Following steps will allow only selected users in particular group to run GET command on the server :

Step 1:- Create a group on the server

Code:

]# groupadd getgrp

Step 2:- Give execute permission to group

Code:

]# chmod 750 /usr/bin/GET

Step 3:- Add this group to GET file.

Code:

]# chown root.getgrp /usr/bin/GET

Step 4:- To check the permission of GET

Code:

]# ll -ld /usr/bin/GET

Step 5:- Now if you need to add the user to getgrp so that he gets execute permission on GET. Also getgrp should be secondary group of that user. Let the user be myuser1.

Code:

]# gpasswd -M myuser1 getgrp

Step 6:- To check if the user is added

Code:

]# cat /etc/group | grep getgrp

Step 7:- But if you want to add another user say myuser2 then please make sure that you mention both the user in your command as :

Code:

]# gpasswd -M myuser1,myuser2 getgrp

If you don’t mention both the user, this command will replace all the users with the user mentioned in your command. You should always run the cat command before adding any user so that you know how many users are already added. Or you can just edit the /etc/group file and add the user in the getgrp line.

The above steps will allow only root, myuser1 and myuser2 to execute GET command, all other will be denied.

Please note that path to GET may vary with the OS.

How can I run Rootkit Hunter every day?

You can create a cronjob script like this:

=========== /etc/cron.daily/rkhunter ====================
#!/bin/sh
(
/usr/local/bin/rkhunter –versioncheck
/usr/local/bin/rkhunter –update
/usr/local/bin/rkhunter –cronjob –report-warnings-only
) | /bin/mail -s ‘rkhunter Daily Run’ root
================================================== =======

You must be at ver 1.2.8 to use the report warnings only funtion.

How do I install Rootkit Hunter?

Download the gzipped tarball, extract it and run the installation script.

download:
# wget http://downloads.rootkit.nl/rkhunter-1.2.8.tar.gz
Note: It doesn’t matter where you save the tarball

extract:
# tar zxf rkhunter-1.2.8.tar.gz

installation:
# cd rkhunter
# ./installer.sh

This tutorial is for Web Server Administrators who administer Web Server.

Rules for Apache 2.x for better Security !

P.S: you must have Apache 2.x and Modsecurity_2 Installed

Step 1:- Downloading the Rules file

Code:

cd /etc
wget http://hyperois.com/files/modsec2_rules.tar.gz

Step 2:- Uncompress files

Code:

tar -xzvf modsec2_rules.tar.gz

Step 3:- Edit modsec2.conf

Code:

vi /usr/local/apache/conf/modsec2.conf

Step 4:- Copy and Paste this rules into your modsec2.conf

Code:

<IfModule mod_security2.c>
SecRuleEngine On
# “Add the rules that will do exactly the same as the directives”
# SecFilterCheckURLEncoding On
# SecFilterForceByteRange 0 255
SecAuditEngine RelevantOnly
SecAuditLog logs/modsec_audit.log
SecDebugLog logs/modsec_debug_log
SecDebugLogLevel 0
SecDefaultAction “phase:2,deny,log,status:406″
SecRule REMOTE_ADDR “^127.0.0.1$” nolog,allow
Include “/usr/local/apache/conf/modsec2.user.conf”

SecServerSignature “Rules Powered By HyperOIS.com”

#First, add in your exclusion rules:
#These MUST come first!
Include /etc/modsecurity/exclude.conf

#Application protection rules
Include /etc/modsecurity/rules.conf

#Just in Time Patches for Vulnerable Applications
Include /etc/modsecurity/jitp.conf

#Comment spam rules
Include /etc/modsecurity/blacklist.conf

#Bad hosts, bad proxies and other bad players
Include /etc/modsecurity/blacklist2.conf

#Bad clients, known bogus useragents and other signs of malware
Include /etc/modsecurity/useragents.conf

#Known bad software, rootkits and other malware
Include /etc/modsecurity/rootkits.conf

#Additional rules for Apache 2.x ONLY! Do not add this line if you use Apache 1.x
Include /etc/modsecurity/apache2-rules.conf

</IfModule>

Step 5:- Save and exit the file by clicking escape then typing

Code:

:wq

Step 6:- Lets apply the new setting by restarting Apache

Code:

services httpd restart

or

Code:

/etc/init.d/httpd restart

Spam emails is nothing but flooding  Internet with many copies of the same email messages or legitimate emails . We can also called it as junk emails . It is very frustrating when we receive spam emails in our inbox. Many spammers use various tricks to send spam emails to unknown email addresses like anybody@domain.com , main@domain.com etc . If you are have a web hosting account with cpanel as your control panel then you can easily avoid spam emails using “Default Address” option.

By default all your unrouted emails are received in your main users inbox.

So you can avoid it by adding the following line in your cpanel >> mail >> default address option

•  :fail: no such address here

You can also avoid spam emails using email filtering.

Cpanel >> Email Filtering  >> add filter

Here you need to use your own filtering techniques like filter spam emails with specific subject, email address, contents, message ID etc.

While choosing web host you need to consider following important factors of web host.

1: Security and reliability:

While hosting your site with any web hosting provider you must be sure that the servers are fully secured and reliable for your applications. That starts from basic website data protection especially hacking attempts are an important watch-point for web developers while selecting an host.

Security in terms of firewall, security patches, tweaking on server configurations to avoid hacking process,denial of service attacks (DDOS) etc.

Hosting provider or ISP is completely responsible for regular upgrades as well as security measures that are taken on a web server and lastly, daily / weekly backups are also part of their hosting packages to recover from any critical issues.

2:Customer Service

Customer Service is another important concept hosting business. Various Hosts offer a variety of customer services to attract customers. You need to sure that your service provider has 24X7 support on chats, phone and email. Technical expertise and experience are part of customer service.

3:Server Software

UNIX and Windows NT are the most common server software environments provided by hosting provider. server software can also affect a website with their limitation and restrictions. Your web developer should be aware of applications they will be using and assess which software environment will best suit their needs.

4: Internet Connection used by host:

Internet connection is very important while choosing hosting provider.
There are a bunch of variations T-1, T-3, OC-3 etc. A company that offers a T1 connection to the Internet can only allow 1.544 Mbps , T3 can allow up to 45 Mbps. An OC-256 can allow 13,000 Mbps, having ability to transfer much more information at a higher speed before getting down.

5: Speed:

Server performance and integration with software applications. How fast can they respond to your request ? When we speak of server speed, it clearly means that bandwidth and network connections are an important part. A server that is a host to many sites that are being accessed simultaneously may get bogged down. No matter how fast the connection is this can seriously slow down a viewer’s speed of browse a site. You can easily test the speed at which a server responds by “pinging” a site from your command prompt. Processor speed is also important. video and audio Streaming, forums and message boards, and highly animated applications all require huge amounts of memory and fast access to the main server. Overloaded processors can slow down a site’s transmission .

Hello,

ImageMagick is a software used to create, edit, and compose bitmap images. Using ImageMagick we can read, convert and write images in a variety of formats including DPX, EXR, GIF, JPEG, JPEG-2000, PDF, PhotoCD, PNG, Postscript, SVG, and TIFF. ImageMagick is used to translate, flip, mirror, rotate, scale, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

ImageMagick is typically utilized from the command line or you can use the features from programs written in your favorite programming language. Choose from these interfaces: G2F (Ada), MagickCore (C), MagickWand (C)

How to install ImageMagick On Linux Server

wget ftp://ftp.imagemagick.org/pub/ImageMagick/ImageMagick.tar.gz

tar -zxvf ImageMagick*.tar.gz
cd ImageMagick*

./configure

make

make install

You can verify the installation with command :

which convert

Regards,

Tuks

Note: Please don’t disable the Windows Firewall unless and until you have the other appropriate firewall software installed on your system

There are mainly three methods for disabling the Windows Firewall. The first method is for any user with administrative privileges on an individual machine not remotely or collectively managed in any way. The other two methods are for use windows Administrators on fully managed systems or Windows Servers.

1) Using the Control Panel

This method is for any user with administrative access to unmanaged systems

1. From the Start menu, select Control Panel, then select Windows Firewall.
2. Select Off, then click Ok.

2) Using Local Policy

This method is for administrators with administrative access to unmanaged systems or locally managed systems where the machine is not part of a Windows 2000 or higher domain.

Go to Start menu >> select Run, here enter gpedit.msc.
Expand the Computer Configuration folder, then the Administrative Templates folder.
Expand the Network folder, then the Network Connections folder, then the Windows Firewall folder.
Select the Standard Profile folder.
Double-click the Windows Firewall: Protect all network connections option.
Select Disabled, then click OK.
Select the Domain Profile folder.
Double-click the Windows Firewall: Protect all network connections option.
Select Disabled, then click OK.
Close the Group Policy dialog box.

3) Using Group Policy

This method is for administrators with administrative access to managed machines that are part of a Windows 2000 or 2003 Active Directory domain.

Create a new Group Policy object, and give the object a descriptive name (for example, ITS-Turn off Windows Firewall).
Select the newly created group policy.
Right-click on the newly created policy and select Edit.
Expand the Computer Configuration folder, then the Administrative Templates folder.
Expand the Network folder, then the Network Connections folder, then the Windows Firewall folder.
Select the Standard Profile folder.
Double-click the Windows Firewall: Protect all network connections option.
Select Disabled, then click OK.
Select the Domain Profile folder.
Double-click the Windows Firewall: Protect all network connections option.
Select Disabled, then click OK.
Close the Group Policy dialog box.
In the Security Filter section, click Add.
Search for the objects that this group policy will be applied to, then click OK.
Close the Group Policy editor.

Hello,

The process of booting a Linux system consists of a number of stages as follows

1) BIOS

2) Master Boot Record (MBR)

3) LILO or GRUB

4) Kernel

5) init

6) Run Levels

The process of booting a Linux system consists of a number of stages

1)BIOS: Basic Input/Output System is the lowest level interface between the computer and peripherals which load boot sector from one of following devices

Floppy
CDROM
Hard drive

The boot order can be changed from within the BIOS. BIOS setup can be entered by pressing a del ,F1 , F2, or F10 key during bootup.

2)MBR:
The first sector of the hard disk is reserved master boot record (MBR).

When we the Operating booting from a hard disk, the PC system BIOS loads and executes the boot loader code in the MBR. Here MBR needs to know which partitions on the disk have boot loader code specific to their operating systems in their boot sectors and then attempts to boot one of them.

Fedora Linux is supplied with the GRUB boot loader which is fairly sophisticated and therefore cannot entirely fit in the 512 bytes of the MBR.
The GRUB MBR boot loader merely searches for a special boot partition and loads a second stage boot loader.

This then reads the data in the /boot/grub/grub.conf configuration file, which lists all the available operating systems and their booting parameters. When this is complete, the second stage boot loader then displays the familiar Fedora branded splash screen that lists all the configured operating system kernels for your choice.

3)Boot loader (GRUB or LILO)

Lilo and Grub are installed or at the MBR (Master Boot Record), or at the first sector of the active partition.

Boot loader will ask for the OS label which will identify which kernel to run and where it is located (hard drive and partition specified). The installation process requires to creation/identification of partitions and where to install the OS. GRUB/LILO are also configured during this process. The boot loader then loads the Linux operating system.

LILO: (Linux Loader)
In case of a multi-boot config, LiLo permits the user two choose an operating system from the menu. The LiLo settings are stored at /etc/lilo.conf
-LILO does not understand filesystems
- code and kernel image to be loaded is stored as raw disk offsets
-uses the BIOS routines to load

Grub (GNU Grub Unified Boot Loader)
- Understands file systems
- config lives in /boot/grub/menu.lst or /boot/boot/menu.lst

4)Kernel
-The kernel verifies hardware configuration and initialise devices.
(optionally loads initrd, )
-The kernel tries to mount the file system and the system filesmounts root filesystem specified by lilo or loadin with root= parameter

The file system type is automatically detected. The most used file systems on Linux are ext2 and ext3. If the mount fails, a so-called kernel panic will occur, and the system will “freeze”.
System files are usually mounted in read-only mode, to permit a verification of them during the mount. This verification isn’t indicated if the files were mounted in read-write mode.

-kernel prints: VFS: Mounted root (ext2 filesystem) readonly.
* runs /sbin/init which is process number 1 (PID=1)
- init prints: INIT: version 2.76 booting
- can be changed with boot= parameter to lilo, eg boot=/bin/sh can be useful to rescue a system which is having trouble booting.

After these steps, the kernel will start init, which will become process number 1, and will start the rest of the system.

5) init process
The init process is the last step in the boot procedure and parent of all the other processes. This process is the first running process on any Linux/UNIX system, and is started directly by the kernel. It is what loads the rest of the system, and always has a PID of 1.

Init is responsible for starting system processes as defined in the /etc/inittab file.

The init process is never shut down. It is a user process and not a kernel system process although it does run as root.

Run Levels

0 halt
1 single user
2 Not used (user-definable)

3 Full multi-user mode (no GUI interface)

4 Not used (user-definable)
5 X11 Full multiuser mode (with GUI interface)
6 Reboot

Based on the selected runlevel, the init process then executes startup scripts located in subdirectories of the /etc/rc.d directory. Scripts used for runlevels 0 to 6 are located in subdirectories /etc/rc.d/rc0.d through /etc/rc.d/rc6.d, respectively.

Default is defined in /etc/inittab, eg:
o id:3:initdefault:
The current runlevel can be changed by running /sbin/telinit # where # is the new runlevel, eg typing telinit 6 will reboot.

CGI Scripts :
An acronym for Common Gateway Interface, CGI is an interface that enables you to run external programs on your server for performing specific functions.
CGI is executed in real-time, it output dynamic information instantly so CGI can be considered as a way of interfacing your custom programs with HTTP or WWW servers, so that a server can offer interactive sites instead of just static text and images. CGI programs can be written in Perl, Java, Visual Basic and C.

How it works :
The Common Gateway Interface (CGI) allows information to pass between a Web site’s server and a program usually written in Perl or Java that lives in the “CGI bin” on that server. You send information from your browser to the server; the server passes the information through the CGI gateway to the Perl/Java program; the Perl/Java program does its thing to the information (perhaps conducting a query of a database and creating an HTML page that lists the results), then sends the information back through the CGI gateway to the server, and the server returns the information to your browser.

Uploading CGI scripts :
All CGI programs must be uploaded to your cgi-bin directory. You should be sure to use ASCII mode when uploading Perl scripts.

Calling CGI scripts :
In your HTML documents, reference your CGI script using following path: http://www[DOT]yourdomain[DOT]com/cgi-bin/script.

Precautions to be taken while developing customized CGI scripts :
You should take atmost care while using CGI scripts as they area more vulnerable to attacks, a buggy CGI script can leak sufficient system information to compromise the host.
Quite a number of widely distributed CGI scripts contain known security holes. Many of the ones that are identified here have since been caught and fixed, but if you are running an older version of the script you may still be vulnerable. Get rid of it and obtain the latest version. If there is no fix for a script, just get rid of it.

While you are developing custom CGI scripts avoid
*) Giving out too much information about your site and server host. ( eg : For example, the “finger” command often prints out the physical path to the fingered user’s home directory and scripts that invoke finger leak this information )
*) If you’re coding using some compiled language like C, avoid making assumptions about the size of user input.
(While coding if you made the assumption that user input provided by a POST request will never exceed the size of the static input buffer then a wily hacker can break this type of program by providing input many times that size. The buffer overflows and crashes the program; in some circumstances the crash can be exploited by the hacker to execute commands remotely.

Sometimes you face the problem of bandwidth leakage, even you don’t see much traffic for your site your controlpanel shows heavy bandwidth usage. So you must check what is going wrong with your bandwidth.
There can be many reasons for this but first of all you should check for your images/video and take care for not being compromised or hotlinked. Some blackhat webmaster tries to save their bandwidth by hotlinking files at other sites.

What is Hotlink :
When you link to an image/video on someone else’s server instead of saving that image to your computer and uploading it to your blog/site. When you do this you are stealing bandwidth of the other linking site.
When your visitor loads the page with those images, they are actually loading image/video from the other site eating up the bandwidth of that site.

Some webmaster do such unethical practices as to save their bandwidth, as they have limited amount of bandwidth allowed each month and if it get exceeded then their host may suspend their account so they play such tricks. As a webmaster we should be aware of such illegal practices and should protect us.

How to Detect The Bandwidth Thieves :
Most effective way to check who are the culprits is through checking your dedicated server logs for referrals to the images on your website. Trace the referrers in the logs to the actual referring website and check the offending web page. If you find your graphics displayed on their page, check the HTML source for that page and find out where the graphic files are hosted. If the IMG tag points to your website, it means they are using your bandwidth for their website.

How to protect yourself :
Using .htaccess, you can disallow hot linking on your server, so those attempting to link to your images are either blocked (failed request, such as a broken image) or served with different content may be with some funny image.
Note that mod_rewrite needs to be enabled on your server in order for this aspect of .htaccess to work. If you are using Wordpress, there is a hotlink protection plugin that you can install which fights bandwidth theft.