nixCraft » Tips

20 Linux Server Hardening Security Tips

Vivek Gite — Fri, 30 Oct 2009 07:52:11 +0000

Securing your Linux server is important to protect your data, intellectual property, and time, from the hands of crackers (hackers). The system administrator is responsible for security Linux box. In this first part of a Linux server security series, I will provide 20 hardening tips for default installation of Linux system.

Use a Linux LiveCD to Avoid Windows Malware For Netbanking

Vivek Gite — Thu, 15 Oct 2009 12:53:55 +0000

Internet has revolutionized the way online users can shop and avail banking services like internet Banking from anywhere, anytime without visiting bank. But, how safe is your money with online net-banking which allows to carry out money transfer? Companies and in some case individuals lost anywhere from $10,000 to $500,000 dollars because of a single malware infection. The cyber crooks are targeting innocent MS-Windows user. If you are concerned about how best to protect yourself from this type of fraud, use Linux LiveCD for online banking and avoid Microsoft Windows at all cost.

Top 20 OpenSSH Server Best Security Practices

Vivek Gite — Fri, 24 Jul 2009 21:49:43 +0000

OpenSSH is the implementation of the SSH protocol. OpenSSH is recommended for remote login, making backups, remote file transfer via scp or sftp, and much more. SSH is perfect to keep confidentiality and integrity for data exchanged between two networks and systems. However, the main advantage is server authentication, through the use of public key cryptography. From time to time there are rumors about OpenSSH zero day exploit. Here are a few things you need to tweak in order to improve OpenSSH server security.

Vmware Linux Guest Add a New Hard Disk Without Rebooting Guest

Vivek Gite — Sat, 18 Jul 2009 06:55:53 +0000

As a system admin, I need to use additional hard drives for to provide more storage space or to separate system data from user data. This procedure, adding physical block devices to virtualized guests, describes how to add a hard drive on the host to a virtualized guest using VMWare software running Linux as guest.

It is possible to add or remove a SCSI device explicitly, or to re-scan an entire SCSI bus without rebooting a running Linux VM guest. This how to is tested under Vmware Server and Vmware Workstation v6.0 (but should work with older version too). All instructions are tested on RHEL, Fedora, CentOS and Ubuntu Linux guest / hosts operating systems.

Software Vs Hardware RAID

Vivek Gite — Tue, 07 Jul 2009 16:01:56 +0000

A redundant array of inexpensive disks (RAID) allows high levels of storage reliability. RAID is not a backup solution. It is used to improve disk I/O (performance) and reliability of your server or workstation. A RAID can be deployed using both software and hardware. But the real question is whether you should use a hardware RAID solution or a software RAID solution.

Increase Your VMware Virtual Hard Disk Size ( vmdk file )

Vivek Gite — Tue, 09 Jun 2009 14:22:42 +0000

I've Windows Vista installed as a guest under Ubuntu Linux using VMWARE Workstation 6.0. This is done for testing purpose and browsing a few site that only works with Internet Explorer. Since I only use it for testing I made 16GB for Vista and 5GB for CentOS and 5GB in size for FreeBSD guest operating systems. However, after some time I realized I'm running out of disk space under both CentOS and Vista. Adding a second hard drive under CentOS solved my problem as LVM was already in use. Unfortunately, I needed to double 32GB space without creating a new D: drive under Windows Vista. Here is a simple procedure to increase your Virtual machine's disk capacity by resizing vmware vmdk file.

Linux Find Out If PCI Hardware Supported or Not In The Current Running Kernel

Vivek Gite — Wed, 03 Jun 2009 15:05:04 +0000

From my mailbag:

How do I find out if a given PCI hardware is supported of by the current CentOS / Debian / RHEL / Fedora Linux kernel?

You can easily find out find out if a given piece of PCI hardware such as RAID, network, sound, graphics card is supported or not by the current Linux kernel using the following utilities under any Linux distributions.

Linux x86_64: Detecting Hardware Errors

Vivek Gite — Tue, 02 Jun 2009 21:54:58 +0000

The Blue Screen of Death (BSoD) is used for the error screen displayed by Microsoft Windows, after encountering a critical system. Linux / UNIX like operating system may get a kernel panic. It is just like BSoD. The BSoD and a kernel panic generated using a Machine Check Exception (MCE). MCE is nothing but feature of AMD / Intel 64 bit systems which is used to detect an unrecoverable hardware problem.

Program such mcelog decodes machine check events (hardware errors) on x86-64 machines running a 64-bit Linux kernel. It should be run regularly as a cron job on any x86-64 Linux system. This is useful for predicting server hardware failure before actual server crash.

ss: Display Linux TCP / UDP Network and Socket Information

Vivek Gite — Tue, 02 Jun 2009 12:56:31 +0000

The ss command is used to dump socket statistics. It allows showing information similar to netstat command. It can display more TCP and state information than other tools. It is a new, incredibly useful and faster (as compare to netstat) tool for tracking TCP connections and sockets. SS can provide information about:

All TCP sockets.
All UDP sockets.
All established ssh / ftp / http / https connections.
All local processes connected to X server.
All the tcp sockets in state FIN-WAIT-1 and much more.

Tips To Protect Linux Servers Physical Console Access

Vivek Gite — Thu, 12 Mar 2009 19:09:31 +0000

This is an user contributed article.

Linux computer console is a physical device to operate a computer / server. Here are few steps which, if taken, make it more difficult for an attacker to quickly modify a system from its console.

Linux Convert ext3 to ext4 File system

Vivek Gite — Fri, 23 Jan 2009 15:45:57 +0000

Some time ago ext4 was released and available for Linux kernel. ext4 provides some additional benefits and perforce over ext3 file system. You can easily convert ext3 to ext4 file system. The next release of Fedora, 11, will default to the ext4 file system unless serious regressions are seen. In this quick tutorial you will learn about converting ext3 to ext4 file system.

VMWare ESX4 and ESX3.5: SCSI timeout For Linux Guest

Vivek Gite — Sat, 17 Jan 2009 20:34:23 +0000

Recently, I noticed that the timeout values differ on CentOS v5.x and RHEL Linux 5.x guests on VMWare ESX4 and ESX3.5.

Tutorial: OpenOffice.Org Mail Merge

Vivek Gite — Wed, 14 Jan 2009 20:14:35 +0000

Mail merge is a software function describing the production of multiple documents from a single template form and a structured data source. This helps to create personalized letters and pre-addressed envelopes or mailing labels for mass mailings from a word processing document which contains fixed text, which will be the same in each output document, and variables, which act as placeholders that are replaced by text from the data source. The data source is typically a spreadsheet or a database which has a field or column matching each variable in the template. When the mail merge is run, the word processing system creates an output document for each row in the database, using the fixed text exactly as it appears in the template, but substituting the data variables in the template with the values from the matching columns.

This technique of merging data to create mailshots gave rise to the term mail merge. OpenOffice.Org has a in built software mail merge feature.

If you haven't tried OpenOffice.org's mail merge feature because you find it confusing or difficult to use, you are in luck. Mail Merges in OpenOffice.org and StarOffice provides a detailed description of the mail merge feature from start to finish. Among other things, it shows how you can use the mail merge to create letters, labels, and envelopes.

=> You can download this excellent PDF ebook for your persusal or read the article online - Mail Merge in Openoffice.org: Everything You Need to Know.

FreeBSD Turn On Process Accounting – Track System Resources Used By Users

Vivek Gite — Thu, 08 Jan 2009 10:00:08 +0000

I've already written about Linux process accounting under Linux ( see how to keep a detailed audit trail of what's being done on your Linux systems). You can easily setup process accounting under FreeBSD. This tutorial expalins how to enable and utilizing FreeBSD process accounting including many other useful options are explained to keep track of system resources used, and their allocation among users.

Leap Second To Be Added End Of 2008 And Its Impact On Clustered Computers / Network

Vivek Gite — Wed, 31 Dec 2008 20:28:25 +0000

Get ready for a minute with 61 seconds. Scientists are delaying the start of 2009 by the first 'leap second' a timing tweak meant to make up for changes in the Earth's rotation.

The aged Earth is slowing down in its daily rotation, at least in the current epoch. So a leap second is added (a one-second adjustment added) to our time. This year will be exactly one second longer.

Precise time measurements are needed for high-speed communications systems among other modern technologies such as clusters, GPS, networks. You need to make sure that you are running updated version of ntpd that support leap second for UNIX and Windows computers.

Apache2 mod_fastcgi: Connect to External PHP via UNIX Socket or TCP/IP Port

Vivek Gite — Tue, 30 Dec 2008 12:49:34 +0000

Now, mod_fastcgi is configured and running. FastCGI supports connection via UNIX sockets or TCP/IP networking. This is useful to spread load among various backends. For example, php will be severed from 192.168.1.10 and python / ruby on rails will be severed from 192.168.1.11. This is only possible with mod_fastcgi.

Red Hat / CentOS Apache 2 FastCGI PHP Configuration

Vivek Gite — Tue, 30 Dec 2008 10:31:32 +0000

FastCGI is a protocol for interfacing interactive programs with a web server. FastCGI's main aim is to reduce the overhead associated with interfacing the web server and CGI programs, allowing a server to handle more web page requests at once.

Also, PHP is not recommended with multithreaded Apache2 (worker MPM) because of performance and some 3rd party PHP extensions are not not guaranteed thread-safe.

nginx and lighttpd has inbuilt support for FastCGI. For Apache web server you need to use either mod_fastcgi or mod_fcgid.

mod_fastcgi allows server and application processes to be restarted independently -- an important consideration for busy web sites. It also facilitates per-application security policies -- important for ISPs and web hosting companies.

In this quick tutorial, you will learn about Apache 2 + mod_fastcgi + PHP installation and configuration under Red Hat Enterprise Linux / CentOS Linux version 5.x+.

How To Convert From a VMware Image To Virtualbox Image

Vivek Gite — Mon, 22 Dec 2008 20:24:43 +0000

VirtualBox is a virtual emulator like VMWare workstation. It has many of the features VMWare has, as well as some of its own.

I really like new Opensource VirtualBox from Sun. It is light on resources. Here is a quick tip - you can convert a VMware virtual machine (image) to a VirtualBox machine (image) using qemu-img utility, without reinstalling the GUEST operating system

Test and Troubleshoot Chrooted Apache Jail

Vivek Gite — Mon, 22 Dec 2008 13:30:36 +0000

This is 3rd and the final installment for Apache Chroot Jail for CentOS / RHEL series. Once Apache is configured with mod_chroot, you may need to test and debug problems. This article will provide a few troubleshooting tips.

Upgrade WordPress 2.7 in 3 Simple Steps

Vivek Gite — Thu, 11 Dec 2008 09:48:04 +0000

Wordpress version 2.7 has been released and can be upgraded easily using UNIX / Linux shell prompt. A few assumptions:

Wordpress database name: wptheosblog
Wordpress directory name: /var/www/html/theos.in
Wordpress domain name: theos.in
Operating system: Linux

WARNING! If you are not comfortable with UNIX shell prompt (IF YOU ARE new to a UNIX/Linux os), please follow traditional way of upgrading wordpress and DO NOT use the three Steps described here.