Other useful linux commands - act 3

iwconfig - check wireless setup

dmesg - query a USB device, plug it in a type this command

lspci - chipset interrogation

lsusb - as above

Configure Open SSH securely

Modify config in /etc/ssh or ssh_config to disable support for legacy protocols. Look for the 'Protocol 2,1' line and remove the ver 1 protocol.
Also set 'PermitRootLogin no' and 'MaxAuthTries 3'


After the changes have been made run:
service ssh restart

View attack activity by looking at /var/log/auth. If you see a particular IP that keeps attacking, put an entry in /etc/hosts.deny

You can automate this process by installing the DenyHosts package. Edit it's config in /etc/denyhosts.conf and change DENY_THRESHOLD_INVALID from 5 to 2

Enhanced GUI nmap

Try Zenmap, usually in your distros repository

Quick port scan of a machine

nmap

Not installed by default on Ubuntu or Mint, use:

sudo apt-get install nmap

Change hostname in linux

Using suitable privelages, navigate to /etc and edit the following files, replacing the default name with your desired machine name. Prefereably the FQDN.

/etc/hosts
/etc/hostname

Article to install latest SOLR build on Ubuntu 10.04

http://charlesleifer.com/blog/how-to-set-up-solr-on-ubuntu-1004-or-whatever/

Thanks Dave Hall for your brilliant article

http://davehall.com.au/blog/dave/2010/06/26/multi-core-apache-solr-ubuntu-1004-drupal-auto-provisioning

Tika and Solr

To index Word, Excel, PDF and other "unstructured" documents, Solr uses Tika, another Apache project.

Tika comes bundled in Solr and is ready to run in Solr. However, if you want to run Tika individually you have to copy a few .jar files around.

cd [Your path]/apache-solr-nightly/lib
cp commons-io-1.4.jar commons-codec-1.3.jar [Your path]/apache-solr-nightly/example/solr/lib
cp ~/.m2/repository/org/jempbox/jempbox/0.2.0/jempbox-0.2.0.jar [Your path]/apache-solr-nightly/example/solr/lib

java -jar tika-0.2.jar

Config

If you want to index Word, Excel, PDF, and other types of documents, there is a bit of additional configuration to do. To index those files types you have to get a nightly build of Solr from here, and copy some files and directories as described in the link at the end of this post. You have to add the following lines to example/solr/conf/solrconf.xml:

    
      last_modified
      true
    
    

Bitnami Stacks

Just discovered these and they are pretty awesome. If you just want to test a Wordpress idea and don't want to build a whole VM then download a stack:
http://bitnami.org/stack/wordpress

Linux logs - just so I remember

Most logs are stored in the /var/log/ directory
Over a period of time log files grow too large and are rotated, with the older logs being compressed and appended with .gz
Rotation is handled by the logrotate utility which is governed by the /etc/logrotate.conf file
The /etc/logrotate.d directory contains configs for individual log files such as apt etc.

Linux detective work

When looking at logs, if an attack has taken place and the IP can be discovered of the attacking machine, then it is possible to reverse trace the attacker and potentially find out their pc details, open ports, isp etc.

From linux, open a bash terminal:

dig -x 1.2.3.4

Where 1.2.3.4 is an IP address. This command may return a pointer record. Next, try a whois:

whois 1.2.3.4

This command should give the netblock owner, ISP etc. You can also try using the commands available at www.robtex.com

Finally, try an nmap command:

nmap -O 1.2.3.4