Empowering you with the knowledge to master Linux web hosting, DevOps and Cloud

 Linux Web Hosting, DevOps, and Cloud Solutions

Tag: Linux

URL Monitoring With Nagios

Capabilities

Nagios provides complete URL monitoring of HTTP and HTTPS servers and protocols as well as full URL transaction monitoring.

Benefits

Implementing effective URL monitoring with Nagios offers the following benefits:
* Increased server, services, and application availability
* Fast detection of network outages and protocol failures
* Monitor user experience when accessing URLs
* Web server performance monitoring
* Web transaction monitoring
* URL monitoring

URL monitoring

By using the ‘check_http’ nagios command, we can monitor a specific url rather than checking the Apache service is up or not. This method is helpful to identify if the website is hacked and url is injected with malicious codes or there is some Apache or php errors and page is throwing an error instead. The normal Apache service check will return successful results in the above case.
We can check for a specific keyword string on the webpage. If that string not present, an error will be returned.

Here is an real example

define service{
    use                            urlmonitoring-service
    host_name                      server.linuxwebhostingsupport.in
    service_description            url_check
    check_command                  check_http!-H linuxwebhostingsupport.in -t 30 -R "Cpanel and WHM" -f follow
}

The above will check for the keyword “Cpanel and WHM” on the page “linuxwebhostingsupport.in”. If the keyword is missing or the page is not responding nagios will retun and error.

URL monitoring +SSL

You can refer to below example if the web page has SSL/TLS enabled.

define service{
    use                            urlmonitoring-service
    host_name                      server.linuxwebhostingsupport.in
    service_description            url_check
    check_command                  check_http!-H linuxwebhostingsupport.in -t 30 -R "Cpanel and WHM" -f follow --ssl
}

Here we added the option “–ssl” to the check command

URL monitoring on ht password protected page

Normal method will not work as we need to validate ht password protection first to see the page. You can use the following example for such pages.

define service{
    use                            urlmonitoring-service
    host_name                      server.linuxwebhostingsupport.in
    service_description            url_check_protected
    check_command                  check_http!-H linuxwebhostingsupport.in -a user:password -t 30 -R "Cpanel and WHM" -f follow --ssl 
}

Replace the username and password appropriately.

Run Postfix on multiple ports

Adding additional SMTP listenerports

By default postfix run on port 25 and 587(TLS). However some ISPs block port 25. In that case you can configure the postfix mail server to listen on addional ports too, for example port 26 or some random 5125.

This configuration is done in the master.cf configuration file. Edit it in your editor of choice.

This file is in the following format:

# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100)
# ==========================================================================

The first column is the port number that you want to listen on. The default SMTP port 25 line will read as follows:

smtp inet n - - - - smtpd

To add an additional listener port of 5125, insert the the following after the above:

5125 inet n - n - - smtpd

Save the file and restart postfix service

service postfix restart

Now you can use port 25, 587 and 5125 to connect to your mail server.

CSR generation for UCC certificates

Unified Communications (UC) Certificates (also called SAN Certificates) use Subject Alternative Names o secure multiple sites (e.g. fully qualified domain names) with one certificate. Four SANs are included in the base price of the UC Certificate, but you can purchase additional names at any time during the lifetime of the certificate.

With a UC Certificate, you can secure:

www.linuxwebhostingsupport.in
www.example2.com
www.example3.net
mail.example.net
dev.example2.com

The CSR generation process is little different for creating an UCC certificates. We will have to create a Openssl based configuration file and then create private key and CSR from it.

Step 1: Create a custom OpenSSL Conf file.

The following is an example conf file that can be used for creation of a SAN/UCC cert. Save it as multissl.conf

———–
[ req ]
default_bits = 2048
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
req_extensions = req_ext # The extentions to add to the self signed cert

[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = US
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = Iowa
localityName = Locality Name (eg, city)
localityName_default = Iowa City
organizationName = Organization Name (eg, company)
organizationName_default = The University of Iowa
organizationalUnitName = Organizational Unit Name (eg, section)
organizationalUnitName_default = Domain Control Validated
commonName = Common Name (eg, YOUR SSL domain name)
commonName_max = 64

[ req_ext ]
subjectAltName = @alt_names

[alt_names]
DNS.1 = www.linuxwebhostingsupport.in
DNS.2 = www.example1.com
DNS.3 = example2.com
———–

Notes:

The alt_names section (DNS.1, DNS.2, ….) are the list of all other domain names you wish to secure with this cert. Additional can be added such as DNS.4, etc.
The following examples assume that you name the above config file file multissl.conf (if it is named differently you must adjust the filename in the below examples accordingly.
Step 2: Generate the Private key and CSR with OpenSSL

Execute the following OpenSSL command

$ openssl req -nodes -newkey rsa:2048 -keyout serverfqdn.key -out multidomain.csr -config multissl.conf

* Replace “serverfqdn” with the fully qualified domain name of the server (ie: sample.server.uiowa.edu). Note: it may also be helpful to add a year to the filename.

You will then see output and be prompted for configuration as seen in the following example. Enter your details accordingly.

——————————————
$ openssl req -nodes -newkey rsa:2048 -keyout serverfqdn.key -out multidomain.csr -config multissl.conf
Generating a 2048 bit RSA private key
………………………………….+++
…………………………………………………………+++
writing new private key to ‘serverfqdn.key’
—–
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [US]:US
State or Province Name (full name) [Iowa]:Iowa
Locality Name (eg, city) [Iowa City]:Iowa City
Organization Name (eg, company) [The University of Iowa]:My Company name
Organizational Unit Name (eg, section) [Domain Control Validated]:IT SUPPORT
Common Name (eg, YOUR SSL domain name) []:www.linuxwebhostingsupport.in
——————————————

Note: Replace www.linuxwebhostingsupport.in with the “primary” domain name you want secured with this certificate (likely, but not necessarily the hostname of the machine).

At this point you should have the new key file, and CSR. Save the key file in a secure place, it will be needed to apply the new certificate. The CSR can now be submitted to request the SSL Cert.

Shellshock How to check if you are vulnerable

A new vulnerability has been found that potentially affects most versions of the Linux and Unix operating systems, in addition to Mac OS X. Known as the “Bash Bug” or “ShellShock,” the GNU Bash Remote Code Execution Vulnerability could allow an attacker to gain control over a targeted computer if exploited successfully. And because Bash is everywhere on Linux and UNix-like machines and interacts with all parts of the operating system, everyone anticipates that it will have lot of repercussions.

How does Shellshock work?

Shellshock exploits a flaw in how Bash parses environment variables; Bash allows functions to be stored in environment variables, but the issue is Bash will execute any code placed after the function in the environment variable value.

For example, an environment variable setting of VAR=() { ignored; }; /bin/id will execute /bin/id when the environment is imported into the bash process.

I am vulnerable?

You can check if you’re vulnerable by running the following lines in your default shell.

env X=”() { :;} ; echo vulnerable” `which bash` -c “echo Check completed”

If you see the word “vulnerable” echo’d back , then you’re at risk.

How Shellshock is Impacting the Web

The most likely route of attack is through Web servers utilizing CGI (Common Gateway Interface), the widely-used system for generating dynamic Web content. An attacker can potentially use CGI to send a malformed environment variable to a vulnerable Web server. The attacker is able to inject environment variables inside all bash process spawned by a web server under the CGI specification. This will occur directly if the CGI script is programmed in bash or indirectly by system calls inside other types of CGI scripts since the environment will propagate to the sub-shell. The vulnerability will automatically be triggered at the shell process instantiation. Furthermore if specific headers are used as attack points, the payload may not appear in the webserver logs, letting a compromise occur with virtually no trace of the intrusion.

Example:

CGI stores the HTTP headers in environment variables. Let’s say the example.com is running a CGI application written in Bash script.

We can modify the HTTP headers such that it will exploit the shellshock vulnerability in the target server and executes our code.

curl -k http://example.com/cgi-bin/test -H “User-Agent: () { :;}; echo Hacked > /tmp/Hacked.txt”

Here, the curl is sending request to the target website with the User-Agent containing the exploit code. This code will create a file “Hacked.txt” in the “/tmp” directory of the server.

What can I do to protect myself?

Major operating software vendors including RedHaT, CentOS, etc are already released a initial patch for this bug.

Debian—https://www.debian.org/security/2014/dsa-3032

Ubuntu—http://www.ubuntu.com/usn/usn-2362-1/

Red Hat—https://access.redhat.com/articles/1200223*

CentOS—http://centosnow.blogspot.com/2014/09/critical-bash-updates-for-centos-5.html

Novell/SUSE— http://support.novell.com/security/cve/CVE-2014-6271.html

If a patch is unavailable for a specific distribution of Linux or Unix, it is recommended that users switch to an alternative shell until one becomes available.

Need expert assistanace?

I can help you to patch your server against this bug and make sure you and your customers are secure. Mail me at therealfreelancer[at]gmail[dot]com.

Page 2 of 2

Powered by WordPress & Theme by Anders Norén