Denyhosts on FreeBSD 8
Lars Sommer, lasg@lasg.dk, 2011-06-20 Install the port security/denyhosts Add to /etc/rc.conf denyhosts_enable="YES" add syslogd_flags="-c" in /etc/hosts.allow add: sshd : /etc/hosts.deniedssh : deny sshd : ALL : allow Or, if anything should be denied from these hosts who fails ssh login; insert ALL instead of sshd. If done so, change the BLOCK_SERVICE line in denyhosts.conf from sshd to ALL as well. touch /etc/hosts.deniedssh /etc/rc.d/syslogd restart /usr/local/etc/rc.d/denyhosts start
Host Intrusion Detection System in FreeBSD
Also called Host IDS or just HIDSLars Sommer, lasg@lasg.dk, 2009-01-07DISCLAIMER: This is a personal note made for personal usage. It might not be easy usable nor explaining. In ports in security, there are several HIDS utilities: aide integrit osiris ossec-hids-local samhain But which should I use, and why? ------ aide Aide aims to be a Tripwire ripoff, and a bit more. It is _very_ easy to install and configure. Installation: pkg_add -r aide or build the port security/aide Configuration: cd /var/db/aide aide --init mv databases/aide.db.new databases/aide.db Take a look in the config file /usr/local/etc/aide.conf Usage: Run with "aide" Should be a cronjob e.g.: 10 20 * * 2 root /usr/local/bin/aide > /var/log/aide.log…
GELI encryption of full drive in FreeBSD
Lars Sommer, lasg@lasg.dk, 2010-01-27 Based on: http://www.freebsd.org/doc/handbook/disks-encrypting.html I am using harddrives two and two in RAID1 with geom_mirror. After creating a mirror, I encrypt it using GELI. Loading the GELI module for now: kldload geom_eli Insert into /boot/loader.conf: geom_eli_load="YES" In this example my geom_mirror is called gm2 and resides in /dev/mirror/gm2 Create the master key and attach it to the GELI provider. Then doing a new filesystem on it, and at last mounting it. dd if=/dev/random of=/root/gm2.key bs=64 count=1 geli init -s 4096 -K /root/gm2.key /dev/mirror/gm2 geli attach -k /root/gm2.key /dev/mirror/gm2 dd if=/dev/random of=/dev/mirror/gm2.eli bs=1m newfs /dev/mirror/gm2.eli mount /dev/mirror/gm2.eli /data/2 Consider moving the master key to somewhere safer. I use an USB…
Gnokii SMS support in FreeBSD 8.2
2011-04-19, Lars Sommer, lasg@lasg.dk Install the port: comms/gnokii With options: USB, MYSQL 2011-05-06: Build fails if NOT selecting xgnokii as well. Create a user in phpmyadmin, called smsd, and a database called smsd. Find the sms.tables.mysql.sql in the config file backup folder, and import it: mysql -u root -p smsd < sms.tables.mysql.sql Settings for gnokiirc: port = /dev/ttyU0 model = AT connection = serial use_locking = no Use the startup script from the backup folder touch /var/log/smsd.log insert into crontab: 32 * * * * root /home/ls/repos1/bin/start_smsd.sh > /dev/null which checks if the smsd is running smsd --user smsd --password "MySecretPassword" --db smsd --host localhost --module mysql --logfile /var/log/smsd.log
Apache, PHP and MySQL on FreeBSD
Plain web server, with phpMyAdmin and SSL connections (https)On FreeBSD 7.2Lars Sommer, lasg@lasg.dk, 2009-05-20DISCLAIMER: This is a personal note made for personal usage. It might not be easy usable nor explaining. Apache: Install this port: www/apache22 Enable in /etc/rc.conf: apache22_enable="YES" Note from 090809: For future usage in systems with multiple web-users (vhosts), look at www/apache22-peruser-mpm instead! --- MySQL: Install this port: databases/mysql50-server: In /etc/rc.conf: mysql_enable="YES" /usr/local/etc/rc.d/mysql-server start % mysqladmin -u root password 'mysecretpassword' --- PHP: Install this port: lang/php5 With this option: APACHE Insert in httpd.conf: AddType application/x-httpd-php .php AddType application/x-httpd-php-source .phps and index.php in the DirectoryIndex line Install this port: lang/php5-extensions With this option: MBSTRING MCRYPT MYSQL GD --- phpMyAdmin: Install…
Apache mod proxy on FreeBSD
Lars Sommer, lasg@lasg.dk, 2007-11-08DISCLAIMER: This is a personal note made for personal usage. It might not be easy usable nor explaining. Forwarding http requests from main server to jails Instead of jails, it can be real hosts as well. (Re)compile apache22 with MOD_PROXY MOD_HTTP_PROXY Include the two modules in httpd.conf LoadModule proxy_module libexec/apache22/mod_proxy.so LoadModule proxy_http_module libexec/apache22/mod_proxy_http.so Use virtual hosts on the main server like this: <VirtualHost *:80> ServerName jail.lasg.dk ServerAlias jail.lasg.dk ProxyRequests Off ProxyPass / http://jail.lasg.dk:8000/ ProxyPassReverse / http://jail.lasg.dk:8000/ ErrorLog /var/log/www/jail.lasg.dk_error_log CustomLog /var/log/www/jail.lasg.dk_access_log common </VirtualHost> --- Add hosts to /etc/hosts If just redirecting with the IP address, apache can not use name based virtual hosts. 192.168.1.50 jail.lasg.dk test.jail.lasg.dk
Pure-FTPd in FreeBSD 6.2 (and 7.2, and probably 8.0)
Lars Sommer, lasg@lasg.dk, 2007-10-18DISCLAIMER: This is a personal note made for personal usage. It might not be easy usable nor explaining. Normally I use the build in ftpd in FreeBSD. But on webservers and likely, virtual accounts and restrictions are needed. Here I use Pure-FTPd. Install this: ftp/pure-ftpd Get an initial config file: cp /usr/local/etc/pure-ftpd.conf.sample /usr/local/etc/pure-ftpd.conf Add to config file: PureDB /usr/local/etc/pureftpd.pdb AltLog clf:/var/log/pureftpd.log TLS 1 #REMEMBER to fix a cert first!! Add the system user account the ftpd should use: pw useradd ftpuser -d /dev/null -s /usr/sbin/nologin Enable in /etc/rc.conf: pureftpd_enable="YES" Generate the SSL cert: openssl req -x509 -nodes -newkey rsa:2048 -keyout /usr/local/etc/ssl/private/pure-ftpd.pem -out /usr/local/etc/ssl/private/pure-ftpd.pem chmod 600 /usr/local/etc/ssl/private/*.pem
Setting up PostgreSQL 8.x and phpPgAdmin on FreeBSD 7.1
Lars Sommer, lasg@lasg.dk, 2009-01-18DISCLAIMER: This is a personal note made for personal usage. It might not be easy usable nor explaining. PostgreSQL: Install the port or package: databases/postgresql-8.3 If PostgreSQL are supposed to run inside a jail, this must be set in the master host (the box outside, containing the jails): echo "security.jail.sysvipc_allowed=1" >> /etc/sysctl.conf Insert an entry to rc.conf: echo 'postgresql_enable="YES"' >> /etc/rc.conf Then PostgreSQL can be initialized and started: /usr/local/etc/rc.d/postgresql initdb /usr/local/etc/rc.d/postgresql start An administrative user should be created: su pgsql -c 'createuser -s -P lasg' Add to /usr/local/pgsql/data/postgresql.conf listen_addresses = 'localhost,192.168.1.52' Add to /usr/local/pgsql/data/pg_hba.conf host all all 192.168.1.52/32 trust --- phpPgAdmin: Install the port or package: databases/phppgadmin Add to…
Postfix + Dovecot + MySQL in FreeBSD
Lars Sommer, lasg@lasg.dk, 2009-04-19DISCLAIMER: This is a personal note made for personal usage. It might not be easy usable nor explaining. This is a personal note on:Mail server setup with Postfix as SMTP/MTA, Dovecot as POP3/IMAP, SASLauthentication, virtual users, SSL connections and Smarthost’ing Inspired by these guides:http://workaround.org/articles/ispmail-etch/http://www.colinbaker.org/unix/freebsddovecothttp://wiki.dovecot.org/UserDatabase/Prefetch Install these ports for MySQL: databases/mysql60-server databases/mysql60-client Enable in /etc/rc.conf: mysql_enable="YES" --- Install of Dovecot: If you install Postfix before Dovecot, MySQL support for Dovecot will be missing. You can though just run a "make config" in mail/dovecot, and select MYSQL. Install this port: mail/dovecot With this option: WITH_MYSQL=true Enable in /etc/rc.conf: dovecot_enable="YES" For sieve mail filtering, install this port as well: /usr/ports/mail/dovecot-sieve --- Install…
Postfixadmin on FreeBSD 6.2 (and probably 7.2 and 8.0)
Lars Sommer, lasg@lasg.dk, 2007-10-16Updated at 2008-07-30DISCLAIMER: This is a personal note made for personal usage. It might not be easy usable nor explaining. Add an easy webinterface to your Postfix mail server.Install this AFTER the main mail server. Install this port: mail/postfixadmin Install the initial database: mysql -p < /usr/local/www/postfixadmin/DATABASE_MYSQL.TXT From the port install: 2. Configure ------------ Check the /usr/local/www/postfixadmin/config.inc.php file. There you can specify settings that are relevant to your setup. The default password for the admin part of Postfix Admin is admin/admin. This is specified in the .htpasswd file in the admin directory. Make sure that the location of the .htpasswd file matches your path. 3. Configure Apache ------------------- Add…