THpubs's questions

I'm trying to set my proxy to filter HTTPS traffic just like the HTTP traffic.

I have followed this guide for setup SSLBump

If I set it, even the HTTP traffic won't be accepted through the proxy. Everything stops.

• How to do it correctly?
• How to let Qlproxy to scan and block HTTPS traffic?

_{Please consider me as a newbie to this field.}

I have just installed Squid3 on my server and trying to block the Skype messenger. Still no luck. I tried to add the rules in Squid wiki (http://wiki.squid-cache.org/ConfigExamples/Chat/Skype) to the end of the squid.conf :

# Skype

 acl numeric_IPs dstdom_regex ^(([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)|(\[([0-9af]+)?:([0-9af:]+)?:([0-9af]+)?\])):443
 acl Skype_UA browser ^skype

 http_access deny numeric_IPS
 http_access deny Skype_UA

 acl validUserAgent browser \S+
 http_access deny !validUserAgent

But none works. How to block Skype? Please help

I have just setup a squid proxy server. The server have two interfaces. eth0 connects to the router and eth1 is connected to a switch where all the other machines connect. The server also have a DHCP server. I have setup Squid3 on the machine and when I configure my browser to use that proxy (I network settings if I set the IP and the port), things work. But I need it as a transparent proxy where I don't have to setup the browser and all the requests will pass through the proxy.

It can be done by just setting the IPtable rules right? Some articles talk about changing sysctl.conf. I have tried the Iptable rules from a lot of tutorials and none worked. Please give me a working rule to add. Thank you.

PS : The server is Ubuntu 12.10

PS2 : If you can, please tell me how to add those rules for ufw

Currently, Im using a small script to automatically backup my database (of a webserver). To backup the database, I have created a user account with only read and lock privilages. The script will use this user to backup the server. So, the script have the user's password.

The problem is, Im moving the database to a remote server. If I do this, will it be a security risk to use the password in a script like this? I s there a better solution?

I already have installed Fail2Ban on my server. I planned to install PSAD on it. Are they equal? Isn't it a good idea to keep them both?

How can I check whether my wordpress site use Xcache to cache its content? How to verify it? Can't use the xcache admin because I also have a forum using ipboard. That forum use xcache. So, the xcache admin always show some usage.

Fail2Ban just blocked my IP for 3 SSH attempts. It added the iptables rule and I can see it using the "sudo iptables -L -n" command. But I can still access the site and login through SSH! What might be the problem? Is it because im using CloudFlare? I have set Nginx to write the real IPs to the access logs instead of the Cloud Flare IP. Isn't it enough?

Chain fail2ban-ssh (1 references)
 target     prot opt source               destination         
 DROP       all  --  119.235.14.8         0.0.0.0/0           
 RETURN     all  --  0.0.0.0/0            0.0.0.0/0  

The input chain :

Chain INPUT (policy DROP)

    target     prot opt source               destination         
    fail2ban-NoAuthFailures  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:80
    fail2ban-nginx-dos  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80,8090
    fail2ban-postfix  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 25,465
    fail2ban-ssh-ddos  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 22
    fail2ban-ssh  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 22
    ufw-before-logging-input  all  --  0.0.0.0/0            0.0.0.0/0           
    ufw-before-input  all  --  0.0.0.0/0            0.0.0.0/0           
    ufw-after-input  all  --  0.0.0.0/0            0.0.0.0/0           
    ufw-after-logging-input  all  --  0.0.0.0/0            0.0.0.0/0           
    ufw-reject-input  all  --  0.0.0.0/0            0.0.0.0/0           
    ufw-track-input  all  --  0.0.0.0/0            0.0.0.0/0           
    LOG        all  --  0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 4

When I reboot my server (not nginx, the whole server), Nginx fails to start automatically. After I logged into the server, I can start nginx manually (service nginx start). It works. But if I restart again, I have to manually start Nginx. When checking the error.log for Nginx, I saw this error repeated several times :

2012/08/27 09:19:23 [emerg] 1066#0: bind() to [ipv6]:80 failed (99: Cannot assign requested address)

How can I fix this? What is this problem? (Im running an Ubuntu 12.04 server)

My web server (Ubuntu, Nginx) have both IPv4 and IPv6 addresses assigned by the host. For my website, shall I bind it to only an IPv6 address? Is it the standard recommended way? Or, shall I use both IPv4 and IPv6 addresses?

Im preparing a web-server and have already installed Wordpress on it. Everything worked fine. But instantly, the memory usage went up. Now I only have 300MB of memory free. To check the problem, I disabled some services like php, nginx, fail2ban, psad and mysql. It reduced the memory usage by a small amount but still its too high.

Then I restarted the machine and started working again. Again after some time, the memory usage shot up! How can I locate the exact problem? What might be causing this issue?

PS : Its an Ubuntu

PS : It looks like the swap is not yet used. Swap usage : 0 (The server is a virtual machine (KVM))

The output of free -m

             total       used       free     shared    buffers     cached
Mem:          2003       1764        238          0         43       1350
-/+ buffers/cache:        370       1633
Swap:         2043          0       2043

For PSAD to work, I need to add the following iptables rules and enable packet logging :

iptables -A INPUT -j LOG
iptables -A FORWARD -j LOG
ip6tables -A INPUT -j LOG
ip6tables -A FORWARD -j LOG

I use UFW on my system. So, how can I add these rules with UFW?

I have protected a web folder with Nginx's Auth_Basic module. The problem is, we can try several passwords until it works (brute force attacks). Is there a way to limit the number of failed re-tries?

I just heard that a Xen VPS will consume a lot less ram than an open VPS server and i'll have a lot of free memory to expand! Is this true?

I have installed the Xamp server in my Windows machine. I have placed the follwing .htaccess file in a directory :

# Original
# If you modify this file then change the above line to: # Modified
<IfModule mod_rewrite.c>
   RewriteEngine On
   # Certain hosts may require the following line.
   # If vanilla is in a subfolder then you need to specify it after the /. 
   # (ex. You put Vanilla in /forum so change the next line to: RewriteBase /forum)
   # RewriteBase /
   RewriteCond %{REQUEST_FILENAME} !-d
   RewriteCond %{REQUEST_FILENAME} !-f
   RewriteRule ^(.*)$ index.php\?p=$1 [QSA,L]
</IfModule>

When I try to access that directory, it gives me a 500 internal server error! Can you please help me?

In my server, the ssh port is not the standard 22. I have set a different one. If I setup fail2ban, will it be able to detect that port? How can I tell it to check that port rather than port 22?

The output of iptables -L -v -n:

 Chain fail2ban-ssh (1 references)
 pkts bytes target     prot opt in     out     source               destination                                                                                         
    0     0 DROP       all  --  *      *       119.235.2.158        0.0.0.0/0                                                                                           
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0                                                                                           

 Chain fail2ban-ssh-ddos (0 references)
 pkts bytes target     prot opt in     out     source               destination

The output of service iptables status :

iptables: unrecognized service

Summery of fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf:

Summary
=======

Addresses found:
[1]
[2]
[3]
    113.59.222.240 (Wed Mar 21 18:24:47 2012)
    113.59.222.240 (Wed Mar 21 18:24:52 2012)
    119.235.14.153 (Wed Mar 21 21:52:53 2012)
    113.59.222.21 (Thu Mar 22 07:50:44 2012)
    176.9.57.203 (Fri Mar 23 19:34:29 2012)
    176.9.57.203 (Fri Mar 23 19:34:42 2012)
    113.59.222.56 (Sat Mar 31 14:23:52 2012)
    113.59.222.56 (Sat Mar 31 14:24:05 2012)
    119.235.14.183 (Mon Apr 02 20:49:13 2012)
    119.235.14.168 (Sat Apr 21 09:58:56 2012)
    119.235.2.158 (Wed Apr 25 13:11:03 2012)
    119.235.2.158 (Wed Apr 25 13:11:40 2012)
    119.235.2.158 (Wed Apr 25 13:11:43 2012)
    119.235.2.158 (Wed Apr 25 13:11:47 2012)
    119.235.2.158 (Wed Apr 25 13:12:49 2012)
    119.235.2.158 (Wed Apr 25 13:12:52 2012)
    119.235.2.158 (Wed Apr 25 13:12:55 2012)
    119.235.2.158 (Wed Apr 25 13:12:58 2012)
    119.235.2.158 (Wed Apr 25 13:13:02 2012)
    119.235.2.158 (Wed Apr 25 13:13:04 2012)
    119.235.2.158 (Wed Apr 25 13:13:25 2012)
    119.235.2.158 (Wed Apr 25 13:19:18 2012)
    119.235.2.158 (Wed Apr 25 13:19:52 2012)
    119.235.2.158 (Wed Apr 25 13:19:55 2012)
    119.235.2.158 (Wed Apr 25 13:19:55 2012)
    119.235.2.158 (Wed Apr 25 13:19:58 2012)
    119.235.2.158 (Wed Apr 25 13:20:02 2012)
    119.235.2.158 (Wed Apr 25 13:20:05 2012)
    119.235.2.158 (Wed Apr 25 13:40:16 2012)
[4]
[5]
    119.235.2.158 (Wed Apr 25 13:11:38 2012)
    119.235.2.158 (Wed Apr 25 13:12:46 2012)
    119.235.2.158 (Wed Apr 25 13:19:49 2012)
[6]
    119.235.2.155 (Wed Mar 21 13:13:30 2012)
    113.59.222.240 (Wed Mar 21 18:24:43 2012)
    119.235.14.153 (Wed Mar 21 21:52:51 2012)
    176.9.57.203 (Fri Mar 23 19:34:26 2012)
    119.235.2.158 (Wed Apr 25 13:19:15 2012)
[7]
[8]
[9]
[10]

Date template hits:
1169837 hit(s): MONTH Day Hour:Minute:Second
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second Year
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second
0 hit(s): Year/Month/Day Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
0 hit(s): Day/MONTH/Year:Hour:Minute:Second
0 hit(s): Month/Day/Year:Hour:Minute:Second
0 hit(s): Year-Month-Day Hour:Minute:Second
0 hit(s): Day-MONTH-Year Hour:Minute:Second[.Millisecond]
0 hit(s): Day-Month-Year Hour:Minute:Second
0 hit(s): TAI64N
0 hit(s): Epoch
0 hit(s): ISO 8601
0 hit(s): Hour:Minute:Second
0 hit(s): <Month/Day/Year@Hour:Minute:Second>

Success, the total number of match is 37

However, look at the above section 'Running tests' which could contain important
information.

The jail.conf:

    # Fail2Ban configuration file.
#
# This file was composed for Debian systems from the original one
#  provided now under /usr/share/doc/fail2ban/examples/jail.conf
#  for additional examples.
#
# To avoid merges during upgrades DO NOT MODIFY THIS FILE
# and rather provide your changes in /etc/fail2ban/jail.local
#
# Author: Yaroslav O. Halchenko <[email protected]>
#
# $Revision: 281 $
#

# The DEFAULT allows a global definition of the options. They can be override
# in each jail afterwards.

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host
ignoreip = 127.0.0.1
bantime  = 14400
maxretry = 3

# "backend" specifies the backend used to get files modification. Available
# options are "gamin", "polling" and "auto".
# yoh: For some reason Debian shipped python-gamin didn't work as expected
#      This issue left ToDo, so polling is default backend for now
backend = polling

#
# Destination email address used solely for the interpolations in
# jail.{conf,local} configuration files.
destemail = root@localhost

#
# ACTIONS
#

# Default banning action (e.g. iptables, iptables-new,
# iptables-multiport, shorewall, etc) It is used to define 
# action_* variables. Can be overriden globally or per 
# section within jail.local file
banaction = iptables-multiport

# email action. Since 0.8.1 upstream fail2ban uses sendmail
# MTA for the mailing. Change mta configuration parameter to mail
# if you want to revert to conventional 'mail'.
mta = sendmail

# Default protocol
protocol = tcp

#
# Action shortcuts. To be used to define action parameter

# The simplest action to take: ban only
action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]

# ban & send an e-mail with whois report to the destemail.
action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]
              %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s]

# ban & send an e-mail with whois report and relevant log lines
# to the destemail.
action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]
               %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s]

# Choose default action.  To change, just override value of 'action' with the
# interpolation to the chosen action shortcut (e.g.  action_mw, action_mwl, etc) in jail.local
# globally (section [DEFAULT]) or per specific section 
action = %(action_)s

#
# JAILS
#

# Next jails corresponds to the standard configuration in Fail2ban 0.6 which
# was shipped in Debian. Enable any defined here jail by including
#
# [SECTION_NAME] 
# enabled = true

#
# in /etc/fail2ban/jail.local.
#
# Optionally you may override any other parameter (e.g. banaction,
# action, port, logpath, etc) in that section within jail.local

[ssh]

enabled = true
port    = ssh
filter  = sshd
logpath  = /var/log/auth.log
maxretry = 4

# Generic filter for pam. Has to be used with action which bans all ports
# such as iptables-allports, shorewall
[pam-generic]

enabled = false
# pam-generic filter can be customized to monitor specific subset of 'tty's
filter  = pam-generic
# port actually must be irrelevant but lets leave it all for some possible uses
port = all
banaction = iptables-allports
port     = anyport
logpath  = /var/log/auth.log
maxretry = 6

[xinetd-fail]

enabled   = false
filter    = xinetd-fail
port      = all
banaction = iptables-multiport-log
logpath   = /var/log/daemon.log
maxretry  = 2


[ssh-ddos]

enabled = true
port    = ssh
filter  = sshd-ddos
logpath  = /var/log/auth.log
maxretry = 6

#
# HTTP servers
#

[apache]

enabled = false
port    = http,https
filter  = apache-auth
logpath = /var/log/apache*/*error.log
maxretry = 6

# default action is now multiport, so apache-multiport jail was left
# for compatibility with previous (<0.7.6-2) releases
[apache-multiport]

enabled   = false
port      = http,https
filter    = apache-auth
logpath   = /var/log/apache*/*error.log
maxretry  = 6

[apache-noscript]

enabled = false
port    = http,https
filter  = apache-noscript
logpath = /var/log/apache*/*error.log
maxretry = 6

[apache-overflows]

enabled = false
port    = http,https
filter  = apache-overflows
logpath = /var/log/apache*/*error.log
maxretry = 2

 [nginx-auth]
 enabled = true
 filter = nginx-auth
 action = iptables-multiport[name=NoAuthFailures, port="http,https"]
 logpath = /var/log/nginx*/*error*.log
 bantime = 600 # 10 minutes
 maxretry = 6

 [nginx-login]
 enabled = true
 filter = nginx-login
 action = iptables-multiport[name=NoLoginFailures, port="http,https"]
 logpath = /var/log/nginx*/*access*.log
 bantime = 600 # 10 minutes
 maxretry = 6

 [nginx-badbots]
 enabled  = true
 filter = apache-badbots
 action = iptables-multiport[name=BadBots, port="http,https"]
 logpath = /var/log/nginx*/*access*.log
 bantime = 86400 # 1 day
 maxretry = 1

 [nginx-noscript]
 enabled = true
 action = iptables-multiport[name=NoScript, port="http,https"]
 filter = nginx-noscript
 logpath = /var/log/nginx*/*access*.log
 maxretry = 6
 bantime  = 86400 # 1 day

 [nginx-proxy]
 enabled = true
 action = iptables-multiport[name=NoProxy, port="http,https"]
 filter = nginx-proxy
 logpath = /var/log/nginx*/*access*.log
 maxretry = 0
 bantime  = 86400 # 1 day


#
# FTP servers
#

[vsftpd]

enabled  = false
port     = ftp,ftp-data,ftps,ftps-data
filter   = vsftpd
logpath  = /var/log/vsftpd.log
# or overwrite it in jails.local to be
# logpath = /var/log/auth.log
# if you want to rely on PAM failed login attempts
# vsftpd's failregex should match both of those formats
maxretry = 6


[proftpd]

enabled  = false
port     = ftp,ftp-data,ftps,ftps-data
filter   = proftpd
logpath  = /var/log/proftpd/proftpd.log
maxretry = 6


[wuftpd]

enabled  = false
port     = ftp,ftp-data,ftps,ftps-data
filter   = wuftpd
logpath  = /var/log/auth.log
maxretry = 6


#
# Mail servers
#

[postfix]

enabled  = false
port     = smtp,ssmtp
filter   = postfix
logpath  = /var/log/mail.log


[couriersmtp]

enabled  = false
port     = smtp,ssmtp
filter   = couriersmtp
logpath  = /var/log/mail.log


#
# Mail servers authenticators: might be used for smtp,ftp,imap servers, so
# all relevant ports get banned
#

[courierauth]

enabled  = false
port     = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
filter   = courierlogin
logpath  = /var/log/mail.log


[sasl]

enabled  = false
port     = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
filter   = sasl
# You might consider monitoring /var/log/warn.log instead
# if you are running postfix. See http://bugs.debian.org/507990
logpath  = /var/log/mail.log


# DNS Servers


# These jails block attacks against named (bind9). By default, logging is off
# with bind9 installation. You will need something like this:
#
# logging {
#     channel security_file {
#         file "/var/log/named/security.log" versions 3 size 30m;
#         severity dynamic;
#         print-time yes;
#     };
#     category security {
#         security_file;
#     };
# };
#
# in your named.conf to provide proper logging

# !!! WARNING !!!
#   Since UDP is connectionless protocol, spoofing of IP and immitation
#   of illegal actions is way too simple.  Thus enabling of this filter
#   might provide an easy way for implementing a DoS against a chosen
#   victim. See
#    http://nion.modprobe.de/blog/archives/690-fail2ban-+-dns-fail.html
#   Please DO NOT USE this jail unless you know what you are doing.
#[named-refused-udp]
#
#enabled  = false
#port     = domain,953
#protocol = udp
#filter   = named-refused
#logpath  = /var/log/named/security.log

[named-refused-tcp]

enabled  = false
port     = domain,953
protocol = tcp
filter   = named-refused
logpath  = /var/log/named/security.log

I just noticed an error in the fail2ban log:

2012-04-25 14:57:29,359 fail2ban.actions.action: ERROR iptables -N fail2ban-ssh-ddos

I just experienced a lot of memory usage in my server. So, found out that php-fpm is the one who is eating my memory. Now, how can I know whats the exact location of the problem? How to see which php script is taking too much memory? (Im running an Ubuntu server)

Recently, I solved a problem in my server by adjusting the default.vcl file. The problem is with wordpress... Another person also have that problem and have asked whether i can show my default vcl file to him... is it safe to post it one that forum?

I set the table tmp size to a higher value in my my.cnf file like this:

tmp_table_size = 64M
max_heap_table_size = 64M

But it's not working. I used this script to check it. Even after I reboot, it is still showing that 16M is the default value.

What am I doing wrong?

Any one know why we are getting a very low cache hit rate average when using Wordpress (With Varnish and Nginx)?

Varnish stat shows :

Hitrate ratio: 10 100 518 Hitrate avg: 0.4143 0.2690 0.1948

Any idea how to fix this? My varnish default.vcl is :

# This is a basic VCL configuration file for varnish.  See the vcl(7)
# man page for details on VCL syntax and semantics.
#
# Default backend definition.  Set this to point to your content
# server.
#
backend default {
    .host = "77.81.240.177";
    .port = "8080";
}

acl purge {
    "77.81.240.177";
}

sub vcl_recv {

    # Add a unique header containing the client address
    remove req.http.X-Forwarded-For;
    #set    req.http.X-Forwarded-For = client.ip;
    set    req.http.X-Forwarded-For = req.http.rlnclientipaddr;    

    # Let's make sure we aren't compressing already compressed formats.
    if (req.http.Accept-Encoding) {
        if (req.url ~ "\.(jpg|png|gif|gz|tgz|bz2|mp3|mp4|m4v)(\?.*|)$") {
            remove req.http.Accept-Encoding;
        } elsif (req.http.Accept-Encoding ~ "gzip") {
            set req.http.Accept-Encoding = "gzip";
        } elsif (req.http.Accept-Encoding ~ "deflate") {
            set req.http.Accept-Encoding = "deflate";
        } else {
            remove req.http.Accept-Encoding;
        }
    }

    if (req.request == "PURGE") {
        if (!client.ip ~ purge) {
            error 405 "Not allowed.";
        }
        return(lookup);
    }

    if (req.url ~ "^/$") {
        unset req.http.cookie;
    }
}

sub vcl_hit {
    if (req.request == "PURGE") {
        set obj.ttl = 0s;
        error 200 "Purged.";
    }
}

sub vcl_miss {
    if (req.request == "PURGE") {
        error 404 "Not in cache.";
    }

    if (!(req.url ~ "wp-(login|admin)")) {
        unset req.http.cookie;
    }

    if (req.url ~ "^/[^?]+.(jpeg|jpg|png|gif|ico|js|css|txt|gz|zip|lzma|bz2|tgz|tbz|html|htm)(\?.|)$") {
        unset req.http.cookie;
        set req.url = regsub(req.url, "\?.$", "");
    }

    if (req.url ~ "^/$") {
        unset req.http.cookie;
    }
}

sub vcl_fetch {
    if (req.url ~ "^/$") {
        unset beresp.http.set-cookie;
    }

    if (!(req.url ~ "wp-(login|admin)")) {
        unset beresp.http.set-cookie;
    }

    if (req.url ~ "^/w00tw00t") {
        error 403 "Not permitted";
    }
}

I have set a proxy server on my network. I only want to filter the web traffic. So, I have Squid as a proxy and Qlproxy as the filter : http://www.quintolabs.com/qlicap_info.php

My server have only about 640MB of RAM... So, Squid cache frequently. So, need to disable caching!

How can I disable caching and let Squid forward everything to the filter without touching them?

Thanks...

PS : Im using Squid3! Is there an alternative to web filtering?