Somebody attacking your ssh daemon??

sshd[5948]: Failed password for root from 116.10.191.220
sshd[5948]: Failed password for root from 116.10.191.220
sshd[5948]: Failed password for root from 116.10.191.220

You can stop this easily with iptables rules. The following two rules limit connection attempts on port 22 to maximum 4 every 90 minutes, if you get more attempts they will be dropped.

iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent \

  --set
iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent \
  --update --seconds 90 --hitcount 4 -j DROP

1. First line: any NEW connections to port 22 over TCP use the recent module to keep track of the IP address; the -m recent --set takes care of this. 
2. Second line: -m recent --update checks if the IP address of the incoming connection is in the recent list. The --seconds and --hitcount limit the match to within 90 seconds and 4 tries.

i.e.. Drop if: IP address previously in recent list AND IP address has tried to make a NEW connection within the last 90 minutes AND IP address has tried more than 4 times.

 Stops that nasty traffic!

ref: http://www.debian-administration.org/articles/187

tell SELinux to calm down & get out of the way

DO NOT DO THIS on an internet facing computer, this is only for crash and burn Linux boxen that you are testing in your lab and changing rapidly.

This applies to RedHat, Fedora or CentOS.  When you are in a test lab or even just trying different configurations for your server SELinux can get in your way. It may block what you are trying to do without notice or it may pop up several notices telling you that it is doing so. Either way it can be painful to test or change service configurations with it in full blown enforcing mode. So to make it less intrusive you may do the following (as root or sudo of course):

1. Edit /etc/sysconfig/selinux with your favourite text editor
2. You should see 
3. Change the line SELINUX=enforcing to read
   SELINUX=permissive
4. Save the file
5. Reboot

That's it.  It will now log the information but not block your changes.  Of course once you are ready to go live, put it back!

To see the current status
CLI:  sestatus

By the way if you want to toggle it off and on temporarily:
CLI:  setenforce Permissive
or
CLI:  setenforce Enforcing

I am at heart a C programmer, this is sad.  One of the fathers of C hence Unix and so the grandfather of Linux has died.

DMR Denis M. Ritchie 1949-2011



Google+ post by Rob Pike
techcrunch.com

Free Bash shell

Sometimes you need to do things from another network off of your own box, having a free shell account elsewhere can help.  The lists of accounts and websites that offer supposedly free accounts can be difficult to wade through.  I just finished doing so and I found one that is easy to setup and use and it IS free, so I thought I'd share.

Instructions to get your account may be found here http://www.nvita.org/free-shells.aspx 

Unfortunately the website is running Micro$oft IIS* but the shell runs on Ubuntu.

Snippet from my session

youruserid@ubuntu:~$ uname -a

uname -a
Linux ubuntu 2.6.35-28-generic-pae #50-Ubuntu SMP Fri Mar 18 20:43:15 UTC 2011 i686 GNU/Linux
youruserid@ubuntu:~$ cat /etc/*release*
cat /etc/*release*
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=10.10
DISTRIB_CODENAME=maverick
DISTRIB_DESCRIPTION="Ubuntu 10.10"
youruserid@ubuntu:~$ bash --version
bash --version
GNU bash, version 4.1.5(1)-release (i686-pc-linux-gnu)
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 

For those who are stuck on Windoze to ssh to the box you can use my favourites

• standalone Putty
• bitvise 
• installed original tunnelier installable
• standalone by 3rd party tunnelier portable

*Weirdly Netcraft what's that site runing reports it as running Microsoft-IIS/6.0  on FreeBSD that is a little disturbing.

I lost/forgot mysqld root password

Oops, it happens, you install quickly set a good password then promptly forget to record it.
What a pain, but easily remedied using the command line!

1. stop mysqld
   service mysqld stop 
2. create a text file for example mysqld.reset.password containing the following 2 lines
   update mysql.user set password=password('yournewpassword') where user='root';
   flush privileges;
3. load mysqld using the text file as input
   mysqld_safe --init-file ~/mysqld.reset.password
4. delete your text file, for cleanliness & security reasons
   rm ~/mysqld.reset.password
5. start mysqld
   service mysqld start
   

Which Linux should I use ???

This is a huge bombshell of a question because there are many implementations of Linux,  and some people are attached to distros passionately.  So I am going to concentrate on a few mostly  Redhat and Debian based in this post. I will not even try to cover everything, that would be crazy...

I moved this to a static page instead of a blog post as I've been updating it occasionally see   Which Linux should I use ??? page

Set up LAMP stack on Fedora

LAMP = Linux Apache MySQL PHP
(I set this up for a class I was teaching they were using Fedora 13, it is of course easily adaptable for CentOS or RHEL)
Fedora comes with Apache (httpd) installed and mysql client but it is missing a few things to complete the LAMP stack.  So a little work is required to get everything set up.  All of the following are systems administration tasks and must be done as root user:

Once you complete this you can install Wordpress, Mediawiki, Tikiwik etc.  Or if you want to build your own application start with this tutorial IBM DeveloperWorks Introduction to LAMP

These  instructions are also applicable to Centos 5.x.  Be aware that where it says install / update you may need to do one or the other depending upon your install.


Apache  http://httpd.apache.org/docs/2.2/

1. yum update httpd -y
2. service httpd start  
3. chkconfig httpd on
   make sure it starts up when we reboot

• Note: main configuration file /etc/httpd/conf/httpd.conf, others in /etc/httpd/conf.d./*

MySQL Server http://dev.mysql.com/doc/refman/5.6/en/index.html

1. yum install mysql-server -y
2. service mysqld start
3. chkconfig mysqld on
   make sure it starts up when we reboot
4. mysql_secure_installation
   secure the install a little bit!
5. yum install phpmyadmin -y
   the browser/web interface for mysql
6. service httpd restart 
7. Optional create a database:
1. mysql -u root -p
2. mysql> create database testing;
3. mysql> grant all on testing.* to 'userx' identified by '123pass';
4. mysql> quit
5. mysql -u userx -p
6. mysql> show databases;
7. mysql> quit
• or you can do the same thing using http://localhost/phpMyAdmin

• Note: phpMyAdmin defaults to respond only to a localhost client, to allow other hosts to use it you must modify /etc/httpd/conf.d/phpMyAdmin.conf:

1. Locate the line(s)   Allow from 127.0.0.1
2. Add a line below it  
   Allow from 192.168.10.0/24 
   where 192.168.10.0/24 is your network
3. save the file
4. service httpd reload

PHP http://ca3.php.net/tut.php

1. yum -y update php php-mysql
2. If you are using Tikiwiki  you may also need the php & gd connection: yum install php-gd -y 
3. service httpd reload
4. create a file /var/www/html/hello.php containing:

5. Load the file in a browser   http://localhost/hello.php
   if you see the text hello world, you are ready to go
6. Optional 
1. create a file /var/www/html/phpinfo.php

2. load the file in a browser http://localhost/phpinfo.php

Firewall tcp ports to open:

• 80 for  apache/httpd (443 for https)
• 3306 for mysql