2016年12月19日 星期一

使用 Perl 建立 Line API 運用環境

本 LAB 平台

#cat /etc/redhat-release
CentOS release 6.8 (Final)

#perl -v

This is perl 5, version 24, subversion 0 (v5.24.0) built for x86_64-linux

Copyright 1987-2016, Larry Wall

Perl may be copied only under the terms of either the Artistic License or the
GNU General Public License, which may be found in the Perl 5 source kit.

Complete documentation for Perl, including FAQ lists, should be found on
this system using "man perl" or "perldoc perl".  If you have access to the
Internet, point your browser at http://www.perl.org/, the Perl Home Page.

參考 SDK


   
本 LAB 目地的為建立一個自己專用的 line bot webhook URL
並透過 webhook 的機制取得 Line bot 專用的  line id (UID)

接下來才可以用 Push Message 的方式法做 Send Line Message
或 Reply API 等等運用


Push API與Reply API
Push API指的是Bot能夠在任何時間點對用戶傳送訊息的API。
而Reply API指的則是公司或經營者針對用戶傳來的訊息進行回覆的API。




























關於 line bot


在開始之前可先看一下這個小筆記

Line API 使用小筆記
line 已經推出官方版的 API 了
所以提供這個簡單的小筆記供需要的人參考

先去官網上申請一個 API 的帳號
且建立一個 Developer Trial 的帳號
並確認該帳號為 LINE@Developer


程式開發可參閱

=====================
以 Push Line Message 可參閱


以 PHP 為例

Push message API example

============

$httpClient = new \LINE\LINEBot\HTTPClient\CurlHTTPClient('<channel access token>');
$bot = new \LINE\LINEBot($httpClient, ['channelSecret' => '<channel secret>']);

$textMessageBuilder = new \LINE\LINEBot\MessageBuilder\TextMessageBuilder('hello');
$response = $bot->pushMessage('UID', $textMessageBuilder); "

echo $response->getHTTPStatus() . ' ' . $response->getRawBody(); "

=================

程式就是這麼簡單.


安裝看上面這個 URL 的下方有寫到如何安裝這個 PHP 的 SDK

在寫 API 時會用到的資訊皆在官網上登入的頁面中可取得.
或者是透過 webhook .

其中重要的資訊如下所示: (1) (2) (3)

(1)<channel access token> 官網上登入可取得
(2) <channel secret> 官網上登入可取得
(3) UID
用這支去改
可取得


或


參考資訊


輸入Line Channel Access Token :

輸入監聽email :

產生 webhook url , 並在 API 官網上輸入亦可取得,透過 E-Mail 本文


或參考本文介紹的用 perl 建立 webhook URL


Line API

Push message


shell

Push message API example
curl -X POST \
-H 'Content-Type:application/json' \
-H 'Authorization: Bearer {ENTER_ACCESS_TOKEN}' \
-d '{
"to": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"messages":[
{
"type":"text",
"text":"Hello, world1"
},
{
"type":"text",
"text":"Hello, world2"
}
]
}' api.line.me/v2/bot/message/push









































本文開始 用 perl 建立 webhook URL

為 OS 安裝上新版的 perl


Perl Source

Perl compiles on over 100 platforms, if you want to install from a binary instead see the ports page (especially for Windows).

How to install from source

     wget http://www.cpan.org/src/5.0/perl-5.24.0.tar.gz
     tar -xzf perl-5.24.0.tar.gz
     cd perl-5.24.0
     ./Configure -des -Dprefix=$HOME/localperl
     make
     make test
     make install
Read both INSTALL and README.yoursystem in the perl-5.24.0 directory for more detailed information.


用# mv + ln –s 的方式取代OS上內建的 perl ,確保系統預設使甪的 perl 為 5.24

 系統預設的 Perl 版本為 5.10.1

# perl.old -v

This is perl, v5.10.1 (*) built for x86_64-linux-thread-multi

Copyright 1987-2009, Larry Wall

Perl may be copied only under the terms of either the Artistic License or the
GNU General Public License, which may be found in the Perl 5 source kit.

Complete documentation for Perl, including FAQ lists, should be found on
this system using "man perl" or "perldoc perl".  If you have access to the
Internet, point your browser at http://www.perl.org/, the Perl Home Page.

透過 上述 方式安裝後 perl 的版本變更為 5.24.0
#perl -v

This is perl 5, version 24, subversion 0 (v5.24.0) built for x86_64-linux

Copyright 1987-2016, Larry Wall

Perl may be copied only under the terms of either the Artistic License or the
GNU General Public License, which may be found in the Perl 5 source kit.

Complete documentation for Perl, including FAQ lists, should be found on
this system using "man perl" or "perldoc perl".  If you have access to the
Internet, point your browser at http://www.perl.org/, the Perl Home Page.
  

安裝 cpanm


cpanm: 快速輕便的 CPAN 模組安裝程式
Fri, 26 Feb 2010 22:23:23 +0100
cpanm 是個十分快速的小工具,不用任何設定,就可以開始安裝 cpan module。比起完整的 CPAN.pm Shell 而言,它有一點點不足之處,但實測幾次之後發現,那些都是比較無關痛養的部份。

安裝它
cpanm 是個單一的執行檔,只要下載下來放進 $PATH 裡就可以用:

curl -LO http://bit.ly/cpanm
chmod +x cpanm
sudo cp cpanm /usr/local/bin
使用方式
常用的使用形式如下:

cpanm Jifty
cpanm MIYAGAWA/Plack-0.99_05.tar.gz
cpanm http://backpan.perl.org/authors/id/L/LD/LDS/CGI.pm-3.20.tar.gz
cpanm ~/dists/MyCompany-Enterprise-1.00.tar.gz
參數可接模組名稱、帶版號的 Tarball 檔名、Tarball 網址、或是 Tarball 在本機上的路徑。可調整的選項有五個:

-v, --verbose : 輸出完整的資訊
-f, --force : 強制安裝。就算測試過程有錯誤也照樣安裝
-n, --notest : 不跑測試
-S, --sudo : 安裝時以 sudo 指令進行
--installdeps : 僅安裝依存的模組
這就是全部了。無論是新裝機器或是臨時要裝個 CPAN 模組,都十分的好用。



安裝 LINE::Bot::API & PLack ….

#cpanm install PLack & LINE::Bot::API…..


[root@bbb line]# cpanm install Plack
install is up to date. (0.01)
Plack is up to date. (1.0042)
[root@bbb line]#

[root@bbb bin]# cpanm  Plack
Plack is up to date. (1.0042)
[root@bbb bin]#

[root@bbb bin]#  cpanm install LINE::Bot::API
install is up to date. (0.01)
LINE::Bot::API is up to date. (1.01)
[root@bbb bin]#

[root@bbb bin]#   cpanm LINE::Bot::API
LINE::Bot::API is up to date. (1.01)
[root@bbb bin]#


Line WebHook 建立 參考 URL

關於 Plack


NAME

Plack - Perl Superglue for Web frameworks and Web Servers (PSGI toolkit)

DESCRIPTION

Plack is a set of tools for using the PSGI stack. It contains middleware components, a reference server and utilities for Web application frameworks. Plack is like Ruby's Rack or Python's Paste for WSGI.

See PSGI for the PSGI specification and PSGI::FAQ to know what PSGI and Plack are and why we need them.

如何運行 PSGI

.psgi
  plackup --host 127.0.0.1 --port 9090 /path/to/app.psgi

參考 echo.psgi 的 webhook Source Code




全抄就對了.


在  echo.psgi 該頁 的下方式有提到使用方式

    $ export CHANNEL_SECRET=YOUR CHANNEL SECRET
    $ export CHANNEL_ACCESS_TOKEN=YOUR CHANNEL ACCESS TOKEN
    $ plackup eg/echo.psgi

#plackup --host 127.0.0.1 --port 9090 echo.psgi  

比照辦理 準沒錯!




在網路上有 google 到有高手談到 ngrok 這個方式.
簡單的說透過它可以達到內網的主機,直接打通 Firewall + DNS URL,
讓外面的人直接進入內網的測試主機.進行相關測試.


# ./ngrok http 9090



設定  line webhook URL


  

Test webHook (echo bot)









































其它運用 Push Message



Push message API example

use LINE::Bot::API;
use LINE::Bot::API::Builder::SendMessage;

my $bot = LINE::Bot::API->new(
    channel_secret       => "<channel secret>",
    channel_access_token => "<channel access token>",
);

my $messages = LINE::Bot::API::Builder::SendMessage->new(
)->add_text(
    text => 'hello',
);
my $res = $bot->push_message("<to>", $messages->build);
unless ($res->is_success) {
    # error handling
    ....
}









2016年11月20日 星期日

論 logfmon 簡單的網管運用

依據 NetAdmin網管人文章

2016/5/24
用logfmon即時比對 Log 透過 gcalcli 存入線上行事曆
指令列串接 Google 日曆打造超炫全自動系統日誌
吳惠麟
URL http://netadmin.pcuser.com.tw/article_content.aspx?sn=1605130016&jump=1

這個 Idea 真的很好,但我這裡僅只試了 logfmon 這個程式.
主要拿它來做簡單的網管運用,
依據上面的文章 logfmon 這支程式是放在
http://sourceforge.net/projects/logfmon/
供人下載與安裝,但我使用之時,它是在 github 上.
https://github.com/nicm/logfmon
不過沒差,還是OK的.
看一下 logfmon 流程
http://netadmin.pcuser.com.tw/images/news/NP160513001616051315272705.png



應該跟 Swatch 的用法差不多,
https://sourceforge.net/projects/swatch/

拿它來做簡單的網路設備 log 分析應該不錯.
所以參照我之前用 Swatch 的技法,
改為 logfmon 的技法!

Swatch 的技法,請自行參閱

http://xrcd2.blogspot.tw/2012/05/cacti-xsmsapi-soap-cacti-sms.html
or
http://xrcd2.blogspot.tw/2016/01/cisco-ios-configuration-cisco-config.html

本文開始


以 CentOS 6.X Linux 為 LAB

(1) 安裝 logfmon


#git clone https://github.com/nicm/logfmon
#cd logfmon
#./autogen.sh
#./configure
#make
#make install

預設裝在哪??

[root@bbb logfmon]# whereis logfmon
logfmon: /usr/local/bin/logfmon

man 一下好了..

[root@bbb logfmon]# man logfmon
LOGFMON(8)                BSD System Manager’s Manual               LOGFMON(8)

NAME
     logfmon - log file monitoring daemon

SYNOPSIS
     logfmon [-dsv] [-f conffile] [-c cachefile] [-p pidfile]

DESCRIPTION
     The logfmon daemon monitors a set of syslog log files and matches each new entry against the rules defined in its configuration file. Each rule may be
     tested against entries from a single file, a set of files or from all files. Depending on the rule, a command may be executed or the entry may be
     ignored. All unmatched messages are batched together and mailed every 15 minutes, or whatever alternative time is specified in the configuration file.

     Messages may also be collected into contexts and piped to a command after a final message is found or a number of messages is reached. See
     logfmon.conf(5) for more details of this.

     The options are as follows:

     -c cachefile
                 Specify the cache file location. Default is /var/db/logfmon.cache.

                 This overrides any location specified in the configuration file.

     -d          Run in the foreground and log to stderr.

                 This option also causes additional debugging messages to be generated.  This option may be specified multiple times for increasing levels of
                 verbosity.

     -s          Monitor stdin.  This causes logfmon to remain in the foreground and filter log messages passed on stdin.

     -f conffile
                 Specify the configuration file location. Default is /etc/logfmon.conf.

     -p pidfile  Specify the pid file location. Default is /var/run/logfmon.pid.

                 This overrides any location specified in the configuration file.

     -v          Display the logfmon version, and exit.

FILES
     /etc/logfmon.conf     default logfmon configuration file

SEE ALSO
     syslog(3), logfmon.conf(5)

.....


這樣  logfmon 就裝好了.

(2) 設定 rsyslog

[root@bbb net]# vi /etc/rsyslog.conf
      1 # rsyslog v5 configuration file
      2
      3 # For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
      4 # If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html
      5
      6 #### MODULES ####
      7
      8 $ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
      9 $ModLoad imklog   # provides kernel logging support (previously done by rklogd)
     10 #$ModLoad immark  # provides --MARK-- message capability
     11
     12 # Provides UDP syslog reception
     13 $ModLoad imudp
     14 $UDPServerRun 514

設定 rsyslog 可以對外收 syslog message

     12 # Provides UDP syslog reception
    --> $ModLoad imudp
    --> $UDPServerRun 514

並指定收到  主機或某網段 的 syslog message 存入某一個檔案中,
預備成為  logfmon 被監控的檔案

    --> 88 if $fromhost-ip == '192.168.111.61' then  /var/log/net/vyos.log

重啟 rsyslog 服務

#service rsyslog restart


設定 192.168.111.61 (client )這台 vyos 的 config ,
宣告它的 syslog host 為 192.168.111.247 ( Rsyslog + logfmon Server )

所以 topolog 為 192.168.111.61 (client ) ---> 192.168.111.247 (Server)

Client 端只要是支援標準的 syslog 即可使用.
Server 端是透過 Rsyslog 作為 syslog server 的角色.
用其它的也可,只是 logfmon 只能用在 log 檔案的分析.


vyos 的設定如下;(模擬成網路設備,Client 端角色)

vyos@vyos:~$ show configuration commands
set interfaces ethernet eth0 address 'dhcp'
set interfaces ethernet eth0 duplex 'auto'
set interfaces ethernet eth0 smp-affinity 'auto'
set interfaces ethernet eth0 speed 'auto'
set interfaces loopback 'lo'
set service ssh port '22'
set system config-management commit-revisions '20'
set system host-name 'vyos'
set system login user vyos authentication encrypted-password '$6$wycLUv4kpl$WEywQMIvFUqIC9yA3HPb42IG0328X1iNqa1967sFWEce6oC6SrvcV3Nn2hQF1n4bTE/vyQ9e9LyF813VEx9HS.'
set system login user vyos authentication plaintext-password ''
set system login user vyos level 'admin'
set system name-server '168.95.1.1'
set system name-server '168.95.192.1'
set system ntp server 'clock.hinet.net'
set system syslog global facility all level 'notice'
set system syslog global facility protocols level 'debug'
set system syslog host 192.168.111.247 facility all level 'all'
set system time-zone 'Asia/Taipei'
vyos@vyos:~$


到目前為止,已有 Syslog Message Client + Server 也安裝好了  logfmon 了.


設定 logfmon.conf (依據 man 的說明是寫在 /etc/logfmon.conf 中),
內容依實務需求撰寫之.

# cat /etc/logfmon.conf
set logregexp "(.*)"
file "/var/log/net/vyos.log" tag login
match in  login  "(.*)(Accepted password for)(.*)"  exec  "/usr/bin/perl /root/shell/sendmail.pl \"$1\" \"$2\" \"$3\""
match in  login  "(.*)(session closed for user)(.*)"  exec  "/usr/bin/perl /root/shell/sendmail.pl \"$1\" \"$2\" \"$3\""


原始的 log 內文 如下.

Nov 18 14:00:25 vyos sshd[7071]: Accepted password for vyos from 192.168.1.115 port 50960 ssh2
Nov 18 14:01:08 vyos sshd[7071]: pam_unix(sshd:session): session closed for user vyos

參照(正規化表示法比對)

match in  login  "(.*)(Accepted password for)(.*)"
match in  login  "(.*)(session closed for user)(.*)"


exec ... sendmail .... (執行自定指令)


# cat /root/shell/sendmail.pl

#!/usr/bin/perl
use Mail::Sender;
print " \n Start \n ";
$sender = new Mail::Sender
{smtp => '192.168.1.xxx', from => 'Test-Alert@abc.com.tw'}  or die "Error in mailing : $Mail::Sender::Error\n";
$sender->MailMsg({to => 'xrcd2@abc.com.tw',subject => 'Test_Alert',msg => "My Test \n\n $ARGV[0] $ARGV[1] $ARGV[2] \n ",debug => $DEBUG,debug_level => 4});
print " \n END \n\n";
print " \n $DEBUG \n ";

DEMO

執行 logfmon

[root@bbb net]# logfmon -f /etc/logfmon.conf

驗證 logfmon 是否有被正常執行,如它無法正常被執行,
請再檢核該 conf 的設定與配置是否正確?!

[root@bbb net]# ps -ef | grep logfmon
root     19091     1  0 15:56 ?        00:00:00 logfmon -f /etc/logfmon.conf
root     19113 15664  0 15:59 pts/1    00:00:00 grep logfmon
[root@bbb net]#

rsyslog 收到 log 後會存入於此.

[root@bbb net]# pwd
/var/log/net
[root@bbb net]# ll
total 0
-rw------- 1 root root 0 Nov 18 15:58 vyos.log
[root@bbb net]#


ssh 到 vyos 做 登入與登出的以驗證 rsyslog + logfmon + sendmail

[root@bbb net]# cat  /var/log/net/vyos.log
Nov 18 16:04:01 vyos sshd[7653]: error: Could not load host key: /etc/ssh/ssh_host_ed25519_key
Nov 18 16:04:05 vyos sshd[7653]: Accepted password for vyos from 192.168.1.115 port 52045 ssh2
Nov 18 16:04:05 vyos sshd[7653]: pam_unix(sshd:session): session opened for user vyos by (uid=0)
Nov 18 16:04:34 vyos sshd[7655]: error: Received disconnect from 192.168.1.115: 0:
Nov 18 16:04:34 vyos sshd[7653]: pam_unix(sshd:session): session closed for user vyos
[root@bbb net]#


 Accepted password for   ( Mail Alert )















session closed for user  ( Mail Alert )
















Topology

運用的實例可參考如下:

圖中的 syslog2msn 即為 rsyslog + logfmon + shell (組合變化而來)


























http://xrcd2.blogspot.tw/2012/05/cacti-xsmsapi-soap-cacti-sms.html




其它更進階的運如下:

那個 Swatch 可由 logfmon 取代之,也是可由 rsyslog + swatch + shell (組合變化而來)

http://xrcd2.blogspot.tw/2016/01/cisco-ios-configuration-cisco-config.html


2016年11月15日 星期二

FortiGate Firmware Upgrade Paths

FortiGate Firmware Upgrade

有時候,它就是一版,一版升上來..

如 5.0.12 --> 5.2.8 ---> 5.4.2


在 fortios-v5.4.2-release-notes.pdf 有指出
...

Upgrade Information

Upgrading to FortiOS 5.4.2
FortiOS version 5.4.2 officially supports upgrading from version 5.4.0 and later and 5.2.8 and later.
.....

=================

另在 fortios-v5.2.8-release-notes.pdf 又指出

..

Upgrade Information


Upgrading from FortiOS 5.0.12 or later
FortiOS version 5.2.8 officially supports upgrade from version 5.0.12 or later

.....

================

其實另外亦也可以參考  Upgrade Paths 的 URL

http://cookbook.fortinet.com/sysadmins-notebook/supported-upgrade-paths-fortios/3/

照它上面是寫 應該也是 OK 的....待驗證

如 5.0.12--> 5.2.9 ---> 5.4.2




2016年11月8日 星期二

三論 SNMP OIDs


三論 SNMP OIDs

基礎入門

(1)利用SNMP OIDs 加入 Zabbix 監控
http://xrcd2.blogspot.tw/2012/10/snmp-oids-zabbix.html

(2)再論 SNMP OIDs
http://xrcd2.blogspot.tw/2012/10/snmp-oid.html

本文開始

(3)三論 SNMP OIDs


在 CheckPoint官網  DownLoad 該 MIB 以 R77 為例.
透過修改 snmpd.conf 的方式,可載入該 MIB.


[root@bbb /]# cat /etc/snmp/snmpd.conf
rocommunity public 127.0.0.1/32
MIB +/usr/share/snmp/mibs/CHECK-R77-MIB.txt
[root@bbb /]#



CHECK-R77-MIB 內文
.....

CHECKPOINT-MIB DEFINITIONS ::= BEGIN

 -- SUBTREE: 1.3.6.1.4.1.2620.1
 -- iso.org.dod.internet.private.enterprises.checkpoint.products

.....

checkpoint OBJECT IDENTIFIER ::= { enterprises 2620 }
products OBJECT IDENTIFIER ::= { checkpoint 1 }
tables      OBJECT IDENTIFIER ::= { checkpoint 500 }
fw OBJECT IDENTIFIER ::= { products 1 }

.....

fwPolicyStat  OBJECT IDENTIFIER ::= { fw 25 }

.......

fwNumConn OBJECT-TYPE
  SYNTAX  INTEGER
  ACCESS  read-only
  STATUS  mandatory
  DESCRIPTION
         "Number of connections"
  ::= { fwPolicyStat 3 }

.......


下面這個值是可以從上面的內文中看出....當然用 snmptranslate 這個最快...
但是要會找 MIB 文中的 Key Word...因為這才是根本的出處...
要不然 fwNumConn 這個東西怎麼來呢??!!

MIB OID ===> .1.3.6.1.4.1.2620.1.1.25.3.0
====> "Number of connections"


驗證

[root@bbb tmp]#  snmptranslate -m CHECKPOINT-MIB  -IR -On    fwNumConn
.1.3.6.1.4.1.2620.1.1.25.3
[root@bbb tmp]#


[root@bbb tmp]#  snmptranslate -m CHECKPOINT-MIB  -IR -Onf    fwNumConn
.iso.org.dod.internet.private.enterprises.checkpoint.products.fw.fwPolicyStat.fwNumConn
[root@bbb tmp]#


取得

[root@bbb tmp]#  snmpget -v2c -c public 192.168.xxx.xxx  .1.3.6.1.4.1.2620.1.1.25.3.0
SNMPv2-SMI::enterprises.2620.1.1.25.3.0 = Counter32: 2
[root@bbb tmp]#


那網管軟體就可以做 template 了,以 cacti 為例:





















其它參考資訊.

https://sc1.checkpoint.com/documents/R76/CP_R76_Splat_AdminGuide/51553.htm



http://www.oidview.com/mibs/2620/CHECKPOINT-MIB.html









其它 監控 






















SmartView Monitor



2016年10月26日 星期三

LogAnalyzer Delete Records

loganalyzer 真是一套不錯的 OpenSource ,
用它來收集與分析 syslog  message 最簡單實用不過了!

官網
http://loganalyzer.adiscon.com/

Demo
http://loganalyzer-demo.adiscon.com/

但這次想做的是,刪除2015年前的舊資料,參考官網上的說明如下:

http://wiki.rsyslog.com/index.php/LogAnalyzer_Delete_Records

.....


Samples

All samples assume that the data to be deleted is contained in logstream 2.

Delete all data
  php maintenance.php cleardata 2 all

Delete all data older then 1 hour
  php maintenance.php cleardata 2 olderthan 3600

Some typical values are
60 - one minute
3,600 - one hour
86400 - one day
2592000 - 30 days, roughly one month

Delete all data before 2008-11-18
  php maintenance.php cleardata 2 date 11 18 2008
....


簡單的說透過 maintenance.php 這支程式即可完成該項作業。

maintenance.php (程式內文節錄如下:)( 這裡也有 Sample )

那個 ID 可透過 WEB 介面去查詢到..


149 // --- BEGIN Custom Code
150         //Additional Includes
151         include($gl_root_path . 'include/functions_debugoutput.php');
152 
153         // Run into Commandline part now!
154         /* Only run if we are in command line mode 
155         *       
156         *       Possible Operation Types:
157         *       cleandata               =       If you want to clear data from a logstream source, you can use the operation type. 
158         *                                               Be carefull using this option, any deletion process cannot be undone!
159         *                                               Sample 1: Delete all data in the logstream with id 2
160         *                                                       php maintenance.php cleandata 2 all
161         *                                               Sample 2: Delete all data older then 60 seconds in the logstream with id 2
162         *                                                       php maintenance.php cleandata 2 olderthan 60
163         *                                               Sample 3: Delete all data before 2008-11-18 in the logstream with id 2
164         *                                                       php maintenance.php cleandata 2 date 11 18 2008 
165         *
166         */


ID 怎麼來圖解如下,官網中也有說明:





該程式放在 cron 這個目錄中.

[root@cacti cron]# pwd
/var/www/html/loganalyzer/cron

[root@cacti cron]# ls -la
total 36
drwxr-xr-x  2 root root 4096 Oct 27 11:39 .
drwxr-xr-x 14 root root 4096 Oct 27 10:35 ..
-rw-r--r--  1 root root 7551 May 17  2013 cmdreportgen.php
-rw-r--r--  1 root root   31 May 17  2013 .htaccess
-rw-r--r--  1 root root   68 May 17  2013 maintenance.bat
-rw-r--r--  1 root root 7251 May 17  2013 maintenance.php
-rw-r--r--  1 root root   89 May 17  2013 maintenance.sh
[root@cacti cron]#

實作吧~

[root@cacti cron]# php maintenance.php cleandata 1 date 1 1 2015 
Num. Facility . Debug Message
1. Information. CleanData. Cleaning data for logstream source 'My Syslog Source'.
2. Information. CleanData. Successfully connected and found '3203148' rows in the logstream source.
3. Information. CleanData. Performing deletion of data entries older then '2015-01-01'.
4. Information. CleanData. Successfully Deleted '446346' rows in the logstream source.'
[root@cacti cron]# 


再透過 mysqlcheck 指令,檢查及優化 MySQL 資料庫 ,並釋放出刪除資料後磁碟空間

[root@cacti cron]# mysqlcheck -a -c  -o -r Syslog 
Syslog.SystemEvents                                OK
Syslog.SystemEventsProperties                      OK
Syslog.logcon_charts                               OK
Syslog.logcon_config                               OK
Syslog.logcon_dbmappings                           OK
Syslog.logcon_fields                               OK
Syslog.logcon_groupmembers                         OK
Syslog.logcon_groups                               OK
Syslog.logcon_savedreports                         OK
Syslog.logcon_searches                             OK
Syslog.logcon_sources                              OK
Syslog.logcon_users                                OK
Syslog.logcon_views                                OK
[root@cacti cron]#

前後對照如下:
(前)
[root@cacti cron]# du /var/lib/mysql/* -hs 
51M /var/lib/mysql/cacti
10M /var/lib/mysql/ibdata1
5.0M /var/lib/mysql/ib_logfile0
5.0M /var/lib/mysql/ib_logfile1
1000K /var/lib/mysql/mysql
0 /var/lib/mysql/mysql.sock
656M /var/lib/mysql/Syslog
4.0K /var/lib/mysql/test

(後)
[root@cacti cron]# du /var/lib/mysql/* -hs 
51M /var/lib/mysql/cacti
10M /var/lib/mysql/ibdata1
5.0M /var/lib/mysql/ib_logfile0
5.0M /var/lib/mysql/ib_logfile1
1000K /var/lib/mysql/mysql
0 /var/lib/mysql/mysql.sock
446M /var/lib/mysql/Syslog
4.0K /var/lib/mysql/test
[root@cacti cron]#

完工

2016年10月19日 星期三

Apache 關閉 RC4 加密演算法加上也不使用 SSL v3 及 TLSv1.0

Apache 關閉 RC4 加密演算法加上
也不使用 SSL v3 及 TLSv1.0協定

考古題

昨天同事問我如何關閉 Apache RC4 加密演算法,
所以順便整理這個小筆記,供需要的人參考.


網路常用的RC4加密演算法已可快速破解,研究人員呼籲別再使用
http://www.ithome.com.tw/news/97445


Google 發現 SSL 3.0 漏洞,小心「貴賓犬」攻擊!
http://www.ithome.com.tw/news/91571

TLS加密協定竟然也不安全!企業須審慎內部漏洞
http://www.ithome.com.tw/promotion/93094

懶人包..--> 不使用不安全的加密演算法及通訊協定


#vi /etc/httpd/conf.d/ssl.conf ( Cenots 6 / httpd 2.2 預設檔案位置 )


原 SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW

使用 nmap RC4 檢測結果為

[root@bbb conf.d]# nmap --script ssl-cert,ssl-enum-ciphers -p 443  127.0.0.1 | grep RC4
|       TLS_ECDHE_RSA_WITH_RC4_128_SHA
|       TLS_RSA_WITH_RC4_128_MD5
|       TLS_RSA_WITH_RC4_128_SHA
|       TLS_ECDHE_RSA_WITH_RC4_128_SHA
|       TLS_RSA_WITH_RC4_128_MD5
|       TLS_RSA_WITH_RC4_128_SHA
|       TLS_ECDHE_RSA_WITH_RC4_128_SHA
|       TLS_RSA_WITH_RC4_128_MD5
|       TLS_RSA_WITH_RC4_128_SHA
|       TLS_ECDHE_RSA_WITH_RC4_128_SHA
|       TLS_RSA_WITH_RC4_128_MD5
|       TLS_RSA_WITH_RC4_128_SHA

中獎-->使用 RC4....

===========

改為

SSLHonorCipherOrder on
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH

再檢測即可看到: 已無 RC4 加密演算法

[root@bbb conf.d]# nmap --script ssl-cert,ssl-enum-ciphers -p 443  127.0.0.1 | grep RC4

再看一次該主機的 ssl 資訊 , 可發現有使用不安全的 SSLv3 的協定

[root@bbb conf.d]# nmap --script ssl-cert,ssl-enum-ciphers -p 443  127.0.0.1

Starting Nmap 5.51 ( http://nmap.org ) at 2016-10-19 15:48 CST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000027s latency).
PORT    STATE SERVICE
443/tcp open  https
| ssl-cert: Subject: commonName=aaa/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--
| Issuer: commonName=aaa/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--
| Public Key type: rsa
| Public Key bits: 2048
| Not valid before: 2015-04-08 02:58:19
| Not valid after:  2016-04-07 02:58:19
| MD5:   de0e fdf1 11c0 f3e4 2cc2 3b0b 8e9e 6b9a
|_SHA-1: fc10 b6c3 b1e8 695c 19f4 78a2 3e5d 58f6 6a69 a9f5
| ssl-enum-ciphers:
|   SSLv3
|     Ciphers (2)
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|     Compressors (1)
|       uncompressed
|   TLSv1.0
|     Ciphers (2)
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|     Compressors (1)
|       uncompressed
|   TLSv1.1
|     Ciphers (2)
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|     Compressors (1)
|       uncompressed
|   TLSv1.2
|     Ciphers (8)
|       TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|     Compressors (1)
|_      uncompressed

Nmap done: 1 IP address (1 host up) scanned in 0.38 seconds



但還是中獎 --> 使用 SSLv3 + TLSv1.0


==============

所以再次 vi 該檔案 ssl.conf , 將它改為下面這樣的宣告僅使用 TLS 協定方式.

#SSLProtocol all -SSLv2
SSLProtocol -all +TLSv1.1 +TLSv1.2


再次驗證,已無使用 SSLv3 及 TLSv1 ...


[root@bbb conf.d]# nmap --script ssl-cert,ssl-enum-ciphers -p 443  127.0.0.1

Starting Nmap 5.51 ( http://nmap.org ) at 2016-10-19 16:10 CST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000028s latency).
PORT    STATE SERVICE
443/tcp open  https
| ssl-cert: Subject: commonName=aaa/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--
| Issuer: commonName=aaa/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--
| Public Key type: rsa
| Public Key bits: 2048
| Not valid before: 2015-04-08 02:58:19
| Not valid after:  2016-04-07 02:58:19
| MD5:   de0e fdf1 11c0 f3e4 2cc2 3b0b 8e9e 6b9a
|_SHA-1: fc10 b6c3 b1e8 695c 19f4 78a2 3e5d 58f6 6a69 a9f5
| ssl-enum-ciphers:
|   TLSv1.1
|     Ciphers (2)
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|     Compressors (1)
|       uncompressed
|   TLSv1.2
|     Ciphers (8)
|       TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|     Compressors (1)
|_      uncompressed

Nmap done: 1 IP address (1 host up) scanned in 0.35 seconds



這樣應該好多了....可以弱點掃描或滲透測試的軟體去試看看...是否還有其它的問題???


參考資訊
https://raymii.org/s/tutorials/Strong_SSL_Security_On_Apache2.html
https://www.owasp.org/index.php/Testing_for_Weak_SSL/TLS_Ciphers,_Insufficient_Transport_Layer_Protection_(OTG-CRYPST-001)
http://serverfault.com/questions/314858/how-to-enable-tls-1-1-and-1-2-with-openssl-and-apache

外部 FQDN 檢測網站

https://www.ssllabs.com/ssltest

2016年9月8日 星期四

Kickstart for Appweb

最近想有沒有辦法可以幫 VyOS 做一個好看的 DashBoard
後來看到 http://wiki.vyos.net/wiki/Proposed_enhancements
這裡有提到一個 Web GUI的資訊.


HTML 5 /Css 3 light weight GUI -- perhaps it can be used
https://embedthis.com/blog//blog/2014/05/21/esp-10/
and Demo: https://embedthis.com/appweb/demo/

https://embedthis.com/appweb/demo/#/





重點是這個東西 kickstart ..
https://embedthis.com/appweb/kickstart.html

Licensing for Kickstart

Kickstart is licensed as an optional extra for Appweb. For more information or to evaluate Kickstart for your project,
please contact sales@embedthis.com.

這個東西是要錢的.....哈.....不過我還是有將  appweb 裝起來.

但最後我裝了 http://www.monitorix.org/ 它..反正先求有再求好...

https://embedthis.com/appweb/download.html

appweb 安裝準備:

Platform Format Image
Appweb 6 Source Code TAR appweb-6.2.2-src.tgz
To build from source, install packages, or build web sites, you will require:

MakeMe 0.10.3 or later
Pak 0.12.1 or later
Expansive 0.7.0 or later
If you wish to configure the software before building, you will need to download the MakeMe configuration build tool.

appweb 安裝實作:

root@vyos:/usr/local/src/appweb-6.2.2# ./configure
 [Configure] linux-x64-debug
     [Found] compiler: C/C++ Compiler: /usr/bin/gcc
     [Found] esp: Embedthis ESP, the amazingly fast C-Language web framework
     [Found] http: Embedthis Http Library
     [Found] lib: Library Archive Tool: /usr/bin/ar
     [Found] mbedtls: MbedTLS Support: src/mpr-mbedtls
     [Found] mdb: Embedthis MDB Database
     [Found] mpr: Embedthis Multithreaded Portable Runtime
     [Found] osdep: O/S Dependent Layer
     [Found] pcre: PCRE Library
     [Found] ssl: Secure Socket Layer Interface (MbedTLS Support)
     [Found] watchdog: Embedthis Watchdog: build/linux-x64-debug/bin/appman
    [Create] build/linux-x64-debug/platform.me
    [Create] build/linux-x64-debug/inc/me.h
    [Create] start.me
      [Info] Type "me" to build.
root@vyos:/usr/local/src/appweb-6.2.2# me
      [Copy] build/linux-x64-debug/inc/osdep.h
      [Copy] build/linux-x64-debug/inc/embedtls.h
      [Copy] build/linux-x64-debug/inc/mbedtls.h
   [Compile] build/linux-x64-debug/obj/mbedtls.o
   [Archive] build/linux-x64-debug/bin/libmbedtls.a
      [Copy] build/linux-x64-debug/inc/mpr.h
   [Compile] build/linux-x64-debug/obj/mpr-mbedtls.o
   [Archive] build/linux-x64-debug/bin/libmpr-mbedtls.a
   [Compile] build/linux-x64-debug/obj/mprLib.o
      [Link] build/linux-x64-debug/bin/libmpr.so
      [Copy] build/linux-x64-debug/inc/pcre.h
   [Compile] build/linux-x64-debug/obj/pcre.o
      [Link] build/linux-x64-debug/bin/libpcre.so
      [Copy] build/linux-x64-debug/inc/http.h
   [Compile] build/linux-x64-debug/obj/httpLib.o
      [Link] build/linux-x64-debug/bin/libhttp.so
      [Copy] build/linux-x64-debug/inc/mpr-version.h
   [Compile] build/linux-x64-debug/obj/mpr-version.o
   [Archive] build/linux-x64-debug/bin/libmpr-version.a
      [Copy] build/linux-x64-debug/inc/esp.h
   [Compile] build/linux-x64-debug/obj/espLib.o
      [Link] build/linux-x64-debug/bin/libesp.so
      [Copy] build/linux-x64-debug/inc/appweb.h
      [Copy] build/linux-x64-debug/inc/customize.h
   [Compile] build/linux-x64-debug/obj/config.o
   [Compile] build/linux-x64-debug/obj/convenience.o
   [Compile] build/linux-x64-debug/obj/rom.o
   [Compile] build/linux-x64-debug/obj/cgiHandler.o
   [Compile] build/linux-x64-debug/obj/espHandler.o
      [Link] build/linux-x64-debug/bin/libappweb.so
   [Compile] build/linux-x64-debug/obj/appweb.o
      [Link] build/linux-x64-debug/bin/appweb
   [Compile] build/linux-x64-debug/obj/authpass.o
      [Link] build/linux-x64-debug/bin/authpass
   [Compile] build/linux-x64-debug/obj/esp.o
      [Link] build/linux-x64-debug/bin/appweb-esp
      [Copy] extras => build/linux-x64-debug/bin
   [Compile] build/linux-x64-debug/obj/http.o
      [Link] build/linux-x64-debug/bin/http
      [Copy] install-certs => build/linux-x64-debug/bin
   [Compile] build/linux-x64-debug/obj/makerom.o
      [Link] build/linux-x64-debug/bin/makerom
   [Compile] build/linux-x64-debug/obj/watchdog.o
      [Link] build/linux-x64-debug/bin/appman
  [Complete] all
root@vyos:/usr/local/src/appweb-6.2.2# me install
      [Stop] Embedthis Appweb
   [Install] Embedthis Appweb
      [Copy] File sets: core,libs,web,service,esp,utils,test,dev,doc
       [Run] appman install enable start
      [Info] Embedthis Appweb installed at /usr/local/lib/appweb/6.2.2
      [Info] Configuration directory /etc/appweb
      [Info] Documents directory /var/www/appweb
      [Info] Executables directory /usr/local/lib/appweb/6.2.2/bin
      [Info] Use "man appweb" for usage
      [Info] Use appman [start|stop|restart] to control
      [Info] Browse to http://localhost
  [Complete] install
root@vyos:/usr/local/src/appweb-6.2.2#

2016年9月1日 星期四

VyOS+OpenVPN+MFA



從 雙因子認證/雙因素認證/ 到 多因子認證/多因素認證

https://en.wikipedia.org/wiki/Multi-factor_authentication

Multi-factor authentication


Multi-factor authentication (MFA) is a method of computer access control in which a user is
only granted access after successfully presenting several separate pieces of evidence to an authentication mechanism - typically at least two of the following categories: knowledge (something they know); possession (something they have), and inherence (something they are).[1][2]

Two-factor authentication (also known as 2FA) is a method of confirming a user's claimed identity
by utilizing a combination of two different components. Two-factor authentication is a type of
multi-factor authentication.



Two-Factor Authentication (2FA) / Multi-Factor Authentication (MFA)



http://www.darkreading.com/endpoint/pci-dss-32-3-things-you-need-to-know-/d/d-id/1325292


Additional multi-factor authentication.

Verizon’s 2016 Data Breach Investigations Report found that 63 percent of confirmed breaches
involved weak, default or stolen passwords.The report goes on to recommend that company’s
avoid single-factor authentication. PCI’s Leach says the trend outlined in the Verizon report
is why PCI DSS 3.2 requires that system administrators working internally who access a Cardholder
Data Environment (CDE) must utilize multi-factor authentication. He says with the threat landscape
as dangerous as it is today,single-factor authentication for local access to a CDE is no longer
acceptable. Leach adds that multi-factor authentication for remote access to a CDE has been a
part of the PCI DSS standard from the outset. Organizations have until February 1, 2018 to comply
with this new requirement.


為強化 VPN 認證機制,故需將 VyOS 上的 OpenVPN 由原 2FA 改為 MFA


預計會採 帳密 + 憑證 + OTP token 的三因子認證以符合安控需求.
在網路上已有許多人在談論及使用 google-authenticator.
它可以用在 linxu ssh login 或 sudo 或 OpenVPN 及 freeradius...等等等

google 一下應該可以看到不同的運用.

github URL 如下:

https://github.com/google/google-authenticator


但由於 最新版本的 VyOS 為 1.1.7
而 1.1.7 的 linux kernel 預設的版本為  Debian 6.0 (squeeze)

http://wiki.vyos.net/wiki/Main_Page

Get the Software
Current stable release: VyOS 1.1.7 (Helium)

Read about the versioning scheme.

Downloads: http://mirror.vyos.net/iso/release/1.1.7.


所以為了方便加裝  Debian  軟體及相關套件,
故參考 https://github.com/vyos/vyos-build/
將 VyOS build 為 Debian 8 (jessie)  kernel.


https://www.debian.org/releases/

發行版目錄

下一代 Debian 正式發行版的代號爲 stretch — 發佈時間尚未確定
Debian 8 (jessie) — 當前的穩定版
Debian 7 (wheezy) — 被淘汰的穩定版
Debian 6.0 (squeeze) — 被淘汰的穩定版

.......


VyOS build 的方式可參考

https://github.com/vyos/vyos-build/

所以我以 debian-8.5.0-amd64-netinst.iso ,裝了一台  debian 8.5 的 linux
再透過它去 build VyOS ISO..


#cd /usr/local/src
#git clone https://github.com/vyos/vyos-build.git
#cd vyos-build/
#apt-get install python-pystache
#./configure
#make iso
#cd build

root@debian:/usr/local/src/vyos-build/build# ls -la
total 276060
drwxr-sr-x  9 root staff      4096 Sep  1 22:01 .
drwxr-sr-x  8 root staff      4096 Sep  1 21:35 ..
drwxr-sr-x  2 root staff      4096 Sep  1 21:36 auto
drwxr-sr-x  5 root staff      4096 Sep  1 22:01 binary
drwxr-sr-x  2 root staff      4096 Sep  1 22:01 .build
-rw-r--r--  1 root staff       326 Sep  1 21:36 build-config.json
-rw-r--r--  1 root staff    351053 Sep  1 22:01 build.log
drwxr-sr-x  7 root staff      4096 Sep  1 21:44 cache
drwxr-xr-x 22 root root       4096 Sep  1 22:01 chroot
-rw-r--r--  1 root staff   3797140 Sep  1 21:55 chroot.files
-rw-r--r--  1 root staff     16634 Sep  1 21:55 chroot.packages.install
-rw-r--r--  1 root staff     16679 Sep  1 21:55 chroot.packages.live
drwxr-sr-x 18 root staff      4096 Sep  1 21:36 config
-rw-r--r--  1 root staff       483 Sep  1 22:01 live-image-amd64.contents
-rw-r--r--  1 root staff   3797140 Sep  1 21:59 live-image-amd64.files
-rw-r--r--  1 root root  273678336 Sep  1 22:01 live-image-amd64.hybrid.iso
-rw-r--r--  1 root root     935650 Sep  1 22:01 live-image-amd64.hybrid.iso.zsync
-rw-r--r--  1 root staff     16679 Sep  1 21:59 live-image-amd64.packages
drwxr-sr-x  3 root staff      4096 Sep  1 21:36 local
-rw-r--r--  1 root staff        17 Sep  1 21:36 version
lrwxrwxrwx  1 root staff        27 Sep  1 22:01 vyos-999.201609012136-amd64.iso -> live-image-amd64.hybrid.iso
root@debian:/usr/local/src/vyos-build/build# 



在 IOS 檔 完成後,再拿它來裝 VyOS ...





然後就可以新增 sources.list 去裝一些有沒的...


root@vyos:~# cat /etc/debian_version
8.5
root@vyos:~# uname -r -a
Linux vyos 4.4.5-amd64-vyos #1 SMP Fri Mar 11 06:56:45 EST 2016 x86_64 GNU/Linux
root@vyos:~#



root@vyos:/etc/apt# pwd
/etc/apt
root@vyos:/etc/apt# cat sources.list
#deb http://dl.google.com/linux/deb/ stable non-free
deb http://ftp.tw.debian.org/debian stable main contrib non-free
root@vyos:/etc/apt#

root@vyos:/etc/apt# apt-get update


root@vyos:/etc/apt# apt-get install libpam-google-authenticator
Reading package lists... Done
Building dependency tree    
Reading state information... Done
The following extra packages will be installed:
  libqrencode3
The following NEW packages will be installed:
  libpam-google-authenticator libqrencode3
0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.
Need to get 65.8 kB of archives.
After this operation, 216 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
Get:1 http://ftp.tw.debian.org/debian/ stable/main libqrencode3 amd64 3.4.3-1 [33.8 kB]
Get:2 http://ftp.tw.debian.org/debian/ stable/main libpam-google-authenticator amd64 20130529-2 [32.1 kB]
Fetched 65.8 kB in 0s (292 kB/s)                    
debconf: delaying package configuration, since apt-utils is not installed
Selecting previously unselected package libqrencode3:amd64.
(Reading database ... 48920 files and directories currently installed.)
Preparing to unpack .../libqrencode3_3.4.3-1_amd64.deb ...
Unpacking libqrencode3:amd64 (3.4.3-1) ...
Selecting previously unselected package libpam-google-authenticator.
Preparing to unpack .../libpam-google-authenticator_20130529-2_amd64.deb ...
Unpacking libpam-google-authenticator (20130529-2) ...
Setting up libqrencode3:amd64 (3.4.3-1) ...
Setting up libpam-google-authenticator (20130529-2) ...
Processing triggers for libc-bin (2.19-18+deb8u4) ...
root@vyos:/etc/apt#


這樣就可以用 VyOS + OpenVPN + MFA 了..

 MFA (帳密 + 憑證 + OTP token)

================


需配合在手機上先安裝該 APP:

APP名稱為 : Google Authenticator 可以在 google 商店內 Search 到它.

URL https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=zh_TW

待 VOS 完成後, 會再補上一個 QR供使用者 掃描, 透過手機上的 google authenticator app 讀取 QR Code 即會產出該 Token.
那個數字即為 VPN OTP 的 Token 了 !

往後 VPN的密碼已異動為A B part的型態.
A 即為系統密碼,
B則為 Token ,
 連在一起則為VPN的完整密碼.如下圖示!





===================

憑證制作

root@vyos:/usr/share/easy-rsa# pwd
/usr/share/easy-rsa
root@vyos:/usr/share/easy-rsa# ls -la
total 55
drwxr-xr-x 2 root root   406 Sep  2 09:54 .
drwxr-xr-x 1 root root  4096 Sep  2 10:45 ..
-rwxr-xr-x 1 root root   119 Jan  7  2014 build-ca
-rwxr-xr-x 1 root root   352 Jan  7  2014 build-dh
-rwxr-xr-x 1 root root   188 Jan  7  2014 build-inter
-rwxr-xr-x 1 root root   163 Jan  7  2014 build-key
-rwxr-xr-x 1 root root   157 Jan  7  2014 build-key-pass
-rwxr-xr-x 1 root root   249 Jan  7  2014 build-key-pkcs12
-rwxr-xr-x 1 root root   268 Jan  7  2014 build-key-server
-rwxr-xr-x 1 root root   213 Jan  7  2014 build-req
-rwxr-xr-x 1 root root   158 Jan  7  2014 build-req-pass
-rwxr-xr-x 1 root root   449 Jan  7  2014 clean-all
-rwxr-xr-x 1 root root  1471 Jan  7  2014 inherit-inter
-rwxr-xr-x 1 root root   302 Jan  7  2014 list-crl
-rw-r--r-- 1 root root  7859 Jan  7  2014 openssl-0.9.6.cnf
-rw-r--r-- 1 root root  8416 Jan  7  2014 openssl-0.9.8.cnf
-rw-r--r-- 1 root root  8313 Jan  7  2014 openssl-1.0.0.cnf
-rwxr-xr-x 1 root root 13246 Jan  7  2014 pkitool
-rwxr-xr-x 1 root root  1035 Jan  7  2014 revoke-full
-rwxr-xr-x 1 root root   178 Jan  7  2014 sign-req
-rw-r--r-- 1 root root  2077 Jan  7  2014 vars
-rwxr-xr-x 1 root root   740 Jan  7  2014 whichopensslcnf
root@vyos:/usr/share/easy-rsa#


其它參考資訊


http://xrcd2.blogspot.tw/2016/01/cisco-radius-otp.html

http://xrcd2.blogspot.tw/2015/03/vyos-openvpn-plugin-otp-sop.html

VyOS ( fork of Vyatta Core )

https://en.wikipedia.org/wiki/Vyatta

https://en.wikipedia.org/wiki/VyOS

http://wiki.vyos.net/wiki/Main_Page

https:///vyos.io





2016年8月5日 星期五

Server 被掛馬用 Splunk 分析

Server 被掛馬用 Splunk 分析

因為系統漏洞導致 Server 被掛馬.利用的手法為 web-shells
可參考如下 blog
http://securitydisclosures.blogspot.tw/2013/07/web-shells_28.html

操控手法 ".jsp?cmd=" Apache Log 關鍵字

Splunk 的運用實例如下:



















2016年7月17日 星期日

再論 Graylog2

在 Log 的 Search 的運用套件最常看到的組合有
Elasticsearch Logstash Kibana (ELK)
但另一個組合也不錯,那就是 Elasticsearch + Graylog2
可使用 yum 一路裝到底.
目前 Elasticsearch + Graylog2 亦有二種組合.
一為  Elasticsearch (1.7.x)  +   Graylog (1.2.x)

elasticsearch-1.7.5-1.noarch + graylog-web-1.2.2-1.noarch +  graylog-server-1.2.2-1.noarch

另一組則為

 Elasticsearch (2.x)  +   Graylog (2.x)

elasticsearch-2.3.4-1.noarch+graylog-server-2.1.0-2.alpha.2.noarch
DB 同樣是使用 mongodb 3.x

Graylog
https://www.graylog.org/

Elasticsearch
https://www.elastic.co/


Graylog 可以啟動 syslogd 的服務.配合 Elasticsearch,就是一個類 Splunk 的功能.

安裝的參考 URL

http://www.itzgeek.com/how-tos/linux/centos-how-tos/how-to-install-graylog2-on-centos-7-rhel-7.html#axzz3hLHT1k83

graylog 1.x + Elasticsearch 1.7.x

http://www.systeen.com/2016/05/12/install-graylog-2-0-centos-7-collect-windows-logs/

graylog 2.x + Elasticsearch 2.x

如以 CentOS 7 改以 root 身份去啟動  graylog  可

vi /usr/lib/systemd/system/graylog-server.service

(將user & group 由 graylog 改為 root)