XAMPP: Error 1! Couldn't start Apache!

Oppsss, I got this error message when I tried to edit the SSL certificate in XAMPP on my application server. Honestly, it makes me panic! Know what, I can't running the Apache services. When I tried to run the command it shows an error like this

[root@pknp ~]# /opt/lampp/lampp start
Starting XAMPP for Linux 1.5.3a...
XAMPP: Starting Apache with SSL (and PHP5)...
XAMPP: Error 1! Couldn't start Apache!
XAMPP: Starting diagnose...
XAMPP: Sorry, I've no idea what's going wrong.
XAMPP: Please contact our forum http://www.apachefriends.org/f/

I'm searching on the Internet and exactly I've found it from XAMPP website. It said that I need to type the below command:

[root@mybox ~]#tail -2 /opt/lampp/logs/error_log and then it shows what is the type of error

[root@pknp ~]# tail -2 /opt/lampp/logs/error_log
[Sun Oct 07 10:11:52 2007] [error] Unable to configure RSA server private key
[Sun Oct 07 10:11:52 2007] [error] SSL Library Error: 185073780 error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch

As I expect earlier, it is caused by the SSL editing. I didn't know how this thing happen. 
Maybe there is some misconfigration or the XAMPP version compatibility. When i write this post, I'm using XAMPP for Linux 1.5.3a while the new version is available, XAMPP Linux 1.6.3b. After a few attempt to start the Apache in XAMPP is fail, I was thinking how stupid am I not backup the original certificates files. Now the things come worst. But, I was thinking, Hey, I've got another server (database) that also using XAMPP. Why not I copy that certificate file in that server and replace it back to the original state of my application server.
Fortunately, I still didn't make any configuration to that database server. So, I just copy the files (server.crt and server.key) and replace it to on my application server. 
The I tried to restart the XAMPP back and YESSS!!!! It back on track again. So, the moral is, please BACKUP your original file first before you are going to edit it. 
If not, then it will become a nightmare for you. :-P 





 

Create A Self-signed SSL Certificate in XAMPP

I have added a plugins for my webmail (Squirrelmail). 
It is Secure Login plugins. 
This plugins enables a secure HTTPS/SSL-encrypted connection
for my SquirrelMail login page. So, it can secure my email access. 
As I'm using Apache in XAMPP, the generated SSL certificate are using the default setting.
When I view the certificate, it show's a default XAMPP Apache setting like below :


Issued To
Common Name (CN)           localhost
Organization (O)               Apache Friends
Organization Unit (OU)      
Serial Number                   00

Issued By
Common Name (CN)           localhost
Organization (O)               Apache Friends
Organization Unit (OU)     


So, to create my own self-signed SSL certificate, I need to edit the certain file make a few tuning. So that, the certificate will be no longer using a default XAMPP setting.

1. Open a terminal/console at local or do it remotely through SSH access


2. The first thing that need to do is, create a RSA Private Key by using the below command.

[root@mybox ~]#openssl genrsa -des3 -out server.key 1024

Generating RSA private key, 1024 bit long modulus
.........................................................++++++
........++++++
e is 65537 (0x10001)
Enter PEM pass phrase: enter the desired pass phrase
Verifying password - Enter PEM pass phrase: same as a above


3. The next step is to create a Certificate Signing Request (CSR). CSR is a message sent from an applicant to a certificate authority in order to apply for a digital identity certificate. User will be prompt to enter an information that related to CSR certificate. To create a CSR, enter the below command.

[root@mybox ~]#openssl req -new -key server.key -out server.csr

Country Name (2 letter code) [GB]:type your 2 letter country code
State or Province Name (full name) [Berkshire]:type your state or province name
Locality Name (eg, city) [Newbury]:type your city name
Organization Name (eg, company) [My Company Ltd]:type your company name
Organizational Unit Name (eg, section) []:type your department
Common Name (eg, your name or your server's hostname) []:type your server hostname
Email Address []:type your email address
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:type your password
An optional company name []:type your company name


4. The next step is to remove the passphrase key. It is because if you enable the passphrase, Apache will ask for the pass-phrase each time the web server is started. It will be a problem if the server is restarted as the user always need to type the passphrase. The below command will remove the passphrase.

[root@mybox ~]#cp server.key server.key.org
[root@mybox ~]#openssl rsa -in server.key.org -out server.key


5. To generating a Self-Signed Certificate, enter the below command. As this certificate is not verified by Certificate Authority such as Thawte or Verisign, your browser will notice an error inform you that the signing certificate authority is unknown and not trusted. Bear in mind that this is self-signed certificate. So, you should ignore that error message.

[root@mybox ~]#openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt


6. Installing the Private Key and Certificate is simple. All you need to do is to know where are your XAMPP Apache directory. I assume that, we are using the default XAMPP directory, /opt/lampp. So, copy the two below files, ssl.crt and ssl.key to the XAMPP directory.

[root@mybox ~]#cp server.crt /opt/lampp/etc/ssl.crt
[root@mybox ~]#cp server.key /opt/lampp/etc/ssl.key/server.key

When you are being asked to overwritten the file, just type yes and hit Enter.


7. Restart Apache and test to access your site. Check the certificate and make sure the information that you have insert is correct.


8. Finish! Your configuration is done. Good luck :-)

Linux Intrusion Discovery

THIS GUIDE IS TAKEN FROM SANS INSTITUTE

Purpose
System Administrators are often on the front lines of computer security. This guide aims to support System Administrators in finding indications of a system compromise.

What to use this sheet for
On a periodic basis (daily, weekly, or each time you
logon to a system you manage,) run through these
quick steps to look for anomalous behavior that
might be caused by a computer intrusion. Each of
these commands runs locally on a system.
This sheet is split into these sections:
• Unusual Processes
• Unusual Files
• Unusual Network Usage
• Unusual Scheduled Tasks
• Unusual Accounts
• Unusual Log Entries
• Additional Supporting Tools


• Unusual Processes
Look for running processes:
# ps –aux
Get familiar with “normal” processes for the machine.
Look for unusual processes. Focus on processes with
root (UID 0) privileges.
If you spot a process that is unfamiliar, investigate
unusual processes, getting more detail using:
# lsof –p [pid]
This command shows all files and ports used by the
running process.

• Unusual Files
Look for unusual SUID root files:
# find / -uid 0 –perm -4000 –print
Requires knowledge of normal SUID files
Look for unusual large files (greater than 10
MegaBytes):
# find / -size +10000k –print
Requires knowledge of normal large files
Look for files named with dots and spaces:
(“...”, “.. “, “. “, and “ “)
# find / -name “...“ –print
# find / -name “.. “ –print
# find / -name “. “ –print

On a Linux machine with RPM installed (RedHat,
Mandrake, etc.), run the RPM tool to verify packages
# rpm –Va
Checks size, MD5 sum, permissions, type, owner, and
group of each file with information from RPM
database
Output includes:
S – File size differs
M – Mode differs (permissions)
5 – MD5 sum differs
D – Device number mismatch
L – readLink path mismatch
U – user ownership differs
G – group ownership differs
T – modification time differs
Pay special attention to changes associated with
items in /sbin, /bin, /usr/sbin, and /usr/bin


• Unusual Network Usage
Look for promiscuous mode, which might indicate a
sniffer:
# ip link | grep PROMISC
Note that ifconfig doesn’t work reliably for detecting
promiscuous mode on Linux kernel 2.4

Look for unusual port listeners:
# lsof –i
# netstat –nap
Need to know which TCP and UDP ports are
normally listening on your system and look for
deviations from the norm

Look for unusual ARP entries, mapping IP address to
MAC addresses that aren’t correct for the LAN:
# arp –a
Requires detailed knowledge of what is supposed to
be on the LAN


• Unusual Scheduled Tasks
Look for cron jobs scheduled by root and any other
UID 0 accounts:
# crontab –u root –l
Look for unusual system-wide cron jobs:
# cat /etc/crontab


• Unusual Accounts
Look in /etc/passwd for new accounts, especially
with UID 0 or GID 0
# less /etc/passwd
# grep :0: /etc/passwd
Normal accounts will be there, but look for new,
unexpected accounts


• Unusual Log Entries
Look through your system log files for suspicious
events, including:
Promiscuous mode
“entered promiscuous mode”
Large number of authentication or login
failures from either local or remote access
tools (e.g., telnetd, sshd, etc.)
Remote Procedure Call (rpc) programs with a
log entry that includes a large number (> 20)
strange characters (-^PM-^PM-^PM-^PM-
^PM-^PM-^PM-^PM)
For web servers: Large number of Apache
logs saying “error”


• Additional Supporting Tools
The following tools are often not built into
Linux operating system, but can be used to
analyze its security status in more detail.
Each is available for free download at the
listed web site.
Chkrootkit looks for anomalies on systems
introduced by user-mode and kernel-mode
RootKits
www.chkrootkit.org - free
Tripwire looks for changes to critical system
files
www.tripwire.org - free for Linux for noncommercial
use
AIDE looks for changes to critical system files
http://www.cs.tut.fi/~rammer/aide.html

How to change network setting in Linux

I'm having a problem to access to my desktop using GUI. So, I decided to use command in console. I would like to share with people especially newbies how to configure Linux network using a command prompt based on my experience.

1. [root@localhost ~]#ifconfig eth0 172.20.30.30 netmask 255.255.255.0 up
2. [root@localhost ~]#route add default gw 172.20.30.254

How to disabling the Ctrl+Alt+Delete in Linux console

As usual, I'm coming to office and entering the server room and login to the portal to check in for my attendance system. But all of the sudden, the server is restart!!!! Oh my god! I was accidentally press the Ctrl+Alt+Delete!!! What I have done? Than, I tried to fix the problem. The solution that I can do is I need to disable the Ctrl+Alt+Delete key. I'm afraid that if anyone that accidentally press that key than everything will be horror. To disable that key is quiet simple actually. Below are the steps that I have done.

1. Backup the original etc/inittab file and named it as a inittab.ori
[root@localhost ~]# cp /etc/inittab /root/Desktop/backup/inittab.ori

2. Edit the original file in /etc/inittab
[root@localhost ~]#vi /etc/inittab

3. Find the the # Trap CTRL-ALT-DELETE line
You can see that there is a file that exactly look like this
ca::ctrlaltdel:/sbin/shutdown -t3 -r now

4. Now edit that line such below
ca:12345:ctrlaltdel:/bin/echo "CTRL-ALT-DEL is disabled"

5. Save the file that you have edit and quit from VI

6. In order to activate the changes, you need to run this command
[root@localhost ~]# init q

7. After that to make sure it is effective or not, try to press the Ctrl+Alt+Del key. Your screen should appear "CTRL-ALT-DEL is disabled"

8. Done :-)