hack attacks testing how to conduct your own security phần 10 ppt

clock hwclock Two commands; use either one. Obtain the date/time from the computer-hardware (real-time, battery-powered) clock. You can also use one of these commands to set the hardware clock, but setclock may be simpler. For example, hwclock —systohc —utc sets the hardware clock (in UTC) from the system clock. who Determines the users logged on the machine. w Determines who is logged on the system and finds out what they are doing, finds out their processor usage, and so on. It is a handy security command. rwho -a (remote who) Determines users logged on other computers on your network. The rwho service must be enabled for this command to run. If it isn’t, run Setup (Red Hat- specific) as root to enable rwho. finger user_name System info about a user. Try finger root. You can use finger with any networked computer that exposes the finger service to the world. For example, finger @finger .kernel.org last Shows listing of users last logged in on your system. It is really a good idea to check it from time to time as a security measure on your system. lastb (last bad) Shows the last bad (i.e., unsuccessful) login attempts on your system. If it doesn’t work on your system, try starting it with the following: chmod o-r /var/log/btmp history | more Show the last (1,000 or so) commands executed from the command line on Linux/Unix Shortcuts and Commands 487 the current account. The | more causes the display to stop after each screenful. To see what another user was doing on your system, log in as root and inspect his/her “history.” The history is kept in the file .bash_history in the user home directory (so, yes, it can be modified or erased). uptime Shows the amount of time since the last reboot. ps (print or process status) Lists the processes currently run by the current user. ps axu | more Lists all the processes currently running, even those without the controlling terminal, together with the name of the user who owns each process. top Keeps listing the currently running processes on your computer, sorted by CPU usage (top processes first). Press <Ctrl>c when done. ■■ PID = the process identification. ■■ USER = the name of the user who owns (started?) the process. ■■ PRI = the priority of the process (the higher the number, the lower the priority; normal is 0, highest priority is –20, and lowest is 20. ■■ NI = the niceness level (i.e., if the process tries to be nice by adjusting the prior- ity by the number given). The higher the number, the higher the niceness of the process (i.e., its priority is lower). ■■ SIZE = the kilobytes of code + data + stack taken by the process in memory. ■■ RSS = the kilobytes of physical (silicon) memory taken. ■■ SHARE = the kilobytes of memory shared with other processes. ■■ STAT = the state of the process: S—sleeping, R—running, T—stopped or traced, D—uninterruptible sleep, and Z—zombie. ■■ %CPU = the share of CPU usage since last screen update. ■■ %MEM = the share of physical memory. ■■ TIME = the total CPU time used by the process since it was started. ■■ COMMAND = the command line used to start the task. gtop, ktop In X terminal: Two GUI choices for top—gtop, which comes with GNOME, and, in KDE, ktop is available from the K menu under System-Task Manager. 488 Appendix A uname -a (Unix name with option all.) Info on your (local) server. Also use guname (in an X Win- dow terminal) to better display the info. XFree86 -version Shows the version of X Window on the current system. cat /etc/issue Checks which distribution you are using. You can put your own message in this text file; it’s displayed on login. It is more common to put your site-specific login message to the file /etc/motd (message of the day). free Shows memory info in kilobytes. Shared memory is the memory that can be shared between processes (e.g., executable code is shared). Buffered and cached memory keeps parts of recently accessed files; it can be shrunk if processes need more memory. df -h (disk free) Prints disk info about all the file systems (in human-readable form). du / -bh | more (disk usage) Prints detailed disk usage for each subdirectory starting at the / (root) directory (in human-readable form). cat /proc/cpuinfo CPU info: Shows the content of the file cpuinfo. Note that the files in the /proc direc- tory are not actual files; they are hooks to look at information available to the kernel. cat /proc/interrupts Lists the interrupts in use. cat /proc/version Shows the Linux version. cat /proc/filesystems Shows the types of file systems currently in use. cat /etc/printcap |more Shows the setup of printers. Linux/Unix Shortcuts and Commands 489 lsmod (list modules. As root: Use /sbin/lsmod to execute this command when you are a non- root user.) Shows the kernel modules currently loaded. set|more Shows the current user environment (in full). echo $PATH Shows the content of the environment variable PATH. Can be used to show other environment variables as well. Use set to see the full environment. (See the previous command.) dmesg | less Prints kernel messages (the content of the so-called kernel ring buffer). Press q to quit less. Use less /var/log/dmesg to see what dmesg has dumped into this file right after the last system bootup. chage -l my_login_name Shows the password expiry information mentioned later in this appendix. quota Shows the disk quota (the limits of disk usage) information mentioned later in this appendix. sysctl -a |more Shows all the configurable Linux kernel parameters. runlevel Prints the previous and current runlevel. The output N5 means no previous runlevel and 5 is the current runlevel. To change the runlevel, use init; for example, init 1 switches the system to a single-user mode. NOTE Runlevel is the mode of operation of Linux. It can be switched on the fly using the command init. For example, init 3 (as root) will switch you to runlevel 3. The following runlevels are standard: 0 halt. (Do not set initdefault to this.) 1 Single-user mode. 2 Multiuser, without NFS. (The same as 3, if you do not have networking.) 490 Appendix A 3 Full multiuser mode. 4 Unused. 5X11. 6 Reboot. (Do not set initdefault to this.) The system default runlevel is set in the file: /etc/inittab . sar View information extracted from the system activity log file (/var/log/sarxx, where xx is the current day number). The sar command can extract many kinds of system statistics, including CPU load averages, I/O statistics, and network traffic statistics for the current day and (usually) for several days back. File Management cp source destination Copies files. For example, cp /home/stan/existing_file_name will copy a file to the current working directory. Use the -R (recursive) to copy the contents of whole direc- tory trees; for example, cp -R my_existing_dir/ ~ will copy a subdirectory under your current working directory to your home directory. mcopy source destination Copies a file from/to a DOS file system (no mounting of the DOS file system is neces- sary). For example, mcopy a:\autoexec.bat ~/junk. See man mtools for other com- mands that can access DOS files without mounting: mdir, mcd, mren, mmove, mdel, mmd, mrd, and mformat. You probably won’t use the mtool commands that often; operations on DOS/MS Windows files can be performed with regular Linux commands after you mount the DOS/MS Windows file system. mv source destination Moves or renames files. The same command is used for moving and renaming files and directories. rename string replacement_string filename Flexible utility for changing parts of filenames. For example, rename .htm .html *.htm Linux/Unix Shortcuts and Commands 491 ln source destination Creates a hard link called destination to the file called source. The link appears as a copy of the original files, but in reality only one copy of the file is kept; just two (or more) directory entries point to it. Any changes to the file are automatically visible through- out. When one directory entry is removed, the other(s) will stay intact. The limitations of the hard links are that the files have to be on the same file system; hard links to direc- tories or special files are impossible. ln -s source destination Creates a symbolic (soft) link called destination to the file called source. The symbolic link just specifies a path where to look for the real file. In contradistinction to hard links, the source and destination do not have to be on the same file system. In compar- ison to hard links, the drawback of symbolic links is that if the original file is removed, the link will be broken—that is, it will point to nowhere. Symbolic links can create cir- cular references (like circular references in spreadsheets or databases, for example, in which a points to b and b points back to a). In short, symbolic links are a great tool and are very often used (more often than hard links), but they can create an extra level of complexity. rm files Removes (deletes) files. You must own the file to be able to remove it (or be “root”). On many systems, you will be asked for a confirmation of deletion; if you don’t want this, use the -f (force) option. For example, rm -f * will remove all files in the current work- ing directory without question. mkdir directory Makes a new directory. rmdir directory Removes an empty directory. rm -r files Recursive remove. Removes files, directories, and their subdirectories. Be careful with this command as root; you can easily remove all files on the system with such a com- mand executed on the top of your directory tree, and there is as yet no undelete in Linux. But if you really want to do it, here is how (as root): rm -rf /* rm -rf files Recursive force remove. As in the preceding example, but skip the prompt for confir- mation if one is set on your system. Be careful with this command, particularly as root. 492 Appendix A TEAMFLY Team-Fly ® mc Launches the Midnight Commander file manager (looks like Norton Commander for Linux). konqueror & In X terminal: Launches the KDE file manager. Perhaps this is the ultimate for file man- agement. Much better than that used with MS Windows Explorer, it embeds Web browsing, PDF viewing, and more. xwc In X terminal: Another excellent file manager, called X Win Commander. Faster than konqueror but not as feature-rich. nautilus & In X terminal: a really good file manager. Slower than konqueror but offers icon-preview of the content of files and content-preview of the sound files. Runs great on a 1.33-GHz computer. Process Control ps (print or process status) Displays the list of currently running processes with their process ID (PID) numbers. Use ps axu to see all the processes currently running on your system (as well as those of other users and those without a controlling terminal), each with the name of the owner. Use top to keep listing the processes currently running. any_command & Runs any command in the background (the & means run the preceding command in the background). The job_number is printed on the screen so you can bring the com- mand in the foreground if you want. The job number is shown automatically. Use & when starting a GUI program from an X terminal. jobs Lists background or stopped processes and shows their job numbers. fg job_number Brings a background or stopped process to the foreground. Linux/Unix Shortcuts and Commands 493 bg job_number Places a process in the background as if it had been started with &. This will restart a stopped background process. The current foreground process can often be stopped with <Ctrl>z. If you have stopped or background jobs, you have to type exit twice con- secutively to log out. batch at>updatedb<Ctrl>d Runs any command (usually one that will take more time to complete) when the sys- tem load is low. You can log out and the process will keep running. When the com- mand is completed, an e-mail will be sent to you with the output. In this example, at> represents a prompt, the command to run is updatedb, and the <Ctrl><d> terminates your input to batch. (You could start many commands to run, separated by <Enter>.) at 17:00 Executes a command at a specified time. You will be prompted for the command(s) to run until you press <Ctrl>d. The associated commands are atq (displays the queue of processes started with at) and atrm (removes a process from the at queue). kill PID Forces a process shutdown. First determine the PID of the process to kill using ps. killall program_name Kills program(s) by name. For example, killall pppd will disconnect your dial-up network. nohup program_name (no hungup). Runs program_name so that it does not terminate when you log out. Output is redirected to the file nohup.out in your home directory. You surely do not want to run an interactive program under nohup. xkill In X terminal: Kills a GUI-based program with the mouse. Point with your mouse cursor at the window of the process you want to kill and click. kpm In X terminal: The KDE process manager. lpc As root: Checks and controls the printer(s). Type ? to see the list of available commands. 494 Appendix A lpq Shows the content of the printer queue. Under X Window KDE, you may use the GUI- based Printer Queue available from Kmenu-Utilities. lprm job_number Removes a printing job job_number from the queue. nice program_name Runs program_name adjusting its priority. Since the priority is not specified in this example, it will be increased by 10 (the process will run slower) from the default value (usually 0). The lower the number (of “niceness” to other users on the system), the higher the priority. The priority value may be in the range of –20 to 19. Only root may specify negative values. Use top to display the priorities of the running processes. renice -18 PID As root: Changes the priority of a running process to –18. Normal users can adjust only those processes that they own and only up from the current value (make them run slower). You could also renice +10 -u peter to make the user peter use fewer CPU clicks. By doing so, other users will not suffer when the user peter runs his computing-intensive tasks. <Ctrl>c, <Ctrl>z, <Ctrl>s, and <Ctrl>q In short, these mean, respectively: stop the current command, send the current com- mand to the background, stop the data transfer, and resume the data transfer. lsof Lists the opened files. If you are root, all files will be listed. You can limit yourself to files opened by processes owned by the first console if you use lsof /dev/tty1 . To list only network files (useful for a security audit), you could do lsof -i (as root). watch -n 60 my_command Executes my_command repeatedly at 60 sec intervals (the default interval is 2 sec). Administration Commands su (substitute user ID) Assumes the superuser (root) identity (you will be prompted for the password). Type exit to return to your previous login. Don’t habitually work on Linux/Unix Shortcuts and Commands 495 your machine as root. The root account is for administration; the su command is to ease your access to the administration account when you require it. You can also use su to assume any other user identity; for example, su barbara will make you “barbara” (password required, unless you are the superuser). alias ls=”ls —color=tty” Creates an alias for the command ls to enhance its format with color. In this example, the alias is also called ls and the color option is evoked only when the output is done to a terminal, not to files. Put the alias into the file /etc/bashrc if you want the alias to be always accessible to all users on the system. Aliases are a handy way to customize your system. Type the alias alone to see the list of aliases for your account. Use unalias alias_name to remove an alias. cat /var/log/httpd/access_log Shows who connected to your HTTP (apache) server since the last time the log file was rotated. (It is normally rotated once a day, when cron runs.) cat /var/log/secure As root: Inspects the important system log. It is a really good idea to do it periodically if you use Internet access. ftpwho As root: Determines who is currently connected to your ftp server. printtool As root, in X terminal: Configuration tool for your printer(s). Settings go to the file /etc/printcap and (strangely) /var/spool/lpd. setup As root: Configures the mouse, the soundcard, the keyboard, the X Window, and the system services. There are many distribution-specific configuration utilities; setup is the default on Red Hat Linux. Mandrake 7.0 offers an excellent DrakConf. Linuxconf As root, either in the text mode or in the X terminal: Allows you to access and change hundreds of network settings. It is very powerful; don’t change too many things at the same time, and be careful with changing entries that you don’t understand. Read Hat’s network configuration utility, netconf, is a subset of Linuxconf; therefore, it is simpler and sometimes easier to use. 496 Appendix A [...]... /boot/initrd-2.4.7-10custom.img 2.4.7-custom Quick reference: 501 Appendix A cd /usr/src/Linux-2.4.7 -10 patch -E -p1 < /home/download/the_patch _to_ apply It may also be helpful to read /usr/doc/HOWTO/Kernel-HOWTO and, perhaps, man depmod Configuration, compilation, and installation of a new kernel is quite simple but can lead to problems Compilation of a kernel is also a good way to test your hardware,... Shows the kernel routing table host host _to_ find nslookup host _to_ find dig ip _to_ find Three commands; use any of them Query your default DNS server for an Internet name (or IP number) host _to_ find This way, you can check whether your DNS works You can also find out the name of the host of which you only know the IP number traceroute host _to_ trace Enables you to see how your messages trace to host _to_ trace... use xvidtune to adjust the monitor frequencies for each resolution so that it fits well in your screen To make the changes permanent, display the frequencies on the screen and then transfer them to the setup file /etc/X11/XF86Config On newer monitors, you may prefer to adjust your monitor by using the built-in monitor settings; xvidtune is for older monitors that do not have the capability to remember... must be set up to do this The directory /mnt/floppy must not be your current directory mount /mnt/cdrom As user or root: Mounts a CD as user The file /etc/fstab must be set up to do this The directory /mnt/cdrom must not be your current directory umount /mnt/floppy Unmounts the floppy The directory /mnt/floppy must not be your (or anybody else’s) current working directory Depending on your setup, you... command to find other kernel modules there are to load insmod parport insmod ppa As root: Inserts modules into the kernel (a module is roughly an equivalent of a DOS device driver) Normally, use modprobe (see the previous command) to insert modules This example shows how to insert the modules to support the external parallelport 100 -MB zip drive (It appears to be a problem to get the external zip drive to. .. excellent GUI utility to set the operating system clock and hardware clock and time zone, as well as to tell BIOS to keep time in UTC Then, you won’t need the previous two commands xvidtune In X terminal: Adjusts the settings for your monitor display for all resolutions so as to eliminate black bands, shifts the display right/left/up/down, and so on First, use the knobs on your monitor to fit your text mode... manually to your network configuration Any other service listed in init.d can be similarly stopped, started, or restarted (Call the script with an options stop, start, or restart.) ifdown interface_name (/sbin/ifdown to run as a user) Shuts down the network interface, for example, ifdown ppp0 (See also the previous command.) netstat | more Displays a lot (perhaps too much) of information on the status of your. .. click on the CD-ROM icon on the desktop and choose “UMount CD-ROM” from the selections This will mount your CD-ROM If your browser fails to automatically open with the start file, execute your web browser and open the file Start.html from the CD Using the CD with the Mac OS To install the items from the CD to your hard drive, follow these steps: 1 Insert the CD into your CD-ROM drive 2 Double-click the... The example above shows how to add a journal to a disk partition (hda2, in this example), effectively converting the file system to an ext3 (journaling) file system To complete the transition, you must also edit the file /etc/fstab and change the file system type from ext2 to ext3; otherwise, you may run into problems—ext2 will not mount an uncleanly shut down journaled file system! To check the type... somebody else Only the owner of a file can delete a file 507 508 Appendix A sudo /sbin/shutdown -h now (As a regular user, you will be prompted for your user password.) Runs the command shutdown or another command that your system administrator has given you permission to run With sudo, the administrator can give selected users the rights to run selected commands, without having to hand out the root . command) to insert mod- ules. This example shows how to insert the modules to support the external parallel- port 100 -MB zip drive. (It appears to be a problem to get the external zip drive to work in. settings for your monitor display for all resolutions so as to eliminate black bands, shifts the display right/left/up/down, and so on. First, use the knobs on your monitor to fit your text mode. and Commands 501 cd /usr/src/Linux-2.4.7 -10 patch -E -p1 < /home/download/the_patch _to_ apply It may also be helpful to read /usr/doc/HOWTO/Kernel-HOWTO and, perhaps, man depmod. Configuration,