Is there a way to set multiple proxy servers via winhttp? I have an application that looks at the registry key set by winhttp for the proxy server and I can confirm it's working fine when I set it via the command below.
netsh winhttp set proxy host-name-or-IP:port
However, I want it to try one proxy server first and then fail over to another one. Is there anyway to set multiple proxy servers via the registry key?
Currently I'm using basic API gets to pull down logs from a cloud security vendor but it's not a very clean process. I would like to transition over to the event streaming (AMQPS) service they provide.
I've already setup the queue and have the relevant information on the cloud side but the issue I'm running into is figuring out the best way to accept that stream and dump them to syslog. I'm utilizing syslog-ng right now but it looks like it can only send to RabbitMQ and not accept it.
I'm currently looking at Pika to see if that would work to accept AMQPS and then funnel it to a log file but that's where I'm running into some problems. Any help would be greatly appreciated.
Thanks
A while back I posted about using OSSEC as a sudo SIEM as far as sending logs from various servers to one OSSEC server and using the correlation to trip alerts. Overall that solution worked very well but I've recently had to divide out the logs for load balancing reasons so now I have something along the lines of:
OSSEC Server
Each log file is being written by a different syslog server for load balancing reasons and it works pretty good overall. However the issue I'm running into is that OSSEC can run correlation rules against each log file individually but if there are 4 failed logins and they happen to be spread out over the 4 log files, OSSEC would only see 1 on each instance and not alert of 4 failed logins from 1 user.
Is there anyway to make OSSEC treat the files as one? I'm looking at other solutions such as a gluster/cluster file system where I can write from multiple servers to one file which would fix the issue.
We are currently using syslog-ng to dump files to a network storage location. Each day there are 5 .log files that are written by various servers and at the end of the day I need to merge the 5 files in chronological order and then compress them. For the past 2 years, I've use logmerge and it's worked great. The exact syntax is:
/local/bin/logmerge -f /mnt/logs/Windows/`date -d yesterday +\%Y-\%m-\%d`-sys*.log | gzip -9 -c > /mnt/logs/Windows/`date -d yesterday +\%Y-\%m-\%d`.log.gz && rm -f /mnt/logs/Windows/`date -d yesterday +\%Y-\%m-\%d`-sys*.log
Over the past few weeks this process has broken due to how large the .log files have gotten. Each one is now over 7 GB and the logmerge process is failing on sorting so many lines. Right now I'm just gzipping them but it makes searching harder because the logs aren't in order.
Is there a better way to merge these files and zip them up?
I currently have NxLog running on various Domain Controllers pulling out login/logout events.
Exec if $TargetUserName =~ /(\S+\$|user1|user2|user3|user4)/ drop(); \
else if ($EventID == 4624 or $EventID == 4625 or $EventID == 4648 or $EventID == 4768) $raw_event = "Time:" + $EventTime + ", EventID:" + $EventID + ", Keyword:" + $Status + ", LogonType:" + $LogonType + ", User:" + $TargetDomainName + "\\" + $TargetUserName + ", IPAddr:" + $IPAddress; \
else if $raw_event =~ /^(.+)(Detailed Authentication Information:|Additional Information:)/ $raw_event = $1; if $raw_event =~ s/\t/ /g {}
While the config above works fine, in the fact that it ignores usernames with $ in it and also the ones I specified, I want to only ignore event id 4624 with those usernames in it so I can still see failed logins. I thought the following config would work but I keep getting syntax errors.
Exec if ($EventID == 4624 and $TargetUserName =~ /(\S+\$|user1|user2|user3|user4)/ drop(); \
else if ($EventID == 4624 or $EventID == 4625 or $EventID == 4648 or $EventID == 4768) $raw_event = "Time:" + $EventTime + ", EventID:" + $EventID + ", Keyword:" + $Status + ", LogonType:" + $LogonType + ", User:" + $TargetDomainName + "\\" + $TargetUserName + ", IPAddr:" + $IPAddress; \
else if $raw_event =~ /^(.+)(Detailed Authentication Information:|Additional Information:)/ $raw_event = $1; if $raw_event =~ s/\t/ /g {}
Any help would be greatly appreciated.
Edit: For completeness, below was my final config to rule out usernames with $ in it and then successful/Kerb events on various accounts that were chatty that I didn't care about.
Exec if $TargetUserName =~ /(\S+\$)/ drop(); \
else if ($EventID == 4624 and $TargetUserName =~ /(user1|user2|user3|user4)/) drop(); \
else if ($EventID == 4648 and $TargetUserName =~ /(user1|user2|user3|user4)/) drop(); \
else if ($EventID == 4624 or $EventID == 4625 or $EventID == 4648 or $EventID == 4768) $raw_event = "Time:" + $EventTime + ", EventID:" + $EventID + ", Keyword:" + $Status + ", LogonType:" + $LogonType + ", User:" + $TargetDomainName + "\\" + $TargetUserName + ", IPAddr:" + $IPAddress; \
else if $raw_event =~ /^(.+)(Detailed Authentication Information:|Additional Information:)/ $raw_event = $1; if $raw_event =~ s/\t/ /g {}
We currently use Nxlog on all of our DCs and send that data to a central syslog-ng server. Due to dealing with the agent on each computer and the need for additional agents that only support reading the event viewer, we are debating about using WEF to forward all DC logs to a few servers so we have fewer agents to deal with. In theory this sounds fine, but as I started to read into it, I don't see any ability for HA or clustering. I could probably front end it with a load balance and round robin spray the events to the 5 or so servers on the back end but not sure if that would work the way I want it to.
Does anyone have experience with using WEF in a fairly large environment? We receive around 200 million Windows event logs a day and need to increase the logging level. Also, we have the need for the logs to be as near real time as possible so with this scale, has anyone ran into performance issue on either the DC forwarding logs or latency of the collectors receiving them?
Thanks for your help and input.
I'm working on modifying our current Windows log setup and have ran across an issue I can't quite seem to find the answer to. We currently have nxlog configured on each DC to send windows event IDs 4624 and 4625 to a central log server for basic user login information, both successful and failed. The nxlog config works just fine but the issue I have is with excessive logon events.
When testing the config, I logged into a few different machines using my domain credentials. On each test, I received anywhere between 10 - 70 4624 events per login. They were all "Microsoft-Windows-Security-Auditing[524]: An account was successfully logged on. Logon Type: 3" type of log and always came from the same DC.
Below is a log example that is basically repeated over and over again.
Dec 17 13:02:57 dc1.domain.com Microsoft-Windows-Security-Auditing[536]: An account was successfully logged on. Subject: Security ID: ________ Account Name: -
Account Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: __________ Account Name: my_user_name
Account Domain: my_domain Logon ID: __________ Logon GUID:
{_________} Process Information: Process ID: 0x0 Process Name: - Network Information:
Workstation Name: Source Network Address: 192.168.1.10 Source Port: 61371
I want it to tell me that X user is logging in, but I only need 1 of those entries per login and not multiple ones.
Any help would be greatly appreciated.
Thanks, Eric
I'm trying to install Samplicator to test Netflow central collector and then forwarding to other collectors from there. I mainly want to use Samplicator due to it being able to easily sample the Netflow data and/or send the full raw feed.
When I download it from the github repo, there is no configure file by default like the install instructions say. I've tried using autoconf and various automake commands to get configure to show up and it does finally, but says
config.status: error: cannot find input file: `Makefile.in'
Has anyone else had experience installing this software recently? I know it hasn't been updated in quite a while.
Thanks, Eric
I am using nxlog to tail a custom log file on one of my Windows servers. Each entry in the text file looks similar to this.
===================================================================================================================
1/14/2014 3:08:48 PM DOMAIN\user1 adding group member...
Domain: blah
Group: TestGroup
Member: CN=Joe Bob,CN=Users,DC=blah,DC=ARG,DC=com
1/14/2014 3:08:48 PM 1 member added.<br>
================================================================================================
I'm trying to send this log to my syslog server and I want to combine these multiple lines to 1 line so I can easily grep/search for specific users or groups. I've read some of the documentation on nxlog's website regarding multiline but haven't found a specific config to put them all in 1 entry with a syslog header.
Thanks, Eric
I have 2 ES servers that are being fed by 1 logstash server and viewing the logs in Kibana. This is a POC to work out any issues before going into production. The system has ran for ~1 month and every few days, Kibana will stop showing logs at some random time in the middle of the night. Last night, the last log entry I received in Kibana was around 18:30. When I checked on the ES servers, it showed the master running and the secondary not running (from /sbin/service elasticsearch status), but I was able to do a curl on the localhost and it returned information. So not sure what's up with that. Anyway, when I do a status on the master node, I get this:
curl -XGET 'http://localhost:9200/_cluster/health?pretty=true'
{
"cluster_name" : "gis-elasticsearch",
"status" : "red",
"timed_out" : false,
"number_of_nodes" : 6,
"number_of_data_nodes" : 2,
"active_primary_shards" : 186,
"active_shards" : 194,
"relocating_shards" : 0,
"initializing_shards" : 7,
"unassigned_shards" : 249
}
When I view the indexes, via "ls ...nodes/0/indeces/" it shows all indexes being modified today for some reason and there are new file for today's date.So I think I'm starting to catch back up after I restarted both servers but not sure why it failed in the first place. When I look at the logs on the master, I only see 4 warning errors at 18:57 and then the 2ndary leaving the cluster. I don't see any logs on the secondary (Pistol) on why it stopped working or what truly happened.
[2014-03-06 18:57:04,121][WARN ][transport ] [ElasticSearch Server1] Transport response handler not found of id [64147630]
[2014-03-06 18:57:04,124][WARN ][transport ] [ElasticSearch Server1] Transport response handler not found of id [64147717]
[2014-03-06 18:57:04,124][WARN ][transport ] [ElasticSearch Server1] Transport response handler not found of id [64147718]
[2014-03-06 18:57:04,124][WARN ][transport ] [ElasticSearch Server1] Transport response handler not found of id [64147721]
[2014-03-06 19:56:08,467][INFO ][cluster.service ] [ElasticSearch Server1] removed {[Pistol][sIAMHNj6TMCmrMJGW7u97A][inet[/10.1.1.10:9301]]{client=true, data=false},}, reason: zen-disco-node_failed([Pistol][sIAMHNj6TMCmrMJGW7u97A][inet[/10.13.3.46:9301]]{client=true, data=false}), reason failed to ping, tried [3] times, each with maximum [30s] timeout [2014-03-06 19:56:12,304][INFO ][cluster.service ] [ElasticSearch Server1] added {[Pistol][sIAMHNj6TMCmrMJGW7u97A][inet[/10.1.1.10:9301]]{client=true, data=false},}, reason: zen-disco-receive(join from node[[Pistol][sIAMHNj6TMCmrMJGW7u97A][inet[/10.13.3.46:9301]]{client=true, data=false}])
Any idea on additional logging or troubleshooting I can turn on to keep this from happening in the future? Since the shards are not caught up, right now I"m just seeing a lot o debug messages about failed to parse. I'm assuming that will be corrected once we catch up.
[2014-03-07 10:06:52,235][DEBUG][action.search.type ] [ElasticSearch Server1] All shards failed for phase: [query] [2014-03-07 10:06:52,223][DEBUG][action.search.type ] [ElasticSearch Server1] [windows-2014.03.07][3], node[W6aEFbimR5G712ddG_G5yQ], [P], s[STARTED]: Failed to execute [org.elasticsearch.action.search.SearchRequest@74ecbbc6] lastShard [true] org.elasticsearch.search.SearchParseException: [windows-2014.03.07][3]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"facets":{"0":{"date_histogram":{"field":"@timestamp","interval":"10m"},"global":true,"facet_filter":{"fquery":{"query":{"filtered":{"query":{"query_string":{"query":"(ASA AND Deny)"}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1394118412373,"to":"now"}}}]}}}}}}}},"size":0}]]
I have a logstash server sending events to an elasticsearch server that is displaying the results in Kibana. Everything is working pretty good, other than Kibana is showing 2 names in the host field. I am using the following grok filter in logstash.
^(?:<%{POSINT:syslog_pri}>)?%{SYSLOGTIMESTAMP:timestamp} %{IPORHOST:host} (?:%{PROG:program}(?:\[%{POSINT:pid}\])?: )?%{GREEDYDATA:message}
When I use the Grok debugger, everything is parsed out correctly. However when I view it in Kibana, it shows this:
"host": [
"logstash1",
"servername.domain.com"
],
Where logstash1 is the name of my logstash server that is doing the parsing and sending to elasticsearch. I'm not sure why it is showing both the logstash server and the actual source as the host. How can i remove the logstash1 from the host field? An example of the logs are:
Dec 18 00:00:08 servername.domain.com pam_rhosts_auth[24233]: allowed to [email protected] as user1
I am working on setting up a syslog-ng server to accept logs from various sources. The general setup is going to be:
Device1
Device2 Syslog1
Device3 --> Load balancer --> Syslog2 --> Shared SAN storage
Device4 Syslog3
Device5
I am using 514/udp and with this setup, I should easily have HA and be able to round robin and spread the load. My concern is how the storage is going to be shared and written to on the backend. Ideally I'd like each device to have a deviceX.log file for the day. What happens if syslog1 gets a large log file in from device1 and is still writing to device1.log when syslog2 gets a small log file in from device1 and starts trying to write to the same file at the same time?
I have read that in Linux if you append the file and don't open it in "write" mode, then you will never get the write protected error. I am not sure how syslog does this.
So my questions are:
Any recommendations would be greatly appreciated. Thanks in advance.
I have a Fedora server that I want to spawn an interactive python script after the user logs on. This script will ask the user for various types of information for configuring the system or it will search for the previous config file and show them the predefined information. Originally I was going to put this in rc.local or make it run with init.d but that messed up the boot due to how the script is spawned. So I would like this script to run as soon as the user logs in to Gnome. I've searched around quite a bit and found this answer which appears to be exactly what I want, but it isn't working the way I want it to. Below is my entry.
[Desktop Entry]
Name=MyScript
GenericName=Script for initial configuration
Comment=I really want this to work
Exec=/usr/local/bin/myscript.sh
Terminal=true
Type=Application
X-GNOME-Autostart-enabled=true
Whenever I login, nothing happens. So I then did a test to modified "myscript.sh" to just echo some text to a file and it worked fine. So it appears the portion that isn't working is the script popping open a terminal and waiting for the users input. Are there any additional options I need to add to make this work? I can confirm when I run /usr/local/bin/myscript.sh from the CLI it works fine. I have also tried adding "StartupNotify=true" and still no luck.
Edit @John - I tried moving my Exec= to /usr/local/bin/myscript-test and this is what myscript-test contains.
#!/bin/bash
xterm -e /usr/local/bin/myscript.sh
Yet again, when I just run the myscript-test it works fine. However when I put that in my autostart, nothing happens.
Edit 2 - I did a few more tests and it did start working but I had to remove Terminal=True before the xterm would pop. Thanks for your help.
I'm working on a kickstart script for a custom Scientific Linux ISO. However I am running into an issue with installing some programs from source.
Below is the general syntax I am trying. Where I will copy the .tgz file to the /tmp/ directory and then I will just have it execute the commands. When I do this logged into a computer, it works fine. However I believe when the kickstart script is trying to run it, it's not staying in the initial directory like I want it to. All of my rpm installs work fine due to it just being 1 command. Is there another method of how I should try to compile these?
%post --nochroot
cp -f nmap-6.01.tgz $INSTALL_ROOT/tmp/
%post
tar xzf /tmp/nmap-6.01.tgz -C /tmp/
cd /tmp/nmap-6.01 && ./configure && make && make install
rm -f /tmp/nmap-6.01.tgz
rm -rf /tmp/nmap-6.01
Thanks in advance.
Edit: For nmap I ended up getting the rpm and it worked fine. However there are still other programs I have to compile that I will need to figure this out for.
Edit2: I broke it down a little more and added some additional logging and this is what I see now.
configure: error: installation or configuration problem: C compiler cannot create executables
Then when I look at the actual config.log file I see this error.
collect2: cannot find 'ld'
and
It works fine when I'm logged in, so yet again it's something to do with how it's being built in the kickstart.
cd /tmp/nmap-6.01 && ./configure >> /tmp/nmap.log 2>> /tmp/nmap.log
cd /tmp/nmap-6.01 && make >> /tmp/nmap.log 2>> /tmp/nmap.log
cd /tmp/nmap-6.01 && make install >> /tmp/nmap.log 2>> /tmp/nmap.log
I've looked around quite a bit and have seen similar setup and questions, but none seem to work for me. I'm using the following command to create a custom ISO:
/usr/bin/livecd-creator --config=/usr/share/livecd-tools/test.ks --fslabel=TestAppliance --cache=/var/cache/live
This works great and it creates the ISO with all of the packages and configs I want on it. My issue is that I want the install to be unattended. However, every time I start the CD, it asks for all of the info such as keyboard, time zone, root password, etc. These are my basic settings I have in my kickstart script prior to the packages section.
cdrom
install
autopart
autostep
xconfig --startxonboot
rootpw testpassword
lang en_US.UTF-8
keyboard us
timezone --utc America/New_York
auth --useshadow --enablemd5
selinux --disabled
services --enabled=iptables,rsyslog,sshd,ntpd,NetworkManager,network --disabled=sendmail,cups,firstboot,ip6tables
clearpart --all
So after looking around, I was told that I need to modify my isolinux.cfg file to either do "ks=http://X.X.X.X/location/to/test.ks" or "ks=cdrom:/test.ks". I've tried both methods and it still forces me to go through the install process. When I tail the apache logs on the server, I see that the ISO never even tries to get the file. Below are the exact syntax I'm trying on my isolinux.cfg file.
label http
menu label HTTP
kernel vmlinuz0
append initrd=initrd0.img ks=http://192.168.56.101/files/test.ks ksdevice=eth0
label localks
menu label LocalKS
kernel vmlinuz0
append initrd=initrd0.img ks=cdrom:/test.ks
label install0
menu label Install
kernel vmlinuz0
append initrd=initrd0.img root=live:CDLABEL=PerimeterAppliance rootfstype=auto ro liveimg liveinst noswap rd_NO_LUKS rd_NO_MD rd_NO_DM
menu default
EOF_boot_menu
The first 2 give me a "dracut: fatal: no or empty root=" error until I give it a root= option and then it just skips the kickstart completely. The last one is my default option that works fine, but just requires a lot of user input. Any help would be greatly appreciated.
I need some help with my Snort/Barnyard2 setup. My goal is to have Snort send unified2 logs to Barnyard2 and then have Barnyard2 send the data to other locations. Here is my currrent setup.
snort -c /etc/snort/snort.conf -i eth2 &
/usr/local/bin/barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log -w /var/log/snort/barnyard.waldo &
output unified2: filename snort.log, limit 128
output alert_syslog: host=127.0.0.1
output database: log, mysql, user=snort dbname=snort password=password host=localhost
With this setup, barnyard2 is showing all of the correct information in the database and I'm using BASE to view it on the web GUI. I was hoping to be able to send the full packet data to syslog with barnyard2 but after reading around, it seems that it is impossible to do that. So I then started trying to modify the snort.conf file and add lines like "output alert_full: alert.full". This definitely gave me a lot more information but still not the full packet data like I want.
So my question is, is there anyway I can use barnyard2 to send the full packet data of alerts to a human readable file? Since I can't send it directly to syslog, I can create another process to take the data from that file and ship it off to another server. If not, what flags and/or snort.conf configuration would you recommend to get the most data possible but still be able to handle quite a bit of traffic? In the end of it all, these alerts will be shipped to a central server via a SSH tunnel. I'm trying to stay away from databases.
I am working on an OSSEC deployment where I will have multiple agents behind 1 public IP. Below is an example of the setup
Private Network
OSSEC-Agent1 (192.168.1.10)
OSSEC-Agent2 (192.168.50.33)
OSSEC-Agent3 (10.10.10.1)Those IPs NAT to 1 public IP (1.1.1.1)
Then 1.1.1.1 talks to the public OSSEC server on 2.2.2.2
I've read some OSSEC documentation talking about NAT here, but it doesn't tell me exactly what I need to know. Their example is using an entire /24 subnet and mine will mainly have multiple agents to only 1 public IP. With the setup so far, I brought Agent1 online fine and it is communicating to the OSSEC server. However Agent2 continues to fail trying to connect to 2.2.2.2. Even though when I added the key, I had the correct name for it, so I know it talked to the portal at least once for that information. I'm assuming it's just getting confused with the multiple keys to 1 public IP. I basically want to know if this is possible and/or if I'm just overlooking something simple. Any help would be greatly appreciated.
I've been working on a kickstart script for a Scientific Linux install. My goal is to create a CD ISO so that someone can install it easily on a server. I've been able to do a decent amount with it but I'm still running into a few problems that I would like help on.
Any help or pointers would be greatly appreciated.
######################################################
## Custom Kickstart Script
######################################################
######################################################
## Include another kickstart script
######################################################
%include sl62-livecd-gnome.ks
######################################################
## Basic Settings
######################################################
cdrom
install
autopart
autostep
xconfig --startxonboot
rootpw testpassword
lang en_US.UTF-8
keyboard us
timezone --utc America/New_York
auth --useshadow --enablemd5
selinux --disabled
services --enabled=iptables,rsyslog,sshd,ntpd,NetworkManager,network --disabled=sendmail,cups,firstboot,ip6tables
clearpart --all
######################################################
## Repos
######################################################
repo --name=base --baseurl=http://ftp.scientificlinux.org/linux/scientific/6.2/$basearch/os/
repo --name=security --baseurl=http://ftp.scientificlinux.org/linux/scientific/6.2/$basearch/updates/security/
######################################################
## Packages
######################################################
%packages
# Additional firmware support
aic94xx-firmware
netxen-firmware
atmel-firmware
bfa-firmware
ql2100-firmware
ql2200-firmware
ql23xx-firmware
ql2400-firmware
ql2500-firmware
rt61pci-firmware
rt73usb-firmware
xorg-x11-drv-ati-firmware
# Remove these packages
-tigervnc-server
-tigervnc
-postfix
-pidgin
-cups
-pulseaudio-module-bluetooth
-gnome-bluetooth-libs
-gnome-bluetooth
-cheese
-evolution-data-server
-libgweather
-tsclient
/usr/sbin/lokkit
%end
######################################################
## Post Script --nochroot (nochroot environment allows you to copy from the build host environment to the livecd build enviroment)
######################################################
%post --nochroot
# Modify desktop background
cp -f my_wallpaper.jpg $INSTALL_ROOT/usr/share/backgrounds/1280x1024_default.png
cp -f my_wallpaper.jpg $INSTALL_ROOT/usr/share/backgrounds/1920x1200_default.png
cp -f my_wallpaper.jpg $INSTALL_ROOT/usr/share/backgrounds/2048x1536_default.png
# Copy new splash screen for boot menu
cp -f splash.jpg $LIVE_ROOT/isolinux/
# Copy icons for the new applications
cp -f logo-16x16.png $INSTALL_ROOT/usr/share/icons/gnome/16x16/apps/logo.png
cp -f logo-22x22.png $INSTALL_ROOT/usr/share/icons/gnome/22x22/apps/logo.png
cp -f logo-24x24.png $INSTALL_ROOT/usr/share/icons/gnome/24x24/apps/logo.png
cp -f logo-32x32.png $INSTALL_ROOT/usr/share/icons/gnome/32x32/apps/logo.png
cp -f logo-32x32.png $INSTALL_ROOT/usr/share/icons/gnome/scalable/apps/logo.png
# Copy some files to the hard drive, will put them in the desktop later in the post script
cp -f system_stats $INSTALL_ROOT/usr/local/bin/
# Modify the boot menu
cat > $LIVE_ROOT/isolinux/isolinux.cfg << EOF_boot_menu
default vesamenu.c32
timeout 100
menu background splash.jpg
menu title Welcome to MyISO!
menu color border 0 #ffffffff #00000000
menu color sel 7 #ffffffff #ff000000
menu color title 0 #ffffffff #00000000
menu color tabmsg 0 #ffffffff #00000000
menu color unsel 0 #ffffffff #00000000
menu color hotsel 0 #ff000000 #ffffffff
menu color hotkey 7 #ffffffff #ff000000
menu color timeout_msg 0 #ffffffff #00000000
menu color timeout 0 #ffffffff #00000000
menu color cmdline 0 #ffffffff #00000000
menu hidden
menu hiddenrow 5
label install0
menu label Install
kernel vmlinuz0
append initrd=initrd0.img root=live:CDLABEL=MyISO rootfstype=auto ro liveimg liveinst noswap rd_NO_LUKS rd_NO_MD rd_NO_DM
menu default
EOF_boot_menu
%end
#####################################################
## Post Script (chroot environment isolates the livecd build environment form the host that is building the livecd)
#####################################################
%post
# Add a new user and modify permissions
/usr/sbin/useradd support -G wheel -c "Support" -d /home/support -s /bin/bash; echo password | passwd --stdin support
# Create the .ssh directory for root to have passwordless logins to the syslog server
mkdir /root/.ssh
# Create the keys
cat > /root/.ssh/id_rsa << EOF_id_rsa
PAST PRIVTE KEY HERE
EOF_id_rsa
cat > /root/.ssh/id_rsa.pub << EOF_id_rsa_pub
PAST PUBLIC KEY HERE
EOF_id_rsa_pub
# Modify the permissions for the ssh key
chown root:root -R /root/.ssh/
chmod 700 -R /root/.ssh/
# Allow wheel group sudo access
cat >> /etc/sudoers << EOF_sudoers
### Allow wheel group sudo access ###
%wheel ALL=(ALL) ALL'
EOF_sudoers
# Modify ssh_config
cat >> /etc/ssh/ssh_config << EOF_ssh_config
### Specific settings for timeouts
TCPKeepAlive yes
ServerAliveInterval 120
ServerAliveCountMax 3
### Don't prompt for host verification
StrictHostKeyChecking no
EOF_ssh_config
# Modify sshd_config
/bin/sed -i 's/#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
/sbin/service sshd restart
# Create a directory for rsyslog queuing
mkdir /var/spool/rsyslog
# Modify rsyslog configuration
cat >> /etc/rsyslog.conf << EOF_rsyslog
### Queuing Config ###
\$WorkDirectory /var/spool/rsyslog
\$ActionQueueType LinkedList
\$ActionQueueFileName remotequeue
\$ActionResumeRetryCount -1
\$ActionQueueSaveOnShutdown on
\$ActionQueueMaxFileSize 100m
\$ActionQueueMaxDiskSpace 5g
### Forwarding Rule ###
*.* @@127.0.0.1:1514
EOF_rsyslog
# Start the SSH tunnel and ensure if it goes down, it will be restarted
cat >> /etc/rc.local << EOF_inittab
ssh -fnNTx -L 1514:127.0.0.1:514 [email protected] > /dev/null 2>&1
EOF_inittab
cat >> /usr/local/bin/ssh_syslog << EOF_ssh_syslog
#!/bin/bash
if ps aux | grep "ssh -fnNTx" | grep -v "grep"
then
echo "Already Running"
else
echo "Starting now"
ssh -fnNTx -L 1514:127.0.0.1:514 [email protected]
fi
EOF_ssh_syslog
chmod 777 /usr/local/bin/ssh_syslog
cat >> /etc/crontab << EOF_ssh_cron
*/1 * * * * root /usr/local/bin/ssh_syslog
EOF_ssh_cron
# Allow forwarding (first line is for initial allowance, second line is to maintain during a reboot)
echo 1 > /proc/sys/net/ipv4/ip_forward
/bin/sed -i 's/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/' /etc/sysctl.conf
cat > /etc/sysconfig/iptables.script << EOF_iptables_script
#!/bin/bash
# Iptables configuration script
# Flush all current rules from iptables
/sbin/iptables -F
# Loopback address
/sbin/iptables -A INPUT -i lo -j ACCEPT
# Established inbound rule
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Define new chain with all management IPs
/sbin/iptables -N MGT_IPS
/sbin/iptables -A INPUT -s 192.168.56.0/24 -j MGT_IPS
# Allow SSH , HTTP, ,HTTPS, and ping access to management IPs
/sbin/iptables -A MGT_IPS -p tcp -m state --state NEW -m multiport --dports 22,80,443 -j ACCEPT
/sbin/iptables -A MGT_IPS -p icmp -m icmp --icmp-type any -j ACCEPT
# Allow ICMP from internal IPs
/sbin/iptables -A INPUT -s 10.0.0.0/8 -p icmp -m icmp --icmp-type any -j ACCEPT
/sbin/iptables -A INPUT -s 172.16.0.0/12 -p icmp -m icmp --icmp-type any -j ACCEPT
/sbin/iptables -A INPUT -s 192.168.0.0/16 -p icmp -m icmp --icmp-type any -j ACCEPT
# Drop rules to prevent them from entering the logs
/sbin/iptables -A INPUT -p tcp -m multiport --dports 135,137,138 -j DROP
/sbin/iptables -A INPUT -p udp -m multiport --dports 135,137,138 -j DROP
/sbin/iptables -A INPUT -p all -d 255.255.255.255 -j DROP
# Log dropped traffic
/sbin/iptables -A INPUT -j LOG -m limit --limit 10/m --log-level 4 --log-prefix "Dropped Traffic: "
# Set default policies for INPUT, FORWARD and OUTPUT chains
/sbin/iptables -P INPUT DROP
/sbin/iptables -P FORWARD DROP
/sbin/iptables -P OUTPUT ACCEPT
# Save settings
/sbin/service iptables save
# List rules
/sbin/iptables -L -v
EOF_iptables_script
# Modify iptables.script permissions so it can run
chmod 700 /etc/sysconfig/iptables.script
# Add files to rc.local
cat >> /etc/rc.local << EOF_rclocal
# Run firewall script
/etc/sysconfig/iptables.script
EOF_rclocal
# Remove some files that are not needed (cups,tigervnc-server, libgweather won't allow me to remove them)
rpm -e --nodeps tigervnc
rpm -e --nodeps tigervnc-server
rpm -e --nodeps libgweather
rpm -e --nodeps pulseaudio
rpm -e --nodeps cups
rpm -e --nodeps sendmail
# Modify the applications menu
rm -f /usr/share/applications/gthumb*.desktop
rm -f /usr/share/applications/brasero*.desktop
rm -f /usr/share/applications/gnome-screens*.desktop
rm -f /usr/share/applications/about-this-computer.desktop
rm -f /usr/share/applications/gnome-about*.desktop
rm -f /usr/share/applications/gnome-dictionary.desktop
rm -f /usr/share/applications/gnome-gcalctool.desktop
rm -f /usr/share/applications/gnome-keybinding.desktop
rm -f /usr/share/applications/bluetooth-properties.desktop
rm -f /usr/share/applications/totem.desktop
rm -f /usr/share/applications/gnome-file-roller.desktop
rm -f /usr/share/applications/gnome-gucharmap.desktop
rm -f /usr/share/applications/gedit.desktop
rm -f /usr/share/applications/gnome-baobab.desktop
rm -f /usr/share/applications/gnome-system-monitor.desktop
rm -f /usr/share/applications/palimpsest.desktop
rm -f /usr/share/applications/gnome-nautilus-browser.desktop
rm -f /usr/share/applications/TUV.desktop
rm -f /usr/share/applications/sl-release-notes.desktop
rm -f /usr/share/applications/system-config-users.desktop
rm -f /usr/share/applications/authconfig.desktop
rm -f /usr/share/applications/system-config-firewall.desktop
rm -f /usr/share/applications/system-config-services.desktop
rm -f /usr/share/applications/gnome-network-properties.desktop
rm -f /usr/share/applications/gnome-volume-control.desktop
rm -f /usr/share/applications/gnome-default-application.desktop
rm -f /usr/share/applications/gnome-at-properties.desktop
rm -f /usr/share/applications/gnome-session-properties.desktop
/bin/sed -i 's/Categories=System;Settings;X-Red-Hat-Base;/Categories=Settings;/' /usr/share/applications/system-config-date.desktop
/bin/sed -i 's/NoDisplay=true/NoDisplay=false/' /home/customer_login/.local/share/applications/preferred-mail-reader.desktop
# Create a various scripts for customers to use
cat > /usr/local/bin/remote_support << EOF_remote_support
#!/bin/bash
# This script will open a reverse SSH tunnel for support.
ssh -fnNTx -R 2222:127.0.0.1:22 X.X.X.X
EOF_remote_support
chmod 777 /usr/local/bin/remote_support
chmod 777 /usr/local/bin/system_stats
# Add the scripts to the applications menu
cat > /usr/share/applications/remote-support.desktop << EOF_remote_sup_menu
[Desktop Entry]
Name=Remote Support
Comment=Support
Exec=remote_support
StartupNotify=true
Terminal=true
Type=Application
Categories=System
Icon=/usr/share/icons/gnome/16x16/apps/logo.png
EOF_remote_sup_menu
cat > /usr/share/applications/system-stats.desktop << EOF_sys_stats_menu
[Desktop Entry]
Name=System Statistics
Comment=Basic system information
Exec=system_stats
StartupNotify=true
Terminal=true
Type=Application
Categories=System
Icon=/usr/share/icons/gnome/16x16/apps/logo.png
EOF_sys_stats_menu
chmod 644 /usr/share/applications/remote-support.desktop
chmod 644 /usr/share/applications/system-stats.desktop
%end
# Reboot after installation
reboot --eject
EDIT: I've figured out most of my problems. The only issue I have now is that I want the install procedure to skip the section where it prompts the user for a root password. I will auto set this later and don't want them having the power to do that.
EDIT2: Ok I updated my kickstart script above. Using this script it creates a live CD that instantly goes to the install process. Once I go through the install process it prompts me for root password, HD location, time zones, etc. Then it installs and all of my kickstart script works perfectly on the new system. However, I still want to make it where it doesn't prompt me for the root password during the initial install. I have tried adding the following to the kickstart script but it doesn't work
# Copy kickstart script to the live CD
cp -f test.ks $INSTALL_ROOT/root/
# Modified the boot menu to say
append initrd=initrd0.img ks=cdrom:/root/test.ks root=live:CDLABEL=MyISO rootfstype=auto ro liveimg liveinst noswap rd_NO_LUKS rd_NO_MD rd_NO_DM
On the ks= part I wasn't sure what was correct so I also tried ks=/root/test.ks and it still prompted me for the initial setup information.
EDIT3: I started working on this again over the last few days and I still can't get the ISO to auto step through the basic setting steps such as root password, time settings, keyboard, etc. I've tried various locations of putting the ks.cfg in /root/, on the live CD under that root directory and under isolinux. Every time it still asks for the info.
I'm currently working on setting up some secure syslog connections between a few Fedora servers. This is my currently setup
192.168.56.110 (syslog-server) <----> 192.168.57.110 (syslog-agent)
From the agent, I am running this command:
ssh -fnNTx -L 1514:127.0.0.1:514 [email protected]
This works just fine. I have rsyslog on the syslog-agent pointing to @@127.0.0.1:1514 and it forwards everything to the server correctly on port 514 via the tunnel. My issue is, I want to be able to lock this down. I am going to use ssh keys so this is automated because there will be multiple agents talking to the server. Here are my concerns.
Are there any sshd_config settings on the server that I can use to make it where only port 514 can be tunneled over ssh? Are there any other major security concerns I'm overlooking at this point? Thanks in advance for your help/comments.
I've been working on creating some custom Linux ISOs and have recently ran into some issues. Originally, I used bootcdwrite along with some scripts for create an ISO of the running config on a Debian server. Now I am working on some Fedora/CentoOS/Scientific Linux ISOs and haven't had much luck doing the same thing. I've looked at quite a few forums and people normally recommend revisor/pungi and clonesys. I've tried clonesys a few times and have never gotten the ISO to boot correctly for me. Revisor works fine as far as spinning the images and adding/removing specific packages, but it doesn't (or I haven't found out how to yet) do the customization I want. Ideally this is what I want to do.
This is exactly what I was able to do with bootcdwrite on Debian. I got everything working and configured the way I wanted it, ran a few script to remove tmp files, users, etc. to get it into a "raw" state and then converted it into an ISO.
From my research as of now, I see believe that Revisor is my best bet, I just have to figure out how to make it copy my running config with custom files instead of just modifying the packages (or maybe it does and I'm just not aware of it). That, or maybe I could use a more generic tool such as mkisofs.
Thanks in advance for your help.