NOT just another WordPress site

Month: June 2012

Restrict access to website using IP address in IIS 7

We can restrict the access to a website using IP addresses or domain name in IIS 7 easily using the “IP and Domain Restrictions” module. Unlike IIS 6, this module is not enabled by default when you install Internet Information Services (IIS). we need to install it. But don’t worry, this can also be done easily through Server Manager.

You can follow the below step by step instruction:-

 

Enabling the “IP and Domain Restrictions” module

1. Open the Server Manager by selecting the path Start > Administrative Tools > Server Manager.

2. Click “Add Role Services” link to add the required Role. Check the “IP and Domain Restrictions” check box in “Select Role Services” screen and click “Next” to continue and complete the module installation. If the module is already installed, it will show as “installed”.

 

 

 

Configuring the “IP and Domain Restrictions” module

 

1. Start Internet Information Services (IIS) and open “IP and Domain Restrictions”.

 

Click to enlarge the image

Click to enlarge the image

2. Inside IPv4 Addresses and Domain Restrictions, select “Add Allow Entry” or “Add Deny Entry” to add Allow or Deny entries. You can specify IP address, an IP address range or a Domain Name.

Click to enlarge the image

Click to enlarge the image

 

 

3. For setting default policy, Click on “Edit feature settings” and select “Allow” or “Deny” as required.

 

 

Click to enlarge the image

Click to enlarge the image

Note:-

1. Please note that configuring Allow or Deny restrictions using Domain name require reverse DNS look up every time a request arrives the server. Performing reverse DNS lookups is a potentially expensive operation that can severely degrade the performance of your IIS server.
2. IP entries are applied instantly without the need for a restart of the site or iis. The entries are processed in order so if you place deny and allow entries in the wrong order then you may lock the incorrect people out of the website.

Distributed Denial of service(DDOS)

A denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a computer or network resource unavailable to its intended users. The speciality of the DDOS is that, it relays attacks not from a single network/host like DOS. The DDOS attack will be launched from different dynamic networks which has already been compromised.

Types:-

Ping of death :-
Attacker deliverately sending a ping packet, normally 64 bytes, that is larger than the 65,535 bytes. Many computer systems cannot handle an IP packet larger than the maximum IP packet size of 65,535, and often causes computer systems crash. A ping packet of size greater than 65,535, can be sent if it is fragmented.When a receiving computer reassembles the packet, a buffer overflow occurs, which often causes computer to crash.

Ping of flood:-
An attacker overwhelming the victim’s network with ICMP Echo Request (ping) packets. A flood of ping traffic can consume singificant bandwidth on low to mid-speed networks bringing down a network to a crawl.

Smurf Attack:-
Smurf attack exploits the target by sending repeated ping request to broadcast address of the target network. The ping request packet often uses forged IP address (return address), which is the target site that is to receive the denial of service attack. The result will be lots of ping replies flooding back to the innocent, spoofed host. If number of hosts replying to the ping request is large enough, the network will no longer be able to receive real traffic.

SYN Floods :-
When establishing a session between TCP client and server, a hand-shaking message exchange occurs betwen a server and client. A session setup packet contains a SYN field that identifies the sequence in the message exchange. An attacker may send a flood of connection request and do not respond to the replies, which leaves the request packets in the buffer so that legitimate connection request can’t be accommodated.

Teardrop Attack :-
Teardrop attack exploits by sending IP fragment packets that are difficult to reassemble. A fragment packet identifies an offset that is used to assemble the entire packet to be reassembled by the receiving system. In the teardrop attack, the attacker’s IP puts a confusing offset value in the sebsequent fragments and if the receiving system doesn’t know how to handle such situation, it may cause the system to crash.

Prevetion:-

1. Install Intrusion Detection System (IDS)
2. Implement Sysctl. Prevent ping attacks (ping of death, ping of flood, and smurf attacks) by disabling ping responses on the network machines. Enable IP Spoofing protection, and TCP SYN Cookie Protection.
3. Install advanced firewall and DDoS utilities.
4. Install Apache mod_evasive and mod_security modules to protect against HTTP DDoS attacks.

Mod_security:-
Since DDOS normally targets HTTP. Its always good to have a filtering system for apache . So that the request gets analyzed before web server handles it.

Mod_evasive:-
Detection is performed by creating an internal dynamic hash table of IP Addresses and URIs, and denying any single IP address from any of the following:

1. Requesting the same page more than a few times per second
2. Making more than 50 concurrent requests on the same child per second
3. Making any requests while temporarily blacklisted (on a blocking list)

Note:-
1. Well there are no 100% prevention or protection against DDOS.
2. This steps won’t be enough if the DDOS attack is of very high volume.

How dns works

A DNS client “resolves” an IP address by sending a specially formatted request to a DNS server. The client has to know the address of one or more DNS servers in advance. The reply from the server may be a direct reply with the IP address associated with the hostname, a referral to another DNS server, or a response indicating the requested name can’t be found in DNS.

Typically, the request will ask the server to “recursive“, i.e. if it cannot answer the question from its own local memory, it should go ask other servers on behalf of the client. This behavior helps the local server build up its own cache of addresses frequently looked up.

Another form of query is called iterative query, where a client machine sends the request to a known DNS server , if that DNS server fail to resolve the domain name into a IP, then the client sends the request to another DNS and this process goes on and on until it get the required IP resolution by sending address resolution request to all its known DNS.If every known DNS fail to give the IP, then client goes to the root domain.

When you type a URL into your browser, it uses the following steps to locate the correct website:

A DNS client uses a resolver to request resolution of a host name to an IP address. The resolver is really just a special-purpose application that’s sole function is to act as an intermediary between name servers and various applications that need name resolution, such as Web browsers, e-mail applications, and so on. Here’s an example: Assume you fire up your browser and direct it to connect to www.mysite.com.

1. Your browser checks it’s cache (memory) to see if it knows which IP address the domain name resolves to. If it knows, it will resolve it and display the web page.
2. If the domain name is unable to be resolved, the browser will check your hosts file for a DNS entry.
3. If there’s no entry in the hosts file, the browser will check the default DNS server (specified via your computer’s network settings, /etc/resolv.conf). This is usually your ISP’s DNS server or your employer’s. If the default DNS server has an entry for that domain name, the browser will display the applicable website.
4. If the default name server has no cached results, it sends a DNS query to the root server for the .com domain.
5. The root server responds with the addresses of the name servers that are authoritative for the mysite.com domain.
6. Your ISP’s name server then builds another request for www.mysite.com and submits it to mysite.com’s name server, which responds with the IP address of www.mysite.com.
7. That information is passed back to your resolver, which passes it to your application.

Install SSL certificate in Ubuntu Nginx server

Prerequisites:-

OS: Ubuntu
Web Server: Nginx
Tools: openssl

Assumptions:-

1. You need to login to server using SSH for issuing various commands
2. Name of the domain name which needs the certification: mydomain.com
3. Private key File: mydomain.com.key
4. CSR : mydomain.com.csr 5. Cert FIle :mydomain.com.cert

Steps:-

1. Generate a RSA private key.
2. Generate Certificate Signing Request(CSR) using the private key.
3. Purchase a Valid SSL Certificate from a Certificate Authority(CA). The CSR needs to be provided to CA.
4. Verify that Private Key Matches Certificate
5. Copy the Certificate to server and make necessary changes.

Generate the Private Key

We are generating 2048 bit RSA key. Login to the server and issue following commands
#openssl genrsa -out mydomain.com.key 2048
This will create the key file mydomain.com.key

Generate the CSR

You must use the key file you created above to make the CSR file. Run the following command:-
#openssl req -new -key mydomain.com.key -out mydomain.com.csr

You need to enter the following details while generating CSR:-
Country Name (2 letter code) [GB]:
State or Province Name (full name) [Berkshire]:
Locality Name (eg, city) [Newbury]:
Organization Name (eg, company) [My Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server’s hostname) []:
Email Address []:

Purchase a Valid SSL

You need to purchase a valid SSL certificate from anyone of the CA. You will have to provide the CSR to CA. SO the CA will provide you the mydomain.com.cert.

Verifying that a Private Key Matches a Certificate

In order to SSL work correctly, the certificate and the private key should match. Otherwise the SSL won’t work. You can issue the following commands to check the md5 of the files. The MD5 values of all the files MUST be same.
#openssl x509 -noout -modulus -in mydomain.com.cert | openssl md5
#openssl rsa -noout -modulus -in mydomain.com.key | openssl md5
#openssl req -noout -modulus -in mydomain.com.csr | openssl md5

Install the Certificate

In Nginx server, normally the SSL certificates are placed under “/etc/nginx/certs” Directory. So copy Key, CSR and Cert files to this directory. Now you need edit the vhost file for the mydomain.com and specify the certificate files. In our case the included vhost file is “/etc/nginx/sites-enabled/mydomain.com“. Please check your “nginx.conf” for the locations of vhost files. Now open the “/etc/nginx/sites-enabled/mydomain.com” and add the following entries to the file:-

ssl on;
ssl_certificate /etc/nginx/certs/mydomain.com.cert;
ssl_certificate_key /etc/nginx/certs/mydomain.com.key;

Please make sure that you have placed the above code inside the server ( } Directive. Restart the nginx service. That is all needed. Now the new certificate must be loaded successfully.

Note:-

Always keep a backup of the private key used for creating the SSL Certificate file. This file is needed while you transfer your account or re- install the certificate. If the key is lost, you need to generate a new key, CSR and buy a fresh new SSL certificate.

Case insensitive url Aapche Webserver

How to enable Case-Insensitive url’s ?

Webserver: Apache

OS: Linux

One of our customer had opened ticket. He has a very interesting need. He wants his site urls  to be Case-insensitive . I will explain with examples:- He needs the following urls to work currently he is getting 404 errors for each request.

http://yourdomain.com/Yourpage.html

http://yourdomain.com/YourPage.html

We were unable to add rewrite rules in his htaccess files as we need to write rule for every single file that has a mixture of upper and lower case.

http://yourdomain.com/yourpage.html => This is the correct url

He needs this url http://yourdomain.com/Yourpage.html to load even if they have one spelling mistake or there is one capitalization error. This was found very strange. We have managed to fix the issue by adding an apache module server wide, which neutralise all the the upper case and lower case characters to a single format.

Solution: If you want requested URLs to be valid whether uppercase or lowercase letters are used and with one spelling mistake, “mod_speling” module needs to be enabled in apache.

The mod_speling module is part of the standard Apache distribution but is not enabled by default, so you need to explicitly enable it. When mod_speling is installed, it may be turned on for a particular scope (such as a directory, virtual host, or the entire server) by setting the CheckSpelling directive to On.

For making URL case-insensitive in cPanel:

First run belwow on Cpanel based server : /scripts/easyapache And select ‘Spelling’ from the available module list for apache. Once apache/php are recompiled with this option and easyapache finishes, you can put below code in the .htaccess or in the virtual host entry of the particular domain to apply it to any directory/directories :

< IfModule mod_speling.c > CheckCaseOnly On CheckSpelling On < / IfModule > This helped to fix this particular issue

Powered by WordPress & Theme by Anders Norén