mod_spamhaus is an Apache module for DNS Block Listing that protects web services by denying access to particular IP addresses. It can stop spam relaying via web form URL injection, and block HTTP DDoS attacks from bot-nets.

It queries sbl-xbl.spamhaus.org, taking advantage of the Spamhaus Block List (SBL) and the Exploits Block List (XBL).

1. Download the latest mod_spamhaus deb package from sid package repository (mod_spamhaus is not available for lenny but we can use the sid package)

wget http://ftp.us.debian.org/debian/pool/main/m/mod-spamhaus/libapache2-mod-spamhaus_0.7-1_i386.deb


This package is for i386. If you are using other architecture, you can find a suitable package on the bottom of this page: http://packages.debian.org/sid/libapache2-mod-spamhaus

2. Install the package

dpkg -i libapache2-mod-spamhaus_0.7-1_i386.deb


Apache is automatically restarted and the module is enabled. If you would like to test the module you can add a line to your hosts file to make it think that your IP address is blocked (pico /etc/hosts)

127.0.0.4 1.0.168.192.sbl-xbl.spamhaus.org


Replace 1.0.168.192 with your IP address and reverse it. The IP address 192.168.0.1 should read 1.0.168.192.

By default, only POST, PUT, OPTIONS, CONNECT methods are blocked. You can add GET to the list of methods blocked in /etc/apache2/mods-enabled/mod-spamhaus.conf to block the spammers from seeing your website.

Read More

HAVP (HTTP Antivirus Proxy) is a proxy with a ClamAV anti-virus scanner. The main aims are continuous, non-blocking downloads and smooth scanning of dynamic and password protected HTTP traffic. Havp antivirus proxy has a parent and transparent proxy mode. It can be used with squid or standalone.

1. Install HAVP

apt-get install havp


2. Start HAVP if it didn't start after the installation

/etc/init.d/havp start


It's ready, by default HAVP listens on port 8080. You can configure your web browser to use the server as a proxy.

You can customize the error pages by editing the html files in this directory: /etc/havp/templates/en/

Read More

apache2-mpm-itk is an MPM (Multi-Processing Module) for the Apache web server. mpm-itk allows you to run each of your vhost under a separate uid and gid — in short, the scripts and configuration files for one vhost no longer have to be readable for all the other vhosts.

1. Install the apache2-mpm-itk package

apt-get install apache2-mpm-itk


2. Configure user and group for each virtual host by adding the following line somewhere between <VirtualHost *:80>...</VirtualHost>

AssignUserId [user] [group]


Replace [user] and [group] with a username and group name that already exists on the system.

3. Change the owner of the web root

chown [user].[group] [location]


Replace [user] and [group] with the username and group name configured on the virtual host. Replace [location] with the location specified as DocumentRoot for the virtual host, eg. /var/www

4. Make sure the location isn't accessible by other users (optional)

chmod o= [location]


Replace [location] with the location specified as DocumentRoot for the virtual host, eg. /var/www

5. Restart apache

/etc/init.d/apache restart

Read More

Pure-FTPd is a free, secure, production-quality and standard-conformant FTP server. It doesn't provide useless bells and whistles, but focuses on efficiency and ease of use. It provides simple answers to common needs, plus unique useful features for personal users as well as hosting providers.

In this tutorial we'll install Pure-FTPd with MySQL backend.

Install Pure-FTPd with mysql backend
apt-get install pure-ftpd-mysql


Create user and group used to run the ftp server
groupadd -g 2001 ftpgroup
useradd -u 2001 -s /bin/false -d /bin/null -c "pureftpd user" -g ftpgroup ftpuser


Create database and a table that will store user information
mysql -u root -p
GRANT SELECT ON ftpd.* TO vhosts@localhost IDENTIFIED BY 'mypasswd';
FLUSH PRIVILEGES;
CREATE DATABASE ftpd;
USE ftpd;

CREATE TABLE users (
user varchar(30) NOT NULL,
password varchar(64) NOT NULL,
home varchar(128) NOT NULL,
bandwidth_limit_upload smallint(5) NOT NULL default 0,
bandwidth_limit_download smallint(5) NOT NULL default 0,
ip_allow varchar(15) NOT NULL default 'any',
quota smallint(5) NOT NULL default '0',
quota_files int(11) NOT NULL default 0,
active enum('yes','no') NOT NULL default 'yes',
PRIMARY KEY (user),
UNIQUE KEY User (user)
) TYPE=MyISAM;

INSERT INTO users (user, password, home) VALUES ('username', MD5('mypasswd'), '/home/username');

quit;


You will be able to control bandwidth limits and quotas for each user. Using zero for these fields will allow unlimited use of resources. The bandwidth limits are specified in KB/s and the quota in MB.

Configure Pure-ftpd (pico /etc/pure-ftpd/db/mysql.conf). Remove everything from the default configuration file and add these lines:
MYSQLSocket /var/run/mysqld/mysqld.sock
MYSQLUser vhosts
MYSQLPassword mypasswd
MYSQLDatabase ftpd
MYSQLCrypt md5
MYSQLDefaultUID 2001
MYSQLDefaultGID 2001
MYSQLGetPW SELECT password FROM users WHERE user = "\L" AND active = "yes" AND (ip_allow = "any" OR ip_allow LIKE "\R")
MYSQLGetDir SELECT home FROM users WHERE user = "\L"AND active = "yes" AND (ip_allow = "any" OR ip_allow LIKE "\R")
MySQLGetBandwidthUL SELECT bandwidth_limit_upload FROM users WHERE user = "\L"AND active = "yes" AND (ip_allow = "any" OR ip_allow LIKE "\R")
MySQLGetBandwidthDL SELECT bandwidth_limit_download FROM users WHERE user = "\L"AND active = "yes" AND (ip_allow = "any" OR ip_allow LIKE "\R")
MySQLGetQTASZ SELECT quota FROM users WHERE user = "\L"AND active = "yes" AND (ip_allow = "any" OR ip_allow LIKE "\R")
MySQLGetQTAFS SELECT quota_files FROM users WHERE user = "\L"AND active = "yes" AND (ip_allow = "any" OR ip_allow LIKE "\R")


Create these simple text files that will force the server to create home directories for users if they don't exist and chroot the user to it's home directory:

pico /etc/pure-ftpd/conf/ChrootEveryone
yes


pico /etc/pure-ftpd/conf/CreateHomeDir
yes


Since we are using pure-ftpd-mysql insted of pure-ftpd, make the following change (pico /usr/sbin/pure-ftpd-wrapper):
my $daemon = '/usr/sbin/pure-ftpd-mysql';


Restart Pure-ftpd
/etc/init.d/pure-ftpd-mysql restart


We're all done. You should be able to make connections to the servers with your favorite FTP client.

--

Update - 29th October 2008

I've had problems with debian-minimal installations where the ftp server simply won't start and doesn't leave any trace in the log files. To fix that I had to make one minor change to the inetd config file (pico /etc/inetd.conf):

ftp stream tcp nowait root /usr/sbin/tcpd /usr/sbin/pure-ftpd-mysql


Open the config file and in the ftp line, change pure-ftpd-wrapper to pure-ftpd-mysql

When done, restart inetd:

/etc/init.d/openbsd-inetd restart


--

Update - 20th April 2010

In lenny, use this command to restart the service or change the variable STANDALONE_OR_INETD to standalone in /etc/default/pure-ftpd-common:

/etc/init.d/openbsd-inetd restart

Read More

1. On the source database server run the following command to export all databases:

mysqldump -h localhost -u {username} -p --all-databases > database_dump.sql


Replace {username} with your MySql username.

You can also export a single database using this command:

mysqldump -h localhost -u {username} -p {database} > database_dump.sql


Replace {username} with your MySql username and {database} with the database you are going to export.

2. Move the database_dump.sql file to your destination server. You could grab it from FTP server or put it on a public web location and use wget on the destination server to receive the file. This process it outside the scope of this tutorial.

3. Import the dump to the destination MySql server by running the following command:

mysql -h localhost -u {username} -p < database_dump.sql


Replace {username} with your MySql username.

If you are only exporting a single database, use this command instead:

mysql -h localhost -u {username} -p {database} < database_dump.sql


Replace {username} with your MySql username and {database} with the database you are going to export.

Read More

fail2ban monitors log files such as /var/log/auth.log and /var/log/apache/access.log and temporarily or persistently bans failure-prone addresses by updating existing firewall rules. Currently, by default, fail2ban supports ssh/apache/vsftpd but configuration can be easily extended for monitoring any other ASCII file.

1. Install fail2ban

apt-get install fail2ban


2. Test by connecting via ssh and making three incorrect password attempts. By default fail2ban blocks the IP address for 10 minutes.

You can tail the fail2ban log file to monitor actions:

tail -f /var/log/fail2ban.log


Sample results

2010-06-21 22:27:58,953 fail2ban.jail : INFO Jail 'ssh' started
2010-06-21 22:29:36,430 fail2ban.actions: WARNING [ssh] Ban 192.168.1.18


3. (optional) Specify a list of IP addresses ignored by fail2ban. This can be useful to avoid getting locked out (pico /etc/fail2ban/jail.conf)

ignoreip = 127.0.0.1 192.168.1.0/24


Modify the ignoreip property and type a list of IP addresses or networks seperated by a space.

4. Restart fail2ban (only required if you modified the ignoreip property)

/etc/init.d/fail2ban restart

Read More

If you would like to setup a Virtual Private Network (VPN) for Windows clients, PPTP is a great choice. It's easy to set up on the server and you don't need any additional software for the Windows clients to connect.

1. Install the required packages

apt-get install pptpd


2. Configure the IP range assigned to clients (pico /etc/pptpd.conf)

localip 192.168.1.2
remoteip 192.168.1.10-20


Using this config the clients are assigned any IP address between and including 192.168.1.10 and 192.168.1.20.

3. Restart the PPTP daemon

/etc/init.d/pptpd restart


4. Create a user allowed to connect (pico /etc/ppp/chap-secrets)

user1 pptpd secretpassword *


Passwords are not encrypted. This allows the a user with the username: user1 and the password: secretpassword to login from any ip address.

5. Enable IP forward at startup to allow the VPN clients to connect to the server's local network. (pico /etc/sysctl.conf)

net.ipv4.ip_forward=1


Also run this command to activate the IP forward instantly:

echo 1 > /proc/sys/net/ipv4/ip_forward


6. Create a routing rule to allow the VPN clients to route network traffic through the server.

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE


Read this tutorial to learn how to create iptables rules on startup:

Loading iptables rules on startup

Read More

By default iptables is setup on Debian etch but there are no rules configured. In this tutorial we'll configure some rules and load them into iptables on startup.

1. Rules file

Create a new file that will contain a shell script to insert rules into iptables (pico /etc/firewall-rules.sh) and add this content as template:

#!/bin/sh
IPT="/sbin/iptables"

echo -n "Loading iptables rules..."

# Flush old rules
$IPT --flush
$IPT --delete-chain

# By default, drop everything except outgoing traffic
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT ACCEPT

# Allow incoming and outgoing for loopback interfaces
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT

# ICMP rules
$IPT -A INPUT -p icmp --icmp-type echo-reply -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 5/s -m state --state NEW -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type destination-unreachable -m state --state NEW -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type time-exceeded -m state --state NEW -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type timestamp-request -m state --state NEW -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type timestamp-reply -m state --state ESTABLISHED,RELATED -j ACCEPT

# Block new connections without SYN
$IPT -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

# Allow established connections:
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# SSH
$IPT -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT

# HTTP
$IPT -A INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT
$IPT -A INPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT

# Block fragments and Xmas tree as well as SYN,FIN and SYN,RST
$IPT -A INPUT -p ip -f -j DROP
$IPT -A INPUT -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

# Anti-spoofing rules
$IPT -A INPUT -s 200.200.200.200 -j DROP
$IPT -A INPUT -s 192.168.0.0/24 -j DROP
$IPT -A INPUT -s 127.0.0.0/8 -j DROP

echo "rules loaded."
You can customize this file as required, check the iptables manual for parameters and options.

Change the permissions to make the file executable by root:

chown root /etc/firewall-rules.sh
chmod 700 /etc/firewall-rules.sh


2. Load rules shell script on startup

Add this line above the address line for your default network interface (pico /etc/network/interfaces):

pre-up /etc/firewall-rules.sh


Now, every time you start the network interfaces including restarting the system, iptables rules are reloaded.

Read More