oHbEt.. configuration backup, how to, sample config and reminder..

Saturday, February 21, 2009

Allowing SFTP but not SSH

Here's how they do it, well, I have also tried it.

The default login shell for an account to be able to ssh is /bin/bash, this is the entry at /etc/passwd file. For the certail user to use sftp only and not ssh, login shell should be change to the path of sftp-service. See below:

ssh allowed:


testuser:x:670:670::/home/testuser:/bin/bash

sftp only allowed:


testuser:x:670:670::/home/testuser:/usr/libexec/openssh/sftp-server

When the user try to login using ssh, nothing will happen, but when sftp, it will go to sftp prompt.

Wednesday, December 10, 2008

iptables for chillispot - working

#IPTABLES
# Generated by iptables-save v1.2.11 on Fri Apr 27 18:35:55 2007


*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [37:3532]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A INPUT -p tcp -m tcp --dport 20 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1812 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A INPUT -p udp -m udp --dport 1812 -j ACCEPT
-A INPUT -p udp -m udp --dport 1813 -j ACCEPT
-A INPUT -p udp -m udp --dport 1814 -j ACCEPT
#ftp
#-A INPUT -p tcp -m tcp --dport 20 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
#-A INPUT -p tcp -m tcp --dport 21 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
#-A INPUT -p tcp -m tcp --dport 20 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
#-A INPUT -p tcp -m tcp --dport 21 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A INPUT -p tcp -m tcp --dport 20 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 1812 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A INPUT -m iprange --src-range 10.10.1.200-10.10.1.230 -j ACCEPT
-A INPUT -i eth0 -s 10.1.1.1 -j ACCEPT
-A INPUT -i eth0 -s 10.1.9.3 -j ACCEPT
-A INPUT -m iprange --src-range 10.180.90.1-10.180.91.7 -j ACCEPT
#
#
#-A INPUT -i eth0 -s 10.10.1.1 -j ACCEPT
#-A INPUT -i eth0 -p tcp -m tcp -m multiport --destination-port 69 -j ACCEPT
#-A INPUT -i eth0 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -i eth1 -j DROP
-A INPUT -p tcp -m tcp --dport 80 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3990 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -s 10.10.1.0/24 -j ACCEPT
-A INPUT -s 10.10.9.0/24 -j ACCEPT
-A INPUT -s 10.210.1.1 -j ACCEPT
-A INPUT -m limit --limit 3/second --limit-burst 5 -i ! lo -j LOG --log-prefix "--firewall-logs-chili-dvo--"
-A INPUT -i lo -j ACCEPT
-A FORWARD -i eth1 -j DROP
-A FORWARD -o eth1 -j DROP
COMMIT
# Completed on Fri Apr 27 18:35:55 2007
# Generated by iptables-save v1.2.11 on Fri Apr 27 18:35:55 2007
*nat
:PREROUTING ACCEPT [3654:725407]
:POSTROUTING ACCEPT [2:168]
:OUTPUT ACCEPT [24:1466]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Fri Apr 27 18:35:55 2007
# Generated by iptables-save v1.2.11 on Fri Apr 27 18:35:55 2007
*mangle
:PREROUTING ACCEPT [5730:883086]
:INPUT ACCEPT [5321:743721]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1743:211303]
:POSTROUTING ACCEPT [1743:211303]
COMMIT
# Completed on Fri Apr 27 18:35:55 2007

Tuesday, December 2, 2008

Just my fstab, grub-menu.lst and disk partition


[root@ohbetpc ~]# fdisk -l

Disk /dev/sda: 160.0 GB, 160041885696 bytes
255 heads, 63 sectors/track, 19457 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0xbfdebfde

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *           1        5099    40957686    7  HPFS/NTFS
/dev/sda2            5100       19457   115330635    f  W95 Ext'd (LBA)
/dev/sda5            5100       10198    40957686    7  HPFS/NTFS
/dev/sda6           10199       11528    10683193+   b  W95 FAT32
/dev/sda7           11529       11573      361431   83  Linux
/dev/sda8           11574       11983     3293293+  83  Linux
/dev/sda9           11984       14127    17221648+  83  Linux
/dev/sda10          14128       14263     1092388+  82  Linux swap / Solaris
/dev/sda11          14264       19457    41720773+  83  Linux

Disk /dev/hdb: 20.0 GB, 20020396032 bytes
255 heads, 63 sectors/track, 2434 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x462db064

   Device Boot      Start         End      Blocks   Id  System
/dev/hdb1   *           1        2433    19543041   83  Linux


[root@ohbetpc ~]# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/sda9              17G  7.9G  7.6G  51% /
/dev/sda7             342M   29M  296M   9% /boot
/dev/sda11             40G   34G  6.0G  85% /home
/dev/sda8             3.1G   73M  2.9G   3% /tmp
/dev/sda1              40G   11G   29G  27% /windows/c
/dev/sda5              40G   38G  1.8G  96% /windows/d
/dev/sda6              11G  5.5G  4.8G  54% /windows/e
/dev/hdb1              19G   16G  1.5G  92% /media/hd


[root@ohbetpc ~]# cat /boot/grub/menu.lst
timeout 10
color black/cyan yellow/cyan
default 6

title linux
kernel (hd0,6)/vmlinuz BOOT_IMAGE=linux root=UUID=dcad77ff-8f27-479d-9e19-dd0b5ac71097 resume=/dev/sda7 splash=silent vga=788
initrd (hd0,6)/initrd.img


title linux-nonfb
kernel (hd0,6)/vmlinuz BOOT_IMAGE=linux-nonfb root=UUID=dcad77ff-8f27-479d-9e19-dd0b5ac71097 resume=/dev/sda7
initrd (hd0,6)/initrd.img


title failsafe
kernel (hd0,6)/vmlinuz BOOT_IMAGE=failsafe root=UUID=dcad77ff-8f27-479d-9e19-dd0b5ac71097 failsafe
initrd (hd0,6)/initrd.img


title windows
root (hd0,0)
chainloader +1



title desktop 2.6.24.5-2mnb
kernel (hd1,6)/vmlinuz-2.6.24.5-desktop-2mnb BOOT_IMAGE=desktop_2.6.24.5-2mnb root=UUID=dcad77ff-8f27-479d-9e19-dd0b5ac71097 resume=/dev/sda7 splash=silent vga=788
initrd (hd1,6)/initrd-2.6.24.5-desktop-2mnb.img


title desktop 2.6.24.7-1mnb
kernel (hd0,6)/vmlinuz-2.6.24.7-desktop-1mnb BOOT_IMAGE=desktop_2.6.24.7-1mnb root=UUID=dcad77ff-8f27-479d-9e19-dd0b5ac71097 resume=/dev/sda7 splash=silent vga=788
initrd (hd0,6)/initrd-2.6.24.7-desktop-1mnb.img


title desktop 2.6.24.7-2mnb
kernel (hd0,6)/vmlinuz-2.6.24.7-desktop-2mnb BOOT_IMAGE=desktop_2.6.24.7-2mnb root=UUID=dcad77ff-8f27-479d-9e19-dd0b5ac71097 resume=/dev/sda7 splash=silent vga=788
initrd (hd0,6)/initrd-2.6.24.7-desktop-2mnb.img
[root@ohbetpc ~]#

Well, the reason why I post this was, I spent a whole day figuring out why I cant boot to my linux after re-installing windows XP. I made a manual regenarating GRUB. I even used the supergrub disk but still it has an error file not found when booting to a particular kernel on my GRYB menu. Well, the culprit, as you can see this entry " (hd0,6)/vmlinuz-2.xxx" after messing up with GRUB, that became (hd0,8) while I did not change that to anything. anyway.. It was my fault, I should have remembered that /dev/sdn is equal to (hd0,n-1) on the grub menu.lst entries... now, Im good, booting back to my Mandriva 2008.1.

Wednesday, November 26, 2008

Installing GNS3 Latest on Mandriva 2008.1

1. Get the code from http://code.gns3.net/hgwebdir.cgi/gns3-devel/summary
2. Extracted it to my users home folder
3. issue the command " sudo python setup.py install" - assuming that all dependencies has been installed.
4. Copy the pemu folder at /usr/local/
5. Then set the preferences.

Latest has been installed.

Monday, November 10, 2008

Cisco PIX, VPN config example

Cisco link


Cisco Router and PIX VPN Configuration Example list at Cisco.com

DHCPD - sample conf file

/etc/dhcpd.conf for DHCP Server - Centos 4.5


#
# DHCP Server Configuration file.
#   see /usr/share/doc/dhcp*/dhcpd.conf.sample
#
ddns-update-style interim;
ignore client-updates;

default-lease-time      600;
max-lease-time          7200;
subnet 192.168.253.0 netmask 255.255.255.0 {
        option routers 192.168.253.254;
        option subnet-mask 255.255.255.0;
        option domain-name-servers 203.115.130.40 , 203.115.130.42 , 192.168.254.10;
        range 192.168.253.3 192.168.253.100;
        # Windows xp Machine 1
        host jagapewks002 {
                hardware ethernet 00:0c:29:3c:b7:4c;
                fixed-address 192.168.254.101;
                }
        }
# xp pc2
host xppx2 {
        hardware ethernet 00:0b:29:3a:a4:7c;
        fixed-address 192.168.254.102;
        }
#Mandriva Desktop
host mandriva-desktop {
        hardware ethernet 00:15:6a:cF:5E:21;
        fixed-address 192.168.253.1;
        }

IPTABLES - sample

I used this in my test internet gateway.


#!/bin/bash
ipt="iptables"
mod="/sbin/modprobe"
INTERNET="ppp0"
LAN="eth0"
public_ip=`ifconfig | grep ppp0 -A 1 | grep inet | gawk '{print $2}' | cut -d: -f2`
#load kernel modules
$mod ip_tables
$mod iptable_filter
$mod iptable_nat
$mod ip_conntrack
$mod iptable_mangle
$mod ipt_MASQUERADE
$mod ip_nat_ftp
$mod ip_nat_irc
$mod ip_conntrack_ftp
$mod ip_conntrack_irc
#Flush all active rules and delete all custom chains
$ipt -F
$ipt -t nat -F
$ipt -t mangle -F
$ipt -X
$ipt -t nat -X
$ipt -t mangle -X
#Set default policies
$ipt -P INPUT ACCEPT
$ipt -A INPUT -p tcp -m tcp -i ppp0 --dport 0:1023 -j DROP
$ipt -A INPUT -p udp -m udp -i ppp0 --dport 0:1023 -j DROP
$ipt -A INPUT -p udp -m udp -i ppp0 --dport 0:1023 -j LOG
$ipt -A INPUT -p tcp -m tcp -i ppp0 --tcp-flags SYN,RST,ACK SYN -j DROP
$ipt -A INPUT -p icmp -m icmp -i ppp0 --icmp-type 8 -j DROP
#$ipt -A INPUT -s 192.168.253.1 -j ACCEPT
$ipt -A INPUT -i $INTERNET -p tcp --dport 8910 -j ACCEPT
$ipt -A INPUT -i $INTERNET -p tcp --dport 8999 -j ACCEPT
#
$ipt -A INPUT -i $INTERNET -s checkip.dyndns.com -j ACCEPT
$ipt -A INPUT -i $INTERNET -s 124.107.2.226 -j ACCEPT
$ipt -A INPUT -i $INTERNET -s 125.212.34.154 -j ACCEPT
#LAN
$ipt -A INPUT -i $LAN -s 192.168.253.0/24 -j ACCEPT
#
#DNS of ISP
$ipt -A INPUT -i $INTERNET -s 203.115.130.40 -p udp -m udp --dport 53 -j ACCEPT
$ipt -A INPUT -i $INTERNET -s 203.115.130.42 -p udp -m udp --dport 53 -j ACCEPT
#
$ipt -A INPUT -i $INTERNET -s 203.115.130.40 -p tcp -m tcp --dport 53 -j ACCEPT
$ipt -A INPUT -i $INTERNET -s 203.115.130.42 -p tcp -m tcp --dport 53 -j ACCEPT
#
#$ipt -A FORWARD -i $WAN_IFACE -o $DMZ_IFACE -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
#
$ipt -A FORWARD -i $INTERNET -o $LAN -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$ipt -P FORWARD ACCEPT
$ipt -P OUTPUT ACCEPT
$ipt -t nat -P OUTPUT ACCEPT
$ipt -A INPUT -p udp -m udp --dport 123 -j ACCEPT
$ipt -A INPUT -p udp -m udp --dport 53 -j ACCEPT
$ipt -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
$ipt -A OUTPUT -p tcp -m tcp --dport 1024:63335 -j ACCEPT

#$ipt -A INPUT -p tcp --dport 8910 -j ACCEPT
#
#
#$ipt -A INPUT -p tcp -m tcp -i ppp0 --dport 0:1023 -j DROP
#$ipt -A INPUT -p udp -m udp -i ppp0 --dport 0:1023 -j DROP
#$ipt -A INPUT -p udp -m udp -i ppp0 --dport 0:1023 -j LOG
#
#$ipt -A INPUT -p tcp -m tcp -i ppp0 --tcp-flags SYN,RST,ACK SYN -j DROP
#$ipt -A INPUT -p icmp -m icmp -i ppp0 --icmp-type 8 -j DROP
#$ipt -A INPUT -m state -s 192.168.254.1 --state INVALID -j ACCEPT
#
#Acting as Internet gateway
$ipt -t nat -P PREROUTING ACCEPT
$ipt -t nat -P POSTROUTING ACCEPT
$ipt -t mangle -P PREROUTING ACCEPT
$ipt -t mangle -P POSTROUTING ACCEPT
$ipt -t nat -A POSTROUTING -o $INTERNET -j MASQUERADE
#
$ipt -A PREROUTING -t nat -i $INTERNET -d $public_ip -m tcp -p tcp --dport 80 -j DNAT --to-destination 192.168.253.1:80
$ipt -A FORWARD -p tcp -i $INTERNET -d 192.168.253.1 --dport 80 -j ACCEPT
#
$ipt -A INPUT -i lo -j ACCEPT
$ipt -A OUTPUT -o lo -j ACCEPT
#
#$ipt -A FORWARD -j LOG
#$ipt -A INPUT -j LOG
$ipt -A INPUT -m limit --limit 3/second --limit-burst 5 -i ! lo -j LOG --log-prefix "DROP "