| by Scott Kilroy

Kill all process associated with a user

skill -TERM -u USERNAME

Share Button
Read More
| by Scott Kilroy

Force a user off the system

slay USERNAME

Share Button
Read More
| by Scott Kilroy

Linux Security

“Yes, I’m paranoid — but am I paranoid enough?” ― David Foster Wallace, Infinite Jest Hardening Public Servers Install system accounting On Debian based systems run ‘apt-get install acct’ then you can use commands lastcomm and sa to see who ran various comands. Also a log file will be writen to /var/log/account/pacct Remove compilers from production severs use the command ‘apt-get –purge remove gcc’ Setup remote logging See http://www.thegeekstuff.com/2012/01/rsyslog-remote-logging/ to find out how Install fail2ban Linux.com has a good intro to fail2ban http://www.linux.com/learn/tutorials/469597-weekend-project-keep-out-repeat-offenders-with-fail2ban-on-linux

Share Button
Read More
| by Scott Kilroy

ssh tips

Someday I’ll get around to writing up my own tips but until then this is a pretty good guide http://lugatgt.org/2009/10/28/ssh-tips-and-tricks-2/

Share Button
Read More
| by Scott Kilroy

bashprofile

# .bash_profile # Get the aliases and functions if [ -f ~/.bashrc ]; then . ~/.bashrc fi # User specific environment and startup programs PATH=$PATH:$HOME/bin:/sbin export JAVA_HOME=/usr/java/jdk1.6.0_05/bin/java export PATH=$PATH:/usr/java/jdk1.6.0_05/bin export HISTIGNORE=”&” export EDITOR=nano export PATH unset USERNAME alias rm=’rm -i’ alias cp=’cp -i’ alias ls=’ls –color’ alias zf=’zf.sh’ echo -e “\033[36m########################## \033[0m” echo -e “\033[36mServer $HOSTNAME \033[0m” echo -e “\033[36mWelcome back $USER \033[0m” echo -e “\033[36musers loggged in: \033[0m” echo -e “\033[36m `users ` \033[0m” echo -e “\033[36m`uptime` \033[0m” echo […]

Share Button
Read More
| by Scott Kilroy

bashrc

Here is my typical .bashrc file # .bashrc # Source global definitions if [ -f /etc/bashrc ]; then . /etc/bashrc fi # append commenads to bash_history (when using more then one window) shopt -s histappend PROMPT_COMMAND=’history -a’ # User specific aliases and functions PATH=$PATH:$HOME/bin:/sbin #export JAVA_HOME=/usr/java/jdk1.6.0_05/bin/java export HISTIGNORE=”&” export EDITOR=nano export PATH unset USERNAME #function PWD { #pwd | awk -F\/ ‘{print $(NF-1),$(NF)}’ | sed ‘s/ /\\//’ #} #export PS1=”\[\033[0;32m\]\u@\h \[\033[33m\]\$(pwd 3)\[\033[0m\] \$ “;

Share Button
Read More
| by Scott Kilroy

apache – watch httpd for connected clients

watch httpd for connected clients watch “netstat -anpt | grep httpd | grep ESTABLISHED|cut -b45-60 | cut -d’:’ -f1 | sort” OR netstat -plan|grep :80|awk {‘print $5’}|cut -d: -f 1| sort|uniq -c | sort -nk 1

Share Button
Read More
| by Scott Kilroy

apache – test mod_evasive is setup correctly

You can use this simple script to test mod_evasive is installed and running. I didn’t write this but forgot where I found it. Sorry for the lack of credit where it’s due. #!/usr/bin/perl # test.pl: small script to test mod_dosevasive’s effectiveness use IO::Socket; use strict; for(0..100) { my($response); my($SOCKET) = new IO::Socket::INET( Proto => “tcp”, PeerAddr=> “w3.fiendishplan.com:80”); if (! defined $SOCKET) { die $!; } print $SOCKET “GET /?$_ HTTP/1.0\n\n”; $response = ; print $response; close($SOCKET); }

Share Button
Read More