how to securely wipe a drive in linux

option 1
# shred -n 7 -z /dev/sdb

option 2
# dd if=/dev/urandom of=/dev/sdb bs=4096 count=7
# dd if=/dev/zero of=/dev/sdb bs=4096 count=7

oracle linux links

http://www.oracle.com/us/technologies/linux/index.htm
http://www.oracle.com/us/technologies/linux/unbreakable-enterprise-kernel-ds-173416.pdf
http://www.oracle.com/us/technologies/linux/ubl-edison-066204.pdf
http://public-yum.oracle.com/

generate reasonable passwords at the commmand line


cat /dev/urandom| tr -dc 'a-zA-Z0-9-_!@#$%^&*()_+{}|:<>?='|fold -w 12| head -n 4| grep -i '[!@#$%^&*()_+{}|:<>?=]'


generate strong random passwords at the command line


cat /dev/urandom| tr -dc 'a-zA-Z0-9-_!@#$%^&*()_+{}|:<>?='|fold -w 12| head -n 4| grep -i '[!@#$%^&*()_+{}|:<>?=]'


remove serverbeach backdoor

when you lease a server from ServerBeach, they install a backdoor on your server. Here's how to remove it when you choose CentOS or similar redhat type system.

service sbadm stop
chkconfig --del sbadm
rm -f /etc/ssh/.sbadm_config
rm -f /usr/sbin/sbadm
rm -rf /usr/local/webmin-*
rm -f /etc/init.d/sbadm

import dshield block list for pf

/usr/local/bin/wget -q -O - http://feeds.dshield.org/block.txt | egrep -v '#|Start' | awk '{print $1 "/24"}' | sed -n '4,50p;50p' > /etc/pf.blocklist.dshield && pfctl -f /etc/pf.conf

allow tftp under selinux

For RHEL5:

# audit2allow -a -M mytftp
# semodule -i mytftp.pp
# service xinetd restart

compare directory trees

ssh server1 "find /usr/local/apache2/sites/htdocs/ -type f -exec basename {} \; | sort" > server1.txt; ssh server2 "find /usr/local/apache2/sites/htdocs/ -type f -exec basename {} \; | sort" > server2; comm -3 ./server1 ./server2

slowloris ddos aversion

use Nginx and openBSD/pf to protect Apache.
http://nginx.net/

here's some configuration help.
https://calomel.org/nginx.html

Set up SNMP v3 on Cisco IOS

conf t
snmp-server group group_name v3 priv
snmp-server group group_name v3 priv read secure_ro write secure_rw access 5
snmp-server view secure_ro internet included
snmp-server view secure_rw mgmt included
snmp-server user snmp_user iksecure v3 auth md5 auth_password priv des56 priv_password

access-list 5 permit host x.x.x.x
access-list 5 deny any log


show snmp group
show snmp user

chroot tor in openBSD

https://wiki.torproject.org/noreply/TheOnionRouter/OpenbsdChrootedTor

config check

#!/bin/sh
#written and tested on openbsd 4.4
#pf.master contains the last known good sha1 of pf.conf

MASTER=`cat ./pf.master`
DGST=`ssh fwmon@192.168.43.132 'sudo sha1 /etc/pf.conf | cut -d" " -f 4'`

#echo $DGST
#echo $MASTER

if [[ "${MASTER}X" == "${DGST}X" ]] ; then

#notify that unscheduled config has changed
#insert incident details into security db
echo "fw Config Secure"

else

#insert incident details into security db
echo "fw Config Breached"

fi

Change runlevel Settings for a Group of Services

The following command changes all services set to run at runlevel 5 and sets them to off.

chkconfig --list | grep 5:on | awk '{ print $1 }' | \
 while read LINE; do chkconfig --level 12345 $LINE off; done

Network Access Control

Enterasys has a mature and unmatched product offering, today.

http://www.enterasys.com/products/index.aspx

 

Fact Sheet NSA Suite B Cryptography [08dec2008]

Key length recommendations from the NSA for companies making products for Gov't use.

http://www.keylength.com/en/6/

 

DDOS Incident Cheat Sheet

This is very well put together:

http://www.zeltser.com/network-os-security/ddos-incident-cheat-sheet.pdf

 

Using SSH Remote and Local Tunnels

The following example demonstrates how to use Remote and Local SSH tunneling to access a service on your highly secure home computer (that's not exposed explicitly through a firewall at your home) from a remote location.

For example:

On Home Computer, before traveling:
ssh -R 44444:localhost:22 user@remote.computer.ip.address

On Remote Computer, after arriving at work:
ssh -L 22222:localhost:44444 user@remote.computer.ip.address (possibly rfc1918 ip)
ssh user@localhost -p22222

Wa la, you now have a SSH session to your home computer from work.

 

SSH Remote Command Execution

The following example allows you to execute a command on a remote system and return the results of the command without a shell session.

Simply include the command immediately after the normal ssh session request. Here's an easy one for a periodic secure rule integrity check on openBSD using pf.

ssh someuser@ip.add.re.ss 'pfctl -s rules | openssl sha1'

 

Making real-time kernel adjustments in Linux

/proc/sys is an important directory in Linux, it contains many of the adjustable kernel values that can be changed while a system is running. it also provides a lot of information that can be collected and parsed by a script that might validate certain security settings. For instance, we have the file below, its contents (a zero or a one) would indicate whether or not the kernel is allowed to forward packets.

/proc/sys/net/ipv4/ip_forward

 

Use sshfs to Securely Mount Remote File Systems

The following commands can be used on *BSD systems.

# pkg_add -r fusefs-sshfs
# kldload /usr/local/modules/fuse.ko
# sysctl vfs.usermount=1
# mkdir /mnt/docs
# sshfs user@x.x.x.x:/some/remote.dir /mnt/local.dir