28 Nov 2007 Deny SSH- but allow SFTP access
This is an alternative way of limiting the SSH access to only SFTP explained in my How to restrict users to SFTP only instead of SSH post.
Edit your /etc/sshd_config file and change your settings like this
Match User username
AllowTcpForwarding no
X11Forwarding no
ForceCommand /usr/libexec/sftp-server -l INFO
Replace username with the user name you would limit the SSH access for.
Posted by Hans-Henry Jakobsen
05 Sep 2007 Port Knocking
What is Port Knocking?
Port knocking is a method by which you can dynamically open ports on your server to a single IP address. Port knocking allows you to transparently run a service on your server without exposing the services of that port to all IP addresses.
In practice, it is very similar to having a whitelist of IP addresses which are allowed to access your server. The advantage of this setup is that you can grant the machine you are using access to the ports on your server dynamically without having to reconfigure your firewall or access list.
(more…)
Posted by Hans-Henry Jakobsen
18 Jul 2007 Simple antivirus test using a text file
This is a simple test to check if your antivirus software is up and running
- Create a text file
- Insert the following text into the file
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
- Save the file with the filename eicar.com
Your antivirus software should detect this file as a virus and notify you about that. Your antivirus software is not working if this doesn’t happen!
Then it’s time to worry :)
Tags: antivirus
Posted by Hans-Henry Jakobsen
04 Jun 2007 Shell script to monitor running services such as web/http, ssh, mail
Shell script to monitor running services such as web/http, ssh, mail etc. If service fails script will send an Email to ADMIN user
monitor-linux-service.bash
#!/bin/bash # Shell script to monitor running services such as web/http, ssh, mail etc. # If service fails it will send an Email to ADMIN user # ------------------------------------------------------------------------- # Copyright (c) 2006 nixCraft project# This script is licensed under GNU GPL version 2.0 or above # ------------------------------------------------------------------------- # This script is part of nixCraft shell script collection (NSSC) # Visit http://bash.cyberciti.biz/ for more information. # ---------------------------------------------------------------------- # See URL for more info # http://www.cyberciti.biz/tips/processing-the-delimited-files-using-cut-and-awk.html # --------------------------------------------------- # service port ports="22 80 25" # service names as per above ports service="SSH WEB MAIL" # No of services to monitor as per (above ports+1) SCOUNTER=4 #Email id to send alert ADMINEMAIL="admin@myispname.com" # counter c=1 echo "Running services status:" # use sudo if you want i.e. sudo /bin/netstat /bin/netstat -tulpn | grep -vE '^Active|Proto' | while read LINE do sendMail=0 # get active port name and use : as delimiter t=$(echo $LINE | awk '{ print $4}' | cut -d: -f2) [ "$t" == "" ] && t=-1 || : # get service name from $services and : as delimiter sname=$(echo $service | cut -d' ' -f$c) sstatus="$sname: No" # now compare port for i in $ports do if [ $i -eq $t ]; then sstatus="$sname: Ok" sendMail=1 fi done # display service status as OK or NO echo "$sstatus" #next service please c=$( expr $c + 1 ) [ "$sendMail" == "0" ] && echo $sstatus | mail -s "service down $sstatus" $ADMINEMAIL || : # break afer 3 services [ $c -ge $SCOUNTER ] && break || : done
Posted by Hans-Henry Jakobsen
04 Jun 2007 Shell script to Finding Accounts with No Password
Shell script to Finding Accounts with No Password
listuserwopassword.bash
#!/bin/bash
# Shell script to Finding Accounts with No Password
# Useful to improve system security
# Copyright (c) 2005 nixCraft project
# This script is licensed under GNU GPL version 2.0 or above
# For more info, please visit:
# http://cyberciti.biz/shell_scripting/bmsinstall.php
# TODO
# - Disable all account w/o password
# - Send an email to admin
# -------------------------------------------------------------------------
# This script is part of nixCraft shell script collection (NSSC)
# Visit http://bash.cyberciti.biz/ for more information.
# -------------------------------------------------------------------------
SPATH="/usr/local/etc/bashmonscripts"
INITBMS="$SPATH/defaults.conf"
[ ! -f $INITBMS ] && exit 1 || . $INITBMS
if ( isRootUser ); then
$GREP -v -E "^#" $SHADOW_FILE | $AWK -F: '$2 == "" { print $1 }'
else
echo "Permission denied [$($ID -u)]"
fi
Posted by Hans-Henry Jakobsen
