Key-Based SSH Logins With PuTTY
Following on from the previous SSH security ramblings, one of the most secure methods of security is public/private key-based authentication.
g up key based SSH logins for two reasons;
- They are more secure. You aren't prompted for a password which could be brute forced or sniffed via man in the middle attacks for example
- We're lazy. We don't want to type username/password combinations into each server.
SSH Security Ramblings
SSH - Secure Shell isn't that secure. If you're not using it behind a Layer 7 firewall or an enhanced security daemon like cPanel's cPHulk or even just the default config isn't secure.
What can you do?
[Snippet] Create a large file in Linux
Need to create a large file? For disk speed tests? Or space tests?
- dd if=/dev/zero of=your.big.file bs=1MB count=500
This will create a 500Mb file in your current directory called your.big.file
- 500+0 records in
- 500+0 records out
- 500000000 bytes (500 MB) copied, 4.08855 seconds, 122 MB/s
cPanel MySQL Tuning
The default configuration for MySQL provided by cPanel is pretty barren. /etc/my.cnf
- [mysqld] skip-innodb
Thats it. One line. Its rubbish.
Here's mine to help you along the way. Its got some decent logging set, some decent cache and memory options for a shared server set and some helpful security settings enabled.
- [mysqld]
- max_connections = 200
- bind-address = 127.0.0.1
-
- safe-show-database
- skip-locking
- skip-innodb
-
- # MySQL 4.x has query caching available.
- # Enable it for vast improvement and it may be all you need to tweak.
- query_cache_type=1
- query_cache_limit=1M
- query_cache_size=32M
-
- interactive_timeout=100
-
- # Reduced wait_timeout to prevent idle clients holding connections.
- wait_timeout=15
- connect_timeout=10
-
- # Checked opened tables and adjusted accordingly after running for a while.
- table_cache=512
-
- # Reduced it to 32 to prevent memory hogging.
- thread_cache=32
-
- # Reduced it by checking current size of *.MYI files.
- key_buffer=128M
-
- thread_concurrency=1
-
- log_error = /var/log/mysql/error.log
-
- # log slow queries is a must.
- log_slow_queries=/var/log/mysqld.slow.log
- long_query_time=2
-
- [mysqldump]
- quick
- max_allowed_packet=16M
-
- [mysql]
- no-auto-rehash
-
- [isamchk]
- key_buffer=64M
- sort_buffer=64M
- read_buffer=16M
- write_buffer=16M
-
- [myisamchk]
- key_buffer=64M
- sort_buffer=64M
- read_buffer=16M
- write_buffer=16M
-
- [mysqlhotcopy]
- interactive-timeout
Extending Advanced Policy Firewall with Brute Force Detection
In my previous article I discussed setting up the Advanced Policy Firewall on your servers. So now your servers are protected - but what happens when you get an attack at a legitimate service? SSH? MySQL? Apache? In a series of articles I'll discuss implementing some best practises to help avoid server nightmares.
Advanced Policy Firewall (for cPanel)
More retro software that has been with us for years - APF - Advanced Policy Firewall. A brilliantly robust and fool proof Linux script that acts as a wrapper for iptables.
Here's how I configure it for all the WHM/cPanel boxes I commission, although you can configure it for non-cPanel servers, just adjust your ports accordingly.
CIFS/SMBFS “mount error 13 = Permission denied”
Are you getting a rather generic "mount error 13 = Permission denied" when trying to mount Windows shares in Linux? I was.
Samba's been updated, keep up. You need to add the domain=XXX into your -o command, or text file for your credentials.
Super simple Active Directory with Samba
I needed a super simple, straight forward way of installing samba on Ubuntu and joining it to an Active Directory domain.
This doesn't allow you to login to Ubuntu with domain credentials but allows you to share and access files with domain credentials.
Heres how its done
[Snippet] Allow mysql root access from anywhere
A small annoyance of mine is on local development servers, I can't login to the MySQL server as root.
Simply connect the mysql shell
mysq
- mysql -u
Then,
- GRANT ALL ON *.* TO 'root'@'%' IDENTIFIED BY '[A PASSWORD]'
Exit and you're done.
Ridiculously simple NTLM Authentication for Apache (Ubuntu)
We all know Ubuntu makes things amazingly simple. This is the best I've found so far. NTLM authentication in Apache used to take a while to setup, it used to be tricky, fiddly - generally a bit hit and miss.
About Kieran
