me and my stuff

This will be part2 of my setting up apache2 on feisty[ part1 here ]. As I remember to enable ssl on apache first we need to run 'apache2-ssl-certificate' to create certificate file. But apache2-ssl-certificate is not come with apache2 package in feisty so the procedure need little change. First, create 'ssl' dir in '/etc/apache2' and create cert. file with 'make-ssl-cert'. pnix@pnix-a7n:~$ sudo mkdir /etc/apache2/ssl Password: pnix@pnix-a7n:~$ sudo make-ssl-cert /usr/share/ssl-cert/ssleay.cnf /etc/apache2/ssl/apache2.pem pnix@pnix-a7n:~$ Enable ssl module. pnix@pnix-a7n:~$ sudo a2enmod ssl Module ssl installed; run /etc/init.d/apache2 force-reload to enable. pnix@pnix-a7n:~$ Add "Listen 443" to /etc/apache2/ports.conf. pnix@pnix-a7n:~$ echo "Listen 443" | sudo tee -a /etc/apache2/ports.conf Listen 443 pnix@pnix-a7n:~$ Create ssl site pnix@pnix-a7n:~$ sudo cp /etc/apache2/sites-available/default /etc/apache2/sites-available/ssl pnix@pn...

To add more secure on ssh server it's good idea to make our server allow only user who has a key to login. Today I found this trick from ubuntuforums . Gen the keys : First, on client box, we generate keys pair and copy the public key file to server box. [poj@client ~]$ ssh-keygen -t dsa Generating public/private dsa key pair. Enter file in which to save the key (/home/poj/.ssh/id_dsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/poj/.ssh/id_dsa. Your public key has been saved in /home/poj/.ssh/id_dsa.pub. The key fingerprint is: 38:58:74:7b:4c:5a:11:d7:70:de:c0:41:c2:93:c4:b9 poj@client [poj@client ~]$ ls .ssh id_dsa id_dsa.pub known_hosts [poj@client ~]$ scp .ssh/id_dsa.pub poj@192.168.1.122:./id_dsa.pub poj@192.168.1.122's password: id_dsa.pub 100% 598 0.6KB/s 00:00 [poj@client ~]$ During key gen., we will be asked for place to save the ke...

Yesterday, In the morning my boss tell me to looking at the router. It blinks like it'll going to blow up. Something in our network use almost 60% of my bandwidth. I look around and see that network light on the acient small box on the floor blinks too. It's a secondhand computer from japan and I almost forget it. On that box,I install dapper server,postfix,courier,mysql and use it as a mail server with no firewall. poor me. :( This is first time I got hacked(as I know hah ha). I've no idea what to do first. I go to check /var/log/auth.log and found many ssh attack. 'who' give me two users online, me and test1[the hacker]. 'top' show that user test1 run tons of ssh-scan process. I can't remember that did I create that test1 user myself or the hacker do a dictionary attack, found my password then create test1 user. What I do at that time is restart computer, delete test1 user then create a firewall . Then I go to ubuntuforums and found this thread . It lo...

Last week I need to post data in xml format to one server. For security reason one node[xml] require 3DES encryption and encode to Base64 before send. It's a good idea to encrypt sensitive data before store in database or transfer over internet but I'm not even know what 3DES is. After some search, I found that it's not too hard. This post is about how i encrypt data in java. 3DES algorithm use symetric key[secret key] to encrypt or decrypt data. So.. First define a key [ length must be 24 bytes ]. I do this by getBytes() from random string. byte [] seed_key = (new String("er48nsjhwlG593mjhgdb20ih")).getBytes() create Cipher object SecretKeySpec keySpec = new SecretKeySpec(seed_key,"TripleDES"); Cipher nCipher=Cipher.getInstance("TripleDES"); nCipher.init( Cipher.ENCRYPT_MODE, keySpec ); Cipher class provides the functionality of a cryptographic cipher for encryption and decryption. To create cipher object, pass transformation to getInstance m...

If you run vsftp as your ftp server, may be you want to config in /etc/vsftpd/vsftpd.conf To disable anonymous ftp logins, change anonymous_enable to NO [Default: YES] anonymous_enable=NO To jail some user in their home dir uncomment two following line [Default: NO] chroot_list_enable=YES chroot_list_file=/etc/vsftpd/chroot_list and put a list of user [to be jailed] in /etc/vsftpd/chroot_list. Note that if chroot_local_user set to YES, meaning of list will be a list that not to be jailed. To jail all user in their home dir, add chroot_local_user=YES [Default: NO] chroot_local_user=YES

This post is how to set iptables rule as a linux firewall to avoid brute force attack. Few days ago on my old fedora core4 server, When I monitored in /var/log/messages to verify does my cronjob still running? I found something like.. May 23 15:04:18 fedev sshd(pam_unix)[6037]: check pass; user unknown May 23 15:04:18 fedev sshd(pam_unix)[6037]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=adsl-70-248-31-102.dsl.snantx.swbell.net May 23 15:04:23 fedev sshd(pam_unix)[6040]: check pass; user unknown May 23 15:04:23 fedev sshd(pam_unix)[6040]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=adsl-70-248-31-102.dsl.snantx.swbell.net May 23 15:04:29 fedev sshd(pam_unix)[6043]: check pass; user unknown May 23 15:04:29 fedev sshd(pam_unix)[6043]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=adsl-70-248-31-102.dsl.snantx.swbell.net and in /var/log/secure May 23 15:04:15 fedev sshd[6035]: Failed password for invalid user develop fro...