LinuxSecurityFreak's questions

I have a small business. With little previous knowledge/experience of NAS solutions. The budget was a bit of a problem, I have been capped to 40,000 CZK =~ 1800 USD. First, it may be best to tell you what solution I picked up:

Synology DS923+ with these plugged into:

• Let me start with a UPS, which I already had for 3 months, signalling via USB to the NAS, (this was not part of the budget obviously);
• The included amount of RAM was a joke, so I fitted it with 2x 16 GB ECC module (not from Synology);
• I need just about 22 TB to tripple the previous poor solution, so I went for 4x 8TB HDD (not from Synology);
• Finally, I fitted 2x 1 TB M.2 NVMe (not from Synology).
• 1 Gigabit/s speed is ok for us, so I did not have to buy the 10 Gigabit extension;
• (For completeness, I have a symmetric connection from my ISP with 100 Mbit/s down/and also up and both the router and main switch is not from Synology).

As for set-up, stating only the most important settings:

• SSH access from my main Linux machine with public authentication;
• Reliable and stable connection to the mentioned Linux machine via NFSv4.1;
• Previous solution had only 2 bays 4TB each in RAID0, this time I struggled with my thinking, but in the end had set up RAID5;
• I am well aware I should be going for RAID6 likely, but I would not reach the required capacity, it is a bit better than RAID0, right..;
• As for the file system, I chose BTRFS just to try it out finally, it has nice features..;
• Those two fast M.2 NVMe drives I have set-up as a cache for the volume, in RAID1 as read+write cache.

I was previously decided to use the M.2's in RAID0 as a very fast storage, and here we go:

• I know how to unofficially do that, yet I resisted, and tried the cache first;
• It appears to actually be more helpful, than I thought;
• The use-case for this NAS is very wide, ranging from simple document sharing mostly inside local network with other people to saturating my upload link with high (legal) torrent usage;

Conclusion: Thanks to the heavy torrent use, if I am not mistaken, I believe utilizing those 1 TB NVMe's is a logical choice, but I tend to verify what I am inexperienced with.

So as for the formulation of my question:

Does it make more sense to use NVMe drives for that Synology NAS of ours to act as a cache than as a storage (which is unofficial with non-Synology drives, I know)? Thank you for reading the whole story! I hope to see some fact-based answers. Thanks in any case for your time.

Cache hits normally around 95%, image for the words:

From my basic understanding of iptables I put together the below setup intended to run a Tor relay... here it is after 6 hours approx. Please note, I do not want to discuss any Tor operations, and so I shall not be pointed to https://tor.stackexchange.com/ Thank you.

There was a large attack on port 22, which I spotted when I woke up, so I've changed it, password authentication was already disabled, but the person/bot tried to break in anyways, I have an 8192 bits long RSA public/private key, so I hope it will be enough.

# iptables -L -v --line-numbers

outputs:

Chain INPUT (policy DROP 8242 packets, 735K bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 DROP       tcp  --  any    any     anywhere             anywhere             ctstate NEW tcp flags:!FIN,SYN,RST,ACK/SYN /* protection: non-syn packets */
2       10   452 DROP       all  --  any    any     anywhere             anywhere             ctstate INVALID /* protection: malformed packets */
3       20  1000 ACCEPT     all  --  lo     any     anywhere             anywhere             /* loopback: compulsory */
4        3    98 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp echo-request limit: avg 2/sec burst 5 /* ICMP: ping only */
5    16625 9388K ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED /* traffic */
6        7   420 ACCEPT     tcp  --  any    any     anywhere             anywhere             ctstate NEW,ESTABLISHED tcp dpt:xxyyzz /* SSH: global obfuscated */  <-- CENSORED
7      438 26080 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:9001 /* Tor: OR */
8      558 30828 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:9030 /* Tor: Dir */

Chain FORWARD (policy DROP 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 16969 packets, 6369K bytes)
num   pkts bytes target     prot opt in     out     source               destination         

I would like to deploy fail2ban, but I never used it, so I found several guides to set it up, but I believe we should have some example on this site, I did find too many results for fail2ban alone, however only nothing relevant for fail2ban initial setup ?

If this for whatever reason can't be done here, please comment and I'll delete this question later on.

System: Debian GNU/Linux 11 (bullseye) with openssh-server for ssh service.

Thank you in advance!

PS: Migrated from https://security.stackexchange.com/

About 7 days ago, I found out on https://www.mail-tester.com that sometimes (50% of my tries over a couple of days) my company email does not pass DMARC test. As it states it does not know why, I am helpless right now and don't really understand what is happening.

I get this message:

The DMARC test failed but we didn't find any obvious reason why. If you recently modified your DNS, please wait a few hours and then test again.

DMARC DNS entry found for the domain _dmarc.vlastimilburian.cz:

"v=DMARC1; p=reject; adkim=s; aspf=s"

Verification details:

• mail-tester.com; dkim=pass (1024-bit key; unprotected) header.d=vlastimilburian.cz [email protected] header.b=CefZgBpZ; dkim-atps=neutral
  

• mail-tester.com; dmarc=none header.from=vlastimilburian.cz
  

• mail-tester.com; dkim=pass (1024-bit key; unprotected) header.d=vlastimilburian.cz [email protected] header.b=CefZgBpZ; dkim-atps=neutral
  

• From Domain: vlastimilburian.cz
  

• DKIM Domain: vlastimilburian.cz
  

I have a ProtonMail premium plan with one custom domain and a single email address. My domain DNS is protected with DNSSEC.

I have DKIM (DomainKeys Identified Mail - wiki) also.

My SPF record is a hard-fail:

v=spf1 include:_spf.protonmail.ch mx -all

Strange thing is, both SPF, and DKIM are passing:

I did not modify my DNS in 3 days, is there any other possible reason for DMARC to fail?

Update 2019-May-27

I got a reply from the Mail-Tester.com's staff:

Thank you for sharing this link. I'm afraid I quite still don't understand the answer over there... Basically, it says everything is OK and DMARC should pass... isn't it? If so, I'm afraid it does not help much... we use the famous OpenDMARC library to analyze DMARC and the "we didn't find any obvious reason why" is generated when OpenDMARC says your email does not pass DMARC while our own test does not find anything wrong.

Could this possibly be an error in OpenDMARC, should I report it?

I tried the test now, and it passed.

Additionally, I sent a message to my Gmail free-mail with PASS results:

As I don't understand networking at all, I must turn to you in a very simple question.

I am told I need to set up an SPF record in order to minimize the risk of ending my business mass emails in a spam folder; among other things I need to do. I am not sending any spam or know about ending in it, I just want to set up my DNS records properly.

I have a rather long list of basically two subnets of IP addresses the hosting provider of mine uses for his mail servers.

I have read I should be able to specify them in some CIDR format, unknown to me.

A month ago I have set up, but I have issues, sometimes my SPF passes, sometimes it does not in this Mail-Tester:

v=spf1 a mx ~all

But as the mail server name resolves to multiple IP addresses of two different subnets.

I want to short the list of IP addresses specified. And to make it more flexible, because they may change the last bits of those IP addresses.

My current idea looks like this:

v=spf1 a mx ip4:111.111.111.xxx/?? ip4:222.222.222.xxx/?? -all

Parsing:

1. To specify version of the SPF record:

   v=spf1
   

2. To allow IP address of the domain to send email for this domain:

   a
   

3. To allow servers listed as MX to send email for this domain:

   mx
   

4. The first list of IP addresses starting always with e.g. 111.111.111 and ending with whatever range:

   ip4:111.111.111.xxx/??
   

5. The second list of IP addresses starting always with e.g. 222.222.222 and ending with whatever range:

   ip4:222.222.222.xxx/??
   

6. To set strict behavior for the non-compliant to be rejected:

   -all
   

The question is what should I put after the slash? 24?

I was up to enabling Wake-on-LAN feature on the Dell PowerEdge T20 server with A05 BIOS pre-installed from the delivery.

Once enabled, the server will shut down and immediately turning itself on. Up to 3 times I had to manually press the shutdown button for it to finally power off.

But to the point. What surprised me, was that the recommended way to install the BIOS update was from inside Windows. They provide only .exe files on their web.

Supposing I have a Linux system with rather simple setup, I could install Windows, if there was no other way. But is there?

4-Drive Software RAID1 vs RAID10 heading tells you what I am contemplating about.

Hardware: 2x 1TB Enterprise-class HDDs + 2x 1TB Consumer-class HDDs.

OS and Software: Linux Debian Jessie (stable) with mdadm.

Intended purpose: Extreme reliability storage. Cannot afford data loss. Such thing would simply be unacceptable. That is why I am considering RAID1 instead of RAID10, because fault tolerance with RAID1 should be 3-drive failure.

I see one downside: limiting the global storage size to 1/4. Crazy.

Apart from this decision RAID1 vs RAID10, which I probably already made, RAID1 that is, unless you advise me otherwise, I have a question regarding RAID1:

Supposing I am limited to 4 drives, I would have limited posibilities with RAID10, as opposed to RAID1, where I could define 3 drives active and 4th as a spare. Either that or directly define active 4 HDDs.

Please tell me what you think?

Situation:

I have a 3-drive (SSD) software RAID5 (mdadm) array (SATA) on the server (Linux Debian 8.5) for data only. I need to temporarily remove these drives in order to do something with some other drives.

Questions:

1. What is the correct procedure? Is it as simple as stopping all related services, unmounting the array and stopping it? Can I safely do that and then unplug the drives while having the server running?
2. Do I have to remember which drive has been connected to what SATA port?
3. Do I have to reboot to start the array again, once I put those drives back?

I am on Windows Server 2012 R2, trying to connect to one Hyper-V virtual machine.

The requested operation could not be completed due to a virtual disk system limitation. On NTFS, virtual hard disk files must be uncompressed and unencrypted. On ReFS, virtual hard disk files must not have the integrity bit set.

Well, I admit I did compress the NTFS file system of this particular VM.

It contains the old Windows XP because of several our Software not being compatible with newer versions. We use it for old software and we need it ASAP.

It worked until now.

What we have, possibly useful:

• Ironically, enough disk space to accommodate everything uncompressed from that VHDX twice
• Limited RAM: 16GB per each server
• Linux Debian 8.5 server (headless, but I may enable Cinnamon GUI and connect through TeamViewer)
• Gigabit network

Question:

How do I connect to the compressed NTFS storage to uncompress it for us to make it work again?

EDIT1:

• On Windows 8.1 if I try to mount it via Computer -> Manage -> Storage -> Disk Management -> menu Actions -> Attach VHD:

  The requested operation could not be completed due to a virtual disk system limitation. On NTFS, virtual hard disk files must be uncompressed and unencrypted. On ReFS, virtual hard disk files must not have the integrity bit set.

• On Windows 8.1 if I try to open the VHDX file with StarWind V2V Converter:

  Error opening file (2) [0]

• On Windows 7 if I try to mount it the same way as in 8.1:

  The file or directory is corrupted and unreadable

• On Windows 7 if I try to open the VHDX file with StarWind V2V Converter:

  Error opening VHDX disk image file. VHDX format supported on Windows 8 and later

EDIT2:

By installing libguestfs-tools on Linux Mint 17.3 as follows:

sudo apt-get install libguestfs-tools

I am now able to mount it with as follows:

sudo guestmount -a thevirtualdisk.vhdx -i /mnt/anydirectory

But so far I have no idea how to clear the NTFS compression attribute(?)

Domain: burian-server.cz

What I've tried:

user@pc ~ $ curl -v -3 -X HEAD https://burian-server.cz
* Rebuilt URL to: https://burian-server.cz/
* Hostname was NOT found in DNS cache
*   Trying 192.168.0.102...
* Connected to burian-server.cz (192.168.0.102) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* Unknown SSL protocol error in connection to burian-server.cz:443 
* Closing connection 0
curl: (35) Unknown SSL protocol error in connection to burian-server.cz:443 

As compared to another domain of mine sslhosting.cz, run on a different hosting:

user@pc ~ $ curl -v -3 -X HEAD https://sslhosting.cz
* Rebuilt URL to: https://sslhosting.cz/
* Hostname was NOT found in DNS cache
*   Trying 88.86.120.114...
* Connected to sslhosting.cz (88.86.120.114) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS alert, Server hello (2):
* error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure
* Closing connection 0
curl: (35) error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure

One tester told me I am "probably" not vulnerable, which I do not really understand.

As there are noticeable differences in the above outputs, I suspect I might have configured my Apache server incorrectly.

I have a LAMP webserver, and on it there is https://sslhosting.cz/ domain.

First I attach a general Let's Encrypt config file, which I changed to my needs:

/etc/letsencrypt/options-ssl-apache.conf

# Baseline setting to Include for all Let's Encrypt SSL sites


SSLEngine               on


# Intermediate configuration, tweak to your needs
SSLProtocol             all -SSLv2 -SSLv3
SSLCipherSuite          ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDH$
SSLHonorCipherOrder     on
SSLCompression          off
SSLOptions              +StrictRequire


# Add vhost name to log entries:
LogFormat               "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
LogFormat               "%v %h %l %u %t \"%r\" %>s %b" vhost_common


#CustomLog              /var/log/apache2/access.log vhost_combined
#LogLevel               warn
#ErrorLog               /var/log/apache2/error.log


# Always ensure Cookies have "Secure" set (JAH 2012/1)
#Header                 edit Set-Cookie (?i)^(.*)(;\s*secure)??((\s*;)?(.*)) "$1; Secure$3$4"


# HSTS = HTTP Strict Transport Security
Header                  always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload" env=HTTPS
Header                  always set X-Frame-Options DENY


# OCSP Stapling
SSLCACertificateFile    /etc/apache2/certificates/letsencrypt-crosssigned-stapling.pem
SSLUseStapling          on

Do I need to have port 80 configured in Virtualhost for an HTTPS website? Note that I want HTTP to be redirected to HTTPS.

Follows the specific website config:

/etc/apache2/sites-available/sslhosting.cz-le-ssl.conf

<VirtualHost *:80>

  ServerName             sslhosting.cz
  ServerAlias            www.sslhosting.cz

  RewriteEngine          on

  RewriteCond            %{HTTPS} !on
  RewriteRule            ^/?(.*) https://%{SERVER_NAME}/$1 [R=301,L]

  RewriteCond           %{HTTP_HOST} ^www\.sslhosting\.cz
  RewriteRule           ^(.*)$ https://sslhosting.cz/$1 [R=301,L]

</VirtualHost>


<IfModule mod_ssl.c>

        <VirtualHost *:443>

                ServerAdmin     [email protected]

                ServerName      sslhosting.cz
                ServerAlias     www.sslhosting.cz

                DocumentRoot    /var/www/sslhosting.cz/public_html
                ErrorLog        ${APACHE_LOG_DIR}/error.log
                CustomLog       ${APACHE_LOG_DIR}/access.log combined

                SSLCertificateFile      /etc/letsencrypt/live/sslhosting.cz/fullchain.pem
                SSLCertificateKeyFile   /etc/letsencrypt/live/sslhosting.cz/privkey.pem

                Include         /etc/letsencrypt/options-ssl-apache.conf

        </VirtualHost>

        SSLStaplingCache        shmcb:/tmp/stapling_cache(128000)

</IfModule>

Now, the question:

Do I need to have port 80 configured in LAMP for an HTTPS website?

How do I verify if OCSP Stapling works correctly?

Setup: LAMP with Let's Encrypt, test domain https://pavelstriz.cz/

High-Tech Bridge result says OCSP is enabled

Is this enough for me to believe the OCSP is set up correctly?

Thank you.

I am on Linux Debian Jessie 8.4.

I have set up a web server. It seems to run fine.

I'm just wondering, if I need the following firewall rules are ok for HTTP(S) server to be running fine.

iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 10100 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

The server is behind a router. Port 22 is not forwarded. 10100 is used for passive FTP

Thank you.

Do I need ntpd daemon / service on an LAMP server running Linux Debian 8.3?

I have already disabled some obvious services, but I am not sure about this one.