I have a backup of all files/folders from a Linux install that had Samba running and some shares.
This installation was using the registry for configuring the shares so they are not in /etc/samba/smb.conf.
Where can I go to find the settings/shares that were configured? I can't boot into this system so that's not an option.
By default, a Google Apps Script project cannot access a resource (like an API or a DB using JDBC) inside a corporate network. The company would have to put holes in their firewall for the GAS servers to be able to connect to those internal resources.
But since all GAS projects run on the same Google servers, using the same APIs, putting holes in the firewall means that ANYONE, including GAS projects outside the organization's G-Suite enterprise account, can access the resource inside the corporate network.
If we created a VPC between Google and our corporate network, would that allow only GAS projects in our G-Suite Enterprise organization to access internal resources?
I have configured exim4 to send e-mails using TLS through smtp.gmail.com::465 , NOT STARTTLS through smtp.gmail.com::587. I used information provided to me that was pulled from various sources. The complete list of steps I performed can be seen at https://github.com/imthenachoman/How-To-Secure-A-Linux-Server#configure-gmail-as-mta-with-implicit-tls.
This is for a server at home, behind a router. I don't have a domain name so I created a local server-side certificate using /usr/share/doc/exim4-base/examples/exim-gencert.
I am able to send e-mails. I assume it is actually encrypted TLS traffic through 465 but I am not sure how to check.
I did a system audit using Lynis and it showed a warning for exim4:
[+] Software: e-mail and messaging
------------------------------------
- Exim status [ RUNNING ]
- Type [ SATELLITE ]
- Certificate not set [ WARNING ]
- Private Key not set [ WARNING ]
I went through Lynis' source and discovered it is checking for these to be set by checking for tls_certificate and tls_privatekey in the output of exim -bP transport remote_smtp_smarthost:
$ sudo exim -bP transport remote_smtp_smarthost | egrep 'tls_certificate|tls_privatekey'
tls_certificate =
tls_privatekey =
I don't know how to remediate/fix this.
Questions:
My server is running and I have modified /etc/pam.d/common-password. When certain programs are installed or there are system updates, it needs to update that file so it asks me if I want to the file should be overwritten or not.
One or more of the files /etc/pam.d/common-{auth,account,password,session} have been locally modified. Please indicate whether these local changes should be overridden using the system-provided configuration. If you decline this option, you will need to manage your system's authentication configuration by hand.
Override local changes to /etc/pam.d/common-*?
Is it possible to put my changes in another file that pam will still use so that I don't have to deal with this message in the future?
If it helps, I am changing the line:
password requisite pam_pwquality.so retry=3
To this:
password requisite pam_pwquality.so retry=3 minlen=10 difok=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 maxrepeat=3 gecoschec
My server is generating this psad error. I am not sure what it means? I think it is saying an IPv6 ping request was blocked but am not sure.
And if it is a ping request, is it from the server to another device? I don't recall anything on my network being IPv6 enabled so I'm confused what it could/would be.
=-=-=-=-=-=-=-=-=-=-=-= Sat Mar 9 22:50:28 2019 =-=-=-=-=-=-=-=-=-=-=-=
Danger level: [2] (out of 5)
Source: 0000:0000:0000:0000:0000:0000:0000:0000
DNS: [No reverse dns info available]
Destination: ff02:0000:0000:0000:0000:0000:0000:0016
DNS: [No reverse dns info available]
Overall scan start: Sat Mar 9 22:50:28 2019
Total email alerts: 1
Syslog hostname: vm
Global stats:
chain: interface: protocol: packets:
OUTPUT enp0s3 icmp6 1
[+] ICMP6 scan signatures:
Invalid ICMP type "143" chain=OUTPUT packets=1
[+] Whois Information (source IP):
No whois server is known for this kind of object.
=-=-=-=-=-=-=-=-=-=-=-= Sat Mar 9 22:50:28 2019 =-=-=-=-=-=-=-=-=-=-=-=
I have a clean install of Debian with the NTP client. I was given settings to secure secure my NTP client configuration. I know how to add them to the /etc/ntp.conf file but I am not if settings need to be merged or overwritten, if order matters, or how duplicate settings are handled.
This is the default /etc/ntp.conf file that comes with the package:
cat /etc/ntp.conf | egrep -v '^#|^$'
driftfile /var/lib/ntp/ntp.drift statistics loopstats peerstats clockstats filegen loopstats file loopstats type day enable filegen peerstats file peerstats type day enable filegen clockstats file clockstats type day enable pool 0.debian.pool.ntp.org iburst pool 1.debian.pool.ntp.org iburst pool 2.debian.pool.ntp.org iburst pool 3.debian.pool.ntp.org iburst restrict -4 default kod notrap nomodify nopeer noquery limited restrict -6 default kod notrap nomodify nopeer noquery limited restrict 127.0.0.1 restrict ::1 restrict source notrap nomodify noquery
These are the settings I was told to use:
#creates file to adjust the default system clock value after a service interruption/restart driftfile /var/lib/ntp/drift #access controls to reduce unwanted queries (kod) #prevent alteration of configuration file (nomodify) #prevent nptdc from being used for control message protocol traps (notrap) #prevent peer queries (nopeer) #prevent ntpq and ntpdc queries from being answered (noquery) restrict default kod nomodify notrap nopeer noquery restrict -6 default kod nomodify notrap nopeer noquery #restrict NTP access to localhost restrict 127.0.0.1 restrict -6 ::1 #point to NIST time servers use fastest method to collect time server time.nist.gov iburst #point to localhost if access is lost to NTP servers/pools fudge 127.127.1.0 stratum 10 #mitigates CVE-2013-5211 disable monitor
For some of them, like driftfile, I figured out they need to be over-written. I am not sure of the ones that remain. Are they needed or do I replace them? If I keep them, does order matter?
Based on my understanding, these are the settings I know need to be there based on merging the default options and what I was provided:
# creates file to adjust the default system clock value after a service interruption/restart driftfile /var/lib/ntp/drift # access control configuration restrict -4 default kod notrap nomodify nopeer noquery limited restrict -6 default kod notrap nomodify nopeer noquery limited # restrict NTP access to localhost restrict 127.0.0.1 restrict -6 ::1 # point to NIST time servers use fastest method to collect time server time.nist.gov iburst # point to localhost if access is lost to NTP servers/pools fudge 127.127.1.0 stratum 10 # mitigates CVE-2013-5211 disable monitor
These are the leftover settings from the default file but I'm not sure what to do with them:
statistics loopstats peerstats clockstats filegen loopstats file loopstats type day enable filegen peerstats file peerstats type day enable filegen clockstats file clockstats type day enable restrict source notrap nomodify noquery
I wasn't sure if this question belongs here or on SO. I can move it there if needed.
In any decent Apache configuration, Apache will run as its own ID; www-data for example. And this ID will not have permissions to list and CRUD files as other OS accounts. This is by security design.
I want to be able to, somehow, have Apache list or CRUD files as another OS account. For example, listing files in the account's home directory or creating a new text file in the account's home directory.
I know one solution is to use file/folder group permissions but I can't do that because I cannot muck with file/folder ownership or permissions.
I looked into suEXEC, suPHP, and php-fpm but none of them will work because they will run scripts as the owner of the script. In my case I am running commands like cp or mv as an arbitrary number of OS accounts. The only way I could use these tools is to have a script for each OS account. Or have a script owned by root but that doesn't sound secure.
So then I got to thinking about sudo. I could give www-data sudo privileges as the OS accounts.
Example of an entry in the sudoers file:
www-data ALL = (osAccount1) NOPASSWD: /bin/ls, /bin/mv
www-data ALL = (osAccount2) NOPASSWD: /bin/ls, /bin/mv
But this just stinks of risk. I cannot pin-point how or why -- it just feels ugly.
Is there anyway to do what I want?
I am trying to rsync data one of the volumes in a ZFS pool to an exfat formatted drive. The volume is only 1.3 TB but the rsync got up to syncing 3+ TB worth of data. I killed the rsync so I could figure out what is wrong.
The ZFS pool:
ubuntu@ubuntu:~$ zpool list
NAME SIZE ALLOC FREE EXPANDSZ FRAG CAP DEDUP HEALTH ALTROOT
backup 7.25T 3.59T 3.66T - 0% 49% 1.00x ONLINE -
The volumes and their mountpoints:
ubuntu@ubuntu:~$ zfs list
NAME USED AVAIL REFER MOUNTPOINT
backup 2.61T 2.49T 35.4M /backup
backup/.system 1.97M 2.49T 140K legacy
backup/.system/configs-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 593K 2.49T 593K legacy
backup/.system/cores 692K 2.49T 692K legacy
backup/.system/rrd-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 128K 2.49T 128K legacy
backup/.system/samba4 337K 2.49T 337K legacy
backup/.system/syslog-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 128K 2.49T 128K legacy
backup/vol1 1.26T 2.49T 1.26T /backup/vol1
backup/vol2 128K 2.49T 128K /backup/vol2
backup/vol3 1.78G 2.49T 1.78G /backup/vol3
backup/vol4 1.34T 2.49T 1.34T /backup/vol4
backup/vol5 4.51G 2.49T 4.51G /backup/vol5
The size on disk of /backup/vol1:
ubuntu@ubuntu:~$ du -sh /backup/vol1
1.3T /backup/vol1
How much data was copied after doing an rsync for a couple days:
ubuntu@ubuntu:~$ rsync -avzh --progress --no-o --no-g /backup/vol1 /media/ubuntu/external_drive/freenas/
...
...
ubuntu@ubuntu:~$ du -sh /media/ubuntu/external_drive/freenas/vol1
3.2T /media/ubuntu/external_drive/freenas/vol1
I killed it after seeing how much was transferred.
First, I realize there are many duplicate questions but they are all quite old and their answers may not be relevant anymore. I would assume (or hope) that in our constantly evolving technology landscape there is now a better solution than using 3rd party, potentially buggy, drivers to read NTFS.
Is there?
I have a TP-Link Archer C7 router and a Debian 9.4 server that has UFW installed on it. I was looking through the UFW logs and it looks like my router is sending requests to port 49125 of server every 30 seconds. I cannot figure out how to diagnose this.
My router is 192.168.1.1 and my server is 192.168.1.100. Here is an excerpt from the UFW log file. Does anyone know what this could be?
Mar 23 22:28:12 mydebianserver kernel: [ 769.900902] [UFW BLOCK] IN=eno1 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.1.1 DST=192.168.1.100 LEN=287 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=1900 DPT=49125 LEN=267
Mar 23 22:28:32 mydebianserver kernel: [ 789.900838] [UFW BLOCK] IN=eno1 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.1.1 DST=192.168.1.100 LEN=287 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=1900 DPT=49125 LEN=267
Mar 23 22:28:52 mydebianserver kernel: [ 809.900581] [UFW BLOCK] IN=eno1 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.1.1 DST=192.168.1.100 LEN=287 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=1900 DPT=49125 LEN=267
Mar 23 22:29:12 mydebianserver kernel: [ 829.900395] [UFW BLOCK] IN=eno1 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.1.1 DST=192.168.1.100 LEN=287 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=1900 DPT=49125 LEN=267
Mar 23 22:29:32 mydebianserver kernel: [ 849.900548] [UFW BLOCK] IN=eno1 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.1.1 DST=192.168.1.100 LEN=287 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=1900 DPT=49125 LEN=267
Mar 23 22:29:52 mydebianserver kernel: [ 869.900169] [UFW BLOCK] IN=eno1 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.1.1 DST=192.168.1.100 LEN=287 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=1900 DPT=49125 LEN=267
Mar 23 22:30:13 mydebianserver kernel: [ 890.428246] [UFW BLOCK] IN=eno1 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.1.1 DST=192.168.1.100 LEN=287 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=1900 DPT=49125 LEN=267
Mar 23 22:30:32 mydebianserver kernel: [ 909.899898] [UFW BLOCK] IN=eno1 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.1.1 DST=192.168.1.100 LEN=287 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=1900 DPT=49125 LEN=267
Mar 23 22:30:52 mydebianserver kernel: [ 929.899368] [UFW BLOCK] IN=eno1 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.1.1 DST=192.168.1.100 LEN=287 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=1900 DPT=49125 LEN=267
Mar 23 22:31:12 mydebianserver kernel: [ 949.899450] [UFW BLOCK] IN=eno1 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.1.1 DST=192.168.1.100 LEN=287 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=1900 DPT=49125 LEN=267
Mar 23 22:31:32 mydebianserver kernel: [ 969.899535] [UFW BLOCK] IN=eno1 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.1.1 DST=192.168.1.100 LEN=287 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=1900 DPT=49125 LEN=267
Mar 23 22:31:52 mydebianserver kernel: [ 989.899162] [UFW BLOCK] IN=eno1 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.1.1 DST=192.168.1.100 LEN=287 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=1900 DPT=49125 LEN=267
Mar 23 22:32:12 mydebianserver kernel: [ 1009.899015] [UFW BLOCK] IN=eno1 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.1.1 DST=192.168.1.100 LEN=287 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=1900 DPT=49125 LEN=267
Mar 23 22:32:32 mydebianserver kernel: [ 1029.898800] [UFW BLOCK] IN=eno1 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.1.1 DST=192.168.1.100 LEN=287 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=1900 DPT=49125 LEN=267
I have Apache installed on a Debian Stretch system. I have no sites enabled but for some reason the /var/www/html/index.html still renders if I go to http://hostname.
Loaded sites:
root@hostname:/etc/apache2# a2query -s
No site matches (disabled by site administrator)
The access logs are going to /var/log/apache2/other_vhosts_access.log which is set in /etc/apache2/conf-enabled/other-vhosts-access-log.conf -> ../conf-available/other-vhosts-access-log.conf:
root@hostname:/etc/apache2/conf-enabled# more other-vhosts-access-log.conf
# Define an access log for VirtualHosts that don't define their own logfile
CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log vhost_combined
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
How can I find what setting is doing this? I want to disable that VirtualHost so, for now, no page is loaded/rendered.
I have a fresh install of Ubuntu 16.04. I configured iptables, ufw (with gufw), and psad using instructions from https://www.thefanclub.co.za/how-to/how-secure-ubuntu-1604-lts-server-part-1-basics and https://www.thefanclub.co.za/how-to/how-install-psad-intrusion-detection-ubuntu-1204-lts-server.
Everything seems to work fine but now I'm getting a boatload of e-mails complaining of UDP scans from my machine (to itself), my router and other devices on my network.
How do I fix this? Like ignore them or something?
From the server to itself:
=-=-=-=-=-=-=-=-=-=-=-= Tue May 3 18:40:47 2016 =-=-=-=-=-=-=-=-=-=-=-=
Danger level: [2] (out of 5)
Scanned UDP ports: [32412-32414: 6 packets, Nmap: -sU]
iptables chain: INPUT (prefix "[UFW AUDIT]"), 2 packets
iptables chain: OUTPUT (prefix "[UFW ALLOW]"), 2 packets
iptables chain: OUTPUT (prefix "[UFW AUDIT]"), 2 packets
Source: 192.168.1.50
DNS: server.nigam.com
Destination: 192.168.1.255
DNS: [No reverse dns info available]
Overall scan start: Tue May 3 18:40:20 2016
Total email alerts: 37
Complete UDP range: [32412-32414]
Syslog hostname: nook
Global stats:
chain: interface: protocol: packets:
INPUT br1 udp 6
OUTPUT br1 udp 12
From the router:
=-=-=-=-=-=-=-=-=-=-=-= Tue May 3 18:40:49 2016 =-=-=-=-=-=-=-=-=-=-=-=
Danger level: [2] (out of 5)
Scanned UDP ports: [42608-58785: 6 packets, Nmap: -sU]
iptables chain: INPUT (prefix "[UFW AUDIT]"), 6 packets
Source: 192.168.1.1
DNS: NigamNet
Destination: 192.168.1.69
DNS: nook.nigam.com
Overall scan start: Tue May 3 18:35:58 2016
Total email alerts: 39
Complete UDP range: [32911-60857]
Syslog hostname: nook
Global stats:
chain: interface: protocol: packets:
INPUT br1 udp 119
From localhost:
=-=-=-=-=-=-=-=-=-=-=-= Tue May 3 18:40:47 2016 =-=-=-=-=-=-=-=-=-=-=-=
Danger level: [1] (out of 5) Multi-Protocol
Scanned UDP ports: [33335: 2 packets, Nmap: -sU]
iptables chain: INPUT (prefix "[UFW AUDIT]"), 1 packets
iptables chain: OUTPUT (prefix "[UFW AUDIT]"), 1 packets
Source: 127.0.0.1
DNS: localhost
Destination: 127.0.0.1
DNS: localhost
Overall scan start: Tue May 3 18:40:20 2016
Total email alerts: 5
Complete TCP range: [6789]
Complete UDP range: [33335]
Syslog hostname: nook
Global stats:
chain: interface: protocol: packets:
OUTPUT lo tcp 3
OUTPUT lo udp 3
INPUT lo tcp 3
INPUT lo udp 3
From my Roku:
=-=-=-=-=-=-=-=-=-=-=-= Tue May 3 07:03:33 2016 =-=-=-=-=-=-=-=-=-=-=-=
Danger level: [3] (out of 5)
Scanned UDP ports: [41598: 1 packets, Nmap: -sU]
iptables chain: INPUT (prefix "[UFW BLOCK]"), 1 packets
Source: 192.168.1.108
DNS: NP-4124DU054440.nigam.com
Destination: 192.168.1.69
DNS: nook.nigam.com
Overall scan start: Tue May 3 00:12:39 2016
Total email alerts: 191
Complete UDP range: [39474-41598]
Syslog hostname: nook
Global stats:
chain: interface: protocol: packets:
INPUT br1 udp 195
I am running Ubuntu 14.04 LTS. I've got a mount point called /files that is owned by root, the group is plugdev and I've given the group write permission. I used some of the information in https://help.ubuntu.com/community/InstallingANewHardDrive to set this up. Specifically the following commands:
sudo chgrp plugdev /files
sudo chmod g+w /files
All the users on the machine are also part of plugdev.
I've mounted a drive that has 1 ext4 partition to it.
At this point both user1 and user2 can create files/folders in /files. But, if user1 creates a file or folder in /files then user2 cannot modify it or create files in it.
I am wondering, how can I make it so all users can read/write (and, where applicable, execute) any/all files/folders created in /files regardless of who created it.
If it matters, /files is also a Samba share that is mounted on a Windows 7 machine.