Skip to content


快速配置postfix

在centos6.0上系统默认已安装了postfix和sasl 1.vi /etc/postfix/main.cf

myhostname=mail.c1gstudio.com mydomain=c1gstudio.com myorigin=$mydomain inet_interfaces=all mydestintion=$myhostname,localhost,$mydomain,localhost mynetworks=192.168.100.0/24,127.0.0.0/8 #################CYRUS-SASL################### broken_sasl_auth_clients = yes smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_invalid_hostname,reject_non_fqdn_hostname,reject_unknown_sender_domain,reject_non_fqdn_sender,reject_non_fqdn_recipient,reject_unknown_recipient_domain,reject_unauth_pipelining,reject_unauth_destination smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = $myhostname smtpd_sasl_security_options = noanonymous smtpd_sasl_application_name = smtpd smtpd_banner = $myhostname ESMTP,Warning: Version not Available! smtpd_reject_unlisted_recipient = no

2.vim /etc/sasl2/smtpd.conf

pwcheck_method: saslauthd mech_list: plain login

3.iptables

iptables -A INPUT -p tcp –dport 25 -j ACCEPT service iptables save

4.自动运行

chkconfig postfix on chkconfig saslauthd on

6.添加smtp认证用户

使用shadow认证 [root@dev ~]# groupadd mailuser [root@dev ~]# adduser -g mailuser -s /sbin/nologin service [root@dev ~]# passwd service Changing password for user service. New UNIX password: BAD PASSWORD: it is too simplistic/systematic Retype new UNIX password: passwd: all authentication tokens updated successfully. [root@dev ~]#

检查是否可以通过认证 [root@dev ~]# testsaslauthd -u service -p 123456 0: OK “Success.”

生成base64备用 [root@dev ~]#

perl -MMIME::Base64 -e ‘print encode_base64(“service”);’

c2VydmljZQ== [root@dev ~]#

perl -MMIME::Base64 -e ‘print encode_base64(“123456”);’

MTIzNDU2

7.测试 [root@dev ~]# telnet localhost 25

REtOWTk5OXh4eA== Trying 127.0.0.1… Connected to localhost.localdomain (127.0.0.1). Escape character is ‘^]’. 220 Welcome to our devmail.c1gstudio.com ESMTP,Warning: Version not Available! ehlo localhost 250-devmail.c1gstudio.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN auth login 334 VXNlcm5hbWU6 c2VydmljZQ== 334 UGFzc3dvcmQ6 MTIzNDU2 235 2.0.0 Authentication successful mail from:[email protected] 250 2.1.0 Ok rcpt to:[email protected] 250 2.1.5 Ok data 354 End data with . subject:hello 13:08 this is a test . 250 2.0.0 Ok: queued as 0BABAD607EB quit 221 2.0.0 Bye Connection closed by foreign host.

参考: https://blog.c1gstudio.com/archives/137 http://www.cnblogs.com/paipaita/archive/2012/11/20/centos_postfix.html

Posted in Mail/Postfix.

Tagged with .


Apache Tomcat DIGEST身份验证多个安全漏洞(CVE-2012-3439)

发布时间: 2012-11-05 (GMT+0800) 漏洞版本:

Apache Group Tomcat 7.x Apache Group Tomcat 6.x Apache Group Tomcat 5.x 漏洞描述:

BUGTRAQ ID: 56403 CVE ID: CVE-2012-3439

Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。

Apache Tomcat 7.0.0-7.0.27、6.0.0-6.0.35、5.5.0-5.5.35存在多个安全漏洞,成功利用后可允许攻击者绕过安全限制并执行非法操作。 < 参考 http://secunia.com/advisories/51138/ http://tomcat.apache.org/security-6.html >

Description A weakness and a vulnerability have been reported in Apache Tomcat, which can be exploited by malicious people to bypass certain security restrictions and cause a DoS (Denial of Service).

1) An error within the “parseHeaders()” function (InternalNioInputBuffer.java) when parsing request headers does not properly verify the permitted size and can be exploited to trigger an OutOfMemoryError exception via specially crafted headers.

This vulnerability is reported in versions 6.0.0-6.0.35 and 7.0.0-7.0.27.

2) An error within DIGEST authentication mechanism does not properly check server nonces.

This weakness is reported in versions 5.5.0-5.5.35, 6.0.0-6.0.35, and 7.0.0-7.0.29.

Solution Update to version 5.5.36, 6.0.36, or 7.0.30. tomcat下载地址:http://tomcat.apache.org/download-60.cgi

tomcat升级参见 https://blog.c1gstudio.com/archives/1434

Posted in Tomcat, 安全通告.

Tagged with , .


rsync 配置免登录同步服务

平时可以利用ssh客户端密钥建立信任关系来使rsync同步,但可能存在用户权限过大的问题. 这里以daemon或服务的方式运行可以提高安全性.

一.rsync的安装 rsync现在系统一般都自带 a.yum install rsync

b.http://rsync.samba.org/ 使用rpm或源码等方式安装

二.配置rsync rsync的主要有以下三个配置文件rsyncd.conf(主配置文件)、rsyncd.secrets(密码文件)、rsyncd.motd(rysnc服务器信息)

1.服务器配置文件(/etc/rsyncd.conf),该文件默认不存在,请创建它。 注:关于auth users是必须在服务器上存在的真实的系统用户,如果你想用多个用户以,号隔开,比如auth users = www,root 定义一个discuz的模块 vi /etc/rsyncd.conf

pid file = /var/run/rsyncd.pid port = 873 address = 192.168.0.24 #uid = nobody #gid = nobody uid = www gid = website use chroot = yes read only = no #limit access to private LANs hosts allow=192.168.0.0/255.255.255.0 hosts deny=* max connections = 5 motd file = /etc/rsyncd.motd #This will give you a separate log file #log file = /var/log/rsync.log #This will log every file transferred – up to 85,000+ per user, per sync #transfer logging = yes log format = %t %a %m %f %b syslog facility = local3 timeout = 300 [discuz] path = /opt/htdocs/bbs list=no ignore errors auth users = www secrets file = /etc/rsyncd.secrets comment = This is bbs data #exclude =

2.设定密码文件 密码文件格式很简单,rsyncd.secrets的内容格式为: 用户名:密码 我们在例子中rsyncd.secrets的内容如下类似的;在文档中说,有些系统不支持长密码,自己尝试着设置一下吧。 vi /etc/rsyncd.secrets

www:c1gstudiopass

chown root:root /etc/rsyncd.secrets  #修改属主 chmod 600 /etc/rsyncd.secrets #修改权限

注:1、将rsyncd.secrets这个密码文件的文件属性设为root拥有, 且权限要设为600, 否则无法备份成功! 出于安全目的,文件的属性必需是只有属主可读。 2、这里的密码值得注意,为了安全你不能把系统用户的密码写在这里。比如你的系统用户www密码是000000,为了安全你可以让rsync中的www为c1gstudiopass。这和samba的用户认证的密码原理是差不多的。

3.设定rsyncd.motd 文件; 它是定义rysnc服务器信息的,也就是用户登录信息。比如让用户知道这个服务器是谁提供的等;类似ftp服务器登录时,我们所看到的 c1gstudio.com ftp ……。 当然这在全局定义变量时,并不是必须的,你可以用#号注掉,或删除;我在这里写了一个 rsyncd.motd的内容为: vi /etc/rsyncd.motd

++++++++++++++++++++++++++++++++++++++++++++++ rsync services! staff use only ++++++++++++++++++++++++++++++++++++++++++++++

三.运行 A. xinetd方式 省略

B. –daemon参数方式,是让rsync以服务器模式运行

/usr/bin/rsync –daemon –config=/etc/rsyncd.conf  #–config用于指定rsyncd.conf的位置,如果在/etc下可以不写

添加到/etc/rc.local,启动后自动运行

echo ‘/usr/bin/rsync –daemon –config=/etc/rsyncd.conf’ >> /etc/rc.local

防火墙 授权192.168.0.0 C类

iptables -A INPUT -s 192.168.0.0/24 -p tcp -m tcp –dport 873 -j ACCEPT

授权单个IP192.168.0.21

iptables -A INPUT -s 192.168.0.21 -p tcp -m state –state NEW -m tcp –dport 873 -j ACCEPT

/etc/init.d/iptables save

四,调试 192.168.0.24为rsynce daemon端,接收数据 192.168.0.21为源数据推送端,发送数据

推送端调试列表 rsync –list-only [email protected]:: rsync: failed to connect to 192.168.0.24: Connection timed out (110) 检查防火墙,rsyncd里用户权限 传送本地/opt/htdocs/bbs/data/cache 到远端discuz模块下的data目录

rsync -av /opt/htdocs/bbs/data/cache [email protected]::discuz:/data/

创建密码文件方便免登录,密码和服务器端保持一致

echo ‘c1gstudiopass’ > /etc/rsyncd.passwd chown root:root /etc/rsyncd.passwd chmod 600 /etc/rsyncd.passwd

以密码文件全部同步一次

rsync -av –delete –password-file=/etc/rsyncd.passwd /opt/htdocs/bbs/ [email protected]::discuz

最后再以脚本方式配合inotify和crontab就可以实现自动同步

参考:http://www.cnblogs.com/itech/archive/2009/08/10/1542945.html

Posted in 备份.

Tagged with , , .


windows下svn1.5.4升级至svn1.7.7简明纪要

原始svn版本安装在xp下基于apache,曾经从 1.4.3升至1.5.4 客户端为 TortoiseSVN-1.4.3.8645-win32-svn-1.4.3.msi

1.准备svn http://subversion.apache.org Subversion 1.7.7 + Apache Server (Windows 32-bit) http://tortoisesvn.net/ TortoiseSVN-1.7.10.23359-win32-svn-1.7.7.msi

2.备份原svn backup.bat

echo off rem Subversion的安装目录 set SVN_HOME=”D:\Subversion” rem 所有版本库的父目录 set SVN_ROOT=D:\svnroot rem 备份的目录 set BACKUP_SVN_ROOT=D:\svnrootbak set BACKUP_DIRECTORY=%BACKUP_SVN_ROOT%\%date:~0,10% if exist %BACKUP_DIRECTORY% goto checkBack echo 建立备份目录%BACKUP_DIRECTORY%>>%SVN_ROOT%/backup.log mkdir %BACKUP_DIRECTORY% rem 验证目录是否为版本库,如果是则取出名称备份 for /r %SVN_ROOT% %%I in (.) do @if exist “%%I\conf\svnserve.conf” %SVN_ROOT%\simplebackup.bat “%%~fI” %%~nI goto end :checkBack echo 备份目录%BACKUP_DIRECTORY%已经存在,请清空。 goto end :end

simplebackup.bat

@echo 正在备份版本库%1…… @%SVN_HOME%\bin\svnadmin hotcopy %1 %BACKUP_DIRECTORY%\%2 @echo 版本库%1成功备份到了%2!

用svn hotcopy命今热备,导出的结构和原始文件是一样的,dump方式太慢了; 拷贝到svn库目录下运行backup.bat; 注意svnadmin路径,错误路径会报”发现格式4″,并且没有format文件,不能升级 打包后传到新机器上

3.新svn服务器 解压,并保持和原有目录一致 安装svn服务 在命令行下

[路径]svn upgrade 每个库路径

客户端执行update时报 Not authorized to open root of edit operation

服务器端accessfile文件加上”* = r”可能解决,但所有人都会有check out 权限

[/] * = r

在apache的httpd.conf加入相关认证解决权限问题

用户认证….

Order allow,deny
deny from all

4.客户端升级 在客户端关闭不相关程序,安装TortoiseSVN然后重启 在原目录copy上点右键没有更新操作了,只有“SVN升级工作副本”,升级后就能执行日常操作 ubversion 1.7最让我喜欢的一个改变是.svn目录只存在于根目录了。

=================== 2012-11-30更新apache的httpd.conf相关认证权限

Posted in Subversion.

Tagged with , , .


nginx “location”受限制资源服务漏洞

发布时间: 2012-10-15 (GMT+0800) 漏洞版本:

Nginx 1.2.x 漏洞描述:

CVE ID: CVE-2011-4963

nginx是一款使用非常广泛的高性能Web服务器。

nginx允许远程攻击者通过请求内的“.”或某些“$index_allocation”序列,绕过目标访问限制或访问受限文件。 < 参考 http://secunia.com/advisories/50912/ > 安全建议:

厂商补丁:

Nginx

目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:

http://nginx.net/

参考: http://sebug.net/vuldb/ssvid-60439

Posted in 安全通告.

Tagged with , .


phpMyAdmin 3.5.x HTML注入漏洞(CVE-2012-5339)

PMASA-2012-6

Announcement-ID: PMASA-2012-6

Date: 2012-10-12

Summary

Multiple XSS due to unescaped HTML output in Trigger, Procedure and Event pages.

Description

When creating/modifying a trigger, event or procedure with a crafted name, it is possible to trigger an XSS. phpMyAdmin Trigger, Procedure和Event页面不正确转义HTML输出,使用特殊名创建/修改trigger, event或procedure时,可触发跨站脚本攻击,可获得敏感信息或劫持用户会话。 Severity

We consider these vulnerabilities to be non critical.

Mitigation factor

These XSS can only be triggered when a crafted value is entered by the user.

Affected Versions

Versions 3.5.x are affected.

Solution

Upgrade to phpMyAdmin 3.5.3 or newer or apply the patches listed below.

References

Thanks to Maxim Rupp for reporting an issue when creating an event.

Assigned CVE ids: CVE-2012-5339

CWE ids: CWE-661 CWE-79

http://sebug.net/vuldb/ssvid-60440 http://www.phpmyadmin.net/home_page/security/PMASA-2012-6.php

Posted in 安全通告.

Tagged with , .


mysql复制同步1062错误修复

Percona-Server-5.5.22-rel25.2 其中一台从库同步discuzx时出错,Slave_SQL_Running为no

show slave status;

lave_IO_State Waiting for master to send event Master_Host 192.168.0.99 Master_User xxx Master_Port 3306 Connect_Retry 60 Master_Log_File mysql-bin.000059 Read_Master_Log_Pos 63986019 Relay_Log_File C1g-relay-bin.000417 Relay_Log_Pos 48985722 Relay_Master_Log_File mysql-bin.000059 Slave_IO_Running Yes Slave_SQL_Running No Replicate_Do_DB discuzx Replicate_Ignore_DB Replicate_Do_Table Replicate_Ignore_Table discuzx.pre_common_admincp_session,discuzx.pre_common_session Replicate_Wild_Do_Table Replicate_Wild_Ignore_Table Last_Errno 1062 Last_Error Error ‘Duplicate entry ‘1503760-25’ for key ‘PRIMARY” on query. Default database: ‘discuzx’. Query: ‘INSERT INTO pre_forum_post SET `fid`=’456′ , `tid`=’1553760′ , `first`=’0′ , `author`=’xxx’ , `authorid`=’4018205′ , `subject`=” , `dateline`=’1349931502′ , `message`=’xxx’ , `useip`=’61.165.2.2′ , `invisible`=’0′ , `anonymous`=’0′ , `usesig`=’1′ , `htmlon`=’0′ , `bbcodeoff`=0 , `smileyoff`=’-1′ , `parseurloff`=0 , `attachment`=’0′ , `status`=’0′ , `pid`=’12202748” Skip_Counter 0 Exec_Master_Log_Pos 48985576 Relay_Log_Space 64152580 Until_Condition None Until_Log_File

先尝试修复表pre_forum_post,再删除1503760-25主键记录,start slave; 依然有很表错误

Last_Error Error ‘Duplicate entry ‘3064092’ for key ‘PRIMARY” on query. Default database: ‘discuzx’. Query: ‘INSERT INTO pre_common_member_action_log SET `uid`=’4818285′ , `action`=’1’ , `dateline`=’1349931502” Last_Error Error ‘Duplicate entry ‘2327049’ for key ‘PRIMARY” on query. Default database: ‘discuzx’. Query: ‘INSERT INTO pre_home_notification SET `uid`=’4047895′ , `type`=’post’ , `new`=’1′ , `authorid`=’4818285′ , `author`=’xxx’ , `note`=’xxx’ , `dateline`=’1349931502′ , `from_id`=’12002748′ , `from_idtype`=’quote’ , `from_num`=’1” last_Error Error ‘Duplicate entry ‘3409334’ for key ‘PRIMARY” on query. Default database: ‘discuzx’. Query: ‘INSERT INTO pre_common_credit_rule_log SET `uid`=’4082252′ , `rid`=’5′ , `fid`=’0′ , `total`=’1′ , `cyclenum`=’1′ , `dateline`=’1349931503′ , `extcredits2`=’-2”

尝试sql_slave_skip_counter无效

stop slave; set global sql_slave_skip_counter =1 ; start slave;

使用命令批量修复数据表 不停机 mysqlcheck -A -o -r -p 或停机用myisamchk

在my.cnf中忽略所有1062错误

slave-skip-errors = 1062

重启mysql

/opt/mysql/bin/mysql.server restart

会出现找不到Relay log日志的错误

Last_Errno 1594 Last_Error Relay log read failure: Could not parse relay log event entry. The possible reasons are: the master’s binary log is corrupted (you can check this by running ‘mysqlbinlog’ on the binary log), the slave’s relay log is corrupted (you can check this by running ‘mysqlbinlog’ on the relay log), a network problem, or a bug in the master’s or slave’s MySQL code. If you want to check the master’s binary log or slave’s relay log, you will be able to know their names by issuing ‘SHOW SLAVE STATUS’ on this slave.

show slave status;

Connect_Retry 60 Master_Log_File mysql-bin.000059 Read_Master_Log_Pos 89775799 Relay_Log_File C1g-relay-bin.000417 Relay_Log_Pos 49139383 Relay_Master_Log_File mysql-bin.000059 Slave_IO_Running Yes Slave_SQL_Running No Replicate_Do_DB discuzx Replicate_Ig Skip_Counter 1 Exec_Master_Log_Pos 49139237 Relay_Log_Space 89942788 Until_Condition None Until_Log_File Until_Log_Pos 0 Master_SSL_Allowed

记录下面两个参数,重新设定记录点

Relay_Master_Log_File mysql-bin.000059 Exec_Master_Log_Pos 49139237 stop slave; change master to Master_Log_File=’mysql-bin.000059′, Master_Log_Pos=49139237; start slave;

show slave status;

Slave_IO_Running Yes Slave_SQL_Running Yes

再观察其它从库和master的记录点,没有问题,修复成功




参考: http://www.cnblogs.com/niniwzw/archive/2010/02/04/1663685.html

Posted in Mysql.

Tagged with , .


dedecms(织梦) < 5.7 多个SQL注入漏洞

漏洞版本:

dedecms < 5.7 漏洞描述:

BUGTRAQ ID: 51211 CVE ID: CVE-2011-5200

DedeCms是免费的PHP网站内容管理系统。

DedeCMS 5.6存在多个SQL注入漏洞,通过id参数向 list.php、members.php、book.php传参,可允许远程攻击者利用这些漏洞控制应用、访问或修改数据、利用下层数据库内的其他漏洞。 < 参考 http://www.exploit-db.com/exploits/18292/ > 安全建议:

厂商补丁:

dedecms

目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商的主页以获取最新版本:

http://www.dedecms.com/products/dedecms/

参考:http://sebug.net/vuldb/ssvid-60403

Posted in 安全通告.

Tagged with , .


sourceforge韩国节点被入侵,前段时间下载的phpmyadmin可能受影响

简要描述:

从微博上看到腾讯安全团队说sourceforge一些服务器被入侵,一些源码被植入后门,仔细研究了下,发现并非sourceforge被入侵,而是下面的韩国镜像节点提供商cdnetworks服务器存在问题

详细说明:

在sourceforge上下载源码时,会根据网络情况自动选择镜像节点下载,由于我国没有镜像服务器,所以会从最近的韩国的节点上下载,这次腾讯也发现有phpMyadmin源码被植入了后门的情况,我们经过分析发现其他的节点均不存在问题,只有韩国的cdnetworks提供的某些镜像中才存在问题

漏洞证明: 自动选择的韩国节点上下载phpMyadmin源码会发现存在后门/server_sync.php 里包含一句话木马。 http://cdnetworks-kr-1.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/3.5.2.2/phpMyAdmin-3.5.2.2-all-languages.zip

通过和国网中心的包比对了下,确实多了个server_sync.php文件。

参考:http://www.wooyun.org/bugs/wooyun-2010-012705#0-tsina-1-27413-397232819ff9a47a7b7e80a40613cfe1

Posted in 安全通告.

Tagged with , .


Oracle MySQL 5.1.x 拒绝服务漏洞(CVE-2012-2749)

发布时间: 2012-08-21 (GMT+0800) 漏洞版本:

MySQL 5.1.x 漏洞描述:

BUGTRAQ ID: 55120 CVE ID: CVE-2012-2749

MySQL是一个小型关系型数据库管理系统,开发者为瑞典MySQLAB公司,在2008年1月16号被Sun公司收购。

MySQL 5.1.63之前的5.1.x版本和5.5.24之前的5.5.x版本在实现上存在安全漏洞,可允许已验证用户通过错误计算和排序索引造成拒绝服务,mysqld崩溃。 < 参考 https://bugzilla.redhat.com/show_bug.cgi?id=833737 http://dev.mysql.com/doc/refman/5.1/en/news-5-1-63.html > 安全建议:

厂商补丁:

MySQL AB

目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:

http://www.mysql.com/

参考:http://sebug.net/vuldb/ssvid-60344

Posted in 安全通告.

Tagged with , .