mnt/mywindrive

*Taken from Unix and Linux Forensic Analysis DVD Toolkit 

DD to image a drive

Challenge Procedure Step-by-Step
The following steps show you how to use dd and MD5 to create, restore, and verify forensically sound disk images:

First, we start by creating an MD5 checksum of a disk. To do this, first log in as root, and open a command prompt. Create the MD5 checksom for the disk to be duplicated using the following:

md5sum /dev/fd0 > /tmp/original-md5
This command creates the MD5 checksum of the device, /dev/fd0, and outputs the result to a file named /tmp/ original-md5.

View the checksum with cat /tmp/original-md5.

Now, create an image file of the disk.

Use dd to create a binary copy of the disk:
*Remember to unmount the disk before using dd.

in OS X, use diskutil unmountDisk /dev/disk1

dd if=/dev/fd0 of=/tmp/disk.img bs=1k
The if=/dev/fd0 parameter directs dd to use the device /dev/fd0 as the input file. The of=/tmp/disk.img parameter tells dd to output the data to a file named /tmp/disk.img. The bs=1k tells dd to use a block size of 1024 or 1KB.

Next, we'll use MD5 to verify the accuracy of the image file. First, create the MD5 checksum for the image file with the following:

md5sum /tmp/disk.img > /tmp/image-md5
Compare the checksums of the original disk and the image file using the following:

cat /tmp/*md5
The cat command displays the contents of files that end with md5. Note that the checksums are identical.

Next, you'll restore the image file to a blank disk.

Use dd to copy the image file to the disk:


dd if=/tmp/disk.img of=/dev/fd0 bs= 1k
This command reverses the flow of the data, whereas the command in step 2 created the image file.

Create the checksum for the duplicate disk:


md5sum /dev/fd0 > /tmp/duplicate-md5
Now, use cat to verify the accuracy of the duplicate disk by comparing the checksums of all three versions:


cat /tmp/*md5
Test MD5 against an altered image file. Do this by first adding a single byte of data to the image file:


echo x >> /tmp/disk.img
Then, create a new checksum for the image file:


md5sum /tmp/disk.img > /tmp/corrupt-md5
Finally, compare the checksums for each step of this exercise:


cat /tmp/*md5
Note how a difference of only 1 byte causes the MD5 to change drastically. This demonstrates the value of using and checking the MD5 signatures of files when downloading them from the Internet.

*Taken from http://www.informit.com/articles/article.aspx?p=27203&seqNum=3

Computer Privacy Annoyances (Dan Tynan)

Essential Privacy Practices

1) Be stingy with data. Give out only essential data. 

2) Check credit card report to ensure that no one is using your personal information to apply for credit cards

3) Minimum information on cheques. Writing home address, phone numbers, driver's license on cheques is exposing too much private information to the cheque recipient

4) Rent a private mailbox to protect your home address and safe keep confidential letters from mail looters

5) Delist from phonebook and online directories/yellow pages

6) Opt out early and often

7) Avoid surveys. You may have a one-in-a-million shot at winning but you've definitely lost your privacy

8) Don't expect others to defend your rights for you 

Cell phone Candid Camera

Covert cameras are banned in locker rooms, bedrooms where the subject has "reasonable expectation of privacy". However, if someone captures you during a wardrobe malfunction at the Super Bowl, you're out of luck.

Moblog Rules

If a picture of you appears on blogs (and you don't want it there), you can contact the service provider to have the picture removed. If the picture appears on a private server, you can contact the ISP to lodge the complaint.

*You might need to surrender some private information such as your identity and why you feel the picture invades your privacy. 

Remain anonymous online

Check out www.bugmenot.com to find logins for various websites that requires registration to access.

Peer to peer sharing

Since it is hard for you to identify the person whom you're exchanging files with in a P2P system, be aware that the RIAA might just plant a few seeders and log the transaction between your machine and theirs. From there, they can request the ISP to reveal the identity of the people who were involved in the download/file exchange.

It is not compulsory for employers to inform employees that they are being monitored. The employer also have rights to search the bags of employees who are accused of theft.

*Taken from Computer Privacy Annoyances (Dan Tynan)

MS SQL

Construct insert statements from DB entries

Use cursors

DECLARE @AuthorID char(11)

DECLARE c1 CURSOR READ_ONLY
FOR
SELECT au_id
FROM authors

OPEN c1

FETCH NEXT FROM c1
INTO @AuthorID

WHILE @@FETCH_STATUS = 0
BEGIN

PRINT @AuthorID

FETCH NEXT FROM c1
INTO @AuthorID

END

CLOSE c1
DEALLOCATE c1

Select "insert name,age,address value('" & vname &... & "')"

Linux Run Levels

Linux Run-Levels

By Joshua Erdman
Digital Foundation, inc.

Linux has 7 different run levels (or operating modes):

rc0.d - System Halted
rc1.d - Single User Mode
rc2.d - Single User Mode with Networking
rc3.d - Multi-User Mode - boot up in text mode
rc4.d - Not yet Defined
rc5.d - Multi-User Mode - boot up in X Windows
rc6.d - Shutdown & Reboot
Each mode has it's own list of settings for what services to start and what services to shutdown. Not only does this list contain what is supposed to be running, but also what order each service should be started in - a feature many Linux lovers like to point out that Windows lacks..

chkconfig - will list all the registered services and display thier status at each different run level.

Most of the time when your server boots up it will start in runlevel 3 or 5 depending on what it is set to. This setting can be found in the file /etc/inittab

If you ever want to change what mode your server defaults to on bootup, just edit that file, but NEVER change it to runlevel 6 or 0. This will cause your server to shutdown on bootup or if you set it to runlevel 6 it will continuously reboot. I guess this could make a great prank on a friend's workstation.

RC.D Directory Explanation

In the folder: /etc/rc.d are all the run level folders starting from rc1.d to rc6.d and including init.d

It is in each of these rc#.d folders where the service run settings are kept. If you change directory into /etc/rc.d/rc3.d all the files that start with a capital S are the services that will start at this runlevel. All the files that start with a K are the services that will be killed at that runlevel.

The reason why services that are not supposed to run are still listed is because it is popular to switch a server from one run level to another instead of just booting into the needed run level. That way you can take your server offline (single user mode) and then apply a patch or do a file restore.

Let's take a closer look at these files that are inside the rc#.d folders. Notice that they are symbolic links to the script file located in /etc/rc.d/init.d This makes things very easy. All the commands to start, stop, or reload a service are handled by these scripts. So when a server is to go into a specific run level it can find the correct script and knows whether to start it based on its name and link path.


*we can easily change root password by running in single user mode
Boot Linux into single-user mode
Reboot the machine.
Press the ESC key while GRUB is loading to enter the menu.
If there is a 'recovery mode' option, select it and press 'b' to boot into single user mode.
Otherwise, the default boot configuration should be selected. Press 'e' to edit it.
Highlight the line that begins with 'kernel'. Press 'e' again to edit this line.
At the end of the line, add an additional parameter: 'single'. Hit return to make the change and press 'b' to boot.
Change the admin password
The system should load into single user mode and you'll be left at the command line automatically logged in as root. Type 'passwd' to change the root password or 'passwd someuser' to change the password for your "someuser" admin account.

Networks in VMWare

ExtremeTech article
http://www.extremetech.com/article2/0,1697,1156371,00.asp

Virtual Hosts on Apache2

This is a very useful feature of Apache2. Imagine if you have multiple domain names and wish to reduce hosting cost by hosting all the web sites on a single server, now you can do it through virtual hosting.

Basically, this features enables multiple domains such as

www.example.com

www.example.net

www.example.org

to point to the same machine (i.e. IP) and yet their hosting directory are different on the machine.

Eg, you may store files related to www.example.com in /var/www/example.com , www.example.net in /var/www/example.net, etc...

This is to enable easy management of each site affecting the other sites that are also hosted on the same machine.

There are 4 steps to doing this

1) Edit /etc/host so that the DNS resolution is pointing to the correct machine.

Of course, in production, this means updating your domain name service to point to your server machine.

2) Create the directories for the sites (eg /var/www/example.com, etc) and copy the files to the respective directories.

3) Edit /etc/apache2/conf.d/virtual.conf (create if the does not exist)

The file should contain the following line

NameVirtualHost *

4) Individual host configuration files are stored at /etc/apache2/sites-available. Create your host configuration files in /etc/apache2/sites-available, then create a symbolic link to those files in the sites-enabled directory - this will cause them to be actually loaded/read.

The symbolic links can be created using the Debian utility command, a2ensite and a2dissite to enable and disable the sites.

Example of content of the /etc/apache2/sites-available/www.example.com

#
#  Example.com (/etc/apache2/sites-available/www.example.com)
#

      ServerAdmin webmaster@example.com
      ServerName  www.example.com
      ServerAlias example.com

      # Indexes + Directory Root.
      DirectoryIndex index.html
      DocumentRoot /home/www/www.example.com/htdocs/

      # CGI Directory
      ScriptAlias /cgi-bin/ /home/www/www.example.com/cgi-bin/
      
              Options +ExecCGI
      


      # Logfiles
      ErrorLog  /home/www/www.example.com/logs/error.log
      CustomLog /home/www/www.example.com/logs/access.log combined


Lastly, run (sudo) a2ensite www.example.com
Restart Apache2 and test out the URL.

#ref: http://www.debian-administration.org/articles/412

FTP and SFTP

Setting up FTP server on Ubuntu

sudo apt-get install proftpd gproftpd
*gproftpd is the GUI module for proftpd

Configure the default ftp directory through
sudo gedit /etc/proftpd/proftpd.conf
This is basically the configuration file for proftpd. Reminder to check tie user login to their home directory if need be.
To enable anonymous / general login, need to setup a generic ftp login for all users of the system. *anonymous login does NOT require password. We can also the read and write permission for each directory in this file.


sudo /etc/init.d/proftpd restart


Access Control List for FTP
/etc/ftpusers
/etc/ftphosts
/etc/ftpaccess
*ftphosts -> can use ip domain range or *.domainname.com

Enhanced security. Since authentication protocol for FTP is in plaintext, we should enable TLS/SSH login through SFTP to encrypt username and passsword for ftp logins.




Reference
http://ubuntuforums.org/showthread.php?p=429783

Boot script sequence

Start up order of linux
1) /etc/lilo.conf
2) /etc/inittab
3) /etc




Boot sequence in Red Hat
boot/grub stuff
/etc/inittab
/etc/rc.sysinit script
/etc/init.d stuff ->rc0,rc1,rc2,rc3,etc..
/etc/rc.d/rc.local

Runlevel	Scripts Directory (Red Hat/Fedora Core)	State
0	/etc/rc.d/rc0.d/	shutdown/halt system
1	/etc/rc.d/rc1.d/	Single user mode
2	/etc/rc.d/rc2.d/	Multiuser with no network services exported
3	/etc/rc.d/rc3.d/	Default text/console only start. Full multiuser
4	/etc/rc.d/rc4.d/	Reserved for local use. Also X-windows (Slackware/BSD)
5	/etc/rc.d/rc5.d/	XDM X-windows GUI mode (Redhat/System V)
6	/etc/rc.d/rc6.d/	Reboot
s or S		Single user/Maintenance mode (Slackware)
M		Multiuser mode (Slackware)

After the runlevel script is done, the kernel will execute scripts in one of the following directories.

• /etc/rc.d/init.d/ (Red Hat/Fedora )
• /etc/init.d/ (S.u.s.e.)
• /etc/init.d/ (Ubuntu / Debian)

Init Script Activation:

Adding a script to the /etc/rc.d/rc#.d/ directory with either an S or K prefix, adds the script to the boot or shutdown process. The scripts are run in numerical order. S20abc is run before S30xyz. The extensibility to the boot and shutdown procedures of the operating system is one of the strengths of UNIX. The orderly sequential initiation of processes can be coordinated for dependent processes. The orderly shutdown of processes is often required of complex programs such as databases. This is how it is done. Individual processes may be monitored, shutdown and started at any time using these scripts. i.e. /etc/rc.d/rc2.d/httpd start. The modifiers start, stop or status may be used.

The start/stop/status scripts actually reside in the directory:

• /etc/rc.d/init.d/ (Red Hat/Fedora)
• /etc/init.d/ (S.u.s.e. and Ubuntu / Debian)

and are linked to the appropriate directories. These links may be created or destroyed using the chkconfig command. i.e. chkconfig --del httpd will remove the web server from the startup and shutdown process. Inversely chkconfig --add httpd will add it to the startup/shutdown process by generating links from the script in /etc/rc.d/init.d/ to the appropriate /etc/rc.d/rc#.d/ directory. For more information see the LINUX manual page on init.

The rc.local script is the last system script to be executed. This is equivalent to autoexec.bat in windows. This is where most of the customised commands/scripts are located.
Meaning, /etc/init.d is the central depository of all scripts.
Files in rc?.d are symbolic links to /etc/init.d.
Eg if runlevel 3 is selected, scripts in /etc/rc3.d which are symbolic links to scripts in /etc/init.d are executed.

Cron Jobs

Troubleshooting Cron
1) Uncomment the #cron line in /etc/syslog.conf to enable cron logging
2) Restart sysklogd : sudo /etc/init.d/sysklogd restart
3) Add cron jobs through crontab -e
4) Restart cron : sudo /etct/init.d/cron restart

To disable email notification, redirect the output to /dev/null
0 3 * * * /root/backup.sh >/dev/null 2>&1


Special strings to substitute * * * * *

Special string	Meaning
@reboot	Run once, at startup.
@yearly	Run once a year, "0 0 1 1 *".
@annually	(same as @yearly)
@monthly	Run once a month, "0 0 1 * *".
@weekly	Run once a week, "0 0 * * 0".
@daily	Run once a day, "0 0 * * *".
@midnight	(same as @daily)
@hourly	Run once an hour, "0 * * * *".

User crontabs are saved in
/var/spool/cron


*Cron status reporting
Set up Evolution to read mails sent by cron.
Create a new account and select "local delivery mails" from the dropdown box. This will enable Evolution to receive mails sent to /var/mail/


*cron commands are also logged in auth.log

Alternative to cron jobs
If a particular task needs to be schedule to be run once or a few times, an alternative solution would be to use the "at" command. This command basically allows the user to schedule a job at any particular time. Eg to send out an email at 4am next week.

at -f /home/user/atcommand -m now + 7 days

The f options tells the at command to run the content of a file (which is in a script format situated at /home/user/atcommand). The -m options will tell the system to send out an email (which contains the output of the command) to notify the user once the job is done and now + 7 days indicates that this job will be executed 7 days from now.

*make sure that there's either /etc/at.deny or /etc/at.allow file in your system. Else, onyl the root will be able to use the at command. These are basically ACL for at command.

You can query all at command jobs using atq and remove the jobs using atrm


Anacron for systems that are not up and running 24/7.
For each job, Anacron checks whether this job has been executed in the last n days, where n is the period specified for that job. If not, Anacron runs the job's shell command, after waiting for the number of minutes specified as the delay parameter.

After the command exits, Anacron records the date in a special timestamp file for that job, so it can know when to execute it again. Only the date is used for the time calculations. The hour is not used.

When there are no more jobs to be run, Anacron exits.
Only root can schedule anacron jobs. A way to enable other users to do so is by creating an anacron group and enable write permission for this group on /var/spool/anacron (where job timestamps are stored)

"run-parts" executes all the executable files in a directory. For example:
# run-parts /etc/cron.daily

"run-crons" executes all the scripts in the /etc/cron.daily, /etc/cron.hourly, /etc/cron.monthly, and /etc/cron.weekly directories.

*used to find files in directory that is messy, file criteria is *junk*
find /tmp -name '*junk*' -exec ls -l {} \;


To force anacron to be executed hourly, put a script which consist of the following in /etc/cron.hourly
#!/bin/sh
/usr/sbin/anacron -s

Installing PHP5

Assuming that you already have apache2 installed, the next step is to install PHP5. It is recommended that you install phpmyadmin and mysql as well.
1) Start by selecting and installing your modules through the synaptic package manager.
OR by command line
sudo apt-get install php5 mysql phpmyadmin
*please install PHP5.gd is you intend to use drupal
2) To enable PHP5, sudo a2enmod PHP5 and restart apache2
3) Test whether php pages are parsed by entering http://localhost/ and click on phpadmin
4) If cannot access that page (greeted by save php or phtml page as) , then you need to edit /etc/apache2/apache2.conf
look for the line AddType ****
and add in "AddType application/x-httpd-php .php .phtml"
5) Restart apache2 and you should be able to access the phpmyadmin page

Unable to start in Linux GUI

If you ever get an error logging into a linux GUI because the system is complaining that it ran out of space, here are some steps to free up some hard disk space to enable you to login (to do further cleaning)

1) At the GUI login , press Ctrl + Alt + F1 to login in terminal
2) Use df -h to check hard disk utilization information
3) Try deleting files in /home which you know can be deleted.
4) Try deleting files in /tmp
5) mount a USB drive and move some of your files in /home to the USB drive and delete them from the system.

Installing Apache 2 in Ubuntu Feisty

Before installing, please ensure that apache is not installed, else uninstall it.
*Apache modules are reported not to work with Apache2 modules.
1) To uninstall Apache
sudo apt-get remove apache
*alternatively, this can be done through sypnatic package module
2) Update apt-get's package list
sudo apt-get update (to subscribe to updated packages)
3) Install Apache2
sudo apt-get install apache2
4) The system should print out a message saying that apache2 is running. To test,
type http://localhost/ in a browser. You should be able to see the apache-default folder.
5) If step 4 fails, check /etc/default/apache2
ensure that NO_START = 0 to enable apache2 to start at port 80.
It could be that NO_START = 1 if apache was installed in your system and prevented Apache2 from starting at port 80.
6) Restart apache2
sudo /etc/init.d/apache2 restart

* commands to clean up source codes / downloaded files which are no longer in used
sudo dpkg --purge apache apache2

Installation of Ubuntu in Vmware Fusion

Installing Ubuntu Feisty in a virtual machine (VMWare Fusion)

1) Allocate at least 3Gb of space for the virtual drive (about 200Mb will be needed to install VMTools)

2) Boot up ISO image in VMWare Fusion and follow the installation steps.

3) Upon booting into Ubuntu, click on install VMWare Tools in the VMWare tab

4) Press the extract button and save vmware-tools-distrib to your home directory.
5) Enter the following commands:
cd vmware-tools-distrib
./vmware-install.pl
*The default answers are all suitable - but the process takes out your network connection.
./vmware-config-tools.pl.
6) When prompted to enter password when executing sudo commands, enter the admin's (usually the first user registered in Ubuntu) password and NOT the root password.
7) Root password can be set in System / Administration / Users and Groups in the GUI.