I'd like to be notified via email if our Linux servers are under any kind of hacking attempt or service attack. Is there some kind of all-in-one solution that can monitor for suspicious activity and send reports of said activity to an email address?
I just cant seem to figure out the logic in how to configure my Mac Server.
So I have set up an DNS, which will take the domain and all subdomains and point towards an IP.
File: db.mydomain.com (in /var/named/)
mydomain.com. 10800 IN SOA mydomain.com. admin.mydomain.com. (
2012110903 ; serial
3600 ; refresh (1 hour)
900 ; retry (15 minutes)
1209600 ; expire (2 weeks)
86400 ; minimum (1 day)
)
10800 IN NS mydomain.com.
10800 IN A 10.0.1.2
www.mydomain.com. 10800 IN A 10.0.1.2
So I want all of these requests to be requested to the 10.0.1.2 server, as I run 2 servers in my cluster. This one has always handled the requests, and now I want to add a server in between. So the server in between will get all the signals from my router which NAT the trafic coming from outside.
So after setting this up and trying to point my port 80 towards my new server which will be the middle point, it doesn't work. Is it even possible to do it this way?
First server: Mac
Second server: Linux
So what I try to achieve once more:
1. User goes to mydomain.com or www.mydomain.com
2. User request gets handled by my first server
3. First server refers to a local server, which is only available locally (it is configured to allow requests on port 80 and handle them)
4. Second server receives signal
5. Second server returns a request (either directly send to user or send through first server, whichever is most secure and configurable)
I also want to be able to set up domains that lead to other servers in the future, and some that are only available within the VPN. (If that changes anything)
I hope some kind soul could help me with this, it is really cumbersome for my mind to get the logic here.
Do I have to configure my other server in any way?
/Marcus
My question is pretty self-explanatory. I prefer firefox, but my organization send out intranet links that simply work better in IE. Is there a way to do this?
I've been running my QNAP 469L with Debian (Wheezy deb7u3) for a few months. Yesterday I upgraded the memory to 4 GB. The system boots fine, but since the upgrade, I'm not able to connect the server to my router (a TP-Link WR941ND).
My configuration:
The router runs a DHCP server (192.168.67.100 and up), with a preconfigured ip address for the QNAP (192.168.67.10). The router is on 192.168.67.1.
As said, Debian is installed on the QNAP (which can be regarded as a normal computer).
Networking hardware on the QNAP: Intel PRO/1000 Network Connection using the e1000e kernel module.
This is what I have tried so far:
Replace the network cable (tried 3 different cables on different router ports).
Check for messages from the kernel: dmesg | grep eth. Besides the normal hardware messages I get a ADDRCONF(NETDEV_UP): eth0: link is not ready for each call to ifup.
Manually restart the network sudo server networking restart
Check sudo ifconfig (eth0 is up, but no ip addresses).
Check the /etc/network/interfaces which has (besides the loopback device) an allow-hotplug eth0 and iface eth0 inet dhcp, which is afaik the default Debian configuration.
Since the server has two ethernet ports, I checked if I'm using the right port (checked the hardware address that ifconfig reports for eth0 is the same as the hardware address that is in the preconfigured ip address for the server in the router.
Do a manual sudo ifdown eth0 && sudo ifup eth0 with no results (but an extra ADDRCONF(NETDEV_UP): eth0: link is not ready in the kernel log)
Do a dhcp request dhclient -v eth0: for about a minute requests are send (according to the terminal) and at the end I get a No DHCPOFFERS received. No working leases in persistent database - sleeping..
Check the router system log if DHCP requests are received. I see them for some devices (my Mac, my iPhone) but not from the QNAP. The log entry looks like: DHCPS:Recv REQUEST from 84:85:06:07:75:6A and then a DHCPS:Send ACK to 192.168.67.101. There are no records from the QNAP's hardware address.
So the two error messages that I do get are: ADDRCONF(NETDEV_UP): eth0: link is not ready for every ifup and No DHCPOFFERS received. No working leases in persistent database - sleeping. for every DHCP call.
I want to put a web application on my Linux server: I will first explain to you what the web app will do and then I will tell you what I did so far to secure my brand new Linux system.
The app will be a classified ads website (like gumtree.co.uk) where users can sell their items, upload images, send to and receive emails from the admin. It will use SSL for some pages. I will need SSH.
So far, what I did to secure my stock Ubuntu (latest version) is the following:
NOTE: I probably did some things that will prevent the application from doing all its tasks, so please let me know of that. My machine's sole purpose will be hosting the website.
(I put numbers as bullet points so you can refer to them more easily)
1) Firewall
I installed Uncomplicated Firewall.
Deny IN & OUT by default
Rules:
Allow IN & OUT: HTTP, IMAP, POP3, SMTP, SSH, UDP port 53 (DNS), UDP port 123 (SNTP), SSL, port 443
(the ones I didn't allow were FTP, NFS, Samba, VNC, CUPS)
When I install MySQL & Apache, I will open up Port 3306 IN & OUT.
2) Secure the partition
in /etc/fstab, I added the following line at the end:
tmpfs /dev/shm tmpfs defaults,rw 0 0
Then in console: mount -o remount /dev/shm
3) Secure the kernel
In the file /etc/sysctl.conf, there are a few different filters to uncomment. I didn't know which one was relevant to web app hosting. Which one should I activate? They are the following:
A) Turn on Source Address Verification in all interfaces to prevent spoofing attacks
B) Uncomment the next line to enable packet forwarding for IPv4
C) Uncomment the next line to enable packet forwarding for IPv6
D) Do no accept ICMP redirects (we are not a router)
E) Accept ICMP redirects only for gateways listed in our default gateway list
F) Do not send ICMP redirects
G) Do not accept IP source route packets (we are not a router)
H) Log Martian Packets
4) Configure the passwd file
Replace "sh" by "false" for all accounts except user account and root.
I also did it for the account called sshd. I am not sure whether it will prevent SSH connection (which I want to use) or if it's something else.
5) Configure the shadow file
In the console: passwd -l to lock all accounts except user account.
6) Install rkhunter and chkrootkit
7) Install Bum
Disabled those services: "High performance mail server", "unreadable (kerneloops)","unreadable (speech-dispatcher)","Restores DNS" (should this one stay on?)
8) Install Apparmor_profiles
9) Install clamav & freshclam (antivirus and update)
What did I do wrong and what should I do more to secure this Linux machine?
Thanks a lot in advance
I'm using Ubuntu 10.10 32 bit. This is new server with nginx, php-fpm and PHP 5.3
I will install postfix. Currently the server can send mail (maybe sending through sendmail) but very slow until PHP timeout.
To install, I will run:
sudo apt-get install php-pear
sudo pear install mail
sudo pear install Net_SMTP
sudo pear install Auth_SASL
sudo pear install mail_mime
sudo apt-get install postfix
But after Postfix installed, how to make sure all mails using Postfix?
We have a Small Business Server (SBS) Windows 2003, and we need to setup a shared outlook calendar using exchange (comes with the SBS), however my client does not want to use exchange mail. In other words, they would like to use Outlook to send an receive emails using some hosted web mail service (using POP) but have the Outlook calendar shared among users using exchange on local SBS server. All users have domain accounts configured. Is this possible to do?
Is there a way to find my SMTP information on my Exchange Server 2007? It was set up by someone else but I have full admin rights. I would like to use it for an internal .net application just to send emails locally.
Thanks in advance!
Daniel
I always put it to sleep at night, but when I try and turn it on I hit the keyboard to activate it and a Windows screen pops up saying and error has occured. It collects data then reboots and offers to send an error report.
Note this only appears to happen when I'm at home and it's hooked up to 2 monitors and 3-4 USB devices. When it's not connected to everything it looks like sleep actually works.
HP DV7
XG300AV
Previously I used Outlook 2003 and I was able to send a hyperlink with a space by typing < before entering the hyperlink and a > after typing the hyperlink and the whole thing would become a valid clickable link.
Like so
<\\network share with spaces\folder
We upgraded to Outlook 2010 and currently this happens
<\\network share with spaces\folder
or if I do nothing
\\network share with spaces\folder
Is there a setting in one of these ribbons somewhere to control this?
For last few days I've been reading about Spanning Tree Protocol ,L2 protocol and understood how it prevents loop in network ,various steps in STP but one thing i wanted to know how STP actually detects the loops in network so that it can prevent it.Somewhere I read STP uses BPDU as probe and detects loops I mean how it happen is when switch send a BPDU with Destination Address as multicast and receive same BPDU again mean there is loop in network .
But is it how STP detects loops in network?
How to customize the html page which is re-directed when a user tries to access a URL which has been blacklisted by squid proxy server.
acl blocksites url_regex "/etc/squid/squid-block.acl"
http_access deny blocksites
I would like to re-direct to a custom HTML page explaining why he is not allowed to go the blocked site or send him to an empty page.
As it is not possible to directly share a serial port between two processes using Linux, I am looking for another way to achieve this, I have heard about socat but could not find a concrete example of how to realize the following:
Split one physical serial port (/dev/ttyUSB0) into two virtual ports, one for reading and one for writing, as one process only needs to send data, and one only needs to receive data.
I can no modify the sending application unfortunately.
I have a postfix installation and have setup relaying through google apps, but when I send mail to postfix it relays it to google apps using the ONE account I have specified in the main.cf.
Is there a way to do this more dynamically. Ideally, the user would authenticate with postfix when sending mail and postfix would use that username and password to authenticate against gmail. Is that possible or what would be the next best solution?
Thanks in advance
Is there a way to use the built-in windows file compression tool in command line? Instead of RightClick/Send To/Compress (Zipped) Folder.
Windows Server 2003 Enterprise Edition
Thanks!
I am using Apple's Screen Sharing client in OS X 10.6.2, to connect to TightVNC running on Win XP. But TightVNC is not receiving right-clicks.
Scaling is on, and everything else is working fine. I do not think it is a problem with the server because a friend was over and was able to send right-clicks to my server using a RealVNC client.
What is the best app for supporting multiple monitors in Windows 7? Ultra mon was perfect in Vista and XP but I don't think it works with Windows 7 yet. The main features I'm looking for are:
Taskbar for each monitor with only the apps that are running there. This might not be doable based on how the Windows 7 taskbar works now.
A button next to Minimize to send the window to the other monitor
Separate wallpapers for each monitor
I have an interesting problem with communication via standard SSL ports.
Fresh installed Ubuntu 14.04 server + Postfix + Dovecot, SASL authentication provided by Dovecot, self-signed certificate generated trough the Dovecot script mkcert.sh. Redirected ports on ZyWALL USG 200.
I can send and receive e-mails from outside with standard ports 25 and 110, but not over 587.
I am connecting to my server from machine with Windows 8.1 + VMWare Player + Ubuntu 14.04 Desktop + ssh. On Windows host I have installed Avast! antivirus.
When I am trying to telnet from virtual machine to server over 587, it refused connection. But when I turn on Avast! it let me in to message Connected to... Same with nmap. When Avast! is turned on it is show me all SSL ports. When I turned it off, only standard ports appeared. OpenSSL shows me CONNECTED(00000003).
But outside virtual machine directly in Windows 8.1 using nmap with zenmap there are not opened SSL ports in both Avast! states.
From other external linux machines are problems with touching SSL ports same - refused.
I have turned on submission in master.cf and 587 port is correctly listening on 0.0.0.0 in process master.pid which belongs to Postfix. I can telnet, or nmap over port 587 to my domain directly from server. Other ports like 995, 993 are OK on localhost, too.
It is true, that I can't send emails via 587 anyway (Avast! turned on/off), but I can see ports opened.
It is possible, that I have simply bad certificate and Avast! has right one, so with turned it on I can see opened ports?
EDIT:
To be more clear, I can't see or using port 587 everywhere from outside (tried Thunderbird, telnet, openssl, nmap, putty, swaks; both from Linux or Windows machines) and that is my problem. It was only by chance that I saw opened ports when Avast! is turned on.
In TCP Connection Termination, when client enters in TIME_WAIT state means the client waits for a period of time equal to double the maximum segment life (MSL) time, to ensure the ACK it sent was received.
(I read above from a book computer networking by kurose and also given in following URL http://www.tcpipguide.com/free/t_TCPConnectionTermination-2.htm )
But how it was detected if last ACK(send by client as a response to server FIN) lost?
I have a personal GMail account, from which I frequently send e-mail to a great many various users of a specific business. The corporation has been kind enough to provide me with the credentials to access their LDAP server, with which I would like my GMail web client to be able to auto-complete partial addresses or names for which that LDAP server has an entry.
Is there any way I can get a personal GMail account (or it's corresponding entire Google account) account to incorporate an LDAP server into it's Contacts?
i have windows 2003 server
suddenly when i restart my server i got error svhost error (send report etc)
after when i check the event long i got following log
can you please what is this error ? and how to remove it.
To create a test email server, I have a similar requirement as:
http://serverfault.com/questions/94640/how-to-redirect-all-outgoing-email-from-postfix-to-a-single-address-for-testing
But I need to send all the emails to an external account, not a local one.
I would like to do something like:
xyz:[email protected]
but xyz is not local nor smtp.
I have a CentOS 6.2 server.
Whenever some one logs into the server using the terminal (SSH) the user profile (.bash_profile) is loaded.
Now my question is, is there a profile that loads whenever you use SFTP to login into the server via "FTP browsing software" ( I use WinSCP ), I want to send an email whenever a user logs into the server via SFTP. I already have the code to do this when a user logs into the terminal (SSH) when his profile loads.
Thanks