By Peter on November 22nd,
2007
Leave Comment » | Posted in Security, Tips
By Peter on November 21st,
2007
One of the crucial task one have as an administrator is to make sure that there is no suspicious activity on the system that might compromise security.
Monitoring tasks include evaluating login activity for signs of a security breach, such as multiple failed logins.
To monitor login activity, you can use the following six commands.
- who. This command shows who is currently logged intothe system and information such as the time of the last login. You can use options such as -H (display column headings), -r (current runlevel), and -a (display information provided by most options).
For example, entering who -H returns the following:

- w. This command displays information about the users currently on the machine and their processes.
The first line includes information the current time, how long the system has been running, how many users are currently logged on, the system load average for the past 1, 5, and 15 minutes. Below the first line is an entry for each user that displays the login name, the tty name, the remote host, login time, idle time, JCPU, PCPU, and the command line of the users current process.
You can use options such as -h (don’t display the header), -s (don’t display the login time, JCPU, and PCPU), and -V (display version information)
For example, entering w returns the following:

- finger. This command displays information about local and remote system suers. By default, the following information is displayed about each user logged into the local host: login name, User’s full name, Associated terminal name, Idle time, Login time. You can use the options -l (long format) and -s (short format).
For example, entering finger -s returns the following:

- last. This command displays a listing of the last logged in users. Last searches back through the file /var/log/wtmp (or the file designated by the option -f) and displays a list of all users logged in (and out) since the file was created. You can use options such as -num (where num is the number of lines to display), -a (display the hostname in the last column), and -x (display system shutdown entries and runlevel changes).
For exmample, entering last -ax returns the following:

- lastlog. This command formats and prints the contents of the last log file (/var/log/lastlog). the login name, port, and last login time are displayed. You can use options such as -u login_name (display information for designated users only) and -h (display a one line help message).
For example, entering lastlog returns the following:

- faillog. This command formats and displays the contents of the failure log (/var/log/faillog) and maintains failure counts and limits. You can use options such as -u login_name (display information for designated users only) and -p (display in UID order).
For example, entering faillog returns the following:

1 Comment » | Posted in Linux Tools, Security, Tips
By Peter on November 21st,
2007
The following is a list of rules and tips you might find useful in dealing with basic security concerns:
- Avoid doing your regular jobs when you are logged in as root. This reduces the risk of getting a cuckoo egg or a virus and protects you from your own mistakes.
- If possible, always try to use encrypted connections to work on a remote machine. Using SSH (secure shell) to replace telnet, ftp, rsh, and rlogin should be standard practice.
- Avoid using authentic method based on ip address alone.
- Try to keep the most important network-related packages up-to-date and subscribe to the corresponding mailing lists to recieve announcements on new versions of programs such as bind, postfix, and ssh. The same should apply to software relevant to local security.
- Disable any network services you do not absolutely require for your server to wok properly. This will make your system safer. Open ports, with the socket state LISTEN, can be found using the netstat program.
- RPM packages from SUSE are digitally signed. You can verify the integrity of any SUSE RPM package by entering this on concole: rpm — chechsig package.rpm . The needed public gpg-key is copied to the home directory of root upon installation.
- Check your backups of user and system files regularly. Remember that if you do not test whether the backup will work, its as good as useless.
- Check your log files. Whenever possible, write a small script to search for suspicious entries.
- Use firewall to enhance the security provided by tcpd (tcp wrapper)
- Design your security measure to be redundant. A message seen twice is better than no message at all.
Linux Commands/Tools Security Tips
9 Comments » | Posted in Linux Tools, Security, Tips
By Peter on November 21st,
2007
New features and changes in this milestone include:
- Improved security features such as: better presentation of website identity and security, malware protection, stricter SSL error pages, anti-virus integration in the download manager, and version checking for insecure plugins.
- Improved ease of use through: better password management, easier add-on installation, new download manager with resumable downloading, full page zoom, animated tab strip, and better integration with Windows Vista and Mac OS X.
- Richer personalization through: one-click bookmarking, smart search bookmark folders, direct typing in location bar searches your history and bookmarks for URLs and page titles, ability to register web applications as protocol handlers, and better customization of download actions for file types.
- Improved platform features such as: new graphics and font rendering architecture, major changes to the HTML rendering engine to provide better CSS, float-, and table layout support, native web page form controls, colour profile management, and offline application support.
- Performance improvements such as: better data reliability for user profiles, architectural improvements to speed up page rendering, over 300 memory leak fixes, and a new XPCOM cycle collector to reduce entire classes of leaks.
Download Link in Linux MacOS and Windows version in 20 languages:
http://www.mozilla.com/en-US/firefox/all-beta.html

News
Leave Comment » | Posted in News