How To Install VSFTPD

How To Install VSFTPD

Most Linux software products are available in a precompiled package format. Downloading and installing packages isn't hard .It is best to use the latest version of VSFTPD.

When searching for the file, remember that the VSFTPD packages' filename usually starts with the word vsftpd followed by a version number, as in vsftpd-1.2.1-5.i386.rpm for Redhat/Fedora or vsftpd_2.0.4-0ubuntu4_i386.deb for Ubuntu.

How To Get VSFTPD Started

With Fedora, Redhat, Ubunbtu and Debian You can start, stop, or restart VSFTPD after booting by using these commands:

[root@ash tmp]# /etc/init.d/vsftpd start

[root@ash tmp]# /etc/init.d/vsftpd stop

[root@ash tmp]# /etc/init.d/vsftpd restart

With Redhat / Fedora you can configure VSFTPD to start at boot you can use the chkconfig command.

[root@ash tmp]# chkconfig vsftpd on

With Ubuntu / Debian the sysv-rc-conf command can be used like this:

root@u-ash:/tmp# sysv-rc-conf on

Note: In RedHat Linux version 8.0 and earlier, VSFTPD operation is controlled by the xinetd process.

Testing the Status of VSFTPD

You can always test whether the VSFTPD process is running by using the netstat -a command which lists all the TCP and UDP ports on which the server is listening for traffic. This example shows the expected output.

[root@ash tmp]# netstat -a | grep ftp

tcp 0 0 *:ftp *:* LISTEN

[root@ash tmp]#

If VSFTPD wasn't running, there would be no output at all.

The vsftpd.conf File

VSFTPD only reads the contents of its vsftpd.conf configuration file only when it starts, so you'll have to restart VSFTPD each time you edit the file in order for the changes to take effect. The file may be located in either the /etc or the /etc/vsftpd directories depending on your Linux distribution.

This file uses a number of default settings you need to know about.

• VSFTPD runs as an anonymous FTP server. Unless you want any remote user to log into to your default FTP directory using a username of anonymous and a password that's the same as their email address, I would suggest turning this off. The configuration file's anonymous_enable directive can be set to no to disable this feature. You'll also need to simultaneously enable local users to be able to log in by removing the comment symbol (#) before the local_enable instruction.
• If you enable anonymous FTP with VSFTPD, remember to define the root directory that visitors will visit. This is done with the anon_root directive.

anon_root=/data/directory

• VSFTPD allows only anonymous FTP downloads to remote users, not uploads from them. This can be changed by modifying the anon_upload_enable directive shown later.
• VSFTPD doesn't allow anonymous users to create directories on your FTP server. You can change this by modifying the anon_mkdir_write_enable directive.
• VSFTPD logs FTP access to the /var/log/vsftpd.log log file. You can change this by modifying the xferlog_file directive.
• By default VSFTPD expects files for anonymous FTP to be placed in the /var/ftp directory. You can change this by modifying the anon_root directive. There is always the risk with anonymous FTP that users will discover a way to write files to your anonymous FTP directory. You run the risk of filling up your /var partition if you use the default setting. It is best to make the anonymous FTP directory reside in its own dedicated partition.

The configuration file is fairly straight forward as you can see in the snippet below where we enable anonymous FTP and individual accounts simultaneously.

# Allow anonymous FTP?

anonymous_enable=YES

...

# The directory which vsftpd will try to change

# into after an anonymous login. (Default = /var/ftp)

anon_root=/data/directory

...

# Uncomment this to allow local users to log in.

local_enable=YES

...

# Uncomment this to enable any form of FTP write command.

# (Needed even if you want local users to be able to upload files)

write_enable=YES

...

# Uncomment to allow the anonymous FTP user to upload files. This only

# has an effect if global write enable is activated. Also, you will

# obviously need to create a directory writable by the FTP user.

#anon_upload_enable=YES

...

# Uncomment this if you want the anonymous FTP user to be able to create

# new directories.

#anon_mkdir_write_enable=YES

...

# Activate logging of uploads/downloads.

xferlog_enable=YES

...

# You may override where the log file goes if you like.

# The default is shown below.

xferlog_file=/var/log/vsftpd.log

...

To activate or deactivate a feature, remove or add the # at the beginning of the appropriate line.

Other vsftpd.conf Options

There are many other options you can add to this file:

• Limiting the maximum number of client connections (max_clients)
• Limiting the number of connections by source IP address (max_per_ip)
• The maximum rate of data transfer per anonymous login. (anon_max_rate)
• The maximum rate of data transfer per non-anonymous login. (local_max_rate)

Descriptions on this and more can be found in the vsftpd.conf man pages.

FTP Security Issues

FTP has a number of security drawbacks, but you can overcome them in some cases. You can restrict an individual Linux user's access to non-anonymous FTP, and you can change the configuration to not display the FTP server's software version information, but unfortunately, though very convenient, FTP logins and data transfers are not encrypted.

The /etc/vsftpd.ftpusers File

For added security, you may restrict FTP access to certain users by adding them to the list of users in the /etc/vsftpd.ftpusers file. The VSFTPD package creates this file with a number of entries for privileged users that normally shouldn't have FTP access. As FTP doesn't encrypt passwords, thereby increasing the risk of data or passwords being compromised, it is a good idea to let these entries remain and add new entries for additional security.

Anonymous Upload

If you want remote users to write data to your FTP server, then you should create a write-only directory within /var/ftp/pub. This will allow your users to upload but not access other files uploaded by other users. The commands you need are:

[root@ash tmp]# mkdir /var/ftp/pub/upload

[root@ash tmp]# chmod 722 /var/ftp/pub/upload

FTP Greeting Banner

Change the default greeting banner in the vsftpd.conf file to make it harder for malicious users to determine the type of system you have. The directive in this file is.

ftpd_banner= ****welcome ash*********

Using SCP As Secure Alternative To FTP

One of the disadvantages of FTP is that it does not encrypt your username and password. This could make your user account vulnerable to an unauthorized attack from a person eavesdropping on the network connection. Secure Copy (SCP) and Secure FTP (SFTP) provide encryption and could be considered as an alternative to FTP for trusted users. SCP does not support anonymous services, however, a feature that FTP does support.

FTP Users with Only Read Access to a Shared Directory

In this example, anonymous FTP is not desired, but a group of trusted users need to have read only access to a directory for downloading files. Here are the steps:

1) Disable anonymous FTP. Comment out the anonymous_enable line in the vsftpd.conf file like this:

# Allow anonymous FTP?

anonymous_enable=NO

2) Enable individual logins by making sure you have the local_enable line uncommented in the vsftpd.conf file like this:

# Uncomment this to allow local users to log in.

local_enable=YES

3) Start VSFTP.

[root@ash tmp]# service vsftpd start

4) Create a user group and shared directory. In this case, use /home/ftp-users and a user group name of ftp-users for the remote users

[root@ash tmp]# groupadd ftp-users

[root@ash tmp]# mkdir /home/ftp-docs

5) Make the directory accessible to the ftp-users group.

[root@ash tmp]# chmod 750 /home/ftp-docs

[root@ash tmp]# chown root:ftp-users /home/ftp-docs

6) Add users, and make their default directory /home/ftp-docs

[root@ash tmp]# useradd -g ftp-users -d /home/ftp-docs user1

[root@ash tmp]# useradd -g ftp-users -d /home/ftp-docs user2

[root@ash tmp]# useradd -g ftp-users -d /home/ftp-docs user3

[root@ash tmp]# useradd -g ftp-users -d /home/ftp-docs user4

[root@ash tmp]# passwd user1

[root@ash tmp]# passwd user2

[root@ash tmp]# passwd user3

[root@ash tmp]# passwd user4

7) Copy files to be downloaded by your users into the /home/ftp-docs directory

8) Change the permissions of the files in the /home/ftp-docs directory for read only access by the group

[root@ash tmp]# chown root:ftp-users /home/ftp-docs/*

[root@ash tmp]# chmod 740 /home/ftp-docs/*

Users should now be able to log in via FTP to the server using their new usernames and passwords. If you absolutely don't want any FTP users to be able to write to any directory, then you should set the write_enable line in your vsftpd.conf file to no:

write_enable = NO

Remember, you must restart VSFTPD for the configuration file changes to take effect.

Sample Login Session To Test Functionality

Here is a simple test procedure you can use to make sure everything is working correctly:

1) Check for the presence of a test file on the ftp client server.

[root@ash tmp]# ll

total 1

-rw-r--r-- 1 root root 0 Dec 4 09:08 testfile

2) Connect to via FTP

[root@ash tmp]# ftp 192.168.1.100

Connected to 192.168.1.100 (192.168.1.100)

220 ready, dude (vsFTPd 1.1.0: beat me, break me)

Name (192.168.1.100:root): user1

331 Please specify the password.

Password:

230 Login successful. Have fun.

Remote system type is UNIX.

Using binary mode to transfer files.

ftp>

As expected, we can't do an upload transfer of testfile to ash

ftp> put testfile

local: testfile remote: testfile

227 Entering Passive Mode (192,168,1,100,181,210)

553 Could not create file.

ftp>

But we can view and download a copy of the VSFTPD RPM located on the FTP server ash.

ftp> ls

227 Entering Passive Mode (192,168,1,100,35,173)

150 Here comes the directory listing.

-rwxr----- 1 0 502 76288 Jan 04 17:06 vsftpd-1.1.0-1.i386.rpm

226 Directory send OK.

ftp> get vsftpd-1.1.0-1.i386.rpm vsftpd-1.1.0-1.i386.rpm.tmp

local: vsftpd-1.1.0-1.i386.rpm.tmp remote: vsftpd-1.1.0-1.i386.rpm

227 Entering Passive Mode (192,168,1,100,44,156)

150 Opening BINARY mode data connection for vsftpd-1.1.0-1.i386.rpm (76288 bytes).

226 File send OK.

76288 bytes received in 0.499 secs (1.5e+02 Kbytes/sec)

ftp> exit

221 Goodbye.

[root@ash tmp]#

As expected, anonymous FTP fails.

[root@ash tmp]# ftp 192.168.1.100

Connected to 192.168.1.100 (192.168.1.100)

220 ready, dude (vsFTPd 1.1.0: beat me, break me)

Name (192.168.1.100:root): anonymous

331 Please specify the password.

Password:

530 Login incorrect.

Login failed.

ftp> quit

221 Goodbye.

[root@ash tmp]#

Installing MySQL 5.0 on Solaris 10

Installing MySQL 5.0 on Solaris 10.
At least some basic Unix/Linux administrative skills.
must have FRESH running copy of Solaris 10 6/06.
unstalled MySQL version in the system
.
DownloadsPlease obtain a copy of MySQL 5.0 from http://dev.mysql.com/downloads/mysql/5.0.html. For the Solaris 10 MySQL packages, please scroll the page down the section of “Solaris (pkgadd package) downloads”. Choose the appropriate processor architecture of the package (either x86 or SPARC). Download the packages (both Standard and Max) and save them in an appropriate directory.
I will use “/usr/files” as the directory where the mysql-xxx.pkg.gz files were placed through out the tutorial (Please take note that the xxx is the version number and is to be replaced by the actual text in the file name).PreparationPlease perform the following as the root user.
Imp point--Make sure that any other previously running copies of MySQL are to be uninstalled from the system.
Step 1.
login as “root”
To list all the packages, type: "pkginfo grep mysql" at the shell.
If you see any listed packages, you may remove them by typing “pkgrm ” The names of the packages are list at the second column of after executing pkginfo.
Step 2.
Change the directory to the place where you’ve downloaded the mysql-xxx.pkg.gz files. (e.g. “cd /usr/files”). If the files were compressed by gzip and you can see the .gz extension at the end of the files, you may decompress them by typing “gzip –d mysql-xxx.pkg.gz”. Decompress the downloaded mysql-xxx.pkg.gz files. InstallationFollow these steps to perform the installation (perform as "root"):
Step 3.
Create the mysql group by typing “groupadd mysql”.
Create the mysql user by typing “useradd -g mysql mysql”.
Change the directory where the MySQL packages were placed. “cd /usr/files”.
install the package by typing: “pkgadd -d mysql-xxx.pkg”. Just accept the default install directory (/opt/mysql) when prompted and go through the installation process.
Step4.
The MySQL should have been installed in “/opt/mysql/mysql”.
Change the directory to /etc/init.d and edit the "mysql" file with any text editor.
IT is better to keep the copy in desktop before you make edit
Locate the line which states: "datadir=". Change the line to "datadir=/opt/mysql/mysql/data". Save the changes.

After the installation, change the path to "/opt" and type this: “chown -R mysql:mysql mysql”. This is to change the ownership of the whole mysql directory.Initiallizing the database
Change the operating user from “root” to “mysql” by tying: “su mysql”.
Change the working directory to “/opt/mysql/mysql/scripts” by typing: “cd /opt/mysql/mysql/scripts”.
Execute the mysql_db_install script by typing: “./mysql_install_db --user=mysql --ldata=/opt/mysql/mysql/data”.
Change the working directory to "/opt/mysql/mysql/bin”.
Start the database by typing: “./mysqld_safe --datadir=/opt/mysql/mysql/data --user=mysql &”.
Connecting to MySQLTry to connect to the Mysql Database by typing “mysql” as the root user. You should be able to see the “mysql>” prompt for the successful connection. The only user which could connect to the database now is the root user and it doesn't require a password.
I hope this will help those who are trying to install the MySQL 5.0 database on the Solaris 10 OS for the first time.

Homemade Honeypots

Developing your own honeypot is not as complicated as it might seem. Using a variety of commonly found security tools, some basic code, and a lot of creativity, you can create many different honeypots. There is no blueprint for developing your own honeypot. It all depends on what you want it to do, the resources you have on hand, and the technologies you feel most comfortable with. The purpose of this chapter is to give you examples of the different technologies and solutions that can be created. It is hoped that by reviewing these different possibilities, you will have a better understanding of what your options are and how to best develop and implement them.
Homemade honeypots have a variety of possible uses. Perhaps you want to detect certain probes or scans, or you need to capture the payload of a specific attack. For this you need nothing more than a simple program that emulates, or perhaps simply listens on, a single port and captures all the activity to that port. This is an example of a low-interaction honeypot designed for limited interaction. On the other extreme, homemade honeypots can create the illusion of a complete operating system, allowing attackers to execute their activities but in a controlled environment. This is a more complex honeypot with far greater levels of interaction, designed to gather more information on attackers.
The variety of homemade honeypots is limited only by the imagination of security professionals, a very imaginative group indeed. Homemade honeypots can run the gamut from very simple to very advanced, which is why they are covered in the middle of this book, between the relatively simple and relatively complex honeypots that are commercially available. In this chapter we are going to cover two specific implementations of homemade honeypots: port monitoring and caged environments. These two types of honeypots represent the different extremes, from the low-interaction system to the more advanced caged environments.
Port monitoring is the simpler of homemade honeypots. Port monitoring honeypots are nothing more than a solution that monitors a specific port or a variety of ports. The goal of the port monitoring can be as simple as capturing connections to a service, such as with BOF, or it can entail response or emulation capabilities, such as with Specter. Either way, these solutions tend to be low interaction, limiting the attacker to an emulated service to interact with.
A chroot or jailed environment is the more advanced of the two categories we cover here. Instead of emulating the services, a caged environment is created. This caged environment exists within a real operating system. The advantage of the caged, or jailed, environment is that it creates the illusion of a real operating system. The attacker has nearly the same functionality as it would if it had compromised a real computer. However, its actions are more closely monitored and controlled.
Both solutions have advantages and disadvantages. Choosing between them depends on what you want to achieve. Port monitoring solutions are easy to develop and implement and have less risk. But they also have limited capabilities: There is little attackers can interact with. This solution is mainly for a specific, predefined purpose, such as detecting attacks or capturing automated tools. A chroot or jailed environment, while more complicated to develop and implement, is more flexible and can give us far greater information on attackers.
These two solutions are not the only methods for developing your own honeypots. There are countless other varieties. For example, Brad Spencer developed a simple sendmail honeypot that emulates a vulnerable mail relay that can be used for spam. By simply modifying the parameters used with sendmail, Brad has created a homemade honeypot that captures spammers. George Bakos has developed Tiny Honeypot. This suite of tools lets you to build a honeypot that appears to allow attackers to successfully hack into it, regardless of what they do. Both of these homemade solutions can be found on the CD-ROM.
The two solutions we will focus on—port listeners and jails—represent some of the most common methods you will find. They also represent two dramatically different approaches and technologies, demonstrating the different potentials of homemade honeypots. We will begin with the simpler solution of the two, port monitoring.

Ruby

Ruby is an object-oriented programming language that makes programming both enjoyable and fast. With the easy-to-use interpreter, familiar syntax, complete object-oriented functionality, and powerful class libraries, Ruby has become a language that can be applied to a broad range of fields from text processing and CGI scripts to professional, large-scale programs.
While Ruby is easy to learn, there are many details that you can't be expected to remember. This book presents those details in a clean and concise format. It is a reference to keep next to your desktop or laptop, designed to make Ruby even easier to use.
For those of you who are new to Ruby, there are several online tutorials available to get you started: Ruby's home page (http://www.ruby-lang.org/) is a good starting pointing as it offers Ruby tutorials and the Ruby Language FAQ.

BSNL DataOne: Configuring Adsl Connection On Linux

BSNL DataOne: Configuring Adsl Connection On Linux
This is a little how-to to configure an ADSL connection in Linux, mainly in Fedora, I have assumed that you have already installed the distribution and that you have a LAN card in your computer which you are connecting to the router/modem.
In the steps, note that for your Dataone connection, you must use "username@dataone" as the username and your password.

In Fedora, go to: Desktop --> Administration --> Network, The window you will get will have title of "Network Configuration".- From the toolbar of this new window, click on "New" button. You will get a window with title "Add new Device Type".- In this new window, choose xDSL connection, click "Forward" and follow the prompt. It will ask you for the provider name (type anything. e.g. BSNL Dataone), your connection username (mintu@dataone in our example) and password.
Once setup is complete, to test the connection, go back to the "Network Configuration" window (or open it again as specified in the first point above), and select the new connection and click on Activate button in the toolbar.


Then make sure that the device will become automatically active when the computer boots up by selecting this connection in the network configuration window and by editing its profile and by checking the option that tells the device to activate on boot ups. Also, give normal users the option of controlling this device.- To disconnect, select the Deactivate button from the network configuration window.


Modem Configuration
Open browser and go 192.168.1.1(for BSNL)
The pc should be connected to ADSL Modem


How to Monitor the network

Add the Pandel=> Network Monitor

Hosting Multiple Web Sites on a Single Server

More than 87% of active domain names are found to share their IP addresses (i.e. their web servers) with one or more additional domains, and more than two third of active
domain names share their addresses with fifty or more additional domains. While this IP sharing is typically transparent to ordinary users, it causes complications for those who seek to filter the Internet, restrict users' ability to access certain controversial content on the basis of the IP address used to host that content. With so many sites sharing IP addresses, IP-based filtering efforts are bound to produce "overblocking" -- accidental and often unanticipated denial of access to web sites that abide by the stated filtering rules.


A single IIS server can host multiple web sites and normally each web site is tied to a IP address however if the machine only has one IP address it can still be configured to host multiple web sites by specifying a host header name for each web site as follows (you should first ensure you have multiple DNS entries all pointing to the IP address of the machine):
1)Start the Internet Information Services MMC snap-in (Start - Programs - Administrative Tools - Internet Information Services)
2)Expand the server
3)Right click on the web site and select Properties
4)Next to the IP address (ensuring the actual IP address is selected) click the Advanced button
5)Select the IP address entry and click Edit
6)Enter the DNS host entry for the web site and set the port to 80
7) Click OK Click OK to the main dialog
8)Repeat for all other web sites
9)When the client connects the DNS name requested is passed in the header as the host name and that is what is mapped.
If the Web site requested in the host header is stopped, the client receives the default Web site. Therefore, it is recommended that an ISP use the default Web site as the ISP home page, rather than for a customer site. Multiple sites on a single Professional installation is not supported.
Also do not configure a header host name for the default web site as this may cause problems for other packages such as Proxy Server which expect the default web site to use port 80, IP address of "All Unassigned" and no host header name.

What is the difference between a static IP number and a Shared IP number

A Static IP Address is when a website has their very own IP Address. This means that whether you type in your URL or the IP address of your website, both will bring you to the same page.

Shared IP Address - Every web server around the world is assigned an Internet Protocol (IP) address. An example of an IP address would look something like: [126.703.4.151]. Most websites on the world wide web are hosted on shared IP addresses, meaning that one server with one IP address can hold several domain names.A shared IP Address is when multiple websites all share the same IP Address. In this case, the web server does a little bit of extra work when it receives your web request, and passes you to the correct website. Typing in the IP Address will not bring you to your desired website, under most conditions. Why do we need this? I’m sure you noticed that, based on the above definition of an IP Address, that there is a finite number of IP Addresses available before we run out completely. If every single website on the internet had it’s own IP Address, there would be no room for any new ones.
Back to our home address analogy, you might consider a static IP Address to be a stand-alone home. There is only one house who gets mail at that address. You might then consider a shared IP Address to be an apartment building. Many different households get their mail at the same location, and in turn it is distributed to the correct location.