Google Search

Google

What is the most suitable distro to use as a server?

Visit Us!

Google Groups
Kuantan Linux User Group
Visit this group

Threat Resource Center | Trend Micro

Monday, October 19, 2009

CPU / Memory

1. HPUX

2. AIX

3. Solaris

4. Linux

5. Tru64



HPUX

How to check CPU/Memory usage



# glance OR top OR vmstat OR iostat OR sar

## to check CPU/Memory utilisation



· Find large processes which currently filled up the CPU/Memory usage.




AIX

How to check CPU/Memory usage:



# sar OR vmstat OR iostat OR topas ## to check CPU/Memory utilisation



· Find large processes which currently filled up the CPU/Memory usage.




SOLARIS

How to check CPU/Memory usage:



# sar OR vmstat OR iostat ## to check CPU/Memory utilisation



· Find large processes which currently filled up the CPU/Memory usage.




LINUX

How to check CPU/Memory usage:



# sar OR vmstat OR iostat OR top ## to check CPU/Memory utilisation



· Find large processes which currently filled up the CPU/Memory usage.




TRU64



How to check CPU/Memory usage:



# vmstat OR iostat OR top ## to check CPU/Memory utilisation



· Find large processes which currently filled up the CPU/Memory usage.




HPUX

How to check disk space: (using /var as example)



# bdf /var ## to check disk utilisation for /var filesystem

# find /var -xdev -type f -size +5000000c -exec ls -l {} \; | sort -nk 5 ## to find larger files in /var




AIX, SOLARIS, LINUX, TRU64



How to check disk space:



# df -k /var ## to check disk utilisation for /var filesystem

# find /var -xdev -type f -size +5000000c -exec ls -l {} \; | sort -nk 5 ## to find larger files in /var






HPUX/AIX/SOLARIS/LINUX/TRU64

Pre-checking before reboot




Capture the system details

# bdf > /tmp/bdf.txt ## For HPUX

OR

# df –k > /tmp/df.txt ## For other OS

# netstat –in > /tmp/netstat.in.txt

# netstat –rn > /tmp/netstat.rn.txt

# lanscan > /tmp/lanscan.txt ## For HPUX

# ioscan –fn > /tmp/ioscan.txt ## For HPUX

# ps –ef | grep –i sap ## Double confirm no SAP running

# ps –ef | grep –I oracle ## Double confirm no Database running





How to reboot server

# shutdown [-option] [ +Time [ Message ] ] ## man shutdown to find more the option






Account Creation

# finger

OR

# grep –i <> /etc/passwd



HPUX/AIX/SOLARIS/LINUX/TRU64



# useradd –c -g -m –d -s id

## man useradd for more the option





AIX



# mkuser ## man mkuser for more the option





Account Mod

Do initial checking on the account



# finger

OR

# grep –i <> /etc/passwd



HPUX/SOLARIS/LINUX/TRU64




# usermod ## man usermod for more the option



AIX



# chuser ## man chuser for more the option





Account Deletion

Do initial checking on the account



# finger

OR

# grep –i <> /etc/passwd

HPUX/SOLARIS/LINUX/TRU64



# userdel –r ## man userdel for more the option



AIX



# rmuser ## man rmuser for more the option






Generic Process to add printer

1) Confirm details provided (such as printer queue name, IP address and model).

2) Perform initial checking:-



# ping ## Ping new printer IP address

# lpstat –o ## Verify if printer queue used up


Issue following command to create print queue.

# hppi or sam ## HP UX

# smitty ## IBM





Generic Process to modify printer:

1) Confirm details provided (such as printer queue name, IP address and model).

2) Perform initial checking:-



HPUX

# ping ## Ping new and old printer IP address

# lpstat –o ## Verify printer queue

# grep –i model /etc/lp/interface ## Check printer model

# grep –i periph /etc/lp/interface ## Check printer IP

# grep –i /etc/hosts ## Check printer IP

IBM

# Smitty


Issue following command to modify printer queue IP or model. Printer modify can be do anytime.



HPUX

# vi /etc/lp/interface ## Change network printer IP only



**To modify printer model, remove old print queue and recreate with new model.

**If print queue are remote printer, remove old print queue and recreate with new IP or model.



IBM

**Remove old print queue and recreate with new IP or model





Generic Process to delete printer:

1) Confirm details provided (such as printer queue name, IP address and model).

2) Perform initial checking:-



HPUX/IBM/SUN SOLARIS/Linus/Tru64

# ping ## Ping new and old printer IP address

# lpstat –o ## Verify printer queue



Issue following command to delete printer queue IP or model.



HPUX

# hppi or sam



IBM

# smitty

Thursday, June 4, 2009

Using nmap for Linux administration and security

This articles is taken from here

In this tip we are going to learn about nmap, an open source network scanner that is ideal for network troubleshooting, scanning, and auditing. The tool can be used to identify devices on the network as well as the services running on the particular devices. Additionally, advanced information such as operating systems in use, particular services (name and version), and network filters and firewalls can be identified.

The identification of services with nmap is achieved through its fingerprint database that currently contains 5,000+ fingerprints. This database is supported by the community by allowing submission of known fingerprints.


Nmap as an inventory tool
One of the common applications of nmap is to generate basic inventory reports. This is useful for network maps, renewal of maintenance agreements on network devices and nodes, and to identify rogue, unauthorized, or forgotten devices.
The basic scan for an inventory makes use of a ping scan. For example, the following scan shows the host available on the 192.168.1.0/24 network. The -sP tells nmap to do a ping scan, and the -n says to not do name resolution.

nmap -sP -n 192.168.1.0/24
Starting Nmap 4.76 (http://nmap.org) at 2009-05-14 10:18 CDT
Host 192.168.1.1 appears to be up.
MAC Address: 00:18:3A:A4:43:BA (Westell Technologies)
Host 192.168.1.2 appears to be up.
Host 192.168.1.3 appears to be up.
MAC Address: 00:17:EE:01:95:19 (Motorola CHS)
Host 192.168.1.4 appears to be up.
MAC Address: 00:16:CB:A3:27:E4 (Apple Computer)
Host 192.168.1.5 appears to be up.
MAC Address: 00:1E:52:7D:84:7E (Apple)
Nmap done: 256 IP addresses (5 hosts up) scanned in 2.17 seconds

This ping scan is quite useful for building inventories quickly. It can also be the building blocks of more sophisticated scripts and programs to validate adds and changes to the network. For example, the following command reports the new host (192.168.1.5) on the network from two daily scans output to text files:

diff monday.scan tuesday.scan | grep "> Host"
> Host 192.168.1.5 appears to be up.


Host-specific inventory
To look at a particular host to determine services running, you can use nmap. For example, let's take a closer look at the 192.168.1.5 that appears to have been turned up sometime after the Monday scan but before the Tuesday scan:

nmap -n 192.168.1.5
Starting Nmap 4.76 ( http://nmap.org ) at 2009-05-14 12:44 CDT
Interesting ports on 192.168.1.5:
Not shown: 984 closed ports
PORT STATE SERVICE
22/tcp open ssh
88/tcp open kerberos-sec
111/tcp open rpcbind
139/tcp open netbios-ssn
445/tcp open microsoft-ds
515/tcp open printer
548/tcp open afp
631/tcp open ipp
1021/tcp open unknown
1022/tcp open unknown
1023/tcp open netvenuechat
2049/tcp open nfs
3300/tcp open unknown
5900/tcp open vnc
20221/tcp open unknown
20222/tcp open unknown
MAC Address: 00:16:CB:A3:27:E4 (Apple Computer)
Nmap done: 1 IP address (1 host up) scanned in 10.46 seconds
It appears to be a Unix based system based upon ssh, but the identification of the MAC address makes the system most likely an Apple Mac computer. But, a closer look using nmap's service and version detection, more information can be gleaned. The -sV parameter is used for this:

mb3:~ root# nmap -n -sV 192.168.1.5
Starting Nmap 4.76 ( http://nmap.org ) at 2009-05-14 12:47 CDT
Interesting ports on 192.168.1.5:
Not shown: 984 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 5.1 (protocol 1.99)
88/tcp open kerberos-sec Mac OS X kerberos-sec
111/tcp open rpcbind
139/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
515/tcp open printer
548/tcp open afp?
631/tcp open ipp CUPS 1.3
1021/tcp open rpcbind
1022/tcp open rpcbind
1023/tcp open rpcbind
2049/tcp open rpcbind
3300/tcp open unknown?
5900/tcp open vnc VNC (protocol 3.8)
20221/tcp open unknown?
20222/tcp open unknown?
1 service unrecognized despite returning data.
If you know the service/version, please submit the following fingerprint
at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
SF-Port548-TCP:V=4.76%I=7%D=5/14%Time=4A0C5929%P=i386-apple-darwin9.4.0%r(
SF:SSLSessionReq,172,"\x01\x03\0\0Q\xec\xff\xff\0\0\x01b\0\0\0\0\0\x18\0\"
AD9
SF:6FA5112ED039C\0\x04mini");
MAC Address: 00:16:CB:A3:27:E4 (Apple Computer)
Service Info: OS: Mac OS X
Host script results:
| Discover OS Version over NetBIOS and SMB: Unix
|_ Discover system time over SMB: 2009-05-14 12:49:02 UTC-5
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 119.68 seconds

Now the administrator knows that it is Mac OS X, and that it is being used for Windows file sharing using Samba, that it is most likely sharing printers via CUPS, and that the system is configured for remote management with virtual network computing (VNC).


Using nmap for security
While nmap is quite useful for administrators as shown above, it is also quite powerful for security audits. For example, many companies do not allow Web servers to be run on user networks (i.e. networks where user computers and laptops are connected). nmap can easily be used to identify all the systems with Web services running on the well known ports of 80 and 443 with:

nmap -n -p 80,443 192.168.1.0/24 | egrep "ports|open"
Interesting ports on 192.168.1.1:
80/tcp open http
443/tcp open https
Interesting ports on 192.168.1.2:
Interesting ports on 192.168.1.3:
Interesting ports on 192.168.1.4:
Interesting ports on 192.168.1.5:

Another useful feature is identifying particular versions to determine if systems are vulnerable to an announced vulnerability. For example, let's assume the Samba team has announced a security issue with a particular version of Samba, and you need to identify all your Samba versions. The following reports the Samba versions:

nmap -n -sV -p 139 192.168.1.0/24 | egrep "ports|139"
Interesting ports on 192.168.1.1:
139/tcp closed netbios-ssn
Interesting ports on 192.168.1.2:
139/tcp closed netbios-ssn
Interesting ports on 192.168.1.3:
139/tcp filtered netbios-ssn
Interesting ports on 192.168.1.4:
139/tcp open netbios-ssn Samba smbd 3.2 (workgroup: HQ)
Interesting ports on 192.168.1.5:
139/tcp open netbios-ssn Samba smbd 2.1 (workgroup: REMOTE)
Interesting ports on 192.168.1.15:
139/tcp open netbios-ssn Samba smbd 3.2 (workgroup: WORKGROUP)

This tip has shown how nmap can be used for network inventory scans (-sP), more thorough inventory and auditing, and security scans to identify unauthorized services as well as assist in security vulnerability assessments. nmap is a good tool to have readily available...combine it with grep or egrep and it becomes a powerful reporting tool.

How to check Ubuntu version

There are a few command to check the Ubuntu version. See below.

Command : lsb_release -a
root@ubuntu:~# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 8.10
Release: 8.10
Codename: intrepid

Command : cat /etc/issue
root@ubuntu:~# cat /etc/issue
Ubuntu 8.10 \n \l

Command : cat /etc/lsb-release
root@ubuntu:~# cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=8.10
DISTRIB_CODENAME=intrepid
DISTRIB_DESCRIPTION="Ubuntu 8.10"

Command : cat /etc/apt/sources.list
root@ubuntu:~# cat /etc/apt/sources.list
#
# deb cdrom:[Ubuntu-Server 8.10 _Intrepid Ibex_ - Release amd64 (20081028.1)]/ intrepid main restricted

#deb cdrom:[Ubuntu-Server 8.10 _Intrepid Ibex_ - Release amd64 (20081028.1)]/ intrepid main restricted
# See http://help.ubuntu.com/community/UpgradeNotes for how to upgrade to
# newer versions of the distribution.

deb http://my.archive.ubuntu.com/ubuntu/ intrepid main restricted
deb-src http://my.archive.ubuntu.com/ubuntu/ intrepid main restricted

## Major bug fix updates produced after the final release of the
## distribution.
deb http://my.archive.ubuntu.com/ubuntu/ intrepid-updates main restricted
deb-src http://my.archive.ubuntu.com/ubuntu/ intrepid-updates main restricted

## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team. Also, please note that software in universe WILL NOT receive any
## review or updates from the Ubuntu security team.
deb http://my.archive.ubuntu.com/ubuntu/ intrepid universe
deb-src http://my.archive.ubuntu.com/ubuntu/ intrepid universe
deb http://my.archive.ubuntu.com/ubuntu/ intrepid-updates universe
deb-src http://my.archive.ubuntu.com/ubuntu/ intrepid-updates universe

## OpenNMS
deb http://debian.opennms.org stable main
deb-src http://debian.opennms.org stable main

## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team, and may not be under a free licence. Please satisfy yourself as to
## your rights to use the software. Also, please note that software in
## multiverse WILL NOT receive any review or updates from the Ubuntu
## security team.
deb http://my.archive.ubuntu.com/ubuntu/ intrepid multiverse
deb-src http://my.archive.ubuntu.com/ubuntu/ intrepid multiverse
deb http://my.archive.ubuntu.com/ubuntu/ intrepid-updates multiverse
deb-src http://my.archive.ubuntu.com/ubuntu/ intrepid-updates multiverse

## Uncomment the following two lines to add software from the 'backports'
## repository.
## N.B. software from this repository may not have been tested as
## extensively as that contained in the main release, although it includes
## newer versions of some applications which may provide useful features.
## Also, please note that software in backports WILL NOT receive any review
## or updates from the Ubuntu security team.
# deb http://my.archive.ubuntu.com/ubuntu/ intrepid-backports main restricted universe multiverse
# deb-src http://my.archive.ubuntu.com/ubuntu/ intrepid-backports main restricted universe multiverse

## Uncomment the following two lines to add software from Canonical's
## 'partner' repository. This software is not part of Ubuntu, but is
## offered by Canonical and the respective vendors as a service to Ubuntu
## users.
# deb http://archive.canonical.com/ubuntu intrepid partner
# deb-src http://archive.canonical.com/ubuntu intrepid partner

# Line commented out by installer because it failed to verify:
#deb http://security.ubuntu.com/ubuntu intrepid-security main restricted
# Line commented out by installer because it failed to verify:
#deb-src http://security.ubuntu.com/ubuntu intrepid-security main restricted
# Line commented out by installer because it failed to verify:
#deb http://security.ubuntu.com/ubuntu intrepid-security universe
# Line commented out by installer because it failed to verify:
#deb-src http://security.ubuntu.com/ubuntu intrepid-security universe
# Line commented out by installer because it failed to verify:
#deb http://security.ubuntu.com/ubuntu intrepid-security multiverse
# Line commented out by installer because it failed to verify:
#deb-src http://security.ubuntu.com/ubuntu intrepid-security multiverse

Installing nmap in Ubuntu

I want to using nmap in my Ubuntu server but I found that nmap is not installed yet.
root@ubuntu:~# nmap
The program 'nmap' is currently not installed. You can install it by typing:

So, to install nmap just type the below command. It is extremely simple and easy :)
type this command : apt-get install nmap
-bash: nmap: command not found
root@ubuntu:~# apt-get install nmap
** nmap will be installed and the below process will be shown
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
nmap
0 upgraded, 1 newly installed, 0 to remove and 46 not upgraded.
Need to get 1080kB of archives.
After this operation, 3789kB of additional disk space will be used.
Get:1 http://my.archive.ubuntu.com intrepid/main nmap 4.62-1ubuntu1 [1080kB]
Fetched 1080kB in 20s (52.4kB/s)
Selecting previously deselected package nmap.
(Reading database ... 53517 files and directories currently installed.)
Unpacking nmap (from .../nmap_4.62-1ubuntu1_amd64.deb) ...
Processing triggers for man-db ...
Setting up nmap (4.62-1ubuntu1) ...

taddaaaaaaa...!!!! Nmap is installed..Yeaaaaa
root@ubuntu:~# nmap
Nmap 4.62 ( http://nmap.org )
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
Can pass hostnames, IP addresses, networks, etc.
Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
-iL : Input from list of hosts/networks
-iR : Choose random targets
--exclude : Exclude hosts/networks
--excludefile : Exclude list from file
HOST DISCOVERY:
-sL: List Scan - simply list targets to scan
-sP: Ping Scan - go no further than determining if host is online
-PN: Treat all hosts as online -- skip host discovery
-PS/PA/PU [portlist]: TCP SYN/ACK or UDP discovery to given ports
-PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
-PO [protocol list]: IP Protocol Ping
-n/-R: Never do DNS resolution/Always resolve [default: sometimes]
--dns-servers : Specify custom DNS servers
--system-dns: Use OS's DNS resolver
SCAN TECHNIQUES:
-sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
-sU: UDP Scan
-sN/sF/sX: TCP Null, FIN, and Xmas scans
--scanflags : Customize TCP scan flags
-sI : Idle scan
-sO: IP protocol scan
-b : FTP bounce scan
--traceroute: Trace hop path to each host
--reason: Display the reason a port is in a particular state
PORT SPECIFICATION AND SCAN ORDER:
-p : Only scan specified ports
Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080
-F: Fast mode - Scan fewer ports than the default scan
-r: Scan ports consecutively - don't randomize
--top-ports : Scan most common ports
--port-ratio : Scan ports more common than
SERVICE/VERSION DETECTION:
-sV: Probe open ports to determine service/version info
--version-intensity : Set from 0 (light) to 9 (try all probes)
--version-light: Limit to most likely probes (intensity 2)
--version-all: Try every single probe (intensity 9)
--version-trace: Show detailed version scan activity (for debugging)
SCRIPT SCAN:
-sC: equivalent to --script=safe,intrusive
--script=: is a comma separated list of
directories, script-files or script-categories
--script-args=: provide arguments to scripts
--script-trace: Show all data sent and received
--script-updatedb: Update the script database.
OS DETECTION:
-O: Enable OS detection
--osscan-limit: Limit OS detection to promising targets
--osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
Options which take

Monday, May 25, 2009

INVITATION TO PARTICIPATE IN MSC MALAYSIA OPEN SOURCE CONFERENCE 2009

Date: 31 May - 3 June, 2009
Venue: Berjaya Times Square Hotel & Convention Center, Kuala Lumpur.

MSC Malaysia's inaugural and full-fledged Open Source Conference to incorporate a "Quadruple play" of 4 crucial stakeholders consisting of government, businesses, developers and community in envisioning open source's contribution to the IT industry and socio-economy.

Positioned as International forum for sharing and exchanging ideas on technical advancements, applications, development and business cases on open source, and its positive impact in meeting challenges of the current economic climate.

Organised by MSC Malaysia in cooperation with the Malaysian Administrative Modernisation and Management Planning Unit (MAMPU), the annual MSC Malaysia OSCONF is also supported by the Malaysian Open Source community. This event complements the annual Malaysian Government Open Source Software Conference (MyGOSSCON) as the premier platform for all things Open Source in Malaysia.

With 3 DAYS, 3 TRACKS, 1 HACKATHON are in store for everyone who attend this conference. In addition, we have renowned speakers from prime Open Source Enterprises which are Mozilla, Google and Red Hat to name a few and also not forgeting from the developer community - Ubuntu, BSD, Fedora, PHPs, etc

Come join us at the MSC Malaysia Open Source Conference 2009! You'll be pleasantly surprised...

Who should attend?
  • Business executives from MSC Malaysia and Non-MSC Malaysia Status companies
  • Open Source developers, communities, inventors, evangelist, researchers, strategist
  • Government officers
  • Students, general public
Why you should attend?
  1. Provide exposure and knowledge on the importance of Open Source in enhancing competitiveness by giving freedom of choice in software usage with lower total cost of ownership, hence benefiting businesses and society at large. Over 30 session tracks are made available.
  2. Share amongst the open source community on new directions and latest innovations by the subject matter experts, thought leaders and industry gurus.
  3. Provide a platform for conference participants to actively interact, share and exchange views, ideas, and tools on the latest trends and issues of Open Source.
  4. Networking, learning and having great fun! Click here for more details


REGISTER NOW!!!

Linux News Of The Day!

Powered By
widgetmate.com
Sponsored By
Credit Card Forum

Open Source Newsreel

Loading...