Muhammad Dyas Yaskur's questions

I want to prevent a user from seeing a list of home directory(of other users). By default, a user can not access other user's home dir but can find another user's home dir like below:

[opc@instance-20210712-0826 home]$ cd /home
[opc@instance-20210712-0826 home]$ ls -lh
total 8.0K
drwx------. 10 opc       opc       4.0K Nov 14 22:52 opc
drwx------.  2 otheruser otheruser   62 Nov 28 18:19 otheruser
drwx------.  3 yaskur    yaskur    4.0K Nov 28 01:45 yaskur

In another way, a user can see a list of other users (based on home dir). I want to prevent it. It's similar to WHM/cPanel do, if I logged in as a user I can not see other user home dir:

[myuser@sng128 ~]$ cd /home
[myuser@sng128 home]$ ls -l
total 4
drwx--x--x 25 myuser myuser 4096 Nov 28 08:27 myuser

I use Oracle Linux which is similar to CentOS or Rocky Linux.

I want to install certbot using snap, but when I tried Official instruction:

sudo snap install core; sudo snap refresh core
sudo snap install --classic certbot

but returns:

error: cannot perform the following tasks:

• Run configure hook of "certbot" snap if present (run hook "configure": /var/lib not root-owned 1000:1000)

Previously, I uninstalled certbot(from apt) by using the below command:

sudo apt-get remove -y certbot python3-certbot-apache

What happened? I am using ubuntu 18.04 Bionic

From the error, looks like I need to change owner of /var/lib to root user. But I changed and still got the same error. Should I change to root recursively to that folder?

here is ls to the /var/lib:

drwxr-xr-x  4 myuser       myuser       4.0K Mar 10  2020 AccountsService
drwxr-xr-x  5 myuser       myuser       4.0K Mar 24  2020 apache2
drwxr-xr-x  5 myuser       myuser       4.0K Oct  4 02:36 apt
drwxr-xr-x  2 root      root      4.0K Sep  8 02:03 binfmts
drwxr-xr-x  2 myuser       myuser       4.0K May  5  2018 command-not-found
drwxr-xr-x  2 myuser       myuser       4.0K Mar 10  2020 dbus
drwxr-xr-x  2 myuser       myuser       4.0K Apr 16  2018 dhcp
drwxr-xr-x  3 myuser       myuser       4.0K Mar 10  2020 dictionaries-common
drwxr-xr-x  7 myuser       myuser       4.0K Oct  4 02:36 dpkg
drwxr-xr-x  2 myuser       myuser       4.0K Dec  9  2019 git
drwxr-xr-x  3 myuser       myuser       4.0K Mar 10  2020 grub
drwxr-xr-x  2 myuser       myuser       4.0K Oct  3 14:52 initramfs-tools
drwxr-xr-x  2 landscape landscape 4.0K Mar 10  2020 landscape
drwxr-xr-x  4 myuser       myuser       4.0K Oct  4 02:34 letsencrypt
drwxr-xr-x  3 myuser       myuser       4.0K Mar 10  2020 locales
drwxr-xr-x  2 myuser       myuser       4.0K Oct  3 06:25 logrotate
drwxr-xr-x  2 root      root         0 Oct  4 02:56 lxcfs
drwxr-xr-x  2 lxd       nogroup   4.0K Jun 16 00:42 lxd
drwxr-xr-x  2 myuser       myuser       4.0K Mar 10  2020 man-db
drwxr-xr-x  2 myuser       myuser       4.0K Apr 24  2018 misc
drwxr-xr-x  2 myuser       myuser       4.0K Oct  3 06:25 mlocate
drwx------ 35 mysql     mysql     4.0K Oct  3 14:51 mysql
drwx------  2 mysql     mysql     4.0K Mar 24  2020 mysql-files
drwx------  2 mysql     mysql     4.0K Mar 24  2020 mysql-keyring
drwxr-xr-x  2 root      root      4.0K Jan 21  2020 mysql-upgrade
drwxr-xr-x  2 myuser       myuser       4.0K Oct  3 14:50 pam
drwxr-xr-x  4 myuser       myuser       4.0K Mar 24  2020 php
drwxr-xr-x  2 myuser       myuser       4.0K Apr  4  2019 plymouth
drwx------  3 myuser       myuser       4.0K Mar 10  2020 polkit-1
drwxr-xr-x  6 postgres  postgres  4.0K Oct  3 14:50 postgresql
drwx------  3 myuser       myuser       4.0K Mar 10  2020 private
drwxr-xr-x  2 myuser       myuser       4.0K Mar 24  2020 python
drwxr-x---  2 redis     redis     4.0K Feb 24  2021 redis
drwxr-xr-x 21 myuser       myuser       4.0K Oct  4 02:46 snapd
drwxr-xr-x  3 myuser       myuser       4.0K Mar 10  2020 sudo
drwxr-xr-x  7 root      root      4.0K Oct  4 02:36 systemd
drwxr-xr-x  3 root      root      4.0K Jun 27 13:26 ubuntu-advantage
drwxr-xr-x  2 myuser       myuser       4.0K Oct  3 14:53 ubuntu-release-upgrader
drwxr-xr-x  3 myuser       myuser       4.0K Oct  3 14:52 ucf
drwxr-xr-x  2 myuser       myuser       4.0K Nov 25  2019 unattended-upgrades
drwxr-xr-x  2 myuser       myuser       4.0K Mar 10  2020 update-manager
drwxr-xr-x  4 myuser       myuser       4.0K Oct  4 02:44 update-notifier
drwxr-xr-x  3 myuser       myuser       4.0K Mar 10  2020 ureadahead
drwxr-xr-x  2 myuser       myuser       4.0K Mar 10  2020 usbutils
drwxr-xr-x  3 myuser       myuser       4.0K Mar 10  2020 vim

Why I can't ping any domain/hostname when ufw enabled?

[root@ip-172-31-23-37 ec2-user]# ping google.com
ping: google.com: Name or service not known
[root@ip-172-31-23-37 ec2-user]# ufw disable
Firewall stopped and disabled on system startup
[root@ip-172-31-23-37 ec2-user]# ping google.com
PING google.com (74.125.24.100) 56(84) bytes of data.
64 bytes from 74.125.24.100 (74.125.24.100): icmp_seq=1 ttl=100 time=2.14 ms
64 bytes from 74.125.24.100 (74.125.24.100): icmp_seq=2 ttl=100 time=2.19 ms
^C
--- google.com ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 2.149/2.170/2.192/0.051 ms
[root@ip-172-31-23-37 ec2-user]# ufw enable
Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup
[root@ip-172-31-23-37 ec2-user]# ping google.com
ping: google.com: Name or service not known

I was disabled all outgoing traffic except defined by using command ufw default deny outgoing. ufw status:

80                         ALLOW OUT   Anywhere
443                        ALLOW OUT   Anywhere
3306                       ALLOW OUT   Anywhere
2465                       ALLOW OUT   Anywhere
3306/tcp                   ALLOW OUT   Anywhere
3306/udp                   ALLOW OUT   Anywhere
127.0.0.1 3306             ALLOW OUT   Anywhere
80 (v6)                    ALLOW OUT   Anywhere (v6)
443 (v6)                   ALLOW OUT   Anywhere (v6)
3306 (v6)                  ALLOW OUT   Anywhere (v6)
2465 (v6)                  ALLOW OUT   Anywhere (v6)
3306/tcp (v6)              ALLOW OUT   Anywhere (v6)
3306/udp (v6)              ALLOW OUT   Anywhere (v6)

I already set to accept icmp to the /etc/ufw/before.rules file

# allow outbound icmp
-A ufw-before-output -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A ufw-before-output -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT

I have EC2 instance and I tried to block all outgoing connection using :

iptables -P OUTPUT  DROP

But now I can't connect to that server again. I tried from AWS web console, but still can't connect.

How can I connect to it?

My EC2 instance reported got suspicious activity and I got this email:

has been implicated in activity which resembles scanning remote hosts on the internet for security vulnerabilities. Activity of this nature is forbidden in the AWS Acceptable Use Policy (https://aws.amazon.com/aup/). We've included the original report below for your review.

Please take action to stop the reported activity and reply directly to this email with details of the corrective actions you have taken. If you do not consider the activity described in these reports to be abusive, please reply to this email with details of your use case.

If you're unaware of this activity, it's possible that your environment has been compromised by an external attacker, or a vulnerability is allowing your machine to be used in a way that it was not intended.

I don't know how to check what's happened. I changed my root password but I am still got same activity report.

below is the log:

Full logs:
(time in UTC)=2020-12-08T23:59:13 (attacker's IP)=myip (IP being scanned)=91^208^184^50 (TCP port being scanned)=523
(time in UTC)=2020-12-08T23:59:21 (attacker's IP)=myip (IP being scanned)=78^128^99^30 (TCP port being scanned)=2025
(time in UTC)=2020-12-08T23:59:28 (attacker's IP)=myip (IP being scanned)=140^238^172^100 (TCP port being scanned)=841
(time in UTC)=2020-12-08T23:59:42 (attacker's IP)=myip (IP being scanned)=219^91^85^19 (TCP port being scanned)=10699
(time in UTC)=2020-12-08T23:59:54 (attacker's IP)=myip (IP being scanned)=78^128^99^30 (TCP port being scanned)=1298
(time in UTC)=2020-12-09T23:57:40 (attacker's IP)=myip (IP being scanned)=219^91^85^19 (TCP port being scanned)=313
(time in UTC)=2020-12-09T23:57:43 (attacker's IP)=myip (IP being scanned)=219^91^62^21 (TCP port being scanned)=21735
(time in UTC)=2020-12-09T23:57:43 (attacker's IP)=myip (IP being scanned)=91^203^192^19 (TCP port being scanned)=984
(time in UTC)=2020-12-09T23:57:52 (attacker's IP)=myip (IP being scanned)=185^178^44^132 (TCP port being scanned)=18263
(time in UTC)=2020-12-09T23:57:53 (attacker's IP)=myip (IP being scanned)=140^238^172^100 (TCP port being scanned)=1389

another log:

Logs:
------------------------------------------------------------------------
Dec 9 01:01:55 kmh-wmh-003-nbg03 sshd[698]: Invalid user test from myip port 44682
Dec 9 01:01:55 kmh-wmh-003-nbg03 sshd[698]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=myip
Dec 9 01:01:57 kmh-wmh-003-nbg03 sshd[698]: Failed password for invalid user test from myip port 44682 ssh2
Dec 9 01:01:57 kmh-wmh-003-nbg03 sshd[698]: Received disconnect from myip port 44682:11: Bye Bye [preauth]
Dec 9 01:01:57 kmh-wmh-003-nbg03 sshd[698]: Disconnected from myip port 44682 [preauth]
Dec 9 01:18:16 kmh-wmh-003-nbg03 sshd[2480]: Invalid user pppuser from myip port 41660
Dec 9 01:18:16 kmh-wmh-003-nbg03 sshd[2480]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=myip
Dec 9 01:18:17 kmh-wmh-003-nbg03 sshd[2480]: Failed password for invalid user pppuser from myip port 41660 ssh2
Dec 9 01:18:17 kmh-wmh-003-nbg03 sshd[2480]: Received disconnect from myip port 41660:11: Bye Bye [preauth]
Dec 9 01:18:17 kmh-wmh-003-nbg03 sshd[2480]: Disconnected from myip port 41660 [preauth]
Dec 9 01:21:25 kmh-wmh-003-nbg03 sshd[2792]: Invalid user master from myip port 38852
Dec 9 01:21:25 kmh-wmh-003-nbg03 sshd[2792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=myip

Because I never connect to ssh using my instance, so I just want to block all outgoing SSH traffic from any user and any app/process. How to do that?

Maybe I can block all outgoing traffic to port 22 using iptables, but not all ssh using port 22 right? any other effective way?

My EBS storage volume for EC2 instance was nearly full then I tried to upgrade from 50gb to 70gb. The upgrade process take a long time, I didn't check how many minute/hours but after some days I see the progress status was completed. Then I tried go to SSH and using command df -h, but the size still 50gb. Why?

mount return :

[root@ip-172-31-23-37 ec2-user]# mount
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
devtmpfs on /dev type devtmpfs (rw,nosuid,size=1878544k,nr_inodes=469636,mode=755)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)
tmpfs on /run type tmpfs (rw,nosuid,nodev,mode=755)
tmpfs on /sys/fs/cgroup type tmpfs (ro,nosuid,nodev,noexec,mode=755)
cgroup on /sys/fs/cgroup/systemd type cgroup (rw,nosuid,nodev,noexec,relatime,xattr,release_agent=/usr/lib/systemd/systemd-cgroups-agent,name=systemd)
pstore on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime)
cgroup on /sys/fs/cgroup/net_cls,net_prio type cgroup (rw,nosuid,nodev,noexec,relatime,net_cls,net_prio)
cgroup on /sys/fs/cgroup/devices type cgroup (rw,nosuid,nodev,noexec,relatime,devices)
cgroup on /sys/fs/cgroup/hugetlb type cgroup (rw,nosuid,nodev,noexec,relatime,hugetlb)
cgroup on /sys/fs/cgroup/memory type cgroup (rw,nosuid,nodev,noexec,relatime,memory)
cgroup on /sys/fs/cgroup/perf_event type cgroup (rw,nosuid,nodev,noexec,relatime,perf_event)
cgroup on /sys/fs/cgroup/freezer type cgroup (rw,nosuid,nodev,noexec,relatime,freezer)
cgroup on /sys/fs/cgroup/blkio type cgroup (rw,nosuid,nodev,noexec,relatime,blkio)
cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup (rw,nosuid,nodev,noexec,relatime,cpu,cpuacct)
cgroup on /sys/fs/cgroup/pids type cgroup (rw,nosuid,nodev,noexec,relatime,pids)
cgroup on /sys/fs/cgroup/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset)
/dev/nvme0n1p1 on / type xfs (rw,noatime,attr2,inode64,noquota)
systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=25,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=13932)
debugfs on /sys/kernel/debug type debugfs (rw,relatime)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,relatime,pagesize=2M)
mqueue on /dev/mqueue type mqueue (rw,relatime)
sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw,relatime)
tmpfs on /run/user/1000 type tmpfs (rw,nosuid,nodev,relatime,size=379360k,mode=700,uid=1000,gid=1000)

I tried xfs_growfs -d /dev/nvme0n1p1 return:

[root@ip-172-31-23-37 ec2-user]# xfs_growfs -d /dev/nvme0n1p1
meta-data=/dev/nvme0n1p1         isize=512    agcount=26, agsize=524159 blks
         =                       sectsz=512   attr=2, projid32bit=1
         =                       crc=1        finobt=1 spinodes=0
data     =                       bsize=4096   blocks=13106683, imaxpct=25
         =                       sunit=0      swidth=0 blks
naming   =version 2              bsize=4096   ascii-ci=0 ftype=1
log      =internal               bsize=4096   blocks=2560, version=2
         =                       sectsz=512   sunit=0 blks, lazy-count=1
realtime =none                   extsz=4096   blocks=0, rtextents=0
data size unchanged, skipping

without -d arg:

[root@ip-172-31-23-37 kristacrm-new]# xfs_growfs /dev/nvme0n1p1
meta-data=/dev/nvme0n1p1         isize=512    agcount=26, agsize=524159 blks
         =                       sectsz=512   attr=2, projid32bit=1
         =                       crc=1        finobt=1 spinodes=0
data     =                       bsize=4096   blocks=13106683, imaxpct=25
         =                       sunit=0      swidth=0 blks
naming   =version 2              bsize=4096   ascii-ci=0 ftype=1
log      =internal               bsize=4096   blocks=2560, version=2
         =                       sectsz=512   sunit=0 blks, lazy-count=1
realtime =none                   extsz=4096   blocks=0, rtextents=0 

I also tried xfs_resize but command is not found

I tried to reboot my EC2 instance but still 50gb.

I have GCP cloud compute free tier (f1-micro (1 vCPU, 0.6 GB memory)). A few weeks ago I can access it but why now I can not access it. I run command ssh root@IP but return:

ssh: connect to host IP port 22: Operation timed out

I tried access SSH to the platform console but return:

I tried stop and start the instance but still can't be access.

I only can connect without identify-aware proxy.

How can I access my compute from my local?

I never turn on firewall

dyaskur@instance-3:~$ sudo ufw status
Status: inactive

currently I have worked wildcard subdomain config like below:

<VirtualHost *:80>
    ServerAlias *.domain
    ErrorLog /tmp/error.log
    CustomLog /tmp/access.log combined
    VirtualDocumentRoot /var/www/%1/public
<Directory "/var/www">
    DirectoryIndex index.php
    Options Indexes FollowSymLinks
    AllowOverride All
    Require all granted
</Directory>
</VirtualHost>

but if I enter sub.sub.domain will return to default vhost. how to configure to the main/root domain's path? I tried below conf but still not worked:

<VirtualHost *:80>
    ServerAlias *.*.domain
    ErrorLog /tmp/error.log
    CustomLog /tmp/access.log combined
    VirtualDocumentRoot /var/www/%2/public
<Directory "/var/www">
    DirectoryIndex index.php
    Options Indexes FollowSymLinks
    AllowOverride All
    Require all granted
</Directory>
</VirtualHost>

I changed %2 to %1 still doesn't work.

What is right syntax?

Why my ec2 instance always timeout in about 60 seconds when I access http or https? After about 60 seconds always return:

Network Error (tcp_error)

A communication error occurred: "Operation timed out" The Web Server may be down, too busy, or experiencing other problems preventing it from responding to requests. You may wish to try again at a later time.

For assistance, contact your network support team.

and some times return:

Gateway Timeout

The gateway did not receive a timely response from the update server or application.

I use apache web server and PHP with max timeout. I dont use ELB/Load Balancer in my EC2, and I never create any ELB. I tried to find solution in internet but always found ELB setting.

I have 2 computer(A n B) which connected same wifi. If i want to access my localhost(127.0.0.1) from computer A to B i just enter LAN IP(example http://192.168.99.5) on computer B. But how to access 127.0.0.2 or 127.0.0.3 etc to other computer?