OEL Apache SSL

Setting up SSL, with Apache.

On a redhad based distro, we will need

• apache (httpd)
• mod_ssl

Getting httpd and mod_ssl 

yum install httpd mod_ssl

Creating Self Signed Certificate

Run:

cd /var/www/; openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout mysitename.key -out mysitename.crt
Generating a 2048 bit RSA private key

results:

writing new private key to 'mysitename.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:
State or Province Name (full name) []:
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:
Email Address []:

Setting up Apache

if you dont know where your httpd.conf file is. 

locate httpd.conf

go to the directory, or edit the file.

vim /etc/httpd/conf/httpd.conf

php_admin_value engine Off
    ServerAdmin mrAwesomeVic
    DocumentRoot /var/www/html/TeamPass-2.1.22
    ErrorLog logs/test.bjorn.custom-error_log
    CustomLog logs/test.bjorn.access_log common

    SSLEngine on
    SSLCertificateFile /var/www/mysitename.crt
    SSLCertificateKeyFile /var/www/mysitename.key
#    SSLCertificateChainFile /var/www/intermediate.crt #this is only used if you have a certificate chain




   RewriteEngine on
   ReWriteCond %{SERVER_PORT} !^443$
   RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [NC,R,L]

   RewriteEngine on
   ReWriteCond %{SERVER_PORT} !^443$
   RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [NC,R,L]

What I used for the self signed certs

• sslshopper

#bearMan

Linux SSH Port Change

How to Change SSH PORT

vi Into sshd_conf

vi /etc/ssh/sshd_config

Then go to
#Port 22

Un-comment line, and change to desired port.

service sshd restart

#bearMan

Linux: Less

Less Is More

Wait what?

I don't agree with that statement generally, but when it comes to linux, well yea "less".

I know many people that like to tail log files, my preferred method.

Less

Less /path/to/log/file

My Observations:

It opens up a vim like terminal application that you can follow the logs and if needed, look into the logs.

Some Commands

ctrl+f = This is to go to the bottom

shift+f = This is to follow
ctrl+c = Cancel

q = Quit

#bearMan

Linux: List all Users

Linux: List all Users

cat /etc/passwd |grep "/home" |cut -d: -f1

If the user is not in the /home directory, this will not show.

If you want to get all Users:

cat /etc/passwd |grep "/" |cut -d: -f1

Reference
linuxquestions.org

#bearMan

Learning - I think every Linux user should know these three commands

Background

I was doing some downloading on a remote linux machine that I did not have a GUI for, I was only able to access the system through SSH. The problem with this was that I did not want to risk the download stopping if my connection to the server was lost. So my first problem, was learning screen.
After that I ran into another issue, how was I going to copy this file from the remote server to my local machine.

The Process

My First problem was how do I get a "extra" screen or terminal. The Solution was quite literally screen.
There are a number of really good tutorials out there, that can help one get to become a master with this application. I don't really want to become a master, but I wanted to know how to use this.
So firstly I installed it using yum.

yum install screen

wow ok, that was deceptively simple.
How do I use this,

screen -?

Cool
we want to create a new screen/ R seems to be ok.

screen -R

ok well, looks like nothing has changed. Lets test.
Opens another SSH Session and run

screen -list

Ok cool, there was a result and looks good.

Awesome

So lets go, download that file. (Making sure I was in the correct SSH Session, I closed the session that I used to check.) wget my file, the command is pretty simple wget -O '<From>' <to>

Not to sure if this was the best way to do this, but was the way I used and seemed to work.

Downloaded the file, completed, wanted to make sure the md5 was the same, md5sum the file. Once that was completed I got an output of the md5 and the file name.

Next problem, I need to get that file from the server. SCP to the rescue! Quick google search provided me with a solution, scp the file from server to my machine.

No problems, scp <user>@<computer>:<file> <toFile>.

Done!

To Long, Short Version

Basically the commands I think everyone should know are how to scp from one machine to another, md5 a file and screen.

scp

scp <user>@<computer>:<file> <toFile>

md5

md5sum <file>

screen

screen -R, either creates or resumes a screen session.

while in screen

ctrl + a

ctrl + d

"Closes" screen and resumes with normal terminal.

#bearMan saving mySelf.

Linux - Disable Root SSH Access

Disable Root SSH Access

I needed to disable root ssh access without disabling root user or su - root.

in order to do this, it really is easy.

edit /etc/ssh/sshd_config

To do this you can use vi:

vi /etc/ssh/sshd_config

find the line that says:

#PermitRootLogin yes

change that line to

PermitRootLogin no

save and restart sshd

you can do that by:

/etc/init.d/sshd restart

now root cannot be logged in through ssh anymore.

#bearMan

Linux - Routing

Linux - Routing

So in the past week I have had a challenge with regards to Routing in IPTABLES, and one of the problems I faced was I had no GUI to implement it, only terminal.

I needed routing enabled on network card: eth0

I am assuming you are logged in as root.

IPTables

The first thing we need to do is check to see if iptables are enabled, or just enable them.
One way to see if your iptables are enabled it to run

iptables -L

iptables -L

to enable the iptables temporarily, run

iptables start

if you want to enable iptables on boot us this

chkconfig iptables on

Routing

Now that we have iptables enabled, we can start with the forwarding.

Firstly check to see if the network device has forwarding enabled

by running 

cat /proc/sys/net/ipv4/conf/eth0/forwarding

if this returns 0, run this

echo '1' > /proc/sys/net/ipv4/conf/eth0/forwarding

Now that this is enabled, we need to enable MASQUERADE.

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Ok, so I needed to route two ports, SSH and HTTP, the IP i needed routing two was 192.168.1.18
To do that I used these commands:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 9022 -j DNAT --to 192.168.1.18:22
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 9001 -j DNAT --to 192.168.1.18:80

To make sure these have been enabled, you can use more than one command but the one I prefer is

iptables -t nat -L -n -v

Note: This is what I did to get routing working on OEL5, if this does not work for you, please leave a comment and I will try help you as much as I can.

#bearMan out.

Linux - Port Scan Command

Linux - Port Scan Command

Yesterday I was tasked to get open and closed ports on a specific IP address.

I found a website that I started from http://www.catonmat.net/blog/tcp-port-scanner-in-bash/

Once I was there I modified his one procedure and came up with mine.

scan() {
  if [[ -z $1 || -z $2 ]]; then
    echo "Usage: $0 <host> <port, ports, or port-range>"
    return
  fi

  local host=$1
  local ports=()
  local endS=0
  local exS=''
  case $2 in
    *-*)
      IFS=- read start end <<< "$2"

      if ((end - start > 10)); then
        endS=$start
        while [ $endS -lt  $(($end-10)) ]; do
          endS=$(($endS+10));
          (scan $host $(($endS-10))-$endS) &
        done
        wait
        echo "done $(date -d "today" +"%Y%m%d%H%M")"
        return
      fi

      for ((port=start; port <= end; port++)); do
        ports+=($port)
      done
      ;;
    *,*)
      IFS=, read -ra ports <<< "$2"
      ;;
    *)
      ports+=($2)
      ;;
  esac

  for port in "${ports[@]}"; do
    timeout 1 bash -c  "echo >/dev/tcp/$host/$port" &&
      echo -e "<$(date -d "today" +"%Y%m%d%H%M")>\t<$host>\tport $port is open" >> ~/Documents/@hack/log-$host.log ||
        echo -e "<$(date -d "today" +"%Y%m%d%H%M")>\t<$host>\tport $port NOT open" >> ~/Documents/@hack/log-$host.log
  done
}

Example use:

scan www.bjorn.co.za 80

#bearMan

Linux - Display Firewall Rules

Linux - Display Firewall Rules

iptables -L -n

This will display all the firewall Rules

Commands I often use.

#bearMan

Linux - Search History

Linux - Search History

An awesome command Kevin Stroud showed me.

history | grep <Search Term>

#bearMan