Hungerford Web Design Blog

By default, SSH runs on port 22. This leads to thousands of automatic scans and scripted attacks being launched.

No reason not to change your port exists to the best of my knowledge. Get it changed!

Add a line in the file /etc/ssh/sshd_config:

Port 6969

Reload sshd

#/etc/rc.d/sshd reload
OR
service sshd restart

A couple of simple things here will ensure you of success:

• Check that whichever port you choose is not already in use
• After restarting ssh, do not close that window. Instead, open a new connection leaving the existing connection open. If anything has gone wrong and you wish to revert your changes back, you can do so in your existing window.

Technorati Tags: Leads, Port 22, Reason, Ssh Port

Using SSH as a login method for *NIX boxes is pretty common. One thing I am regularly asked by our dedicated server users is how to add messages that can be viewed when a user is accessing the system. Keep in mind that it would be well worth restricting root login and running SSH on a non-standard port

There are two methods for doing this, you can use just one or both depending on the desired effect.

Firstly (in time order) there is the banner which appears after a username has been typed. This is normally used to provide a warning against unauthorised access as follows:

login as: user
************************NOTICE***********************
This system is optimised and configured with security and logging as a
priority. All user activity is logged and streamed offsite. Individuals
or groups using this system in excess of their authorisation will have
all access terminated. Illegal access of this system or attempts to
limit or restrict access to authorised users (such as DoS attacks) will
be reported to national and international law enforcement bodies. We
will prosecute to the fullest extent of the law regardless of the funds
required. Anyone using this system consents to these terms and the laws
of the United Kingdom and United States respectively.
************************NOTICE***********************

To add this to your server, you will need to edit your ssh config file (/etc/ssh/sshd_config) and uncomment/add the following line: Banner /etc/banner

You will then want to create/edit the banner you have just referenced: ( pico /etc/banner)

You will need to restart the ssh daemon for this to work: ( service sshd restart)

When you login, you should now see your message displayed after you have entered a username.

The second method is MOTD (Message of the day). The difference here is that this is displayed after login has completed. Some of the most common uses depending of the numbers of users with access:
Rules for accessing files/services
A message for the next sysadmin due to monitor the box
A list of common commands and how to execute them
Anything else of use

To add a MOTD, you will need to edit the motd file : ( pico /etc/motd ), add your message and save the file, it should now be displayed on successful login. If you were to use both it would display something like this:

login as: user

************************NOTICE***********************
This system is optimised and configured with security and logging as a
priority. All user activity is logged and streamed offsite. Individuals
or groups using this system in excess of their authorisation will have
all access terminated. Illegal access of this system or attempts to
limit or restrict access to authorised users (such as DoS attacks) will
be reported to national and international law enforcement bodies. We
will prosecute to the fullest extent of the law regardless of the funds
required. Anyone using this system consents to these terms and the laws
of the United Kingdom and United States respectively.
************************NOTICE***********************

user@domain.com’s password:
Last login: Sun Apr 27 14:37:24 2008 from user-22222222.domain.com

You have somehow managed to login….We are now monitoring your access,
our systems administrators have received a page to alert them of your
presense. If you are not a fully authorised user acting within your
rights then logoff immediately to prevent further action.

Technorati Tags: Authorisation, Boxes, Dedicated Server, Desired Effect, Dos Attacks, Extent, Firstly, International Law Enforcement, Law Enforcement Bodies, Line Banner, Login Method, Message Of The Day, One Thing, Priority, Root Login, Server Users, Ssh Daemon, System Consents, United Kingdom, United States

You may (for whatever reason) store particularly sensitive information in your webspace. Passwords, links, and anything else.

You may want to be able to access these files by FTP for example, but do not want someone stumbling across them and being able to read or use them. Here we will deny external access to those files using a .htaccess file.

You will require that your server has the mod_access module installed for these rules to work.

In our example, we have a password file stored in /home/username/www/passwords/my-passwords.psswd

We create a .htaccess file (that is “DOT”htaccess) and within it:

<Files ~ “\.psswd$”>
Order allow,deny
Deny from all
</Files>

Save the file and upload it to the directory holding the files you wish to protect (in our case /home/username/www/passwords/ )

Simple

Technorati Tags: Access Files, Directory, Dot, Htaccess File, Lt, Password File, Passwords, Upload

The scenario is that you have a group of files within a folder that you want to password protect. You want to keep them secure from prying eyes.

I did write huge tutorial on this using the shell but then a)wordpress decided to have a fit and lose the work (que: Anger) and then I thought b) a lot of people may not have shell access and c) a lot of people probably don’t care so here is the short version using our .htpasswd creator tool.

(more…)

Technorati Tags: Anger, Creator Tool, Credentials, Directory Structure, Document Root, Documentroot, Fi, Htaccess File, Htaccess Htpasswd, Htpasswd Creator, New Location, Password Protect, Password Protected Directory, Passwords, Prying Eyes, Quotes, Server Path, Shell, Wordpress, Www Domain

If you are new to apache and/or webservers, here are a couple of things in addition to our .htaccess tutorial which you may find of use. As always, please feel free to ask if anything is not clear or you would like any help.

(more…)

Technorati Tags: Apache Configuration, Capitalization, Case Sensitivity, Configuration File, Equivalents, Htaccess Tutorial, Internet Information Server, Jpg Files, Lower Case, Misspelling, Misspellings, Occurrence, Rewritecond, Rewriterule, Secure Site, Server Port, Simple Solution, Speling, Tips For Webmasters, Unencrypted

Many people are now using either dedicated boxes or virtual dedicated hosting. Knowing your way around the filesystem and how to manipulate it is key to running a good, stable, secure service. It also makes takes as a website owner much easier and quicker.

Here is a list of common Linux and/or UNIX commands which may come in handy:

(more…)

Technorati Tags: Bz2, Cd Home, Change Directory, Cp Copy, Empty Directory, Files And Folders, Filesystem, Handy Files, Home Directory, How To Do Anything, Linux Unix, Mv, New Folder, Rf, Secure Service, Tar Gz, Tar Xvf, Tar Zxvf, Unix Commands, Website Owner

This script is nice and neat. It will check your services based on port number and works great in both Windows and Linux/UNIX. Give it a try, we use it regularly.

(more…)

Technorati Tags: Arrays, Cellpadding, Code Lt, Collapse, Com Port, Connection Ip, Div Style, Echo Data, Email, Fp, Ftp Ip, Google, Internet Connection, Ip 6, Lt Ports, Sans Serif Font, Server Status, Service Checks, Service Status, Td Bgcolor

How to update your system

Updating your system regularly is the first step in securing your server. You didn’t think of this did ya?

up2date configuration:
login as root, and issue the following command:

Code:

up2date –configure ENTER
select number for “removeSkipList” ENTER
C ENTER

Code:

select number for “pkgSkipList” ENTER
C ENTER
ENTER

(more…)

Hardening PHP for dangerous functions:

First of all, locate your php.ini

If you don’t know where you php.ini is, it’s easy.
simply upload this file in your www folder

PHP Code:
< ?
phpinfo();
?>
name the file something say info.php
and call the file as http://domain.com/info.php

a page will load, and at the top part, something like this line will be shown i.e on the 6th row

(more…)

Root Access Notification:

This will inform you each time access is made to the root account:

In SSH:
Code:

cd /root

edit .bashrc and add the following at the end, for freebsd: edit .cshrc

Code:

echo -e “root access on `date`” ‘\n’ `who` | mail -s “Root Alert!” you@youremail.com

(more…)

Technorati Tags: Cd Edit, Echo, Mail Alert, Notifications, Root Account, Ssh