Hungerford Web Design Blog

By default, SSH runs on port 22. This leads to thousands of automatic scans and scripted attacks being launched.

No reason not to change your port exists to the best of my knowledge. Get it changed!

Add a line in the file /etc/ssh/sshd_config:

Port 6969

Reload sshd

#/etc/rc.d/sshd reload
OR
service sshd restart

A couple of simple things here will ensure you of success:

• Check that whichever port you choose is not already in use
• After restarting ssh, do not close that window. Instead, open a new connection leaving the existing connection open. If anything has gone wrong and you wish to revert your changes back, you can do so in your existing window.

Technorati Tags: Leads, Port 22, Reason, Ssh Port

Using SSH as a login method for *NIX boxes is pretty common. One thing I am regularly asked by our dedicated server users is how to add messages that can be viewed when a user is accessing the system. Keep in mind that it would be well worth restricting root login and running SSH on a non-standard port

There are two methods for doing this, you can use just one or both depending on the desired effect.

Firstly (in time order) there is the banner which appears after a username has been typed. This is normally used to provide a warning against unauthorised access as follows:

login as: user
************************NOTICE***********************
This system is optimised and configured with security and logging as a
priority. All user activity is logged and streamed offsite. Individuals
or groups using this system in excess of their authorisation will have
all access terminated. Illegal access of this system or attempts to
limit or restrict access to authorised users (such as DoS attacks) will
be reported to national and international law enforcement bodies. We
will prosecute to the fullest extent of the law regardless of the funds
required. Anyone using this system consents to these terms and the laws
of the United Kingdom and United States respectively.
************************NOTICE***********************

To add this to your server, you will need to edit your ssh config file (/etc/ssh/sshd_config) and uncomment/add the following line: Banner /etc/banner

You will then want to create/edit the banner you have just referenced: ( pico /etc/banner)

You will need to restart the ssh daemon for this to work: ( service sshd restart)

When you login, you should now see your message displayed after you have entered a username.

The second method is MOTD (Message of the day). The difference here is that this is displayed after login has completed. Some of the most common uses depending of the numbers of users with access:
Rules for accessing files/services
A message for the next sysadmin due to monitor the box
A list of common commands and how to execute them
Anything else of use

To add a MOTD, you will need to edit the motd file : ( pico /etc/motd ), add your message and save the file, it should now be displayed on successful login. If you were to use both it would display something like this:

login as: user

************************NOTICE***********************
This system is optimised and configured with security and logging as a
priority. All user activity is logged and streamed offsite. Individuals
or groups using this system in excess of their authorisation will have
all access terminated. Illegal access of this system or attempts to
limit or restrict access to authorised users (such as DoS attacks) will
be reported to national and international law enforcement bodies. We
will prosecute to the fullest extent of the law regardless of the funds
required. Anyone using this system consents to these terms and the laws
of the United Kingdom and United States respectively.
************************NOTICE***********************

user@domain.com’s password:
Last login: Sun Apr 27 14:37:24 2008 from user-22222222.domain.com

You have somehow managed to login….We are now monitoring your access,
our systems administrators have received a page to alert them of your
presense. If you are not a fully authorised user acting within your
rights then logoff immediately to prevent further action.

Technorati Tags: Authorisation, Boxes, Dedicated Server, Desired Effect, Dos Attacks, Extent, Firstly, International Law Enforcement, Law Enforcement Bodies, Line Banner, Login Method, Message Of The Day, One Thing, Priority, Root Login, Server Users, Ssh Daemon, System Consents, United Kingdom, United States

You may (for whatever reason) store particularly sensitive information in your webspace. Passwords, links, and anything else.

You may want to be able to access these files by FTP for example, but do not want someone stumbling across them and being able to read or use them. Here we will deny external access to those files using a .htaccess file.

You will require that your server has the mod_access module installed for these rules to work.

In our example, we have a password file stored in /home/username/www/passwords/my-passwords.psswd

We create a .htaccess file (that is “DOT”htaccess) and within it:

<Files ~ “\.psswd$”>
Order allow,deny
Deny from all
</Files>

Save the file and upload it to the directory holding the files you wish to protect (in our case /home/username/www/passwords/ )

Simple

Technorati Tags: Access Files, Directory, Dot, Htaccess File, Lt, Password File, Passwords, Upload

One of the things which gives a potential attacker some help is them knowing which versions of software you use. This can be very easy to find out, particularly if you have never taken steps to secure this information.

For example: I would like to know what software apache.org are using/have used so I look at netcraft (for example) http://toolbar.netcraft.com/site_report?url=http://www.apache.org

192.87.106.226 Linux Apache/2.2.3 Unix mod_ssl/2.2.3 OpenSSL/0.9.7g 12-Apr-2007

I now know that I should look for exploits relating to linux, apache v2.2.3, mod_ssl 2.2.3 and OpenSSL0.9.7g.

By hiding this information you can either report simply “unknown” or just “apache” and no other info. This doesn’t directly make your box more secure, what it does do is start to make the task more difficult for a would-be attacker and for such a small amount of effort it really does seem silly not to do it. So how?

The first thing is to set the ServerTokens directive. I am using a RH linux box so if you know your OS differs, find the corresponding location of your httpd.conf: (more…)

Technorati Tags: 192, Apache 2, Apache Server, Apache Software, Attacker, Default Server, Exploits, Httpd, Linux, Linux Apache, Linux Box, Minimal Server, Netcraft, Quotes, Report Url, Rh Linux, Server Apache, Syntax, Telnet Program, Terminal Type

The scenario is that you have a group of files within a folder that you want to password protect. You want to keep them secure from prying eyes.

I did write huge tutorial on this using the shell but then a)wordpress decided to have a fit and lose the work (que: Anger) and then I thought b) a lot of people may not have shell access and c) a lot of people probably don’t care so here is the short version using our .htpasswd creator tool.

(more…)

Technorati Tags: Anger, Creator Tool, Credentials, Directory Structure, Document Root, Documentroot, Fi, Htaccess File, Htaccess Htpasswd, Htpasswd Creator, New Location, Password Protect, Password Protected Directory, Passwords, Prying Eyes, Quotes, Server Path, Shell, Wordpress, Www Domain

An interesting concept….

An ebay-like online auction has been set up to enable security researchers (/hackers/coders/testers) to auction the defects they find to the highest bidder. By providing an incentive to the researchers the providers hope to prevent bugs getting into the wrong hands (russian crime syndicates and the like).

There is a proven market for vulnerabilites as shown by the Russian hackers selling the Windows WMF vulnerability for $3-5000 a pop. It was closed by Microsoft shortly after it was revealed that the details were being sold. The auction house is called WabiSabiLabi . They state that “Our intention is that the marketplace facility on WSLabi will enable researchers to get a fair price for their findings and ensure that they will no longer be forced to give them away for free or sell them to cyber-criminals”

I have to say (and this is only my opinion), I struggle to see this as being a method of responsible disclosure. To sell to the highest bidder shows no morality or true desire to be helping the vendors. It looks like a pretty good way for blackhats to make a few bucks and for the criminals to have an easy and reliable source of exploit.

An interesting concept and one which plenty of security professionals will probably be keeping an eye on one way or another.

Technorati Tags: Auction House, Blackhats, Bugs, Cyber Criminals, Disclosure, Ebay, Ebay Auction, Ebay Online, Highest Bidder, Intention, Morality, Online Auction, Russian Crime Syndicates, Russian Hackers, Security Professionals, Security Researchers, True Desire, Vulnerabilities, Vulnerability, Wrong Hands

How to update your system

Updating your system regularly is the first step in securing your server. You didn’t think of this did ya?

up2date configuration:
login as root, and issue the following command:

Code:

up2date –configure ENTER
select number for “removeSkipList” ENTER
C ENTER

Code:

select number for “pkgSkipList” ENTER
C ENTER
ENTER

(more…)

Hardening PHP for dangerous functions:

First of all, locate your php.ini

If you don’t know where you php.ini is, it’s easy.
simply upload this file in your www folder

PHP Code:
< ?
phpinfo();
?>
name the file something say info.php
and call the file as http://domain.com/info.php

a page will load, and at the top part, something like this line will be shown i.e on the 6th row

(more…)

Root Access Notification:

This will inform you each time access is made to the root account:

In SSH:
Code:

cd /root

edit .bashrc and add the following at the end, for freebsd: edit .cshrc

Code:

echo -e “root access on `date`” ‘\n’ `who` | mail -s “Root Alert!” you@youremail.com

(more…)

Technorati Tags: Cd Edit, Echo, Mail Alert, Notifications, Root Account, Ssh

Disabling Compilers

When the compiler is disabled, the hacker is not able to compile and make the exploit. This step will prevent “The ability to compile the file in the system”. Most of the hacking guides that is found in the net suggest of compiling the exploit in the system, and seldom a pre-compiled binary is distributed. Thus, either via shell access or daemon exploit or via cgi/php abuse, they will try to get hold of your compiler and compile the exploit. Normally, your users do not need access to the compiler, so it is safe to restrict/disable compilers

(more…)

Technorati Tags: Admins, Amp, Byacc, Cc1, Compilers, Decis, Fedora, Freebsd Code, Hacker, Hacking Guides, Jsp Apache, Lib, Preference, Redhat Linux, Root User, Rpm, Shell, Up2date, Usr Bin, Webservers