Skip to content

OpenSSH SFTP远程溢出漏洞

近日曝出OpenSSH SFTP 远程溢出漏洞。OpenSSH服务器中如果OpenSSH服务器中没有配置”ChrootDirectory”，普通用户就可以访问所有文件系统的资源，包括 /proc，在>=2.6.x的Linux内核上，/proc/self/maps会显示你的内存布局，/proc/self/mem可以让你任意在当前进程上下文中读写，而综合两者特性则可以造成远程溢出。

目前受影响的版本是<=OpenSSH 6.6，安恒信息建议使用该系统的用户尽快升级到最新版本OpenSSH 6.7, OpenSSH 6.7包含了降低风险的方案：sftp-server使用prctl()来阻止直接访问/proc/self/{mem,maps}。Grsecurity/PaX直接禁止了/proc/pid/mem的可写，所以如果您的生产环境中部署了Grsecurity/PaX的话这个漏洞可以不用担心。

OpenSSH 6.7下载地址：

ftp://ftp.openbsd.com/pub/OpenBSD/OpenSSH/portable/openssh-6.7p1.tar.gz

参考信息：

http://seclists.org/fulldisclosure/2014/Oct/35

注：首先你需要有权限登录的用户才能干点事。

Posted in 安全通告.

Tagged with , , .

rev="post-1710" No comments

By C1G – 2014/10/11

曝Bash安全漏洞 比心血还严重 附测试及补救

20140925曝出的来的漏洞,该漏洞对电脑用户构成的威胁可能比今年4月发现的“心脏流血”(Heartbleed)漏洞更大. 网络安全公司Rapid7工程部经理托德·贝尔德斯利(Tod Beardsley)警告称，Bash漏洞的严重级别为“10”，意味着它对用户电脑的威胁最大。Bash漏洞的利用复杂度级别为“低”，意味着黑客可以相对轻松地利用它发动攻击。

测试方法,执行下面命令

$ env x='() { :;}; echo vulnerable’ bash -c “echo this is a test” vulnerable this is a test

出现上面文字侧需要打补丁了.

我试了下centos5.4 5.5 6.0等都有问题 GNU bash, version 3.2.25(1)-release-(x86_64-redhat-linux-gnu) GNU bash, version 4.1.2(1)-release-(x86_64-unknown-linux-gnu)

补救

yum -y update bash

升级后再测

env x='() { :;}; echo vulnerable’ bash -c “echo this is a test” bash: warning: x: ignoring function definition attempt bash: error importing function definition for `x’ this is a test

如上显示就已修复

参考: https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/

Posted in 安全通告.

Tagged with , .

rev="post-1707" No comments

By C1G – 2014/09/25

centos固定多网卡启动顺序

系统插上PCI网卡每次重启后顺序可能都会不同,影响nagios检控准确度.

CentOS6

在CentOS6中，具体网卡的配置文件在/etc/udev/rules.d/70-persistent-net.rules cat /etc/udev/rules.d/70-persistent-net.rules

# PCI device 0x14e4:0x163b (bnx2) (custom name provided by external tool) SUBSYSTEM==”net”, ACTION==”add”, DRIVERS==”?*”, ATTR{address}==”78:2b:cb:xx:xx:02″, ATTR{type}==”1″, KERNEL==”eth*”, NAME=”eth1″ # PCI device 0x14e4:0x163b (bnx2) (custom name provided by external tool) SUBSYSTEM==”net”, ACTION==”add”, DRIVERS==”?*”, ATTR{address}==”78:2b:cb:xx:xx:03″, ATTR{type}==”1″, KERNEL==”eth*”, NAME=”eth2″ # USB device 0x9710:0x7830 (usb) (custom name provided by external tool) SUBSYSTEM==”net”, ACTION==”add”, DRIVERS==”?*”, ATTR{address}==”00:60:6e:xx:xx:f6″, ATTR{type}==”1″, KERNEL==”eth*”, NAME=”eth0″ # PCI device 0x14e4:0x165a (tg3) SUBSYSTEM==”net”, ACTION==”add”, DRIVERS==”?*”, ATTR{address}==”00:10:18:xx:xx:51″, ATTR{type}==”1″, KERNEL==”eth*”, NAME=”eth3″ # PCI device 0x8086:0x10c9 (igb) SUBSYSTEM==”net”, ACTION==”add”, DRIVERS==”?*”, ATTR{address}==”00:1b:21:xx:xx:a1″, ATTR{type}==”1″, KERNEL==”eth*”, NAME=”eth4″ # PCI device 0x8086:0x10c9 (igb) SUBSYSTEM==”net”, ACTION==”add”, DRIVERS==”?*”, ATTR{address}==”00:1b:21:xx:xx:a0″, ATTR{type}==”1″, KERNEL==”eth*”, NAME=”eth5″

删除(usb),(tg3)并调整bnx2及igb的名称,调整后如下

# PCI device 0x14e4:0x163b (bnx2) (custom name provided by external tool) SUBSYSTEM==”net”, ACTION==”add”, DRIVERS==”?*”, ATTR{address}==”78:2b:cb:xx:xx:02″, ATTR{type}==”1″, KERNEL==”eth*”, NAME=”eth0″ # PCI device 0x14e4:0x163b (bnx2) (custom name provided by external tool) SUBSYSTEM==”net”, ACTION==”add”, DRIVERS==”?*”, ATTR{address}==”78:2b:cb:xx:xx:03″, ATTR{type}==”1″, KERNEL==”eth*”, NAME=”eth1″ # PCI device 0x8086:0x10c9 (igb) SUBSYSTEM==”net”, ACTION==”add”, DRIVERS==”?*”, ATTR{address}==”00:1b:21:xx:xx:a1″, ATTR{type}==”1″, KERNEL==”eth*”, NAME=”eth2″ # PCI device 0x8086:0x10c9 (igb) SUBSYSTEM==”net”, ACTION==”add”, DRIVERS==”?*”, ATTR{address}==”00:1b:21:xx:xx:a0″, ATTR{type}==”1″, KERNEL==”eth*”, NAME=”eth3″

配置网卡文件 同时修改/etc/sysconfig/network-scripts/ifcfg-eth*网卡配置文件,修改设备名和MAC地址和udev对应. 同时注意ip地址和网关.

重启服务器 reboot

centos5.8

dmesg中看到intel的pci网卡先于内置网卡

e1000e: Intel(R) PRO/1000 Network Driver – 1.4.4-k e1000e: Copyright(c) 1999 – 2011 Intel Corporation. e1000e 0000:03:00.0: Disabling ASPM L1 GSI 25 sharing vector 0x52 and IRQ 25 ACPI: PCI Interrupt 0000:03:00.0[A] -> GSI 38 (level, low) -> IRQ 82 PCI: Setting latency timer of device 0000:03:00.0 to 64 EDAC MC: Ver: 2.0.1 Feb 21 2012 e1000e 0000:03:00.0: eth0: (PCI Express:2.5GT/s:Width x4) 00:15:17:2d:52:c4 e1000e 0000:03:00.0: eth0: Intel(R) PRO/1000 Network Connection e1000e 0000:03:00.0: eth0: MAC: 0, PHY: 4, PBA No: D28207-005 e1000e 0000:03:00.1: Disabling ASPM L1 GSI 26 sharing vector 0x62 and IRQ 26 ACPI: PCI Interrupt 0000:03:00.1[B] -> GSI 45 (level, low) -> IRQ 98 PCI: Setting latency timer of device 0000:03:00.1 to 64 sd 0:0:0:0: Attached scsi generic sg0 type 0 sd 0:0:1:0: Attached scsi generic sg1 type 0 scsi 3:0:0:0: Attached scsi generic sg2 type 5 e1000e 0000:03:00.1: eth1: (PCI Express:2.5GT/s:Width x4) 00:15:17:2d:52:c5 e1000e 0000:03:00.1: eth1: Intel(R) PRO/1000 Network Connection e1000e 0000:03:00.1: eth1: MAC: 0, PHY: 4, PBA No: D28207-005 bnx2: Broadcom NetXtreme II Gigabit Ethernet Driver bnx2 v2.1.11 (July 20, 2011) GSI 27 sharing vector 0x72 and IRQ 27 ACPI: PCI Interrupt 0000:01:00.0[A] -> GSI 36 (level, low) -> IRQ 114 PCI: Setting latency timer of device 0000:01:00.0 to 64 eth2: Broadcom NetXtreme II BCM5716 1000Base-T (C0) PCI Express found at mem da000000, IRQ 114, node addr 0024e86cd577 GSI 28 sharing vector 0x7A and IRQ 28 ACPI: PCI Interrupt 0000:01:00.1[B] -> GSI 48 (level, low) -> IRQ 122 PCI: Setting latency timer of device 0000:01:00.1 to 64 eth3: Broadcom NetXtreme II BCM5716 1000Base-T (C0) PCI Express found at mem dc000000, IRQ 122, node addr 0024e86cd578 sr0: scsi3-mmc drive: 24x/24x cd/rw xa/form2 cdda tray

cat /etc/udev/rules.d/60-net.rules

ACTION==”add”, SUBSYSTEM==”net”, IMPORT{program}=”/lib/udev/rename_device” SUBSYSTEM==”net”, RUN+=”/etc/sysconfig/network-scripts/net.hotplug”

查看driver和bus-info ethtool -i eth0 driver: bnx2 version: 2.1.11 firmware-version: bc 4.6.4 NCSI 1.0.6 bus-info: 0000:01:00.0 ethtool -i eth1 driver: bnx2 version: 2.1.11 firmware-version: bc 4.6.4 NCSI 1.0.6 bus-info: 0000:01:00.1 ethtool -i eth2 driver: e1000e version: 1.4.4-k firmware-version: 5.11-2 bus-info: 0000:03:00.0 ethtool -i eth3 driver: e1000e version: 1.4.4-k firmware-version: 5.11-2 bus-info: 0000:03:00.1

编辑顺序 DRIVER指driver: e1000e ID是指bus-info:PCI ID

vi /etc/udev/rules.d/60-net.rules

DRIVER==”bnx2″,ID==”0000:01:00.0″,NAME=”eth0″ DRIVER==”bnx2″,ID==”0000:01:00.1″,NAME=”eth1″ DRIVER==”e1000e”,ID==”0000:03:00.0″,NAME=”eth2″ DRIVER==”e1000e”,ID==”0000:03:00.1″,NAME=”eth3″

重启 reboot

input: PC Speaker as /class/input/input0 bnx2: Broadcom NetXtreme II Gigabit Ethernet Driver bnx2 v2.1.11 (July 20, 2011) GSI 25 sharing vector 0x52 and IRQ 25 ACPI: PCI Interrupt 0000:01:00.0[A] -> GSI 36 (level, low) -> IRQ 82 PCI: Setting latency timer of device 0000:01:00.0 to 64 eth0: Broadcom NetXtreme II BCM5716 1000Base-T (C0) PCI Express found at mem da000000, IRQ 82, node addr 0024e86cd577 GSI 26 sharing vector 0x5A and IRQ 26 ACPI: PCI Interrupt 0000:01:00.1[B] -> GSI 48 (level, low) -> IRQ 90 PCI: Setting latency timer of device 0000:01:00.1 to 64 eth1: Broadcom NetXtreme II BCM5716 1000Base-T (C0) PCI Express found at mem dc000000, IRQ 90, node addr 0024e86cd578 EDAC MC: Ver: 2.0.1 Feb 21 2012 e1000e: Intel(R) PRO/1000 Network Driver – 1.4.4-k e1000e: Copyright(c) 1999 – 2011 Intel Corporation. e1000e 0000:03:00.0: Disabling ASPM L1 GSI 27 sharing vector 0x62 and IRQ 27 ACPI: PCI Interrupt 0000:03:00.0[A] -> GSI 38 (level, low) -> IRQ 98 PCI: Setting latency timer of device 0000:03:00.0 to 64 sd 0:0:0:0: Attached scsi generic sg0 type 0 sd 0:0:1:0: Attached scsi generic sg1 type 0 scsi 3:0:0:0: Attached scsi generic sg2 type 5 e1000e 0000:03:00.0: eth2: (PCI Express:2.5GT/s:Width x4) 00:15:17:2d:52:c4 e1000e 0000:03:00.0: eth2: Intel(R) PRO/1000 Network Connection e1000e 0000:03:00.0: eth2: MAC: 0, PHY: 4, PBA No: D28207-005 e1000e 0000:03:00.1: Disabling ASPM L1 GSI 28 sharing vector 0x72 and IRQ 28 ACPI: PCI Interrupt 0000:03:00.1[B] -> GSI 45 (level, low) -> IRQ 114 PCI: Setting latency timer of device 0000:03:00.1 to 64 e1000e 0000:03:00.1: eth3: (PCI Express:2.5GT/s:Width x4) 00:15:17:2d:52:c5 e1000e 0000:03:00.1: eth3: Intel(R) PRO/1000 Network Connection e1000e 0000:03:00.1: eth3: MAC: 0, PHY: 4, PBA No: D28207-005 sr0: scsi3-mmc drive: 24x/24x cd/rw xa/form2 cdda tray

nagios的check_traffic.sh脚本查看顺序 ./check_traffic.sh -V 2c -C privatepass -H localhost -L

List Interface for host localhost. Interface index 1 orresponding to lo Interface index 2 orresponding to eth0 Interface index 3 orresponding to eth1 Interface index 4 orresponding to eth2 Interface index 5 orresponding to eth3

Posted in linux 维护优化.

Tagged with , .

rev="post-1703" No comments

By C1G – 2014/09/24

nagios 监控redis

安装redis支持 perl -MCPAN -e shell cpan>install Redis

下载check_redis.pl http://exchange.nagios.org/directory/Plugins/Databases/check_redis-2Epl/details https://github.com/willixix/WL-NagiosPlugins

测试 ./check_redis.pl -H 192.168.0.130 -p 6379 -a ‘connected_clients,blocked_clients’ -w ~,~ -c ~,~ -f

OK: REDIS 2.6.12 on 192.168.0.130:6379 has 1 databases (db0) with 49801 keys, up 3 days 14 hours – connected_clients is 1, blocked_clients is 0 | connected_clients=1 blocked_clients=0

commands.cfg添加

define command { command_name check_redis command_line $USER1$/check_redis.pl -H $HOSTADDRESS$ -p $ARG1$ -a $ARG2$ -w $ARG3$ -c $ARG4$ -f }

加入主机监控

define service{ use local-service ; Name of service template to use host_name c1gredis service_description redis check_command check_redis!6379!’connected_clients,blocked_clients’!~,~!~,~ notifications_enabled 0 }

重新载入配置。

/etc/init.d/nagios reload

参考: http://exchange.nagios.org/directory/Plugins/Databases/check_redis-2Epl/details http://www.ttlsa.com/nagios/nagios-redis-monitor/ http://bbs.linuxtone.org/thread-6241-1-1.html

Posted in Nagios.

Tagged with , .

rev="post-1700" No comments

By C1G – 2014/09/22

Analog的安装与配置,分析汇总多域名web日志

Analog是一款基于C语言功能强大的开源的网站访问日志分析软件,支持多语言(含中文),可以运行在linux,windows下,支持apache、ngix、iis等主流WEB日志.速度飞快，10分钟内可以处理2千万条日志,数据统计以PV为主,相比Awstats和Webalizer 的报告页面简单了点，更漂亮的图表可用Report Magic 2.21.

目前最新版为analog-6.0,作者自19-Dec-04后就没更新过.演示地址 安装很简单,到:http://www.analog.cx/download.html 下载相应的版本,这里以源码版为例:将下载回来的源码包解压到安装目录,再进入该目录执行make命令即可.

wget http://www.analog.cx/analog-6.0.tar.gz tar zxvf analog-6.0.tar.gz cp -ar analog-6.0 /usr/local/ cd /usr/local/analog-6.0 make ln -s analog-6.0 analog mkdir /opt/htdocs/www/analog chown www:website /opt/htdocs/www/analog cp images /opt/htdocs/www/analog/ mkdir conf cp analog.cfg conf/c1g.cfg

配置

vi conf/c1g.cfg

#定义为中文 LANGUAGE SIMP-CHINESE #nginx日志格式 LOGFORMAT (%s – %j [%d/%M/%Y:%h:%n:%j %j] “%j %r %j” %c %b “%f” “%B”\n) #日志文件 LOGFILE /opt/log/Y.%M/*/*c1gstudio.com.log.gz #输出文件 OUTFILE /opt/htdocs/www/analog/c1gstudiolY.%M/index.html #主机名 HOSTNAME “c1gstudio.com” #主机URL HOSTURL http://www.c1gstudio.com/ #web图片目录 IMAGEDIR ../images/ #只列出访问最高的200个页面URL REQFLOOR 1000p #forum.php文件算一个文件 FILEALIAS /forum.php* /forum.php #统计子目录 SUBDIR */*

LOGFORMAT 说明

%S host (the client hostname, or address of the computer making the request) %s numerical IP address of client (if recorded in a separate field; used when %S is empty) %r file requested %q query string (part of filename after ?, if recorded in a separate field) %B browser %A browser with +’s instead of spaces %f referrer %u user (tip: a cookie or session id can usefully be defined as %u too) %v virtual host (the server hostname, also called the virtual domain) %d day of the month %m month in digits %M month, three letter English abbreviation %y year, last two digits %Y year, four digits %Z year, two or four digits (less efficient) %h hour of the day %n minute of the hour %a a or A for am, or p or P for pm, if %h is in the 12-hour clock. (So to match “am” you need %am and to match “AM” you need %aM) %U “Unix time” (seconds since beginning of 1970, GMT). If it includes decimals, use %U.%j %b number of bytes transferred %t processing time in seconds %T processing time in milliseconds %D processing time in microseconds %c HTTP status code %C code words used instead of HTTP status code in some servers — only used internally %j junk: ignore this field (field can be empty too) %w white space: spaces or tabs %W optional white space %% % sign \n new line \t tab stop \\ single backslash

我的nginx日志格式

‘$remote_addr – $remote_user [$time_local] “$request” ‘ ‘$status $body_bytes_sent “$http_referer” ‘ ‘”$http_user_agent” $http_x_forwarded_for’; 183.62.5.13 – – [06/Aug/2014:17:16:44 +0800] “GET /aboutc1g.html HTTP/1.1” 200 6642 “http://www.c1gstudio.com/web/hello.html” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36” 183.62.5.13

我这多了个$http_x_forwarded_for’,后面也要加个%j表示丢弃,它不会处理”-“

LOGFORMAT (%s – %j [%d/%M/%Y:%h:%n:%j %j] “%j %r %j” %c %b “%f” “%B” %j\n)

更多参考

LOGFILE 和OUTFILE说明

LOGFILE new1.log,old.log LOGFILE /opt/log/%Y.%M/%D/.c1gstudio.com.log.gz 支持通配符,日期变量及gz压缩,OUTFILE不会自动创建目录

%D date of month %m month name, in English %M month number %y two-digit year %Y four-digit year %H hour %n minute %w day of week, in English

但是日期不支持运算有点麻烦,需要外部用shell来解决了 更多参考

2014-8-26更新

The arguments to LOGFILE and CACHEFILE commands are checked for containing only certain allowed characters (specifically, letters, digits, /\.:_*? space, and – between two {letter, digit, underscore}’s). This is because they could match an UNCOMPRESS command and thus be passed to the shell when the uncompress command is popen()’ed.

可以将一个月份分成3部分来减轻压力 LOGFILE /opt/log/%Y.%M/[2-3]?/*.c1gstudio.com.log.gz Analog运行时会将日志读到内存中,想要运行快最好准备比日志大的内存,CACHEOUTFILE和CACHEFILE会占用大量空间,感觉没什么用.

配置文件内统计开关变量

MONTHLY ON # one line for each month WEEKLY ON # one line for each week DAILYREP ON # one line for each day DAILYSUM ON # one line for each day of the week HOURLYREP ON # one line for each hour of the day GENERAL ON # the General Summary at the top REQUEST ON # which files were requested FAILURE ON # which files were not found DIRECTORY ON # Directory Report HOST ON # which computers requested files ORGANISATION ON # which organisations they were from DOMAIN ON # which countries they were in REFERRER ON # where people followed links from FAILREF ON # where people followed broken links from SEARCHQUERY ON # the phrases and words they used… SEARCHWORD ON # …to find you from search engines BROWSERSUM ON # which browser types people were using OSREP ON # and which operating systems FILETYPE ON # types of file requested SIZE ON # sizes of files requested STATUS ON # number of each type of success and failure

命令行参数

x GENERAL General Summary 1 YEARLY Yearly Report Q QUARTERLY Quarterly Report m MONTHLY Monthly Report W WEEKLY Weekly Report D DAILYREP Daily Report d DAILYSUM Daily Summary H HOURLYREP Hourly Report h HOURLYSUM Hourly Summary w WEEKHOUR Hour of the Week Summary 4 QUARTERREP Quarter-Hour Report 6 QUARTERSUM Quarter-Hour Summary 5 FIVEREP Five-Minute Report 7 FIVESUM Five-Minute Summary S HOST Host Report l REDIRHOST Host Redirection Report L FAILHOST Host Failure Report Z ORGANISATION Organisation Report o DOMAIN Domain Report r REQUEST Request Report i DIRECTORY Directory Report t FILETYPE File Type Report z SIZE File Size Report P PROCTIME Processing Time Report E REDIR Redirection Report I FAILURE Failure Report f REFERRER Referrer Report s REFSITE Referring Site Report N SEARCHQUERY Search Query Report n SEARCHWORD Search Word Report Y INTSEARCHQUERY Internal Search Query Report y INTSEARCHWORD Internal Search Word Report k REDIRREF Redirected Referrer Report K FAILREF Failed Referrer Report B BROWSERREP Browser Report b BROWSERSUM Browser Summary p OSREP Operating System Report v VHOST Virtual Host Report R REDIRVHOST Virtual Host Redirection Report M FAILVHOST Virtual Host Failure Report u USER User Report j REDIRUSER User Redirection Report J FAILUSER User Failure Report c STATUS Status Code Report

#+a可以带上全部统计 更多参考

#输出当前配置 analog -settings > file

#使用命令行配置LOGFILE和OUTFILE ./analog +O/opt/htdocs/www/analog/c1gstudio2014.html /opt/log/2014.08/02/*.c1gstudio.com.log.gz 我使用时一直会报日志格式错误,无法出报告

#我使用的参数 /usr/local/analog -G +g/usr/local/analog/conf/c1g.cfg +b +s +S -n -o -Z -r +b 浏览器概要报告 -n 检索字报告 +s 来源网站报告 -o 网域报告 -Z 来源组织单位报告 +S 主机报告 -r 请求报告

-G 不读analog.cfg +g读取自定义配置文件

我这每日报告用awstats统计,每月报告用analog统计,每个域名汇总一个月报告. 日志按天存放在/opt/log/2014.08/07/目录下 www.c1gstudio.com.log.gz blog.c1gstudio.com.log.gz www.c1g.com.log.gz

每日运行完awstats后运行analog crontab

10 5 * * * /bin/sh /opt/shell/analog.sh > /dev/null 2>&1

vi /opt/shell/analog.sh

#!/bin/sh ana_dir=/usr/local/analog/ web_dir=/opt/htdocs/www/analog/ conf_dir=”${ana_dir}/conf/” today=`date +%d` yesterday=`date +%Y%m%d` lastday_month=`date +%Y.%m -d ‘1 day ago’` lastday_day=`date +%d -d ‘1 day ago’` c1g_LOGFILE=/opt/log/${lastday_month}/*/*c1gstudio.com.log.gz c1g_OUTFILE=${web_dir}c1gstudio${lastday_month}/index.html POST_LOGFILE=/opt/log/${lastday_month}/*/c1g.com.log.gz POST_OUTFILE=${web_dir}c1g${lastday_month}/index.html #if [ $today == “02” ]; then if [ ! -d $(dirname “${c1g_OUTFILE}”) ]; then mkdir -p $(dirname “${c1g_OUTFILE}”) chown www:website $(dirname “${c1g_OUTFILE}”) fi if [ ! -d $(dirname “${POST_OUTFILE}”) ]; then mkdir -p $(dirname “${POST_OUTFILE}”) chown www:website $(dirname “${POST_OUTFILE}”) fi sed -i “s;LOGFILE.*;LOGFILE ${c1g_LOGFILE};” ${conf_dir}c1gstudio.cfg sed -i “s;OUTFILE.*;OUTFILE ${c1g_OUTFILE};” ${conf_dir}c1gstudio.cfg sed -i “s;LOGFILE.*;LOGFILE ${POST_LOGFILE};” ${conf_dir}c1g.cfg sed -i “s;OUTFILE.*;OUTFILE ${POST_OUTFILE};” ${conf_dir}c1g.cfg #fi ${ana_dir}analog -G +g${conf_dir}c1gstudio.cfg +b +D -d +s +S -n -o -Z -r ${ana_dir}analog -G +g${conf_dir}c1g.cfg +b +D -d +s +S -n -o -Z +r

Posted in 日志.

Tagged with , .

rev="post-1691" No comments

By C1G – 2014/08/08

升级postfix至postfix-2.10.3

已有sasl2和mysql情况下

chkconfig sendmail off /etc/rc.d/init.d/sendmail stop

关闭原有的sendmail：

mv /usr/sbin/sendmail /usr/sbin/sendmail.OFF mv /usr/bin/newaliases /usr/bin/newaliases.OFF mv /usr/bin/mailq /usr/bin/mailq.OFF chmod 755 /usr/sbin/sendmail.OFF /usr/bin/newaliases.OFF /usr/bin/mailq.OFF

文件解锁,可省略

chattr -i /etc/passwd /etc/shadow /etc/group /etc/gshadow /etc/services

添加用户和组,已有可省略

groupadd -g 2525 postfix useradd -g postfix -u 2525 -s /sbin/nologin -M postfix groupadd -g 2526 postdrop useradd -g postdrop -u 2526 -s /sbin/nologin -M postdrop

sasl升级安装

ftp://ftp.cyrusimap.org/cyrus-sasl/cyrus-sasl-2.1.26.tar.gz tar zxvf cyrus-sasl-2.1.26.tar.gz cd cyrus-sasl-2.1.26 ./configure –prefix=/usr/local/sasl2 –disable-gssapi –disable-anon –disable-sample –disable-digest –enable-plain –enable-login –enable-sql make make install 移除旧版 mv /usr/lib/libsasl2.a /usr/lib/libsasl2.a.OFF mv /usr/lib/libsasl2.la /usr/lib/libsasl2.la.OFF mv /usr/lib/libsasl2.so.2.0.19 /usr/lib/libsasl2.so.2.0.19.OFF mv /usr/lib/sasl2 /usr/lib/sasl2.OFF rm /usr/lib/libsasl2.so rm /usr/lib/libsasl2.so.2 ln -sv /usr/local/sasl2/lib/* /usr/lib postfix 2.3以后的版本会分别在/usr/local/lib和/usr/local/include中搜索sasl库文件及头文件，故还须将其链接至此目录中： ln -sv /usr/local/sasl2/lib/* /usr/local/lib ln -sv /usr/local/sasl2/include/sasl/* /usr/local/include postfix升级安装 wget ftp://ftp.reverse.net/pub/postfix/official/postfix-2.10.3.tar.gz tar xfv postfix-2.10.3.tar.gz cd postfix-2.10.3 make tidy make -f Makefile.init makefiles ‘CCARGS=-DUSE_SASL_AUTH -I/usr/local/sasl2’ ‘AUXLIBS=-L/usr/local/sasl2 -lsasl2 ‘ make && make install 安装配置 /bin/sh postfix-install Warning: if you use this script to install Postfix locally, this script will replace existing sendmail or Postfix programs. Make backups if you want to be able to recover. Before installing files, this script prompts you for some definitions. Most definitions will be remembered, so you have to specify them only once. All definitions should have a reasonable default value. Please specify the prefix for installed file names. Specify this ONLY if you are building ready-to-install packages for distribution to OTHER machines. See PACKAGE_README for instructions. install_root: [/] Please specify a directory for scratch files while installing Postfix. You must have write permission in this directory. tempdir: [/root/src/lempelf/packages/postfix-2.10.3] /tmp Please specify the final destination directory for installed Postfix configuration files. config_directory: [/etc/postfix] /etc/postfix Please specify the final destination directory for installed Postfix administrative commands. This directory should be in the command search path of adminstrative users. command_directory: [/usr/sbin] /usr/local/postfix/libexec Please specify the final destination directory for installed Postfix daemon programs. This directory should not be in the command search path of any users. daemon_directory: [/usr/libexec/postfix] /usr/local/postfix/sbin Please specify the final destination directory for Postfix-writable data files such as caches or random numbers. This directory should not be shared with non-Postfix software. data_directory: [/var/lib/postfix] Please specify the final destination directory for the Postfix HTML files. Specify “no” if you do not want to install these files. html_directory: [no] Please specify the owner of the Postfix queue. Specify an account with numerical user ID and group ID values that are not used by any other accounts on the system. mail_owner: [postfix] Please specify the final destination pathname for the installed Postfix mailq command. This is the Sendmail-compatible mail queue listing command. mailq_path: [/usr/bin/mailq] Please specify the final destination directory for the Postfix on-line manual pages. You can no longer specify “no” here. manpage_directory: [/usr/local/man] Please specify the final destination pathname for the installed Postfix newaliases command. This is the Sendmail-compatible command to build alias databases for the Postfix local delivery agent. newaliases_path: [/usr/bin/newaliases] Please specify the final destination directory for Postfix queues. queue_directory: [/var/spool/postfix] Please specify the final destination directory for the Postfix README files. Specify “no” if you do not want to install these files. readme_directory: [no] Please specify the final destination pathname for the installed Postfix sendmail command. This is the Sendmail-compatible mail posting interface. sendmail_path: [/usr/sbin/sendmail] Please specify the group for mail submission and for queue management commands. Specify a group name with a numerical group ID that is not shared with other accounts, not even with the Postfix mail_owner account. You can no longer specify “no” here. setgid_group: [postdrop] 重新关联 newaliases chown root /etc/postfix/main.cf chown -R postfix:postdrop /var/spool/postfix chown -R postfix:postdrop /var/lib/postfix/ chown root /var/spool/postfix chown -R root /var/spool/postfix/pid vi /etc/postfix/main.cf 修改以下几项为您需要的配置 myhostname = mail.c1gstudio.com myorigin = c1gstudio.com mydomain = c1gstudio.com mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain mynetworks = 192.168.1.0/24, 127.0.0.0/8 启动 sendmail -bd 测试 mail -s “test” [email protected]

Posted in Mail/Postfix.

Tagged with .

rev="post-1685" No comments

By C1G – 2014/07/16

微信公众平台开发

最近在做微信公众平台开发,推荐这个 微信公众平台开发入门教程.做的不错一遍看下来就明白了.

官方文档:http://mp.weixin.qq.com/wiki/index.php

Posted in 文档理论.

Tagged with , .

rev="post-1683" No comments

By C1G – 2014/07/15

部署snort+base入侵检测系统

【简 介】 　　Snort是一个轻便的网络入侵检测系统，可以完成实时流量分析和对网络上的IP包登录进行测试等功能，能完成协议分析，内容查找／匹配，能用来探测多种攻击和嗅探（如缓冲区溢出、秘密断口扫描、CGI攻击、SMB嗅探、拇纹采集尝试等）。

snort 需安装libpcap和dap As of Snort 2.9.0, and DAQ, Snort now requires the use of a libpcap version greater than 1.0. Unfortunately for people using RHEL 5 (and below), CentOS 5.5 (and below), and Fedora Core 11 (and below), there is not an official RPM for libpcap 1.0.

Sourcefire will not repackage libpcap and distribute libpcap with Snort as part of an RPM, as it may cause other problems and will not be officially supported by Redhat.

yum 安装

yum install libpcap libpcap-devel wget http://www.tcpdump.org/release/libpcap-1.4.0.tar.gz tar zxvf libpcap-1.4.0.tar.gz cd libpcap-1.4.0 ./configure make make install cd .. http://code.google.com/p/libdnet/ wget https://libdnet.googlecode.com/files/libdnet-1.12.tgz tar zxvf libdnet-1.12.tgz cd libdnet-1.12 ./configure make && make install cd .. wget http://www.snort.org/downloads/2778 tar zxvf dap-2.0.2.tar.gz cd daq-2.0.2 ./configure –with-libpcap-libraries=/usr/local/lib make make install

添加用户

groupadd snort useradd -g snort snort -s/sbin/nologin

安装snort

cd .. wget http://www.snort.org/downloads/2787 tar zxvf snort-2.9.6.0.tar.gz cd snort-2.9.6.0 ./configure –prefix=/usr/local/snort-2.9.6.0 –with-dnet-libraries=/usr/local/lib/ make make install cd /usr/local ln -s snort-2.9.6.0 snort cd bin ./snort -v

错误

usr/local/snort/bin/snort: error while loading shared libraries: libdnet.1: cannot open shared object file: No such file or directory

解决

export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/lib cp libdnet libdnet.so cp libdnet.1 libdnet.1.so ldconfig

错误

configure: WARNING: unrecognized options: –with-mysql

snort-Snort 2.9.3开始不支持mysql,改用barnyard插件

snort规则下载地址： 1.在http://www.snort.org/ 可以免费下载到社区版 snortrules-snapshot,下载官方rules是需要订阅付费 2.在 http://www.bleedingthreats.net/cgi-bin/viewcvs.cgi/rules/ 可以下载到一个第三方的 rules 文件 rules.tar.gz，这个系列更新也比较频繁,我的snortrules-snapshot-2.8.tar.gz 是在51cto上下载的。 3.BASE 可以从http://sourceforge.net/projects/secureideas/ 获取版本或者用软件SnortCenter是一个基于Web的snort探针和规则管理系统，用于远程修改snort探针的配置，起动、停止探针，编辑、分发snort特征码规则。http://users.telenet.be/larc/download/ 4.Adodb 可以从 http://sourceforge.net/projects/adodb/ 下载.ADODB 是 Active Data Objects Data Base 的简称，它是一种 PHP 存取数据库的中间函式组件

mkdir /usr/local/snort/etc cd /usr/local/snort/etc/ tar zxvf snortrules-snapshot-2956.tar.gz mv etc/* . rm snortrules-snapshot-2956.tar.gz chown -R root:root . vi /usr/local/snort/etc/snort.conf

修改

var RULE_PATH /usr/local/snort/etc/rules var SO_RULE_PATH /usr/local/snort/etc/so_rules var PREPROC_RULE_PATH /usr/local/snort/etc/preproc_rules var WHITE_LIST_PATH /usr/local/snort/etc/rules var BLACK_LIST_PATH /usr/local/snort/etc/rules dynamicpreprocessor directory /usr/local/snort/lib/snort_dynamicpreprocessor/ dynamicengine /usr/local/snort/lib/snort_dynamicengine/libsf_engine.so dynamicdetection directory /usr/local/snort/lib/snort_dynamicrules output unified2: filename /var/log/snort/snort.u2, limit 128 mkdir /usr/local/snort/lib/snort_dynamicrules mkdir /var/log/snort chown snort:snort /var/log/snort touch /usr/local/snort/etc/rules/white_list.rules touch /usr/local/snort/etc/rules/black_list.rules

启动snort

/usr/local/snort/bin/snort -d -u snort -g snort -l /var/log/snort -c /usr/local/snort/etc/snort.conf –== Initialization Complete ==– ,,_ -*> Snort!

The database output plugins are considered deprecated as !! of Snort 2.9.2 and will be removed in Snort 2.9.3.

barnyard知名的开源IDS的日志工具，具有快速的响应速度，优异的数据库写入功能，是做自定义的入侵检测系统不可缺少的插件 http://www.securixlive.com/barnyard2/download.php

安装barnyard2,前提需要你已安装mysql,这里装在/opt/mysql

wget http://www.securixlive.com/download/barnyard2/barnyard2-1.9.tar.gz tar zxvf barnyard2-1.9.tar.gz cd barnyard2-1.9 ./configure –with-mysql=/opt/mysql make make install cp etc/barnyard2.conf /usr/local/snort/etc/ mkdir /var/log/barnyard2 touch /var/log/snort/barnyard2.waldo vi /usr/local/snort/etc/barnyard2.conf config reference_file: /usr/local/snort/etc/reference.config config classification_file: /usr/local/snort/etc/classification.config config gen_file: /usr/local/snort/etc/gen-msg.map config sid_file: /usr/local/snort/etc/sid-msg.map config hostname: localhost config interface: eth0 outdatabase: output database: log, mysql, user=snort password=snort dbname=snort host=localhost

output database配好自已的db地址和密码

在编译目录schemas/create_mysql下有数据库语句,用mysql导入

CREATE USER ‘snort’@’localhost’ IDENTIFIED BY ‘***’; GRANT USAGE ON * . * TO ‘snort’@’localhost’ IDENTIFIED BY ‘***’ WITH MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0 ; GRANT SELECT , INSERT , UPDATE , DELETE , CREATE , DROP , INDEX , ALTER ON `snortdb` . * TO ‘snort’@’localhost’;

安装base和adodb

wget http://jaist.dl.sourceforge.net/project/secureideas/BASE/base-1.4.5/base-1.4.5.tar.gz tar zxvf base-1.4.5.tar.gz chown -R www:website base-1.4.5 mv base-1.4.5 /opt/htdocs/www/ ln -s base-1.4.5 base http://jaist.dl.sourceforge.net/project/adodb/adodb-php5-only/adodb-518-for-php5/adodb518a.zip unzip adodb518a.zip chown -R www:website adodb5 mv adodb5 /opt/htdocs/www/base/adodb5

更新php的pear组件

cd /opt/php/bin ./pear install Image_Graph-alpha Image_Canvas-alpha Image_Color Numbers_Roman Mail_Mime Mail

访问地址并在线安装,就是配制一下 http://localhost:80/base/setup/index.php

测试snort

/usr/local/snort/bin/snort vd -i eth1

Snort还有一个测试功能选项（“－T”），它可以轻松地检测到用户批准的配置变更。你可以输入命令“snort -c /etc/snort/snort.conf -T”，然后查看输出来判断变化的配置是否工作正常。

运行snort,监控eth1入侵并记录日志到mysql中

/usr/local/snort/bin/snort -D -c /usr/local/snort/etc/snort.conf -i eth1 barnyard2 -c /usr/local/snort/etc/barnyard2.conf -d /var/log/snort -f snort.u2 -D -w /var/log/snort/barnyard2.waldo

查看流量 iftop -i eth1

如果有入侵,在base就可以看到记录.

如果需要监控整个交换机的流量,可以在交换机上做端口镜像将流量导入到snort机网卡对应的端口上. 我这里snort机上有4个网卡,监控电信、网通还有内网的流量,剩下一个做管理和转输数据。

vi /usr/local/snort/etc/barnyard2.conf 去掉绝对路径和时间戳

output unified2: filename snort.log, limit 128 mkdir /var/log/snort0 /var/log/snort1 /var/log/snort2 chown snort:snort /var/log/snort0 /var/log/snort1 /var/log/snort2 touch /var/log/snort0/barnyard.waldo touch /var/log/snort1/barnyard.waldo touch /var/log/snort2/barnyard.waldo

运行

/usr/local/snort/bin/snort -D -u snort -g snort -c /usr/local/snort/etc/snort.conf -i eth1 -l /var/log/snort1 barnyard2 -c /usr/local/snort/etc/barnyard2.conf -i eth1 -d /var/log/snort1 -f snort.log -D -w /var/log/snort1/barnyard.waldo /usr/local/snort/bin/snort -D -u snort -g snort -c /usr/local/snort/etc/snort.conf -i eth0 -l /var/log/snort0 barnyard2 -c /usr/local/snort/etc/barnyard2.conf -i eth0 -d /var/log/snort0 -f snort.log -D -w /var/log/snort0/barnyard.waldo /usr/local/snort/bin/snort -D -u snort -g snort -c /usr/local/snort/etc/snort.conf -i eth2 -l /var/log/snort2 barnyard2 -c /usr/local/snort/etc/barnyard2.conf -i eth2 -d /var/log/snort2 -f snort.log -D -w /var/log/snort2/barnyard.waldo

这时用tcpdump或iftop可以看到同交换机上其它机器的流量.

防止攻击snort,去掉网卡ip, 隐密snort方式 依次去掉eth0、eth1、eth2留下内网eth3 ifdown eth1 vi /etc/sysconfig/network-scripts/ifcfg-eth1

#NETMASK=255.255.255.192 #IPADDR=66.84.77.8

ifup eth1

自动启动 vi /etc/rc.local

/usr/local/snort/bin/snort -D -u snort -g snort -c /usr/local/snort/etc/snort.conf -i eth1 -l /var/log/snort1 barnyard2 -c /usr/local/snort/etc/barnyard2.conf -i eth1 -d /var/log/snort1 -f snort.log -D -w /var/log/snort1/barnyard.waldo /usr/local/snort/bin/snort -D -u snort -g snort -c /usr/local/snort/etc/snort.conf -i eth0 -l /var/log/snort0 barnyard2 -c /usr/local/snort/etc/barnyard2.conf -i eth0 -d /var/log/snort0 -f snort.log -D -w /var/log/snort0/barnyard.waldo /usr/local/snort/bin/snort -D -u snort -g snort -c /usr/local/snort/etc/snort.conf -i eth2 -l /var/log/snort2 barnyard2 -c /usr/local/snort/etc/barnyard2.conf -i eth2 -d /var/log/snort2 -f snort.log -D -w /var/log/snort2/barnyard.waldo

错误示例:

ERROR! dnet header not found, go get it from http://code.google.com/p/libdnet/ or use the –with-dnet-*

解决 安装dbus http://www.freedesktop.org/wiki/Software/dbus/

http://downloads.sourceforge.net/project/libdnet/libdnet/libdnet-1.11/libdnet-1.11.tar.gz?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Flibdnet%2Ffiles%2Flibdnet%2Flibdnet-1.11%2F&ts=1392967212&use_mirror=jaist tar zxvf libdnet.1.11.tar.gz cd libdnet.1.11 ./configure make && make install

====================

/usr/local/lib/libz.a: could not read symbols: Bad value collect2: ld returned 1 exit status

解决 安装zlib

wget http://nchc.dl.sourceforge.net/project/libpng/zlib/1.2.3/zlib-1.2.3.tar.gz tar zxvf zlib-1.2.3.tar.gz cd zlib-1.2.3 ./configure vi MakeFile ,找到 CFLAGS=xxxxx ,在最后面加上 -fPIC #编译时加这个没用CFLAGS=”-O3 -fPIC” make make install

=======================

May 15 15:22:37 c1gstudio snort[29521]: S5: Pruned 35 sessions from cache for memcap. 5881 ssns remain. memcap: 8362032/8388608 May 15 15:22:38 c1gstudio snort[29521]: S5: Pruned 10 sessions from cache for memcap. 6038 ssns remain. memcap: 8388229/8388608 May 15 15:22:38 c1gstudio snort[29521]: S5: Pruned 5 sessions from cache for memcap. 6033 ssns remain. memcap: 8377128/8388608 May 15 15:22:38 c1gstudio snort[29521]: S5: Pruned 5 sessions from cache for memcap. 6029 ssns remain. memcap: 8362875/8388608 May 15 15:22:38 c1gstudio snort[29521]: S5: Pruned 10 sessions from cache for memcap. 6022 ssns remain. memcap: 8388607/8388608 May 15 15:22:38 c1gstudio snort[29521]: S5: Pruned 20 sessions from cache for memcap. 6002 ssns remain. memcap: 8379709/8388608

vi /usr/local/snort/etc/snort.conf

增加memcap 134217728 (128m)

# Target-Based stateful inspection/stream reassembly. For more inforation, see README.stream5 preprocessor stream5_global: track_tcp yes, \ track_udp yes, \ track_icmp no, \ memcap 134217728, \ max_tcp 262144, \ max_udp 131072, \ max_active_responses 2, \ min_response_seconds 5

=====================

WARNING: /usr/local/snort/etc/snort.conf(512) => Keyword priority for whitelist is not applied when white action is unblack. May 15 17:01:08 c1gstudio snort[12460]: Processing whitelist file /usr/local/snort/etc/rules/white_list.rules May 15 17:01:08 c1gstudio snort[12460]: Reputation entries loaded: 1, invalid: 0, re-defined: 0 (from file /usr/local/snort/etc/rules/white_list.rules) May 15 17:01:08 c1gstudio snort[12460]: Processing blacklist file /usr/local/snort/etc/rules/black_list.rules May 15 17:01:08 c1gstudio snort[12460]: Reputation entries loaded: 0, invalid: 0, re-defined: 0 (from file /usr/local/snort/etc/rules/black_list.rules) May 15 17:01:08 c1gstudio snort[12460]: Reputation total memory usage: 529052 bytes

WHITE_LIST_PATH 绝对路径 vi /usr/local/snort/etc/snort.conf

var WHITE_LIST_PATH /usr/local/snort/etc/rules var BLACK_LIST_PATH /usr/local/snort/etc/rules

黑白名单示例,但我尝试无效.

preprocessor reputation: \ nested_ip both, \ blacklist /etc/snort/default.blacklist, \ whitelist /etc/snort/default.whitelist white trust In file “default.blacklist” # These two entries will match all ipv4 addresses 1.0.0.0/1 128.0.0.0/1 In file “default.whitelist” 68.177.102.22 # sourcefire.com 74.125.93.104 # google.com

================

May 15 23:29:32 c1gstudio snort[20203]: S5: Session exceeded configured max bytes to queue 1048576 using 1049895 bytes (server queue). 36.250.86.52 5917 –> 61.147.125.16 80 (0) : LWstate 0x1 LWFlags 0x2001 May 15 23:32:42 c1gstudio snort[20203]: S5: Pruned session from cache that was using 1108276 bytes (stale/timeout). 36.250.86.52 5917 –> 61.147.125.16 80 (0) : LWstate 0x1 LWFlags 0x212001 May 16 05:01:49 c1gstudio snort[20203]: S5: Session exceeded configured max bytes to queue 1048576 using 1049688 bytes (client queue). 69.196.253.30 3734 –> 61.147.125.16 80 (0) : LWstate 0x1 LWFlags 0x402003

max_queued_bytes Default is “1048576” (1MB). 改成10MB

preprocessor stream5_tcp: policy windows, detect_anomalies, require_3whs 180, \ max_queued_bytes 10485760, \

参考: http://www.ibm.com/developerworks/cn/web/wa-snort1/ http://www.ibm.com/developerworks/cn/web/wa-snort2/

http://www.snort.org/snort-downloads? http://man.chinaunix.net/network/snort/Snortman.htm http://blog.chinaunix.net/uid-286494-id-2134474.html http://blog.chinaunix.net/uid-522598-id-1764389.html http://sourceforge.net/p/snort/mailman/snort-users/thread/433A1D25-D6EE-4257-8CE6-3743395D05D0%40auckland.ac.nz/#msg26465706 http://manual.snort.org/

Posted in 安全, 技术.

Tagged with , , .

rev="post-1677" No comments

By C1G – 2014/05/29

使用Nginx添加header防止网页被frame

可以使用php或nginx等添加X-Frame-Options header来控制frame权限 X-Frame-Options有三个可选的值：

DENY：浏览器拒绝当前页面加载任何Frame页面

SAMEORIGIN：frame页面的地址只能为同源域名下的页面

ALLOW-FROM：允许frame加载的页面地址

PHP代码:

header(‘X-Frame-Options:Deny’);

Nginx配置:

add_header X-Frame-Options SAMEORIGIN

可以加在locaion中 location / { add_header X-Frame-Options SAMEORIGIN }

Apache配置:

Header always append X-Frame-Options SAMEORIGIN

使用后不充许frame的页面会显示一个白板。

参考： https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options?redirectlocale=en-US&redirectslug=The_X-FRAME-OPTIONS_response_header

Posted in Nginx.

Tagged with , .

rev="post-1671" No comments

By C1G – 2014/04/23

OpenSSL“心脏出血”漏洞

OpenSSL“心脏出血”漏洞是一个非常严重的问题。这个漏洞使攻击者能够从内存中读取多达64 KB的数据。一些安全研究员表示： OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable 并且开了https服务的需尽快升级. 目前官网已出OpenSSL 1.0.1g http://www.openssl.org/

OpenSSL 1.0.0 ,OpenSSL 0.9.8不受影响

参考: http://drops.wooyun.org/papers/1381

Posted in 安全通告.

Tagged with , .

OpenSSL“心脏出血”漏洞已关闭评论

By C1G – 2014/04/10