Monday, November 22, 2010

NFS [ Network File System]


NFS [ Network File System]

                         To share the data on one computer with other computer NFS is used.
The Network File System (NFS) was developed to allow machines to mount a disk partition on a remote machine as if it were a local disk. It allows for fast, seamless sharing of files across a network. There are other systems that provide similar functionality to NFS e.g. Samba provides file services to Windows clients.
For Username and Password if we share “/etc/passwd” file on NIS server to clients then they can login to the server but cant get their home directory on server. For that configure that server as NFS and mount the home directory of the user. For that give command :

# mount -t nfs (server's ip address):/home /home
here “:/home” this directory is of server and “/home” is of client.

There is a file at “/etc/” named “exports”
Edit that file... #vim /etc/exports

make changes as...
(name of directory to be shared)     (Ip address of machine whom you want to share directory)    (rights, sync/async)

e.g. /dbc * (rw, async)

here /dbc is the directory on server which we want to share
' * ' means share for all machines ( or you can give specific Ip)

Now to share it give command :
# exportfs -a
# exportfs                    ( To see what is shared on your machine )

To share a directory on your machine which is currently on other machine
make any directory on root for e.g.
# mkdir /abc
# service nfs start
Then mount directory which is on other computer onto your computer for that give command-
# mount -t nfs (client's IP address):s1 /abc

Modes :
async : This mode is fast working because, if someone is accessing a file on a machine and after some processing he changed that file and saved it, but before saving it on to hard disk some other person requested to access that file then in that case also the file is made available for new client without saving that file. But if meanwhile machine gets restarted or network gets off then the file gets lost or corrupted.

Sync : in this mode working is slow because, file gets saved on hard disk first and then made available for the client machine.

no_wdely : If we have selected the 'async' mode then we cannot use this mode.
In this case if 2 users wants to access a single file simultaneously then it is made available for both users and when one user makes changes to that file the changes are reflected only after saving the file by first user.

nohide : if we mount any directory from samba server using nfs it is there in hidden format ( it is due to file system), then instead of mounting filesystem separately to each client just mount filesystem on NFS server and use “nohide” option, the data will gets directly available.

no_subtree_check : if we use this option it will not show directory tree list to client. They have to check it by browsing each directory separately.

insecure_locks : if following options are selected the directory security will not be maintained-
a) no_auth_nlm : authentication is not required for access
b) no_acl : Permissions on file are not checked by server.
c)Mountpoint = path : if we have alredy mounted a directory from some where else we can remount it using nfs.

User Id mapping :

a) root/squash : 'root' is also considered as an anonymous user. It does not have full rights because of security concern.
b) no_root_squash : root is having access as a root user.
c)all-squash : all users will get access as anonymous user.
d)anonuid and anongid : it can map anonymous user and groups id's.
e)insecure : we can not check permissions and other parameters.

If you want a persistent mounting then edit /etc/fstab and make changes as

(ip address of server):/directory_name /path_where_to_mount_directory nfs defaults 0 0

save and exit

It will be helpful if server is having users and their home directories. Give entry of above line in every clients /etc/fstab file. After login every client will gets his home directory.

To make on the service after every reboot give command :

# chkconfig nfs on

Friday, November 12, 2010

Squid Proxy

Squid Proxy

Squid Server acts as a Internet Service Provider. It caches data and hence speed of internet browsing increases little-bit.
Internet Data : Internet data is of 2 types-
a) Static Data : This data does not changes e.g. Documents etc.
b) Dynamic Data : this data changes as time passes. e.g. Advertise, pictures etc.

                         Static data can be cached. Dynamic data can not be cached. The data which has been cached on internet is given to clients through server. But dynamic data needs to be taken every time from internet. Proxy server can also be used as an internet accelerator. If someone is accessing data from outside network then this server acts as a interface between main server and client, so that there is less load on main server.

Check for package is installed or not : # rpm -qa |grep squid*

If package is installed on your system then...

Edit '/etc/squid/squid.conf ' file
                                 Contents of squid.conf
a) #http_port 3128
the default port for squid is 3128, if you want to change then remove comment.

b) cache_dir ufs /var/spool/squid 100 16 256
this directory contains cached data. [ufs = file system, 100 = size = 100 Mb default,
16 = first level directories to be created,
256 = Under every directory we can create 256 second level sub directories]

Exit from vi mode

The directories where it stores cached data are called as 'swap directories'.
To create swap directories give command-

# squid -z ( if error is there then follow next step)

Edit squid.conf file
make changes as
Default :
instead of #none type your host name
save and exit

# squid -z
# service squid start
# chkconfig squid on (to start the service after every reboot)

Goto mozilla
edit tab → preferences → Advanced → proxies
Give Ip address of proxy server
e.g. 172.16.0.1 port 3128

if you are using Internet Explorer then make same changes in
tools tab → internet options

In squid by default there is everything 'off '
To block or allow Ip addresses of machines we need to write ACL's (Access Control List)

To write ACL there is command :
acl   (list name) acl-type   value
e.g. If you want to allow http access to machines in “intranet” domain write following lines in squid.conf file below... #INSERT YOUR OWN RULES HERE line

acl intranet src 192.168.100.10-100
http_access allow intranet


save and exit

# service squid restart

then goto client machine start mozilla open any site. If your machine is having internet connection you will get that site.
Remember first insert all rules of “deny” then insert all rules for “allow”

To Allow or Block Sites :


/etc/squid/squid.conf

acl intranet src 172.16.0.10-172.16.0.20
acl yahoo dstdomain .yahoo..com
http_access deny intranet yahoo


save and Exit

As we know there are very few sites which we want to allow as compared to the sites to be denied. So list of allowed sites can be stored in a file e.g. file named 'goodsites'
e.g. # vim /goodsites
in that file list all the allowed sites i.e.

.yahoo.com
.rediffmail.com
.google.com


save and exit

Edit squid.conf

acl intranet src 172.16.0.10-172.16.0.20
acl good dstdomain “/goodsites”
http_access allow intranet good


save and exit

# service squid restart

open mozilla and check for those sites.

Time Scheduling :

For time scheduling edit squid.conf file

acl intranet src 172.16.0.10-172.16.0.20
acl nettime time SMTW 17:00-19:00
acl good dstdomain “/goodsites”
http_access allow nettime good intranet


save and Exit
# service squid restart

it means if the days are Sunday, Monday, Tuesday, Wednesday and the time is in between 5:00 pm to 7:00 pm the good sites for intranet will open and other sites will remain blocked. If days are Thursday, Friday, Saturday all sites for intranet will be blocked.

This server caches files automatically. If the server gets slow then just increase the size of cache directory above 100Mb.

Wednesday, October 27, 2010

Server Configuration in Linux

 DHCP [Dynamic Host Configuration Protocol]:

To check package is installed or not :

# rpm -qa |grep dhcp*

if package is installed on your machine it will display you the list. If not inatall it using CD or DVD as mentioned in FTP section.

Search a file “dhcpd.conf.sample
this file is present at '/usr/share/doc/dhcp-*/ ' location. Copy this file into /etc/ location and rename it as 'dhcpd.conf'. i.e.
# cp /usr/share/doc/dhcp-*/dhcpd.conf.sample /etc/dhcpd.conf

goto /etc/ and check it.

Edit that file
Contents of that file are-
# vim /etc/dhcpd.conf

1) ddns-update-style interim;
'dhcp server and DNS server communicate with each other using interim method
2) ignore client-updates;
if client tries to update the information, DHCP will not allow it.
3) Range dynamic-bootup  (range of ip addresses);
    e.g.   172.16.0.50  to   172.16.0.100


The default lease time upto which client can use the connection is 21600 seconds (i.e. 6 Hrs. approx) and the maximum lease time is 43200 seconds (i.e. 12 Hrs. approx). You can increase the max lease time if client request for it.
Server can renew the Ip address if the lease period is 50% over. After 80% lease period done the server frees that ip address for to give to anyone.

# service dhcpd start

if you get [Failed] message the check the ip address of system and server and make them same.

# service network restart
# service dhcpd start


you will get [OK] message

For to give a fix ip address i.e. reservation:

get MAC address of client (using ifconfig command you can get it).

Edit dhcpd.conf file
in that file serach option

 hardware ethernet (give client's MAC address)  
 fixed address (give client's ipaddress)  

# service dhcpd restart

If you want to check the ip addresses of various machines assigned by DHCP server then edit
'/var/lib/dhcp/dhcpd.leases' file





Sunday, October 17, 2010

LINUX   Installation Requirements
For installation of Linux we need to create minimum 3 partitions :-
 1) /boot – 100Mb approx.
 2) /   - 5 GB Minimum (For Full installation).
3) /swap – Double of RAM (swap partition i.e. Virtual Memory)
Difference Between Windows and Linux :-
Windows                                                                                    Linux
1) Not case Sensitive.                                                         1) case sensitive
2)  Drive letters are allowed                                                2) No drive letters used to identify partitions
                                                                                                              Instead names are used. E.g. /, /boot, /swp
3) Hidden files are having special attribute –h           3) Any file name starting with a                                                                                       dot(.) is considered as hidden
          
and there are many more… 
 
Commands :     
1)      Pwd : Publish working directory.
2)      Whoami : Gives Login user name.
3)      ls : similar to dir command in windows.
4)      man : manual pages ( Gives Help of a command) e.g.  $ man ls
5)      cd : change directory
6)      mkdir : create a new directory.
7)      touch : creates a blank file by the name given.
8)      cat : displays the contents of the file.
9)      cp   : copy file from source to destination
10)  rm : to delete files and folders
11)  mv  : to move files or folders from one location to other.      

VI Editor Basics:


To create a file vi editor is used. The command to create 'sample' file is:
$vim sample


When vi editor starts, it starts in read only mode by default. Press 'i' or 'Insert' key to work in read write mode.


commands:

1) esc key: To come out of any mode.


2) :wq - to save file and exit


3) :w - to save file


4) :q - to exit from vi editor without saving


5) :q! - forcefully exit without saving


Screens:   In GUI we get 6 screens to work on command line.


a) ctrl + Alt + F1  :- First screen
b) ctrl + Alt + F2  :- Second screen
c) ctrl + Alt + F3   :- Third screen 
d) ctrl + Alt + F4   :- Fourth screen
e) ctrl + Alt + F5   :- Fifth screen
f) ctrl + Alt + F6    :- Sixth screen
The 7th screen is GUI screen i.e. ctrl + Alt + F7 



How to store XP's Boot Loader in MBR using CD:

1) Boot your system using XP's bootable CD.

2) Choose recovery console by pressing 'r' option when asked.

3) Give path of your XP's installation folder

e.g. C:Windows (Press Enter)

4) Type 'fixmbr' (Press Enter)

5) Type 'fixboot' (Press Enter)

6) Type 'yes' (Press Enter)

7) Type 'exit (Press Enter)

8) Then Restart your system

the XP's Boot loader gets installed.



Creating CHAIN LOADER:

How to Install Linux Boot Loader:

If you Install XP over Linux (Dual Boot) the Linux's Boot Loader gets corrupted.
So to Install again Linux Boot Loader without disturbing XP we need to create a
Chain Loader. For that-

1) Insert Linux Bootable CD or DVD.

2) Type 'linux rescue' (Press Enter)

3) Type 'chroot /mnt/sysimage'

4) Then check partitions by giving command 'fdisk -l'

5) Then copy Linux grub loader on first sector of Linux Partition insted
of MBR. For that give commmand-
#grub-install /dev/hda2         (Press Enter) ---(Here /dev/hda2 is your
                                               linux partition shown in 'fdisk -l' command)

6) Then copy Boot Loader image in a file say 'bootsect.lnx'. for that-
#dd if=/dev/hda2 of=bootsect.lnx bs=512 count=1 (Press Enter)

    (here dd= disk duplicator, if= input file, of=output file,
      bs=block size in bytes)

7) Then mount XP's Partition in a test directory... for that
#mkdir test                                     (Press Enter)
#mount -t auto /dev/hda1 /test (Press Enter)
   (here /dev/hda1 is your XP'x partition shown by 'fdisk -l')

8) Then see contents of /test
#cd /test
#ls

9) Then copy 'bootsect.lnx' file in /test directory i.e.
#cp /bootsect.lnx bootsect.lnx (Press Enter)

10) Edit XP's boot.ini file and make changes i.e.
#vi boot.ini

Press 'Insert' key and make changes at the End of file as...
C:\bootsect.lnx="RedHat Linux EL"

save the file using 'esc' key and ':wq'

11) Unmount that volume using...
#umount /test

Restart your system... You will get chain loader installed




Partition Management in Linux:

To create new partitions or to edit, modify, delete or manage partitions there is command in Linux:
'fdisk'

To check existing partition table give command:
#fdisk -l

For more options of fdisk give 'man fdisk' command.

We can easily manage our partitions using this options. To enter fdisk utility give command:
#fdisk /dev/

After Creating partitions we need to format them. For this 'mke2fs' command is there. This command formats the partitions using ext2 file system by default.

#mke2fs -j /dev/
Here -j option is used to format the partition using ext3 FS.

This Partitioning is not permanent. It losts after logoff or restartint system.

To make the changes permanent or static we need to make entry of that partition in '/etc/fstab' file.
Then only the changes remain permanent.


Run Levels :

The run levels are managed by '/etc/inittab' file
There are total 6 run levels present in this file, in which run level 4 is actually not present.

0 - halt (Do NOT set initdefault to this, otherwise system will not start.)
1 - Single user mode
2 - Multiuser, without NFS (The same as 3, if you do not have networking)
3 - Full multiuser mode
4 - unused
5 - X11
6 - reboot (Do NOT set initdefault to this)

you can set your desired run level to run as default using this file.



User Management in Linux

For managing users in linux there are various commands, we will see them:

1) useradd: This command is used to create new users.
You can see the help of this command by typing 'man useradd' . The some important parameters are:
a) -c : comment: description for the user. e.g. manager, sales representative etc.
b) -d : home directory : assigns the specified directory as the home directory for the user
e.g. -d /sales/pranay
c) -e : expiration date : user account will be expired on that date. i.e. disable on the date specified. Format: yyyy-mm-dd
d) -f : Inactive days : number of days after the password expires, the user can login to system, before his account has been disabled.
e) -g : (gid, froup name) : this is the primary group os the user.
f) -G : group name : secondary group membership.
g) -m : this switch creates home directory for the user if the home directory is not present. It also copies contents from /etc/skel directory into the home directory of user which has been created.
h) -M : No user home directory is created.
i) -n : No group is created by the name of the user.
j) -o : allow create user with duplicate (non-unique) UID.
System considers such users as a single user, but they can login using different user names.
k) -p : accepts passwords as encrypted formats.
For this first give command 'crypt ' and then use it with -p option.
l) -r : allow to accept UID less than 500.
this option is used with -u option. The users having UID less then 500 are treated as system created users.
m) -s : shell : allow user to accept shell
e.g. -s /bin/bash
n) -u : UID : allow user to accept specific UID.
To give UID 400 give command: #useradd -r -u 400

E.g.:
1) to add new user having same group id (member of the same group):
#useradd -n -g 502
2) to change login shell of user:
#useradd -s /bin/csh

If you want multiple users with same settings give command:
first create one home directory: #mkdir /home/home_dir
then,

#useradd -D -g 502 -b /home/home_dir -e 2010-11-11 -f 3 -s /bin/ksh
#useradd -n user1
#useradd -n user2
#useradd -n user3

.
.
.
and so on...
now these users are having same group id (502), same home directory (/home/home_dir), same expiration date [11 Nov 2010], same default inactive says after expiry (3 days) and same login shell (/bin/ksh).

3) to create groups of same GID: #gropuadd -g 400 group1
                                                    #groupadd -o -g 400 group2
(see 'man groupadd')
to delete group: # groupdel
to delete user : #userdel



usermod Command:

used to modify user settings. See 'man usermod'.
E.g. 1) To change UID of existing user: #usermod -u 515

2) To change login name of existing user: #usermod -l

we see membership of PRIMARY GROUP in /etc/passwd file and membership of SECONDARY GROUP in /etc/group file. For that give command
#usermod -G 502
After that user will became member of group having GID 502. It will be displayed in /etc/group file.

chmod Command:

create a directory '/temp' & check permissions for it by,
#ls -all

then change the permissions of other users by
#chmod o-rx /temp

then login by another user & try to gointo that directory by #cd /temp
It will not go.

Using numbers: r=4
w=2
x=1
i.e. rwx=7, rx=5, rw=6

#chmod 755 /temp
it will set permissions for
owner (u) =rwx (7)
group (g) =rx (5)
others (o) =rx (5) on /temp directory.

chgrp command:

#chgrp 301 /temp
or #chgrp /temp
this command is used to change group of particular directory.

Sticky Bit:
If for a directory all users have rwx rights then anyone can delete others files and folders or modify them easily. For that 'sticky bit' is used. It causes only owner of that file can delete or modify that file.
To add = +t
To remove = -t
e.g. #chmod +t /temp

  
Commands related to Networking:

  1. netconfig : command used to setup ip address to a machine.
  2. setup : command used to setup ip address to a machine.
  3. ifconfig : command to check the ip address.
  4. service network restart : to restart network service.
  5. ping : it will continuously ping if network is ok.
    To stop press 'ctrl + c' or 'ctrl + z'


Telnet [ Terminal Network ]

It is used to work on a particular machine remotely. By default telnet is disabled for security purpose. For managing network there is a daemon 'xinetd.d'. the 'xinetd.d' directory is located at /etc folder. In that folder there is a file 'telnet'. We just open '/etc/xinetd.d/telnet' file and make change as...
disable = no
then save and exit vi. Restart the service i.e.
#service xinetd restart
now check #telnet
Telnet does not allow root user login (because of security). We can login as a ordinary user. And then using command 'su' we can switch to root user account.



Rlogin:

there is a file '/etc/xinetd.d/rlogin'. Edit it make changes as...
disable = no
save and exit from vi editor. Restart xinetd service
#service xinetd restart
# rlogin ip_address_of_machine

you will logged in. if you want to switch user root you can do it by
# su

for further help try
# man rlogin

if there is a user 'aaa' on server and user 'bbb' on workstation and you want to login to server then simply login to workstation by 'bbb' user and give command,

#rlogin server's_ip_address  -l aaa

you will get login.



FTP [ File Transfer Protocol ]:

FTP is used to send or receive a file from one machine to other machine. Name of FTP server in Linux is VSFTP i.e. very secure FTP.

Check whether there is package installed on your system, for that-
# rpm -qa | grep vsftpd*
here q – query packages installed on the system
a – all packages
it will list all the installed packages.

If vsftpd package is not installed on system, then insert CD-1 or DVD of o/s and install the RPM by giving command-
# rpm -ivh vsftpd- - - (give tab)

after successful installation vsftpd directory gets created under /etc directory and two files get created in that folder. It indicates ftp gets installed. You need to copy the data which you want to send via ftp in '/etc/var/ftp/pub' directory.

Contents of '/etc/vsftpd/vsftpd.conf ' file :

1) anonymous_enable = yes
here anonymous stands for all users. Login using 'anonymous' user name and blank password. If you dont want to login as anonymous user set this option 'no'.
2) local_enable = yes
if it is 'yes' then local users can also login using ftp.
3) write_enable = yes
if you want uploading allowed then make it 'yes'.
4) local_umask = 022
the value infront of umask gets deducted from previous value (777).
5) #anon_upload_enable = yes
by deafault only local users having file uploading permission on server. If you want it to allow for anonymous user make it 'yes'.
6) #anon_mkdir_write_enable = yes
anonymous user doesnt having permission to create directory on server. If you want to allow him for that make changes here.
7) dirmessage_enable = yes
create a directory '.message' in every sub-directory in /var/ftp directory. Write a message in '.message' directory about what is there in parent directory.
e.g. this directory contains display drivers etc.
8) xferlog_enable = yes
it keeps record of who uploaded data on ftp, who downloaded data in a log file.
9) connect_from_port_20 = yes
for FTP it uses tcp port 20 & 21. one is used for communication (wid client server) and other is used for actual data transfer. Only one port is kept enable at a time for convinience.
10) chown_updates = yes
it is used in case of data entry to change ownership of uploaded file.
11) chown_username = whoever
give the user name by whom you want to create ownership.
12) xferlog_file = /var/log/vsftpd.log
the log record is kept in this file. To change the location of that file this command is used.
13) xferlog_std_format = yes
to store log in standard format
14) idle_session_timeout = 600 (seconds)
if the user using ftp is idle for 600 seconds the session gets terminated.
15) data_connection_timeout = 120 (seconds)
if there is no data transfer for 120 seconds the connection gets disconnected.
16) #nopriv_user = ftpsecure
for first time the ftp gets connected using root user name but later it gets converted to 'ftpsecure' user. It is used for security purpose.
17) #async_abor_enable = yes
while downloading if connection gets losts then it downloads from start again. To avoid it use this option. It will download from where it gets disconnected.
18) ascii_upload_enable = yes
by default it uses binary upload or download. You can make it ascii using this option.
19) ascii_download_enable = yes
try to avoid it coz it gets more memory and less speed.
20) ftp_banner = welcome to blah ftp server
a banner gets displayed at login time.
21) deny_email_enable = yes
used to ban particular email address.
22) #banned_email_file = /etc/vaftpd.banned_emails
the email id's which are banned are stored in this file
23) chroot_list_enable = yes
used to change root directory (i.e. starting point of user home directory) of user.
24) chroot_list_file = /etc/vsftpd.chroot_list
this file includes users who are allowed to run chroot
25) # ls_rescue_enable = yes
used to disable 'ls -R' command.
26) Pam_Service_name = vsftpd
pam is nothing but pluggable authentication module.
27) userlist_enable = yes
enter the user names whom you want to allow ftp or deny ftp in '/etc/vsftpd.user' file.
28) Listen = yes
it decides whether to accepts packets on network card or port.
29) tcp_wrappers = yes
it wraps the ftp packets into tcp protocol and sends, coz transfer layer protocol is tcp.

To start service:
# service vsftpd start

then open a terminal and give command-
#ftp

username = anonymous
password = blank (no password)


ftp> ls
you will see pub directory.
Now to accept a file from other machine (to download a file)
ftp> get
ftp> bye (to exit ftp)
the file gets downloaded at your last working location.

Now tp upload a file on ftp server...
ftp> put
ftp> bye


by default the anonymous user is not having permission for uploading a file. You can give it using vsftpd.conf file.

Saturday, March 6, 2010

CRYPTOGRAPHY

Cryptography is the study of hidden information. An application of cryptography includes ATM cards, computer passwords, Electronic commerce etc.
It is nothing but encryption. A cipher is a pair of algorithms which create the encryption and the decryption. The detailed operation of cipher is controlled by both algorithm and keys. The key is secret parameters without which cipher can easily break.

History: Cryptography was concerned with message confidentiality (i.e., encryption). It is nothing but conversion of messages from a comprehensible form into an incomprehensible one and back again at the other end, rendering it unreadable by interceptors or eavesdroppers without secret knowledge (namely the key needed for decryption of that message).

Authentication: It is the process by which you can verify that someone is who they claim they are. This usually involves a username and password. It also include other method of identity such as a smart card, retina card, voice recognition, finger prints etc.

Authorization: it is the process of finding out if the person, once identified is permitted to have the resource. It can be known by finding out whether that person is a part of a particular group, if that person has paid admission or has a particular level of security clearance.

TEMPEST: TEMPEST is a codename referring to investigations and studies of compromising emanations. Compromising emanations are defined as unintentional intelligence bearing signals which if intercepted and analyzed, may disclose the information transmitted, received, handled or otherwise processed by any information processing equipment.

Worm: computer worms are developed by Robert Morris in 1988. worm is send to a computer by mail. It then copies itself and then send copy after copy on to other computer. Initially the worms were designed for good intent. The worms try to download and install patches from Microsoft’s website to fix problems in the host computer. They download patches and install it and reboot the host without help of computer’s user.
Worms work without user intervention. It does not attach itself to an existing program. Worms almost always cause at least some harm to network by consuming bandwidth. Whereas viruses always corrupt or modify files on targeted computer. Worms are designed to spread and don’t attempt to modify systems, but ‘Morris worm’ and ‘my doom’ showed that network traffic can often cause major disruption.
‘Payload’ is a worm code designed to do more than spreading. It might delete files on a host system. It can also encrypted files & send via email. Worm writers can get a list of IP addresses of infected of infected machines.

Trojan Horse: A Trojan horse is a non self replicating malware that appears to perform a desirable function for the user but instead facilitates unauthorized access to the users computer system.
Purpose and operation: Trojan horses are designed to allow a hacker remote access to a target computer system. Once a Trojan horse has been installed on a target computer system, it is possible for a hacker to access it remotely and perform various operations. The operations that a hacker can perform are limited by user privileges on the target computer system and the design of the Trojan horse. Operations could be performed by a hacker on a target computer system include:
1) Use of the machine as part of a botnet (i.e. to perform spamming or to perform Distributed Denial-of-service (DDoS) attacks)
2) Data theft (e.g. passwords, credit card information, etc.)
3) Installation of software (including other malware)
4) Downloading or uploading of files
5) Modification or deletion of files
6) Keystroke logging
7) Viewing the user's screen
8) Wasting computer storage space
Trojan horses require interaction with a hacker to fulfill their purpose, though the hacker need not be the individual responsible for distributing the Trojan horse. In fact, it is possible for hackers to scan computers on a network using a port scanner in the hope of finding one with a Trojan horse installed, that the hacker can then use to control the target computer.

Installation and distribution: Trojan horses can be installed through the following methods:
1) Software downloads (i.e. a Trojan horse included as part of a software application downloaded from a file sharing network)
2) Websites containing executable content (i.e. a Trojan horse in the form of an ActiveX control)
3) Email attachments
4) Application exploits (i.e. flaws in a web browser, media player, messaging client, or other software that can be exploited to allow installation of a Trojan horse)
Some compilers also contain Trojans.


Multilevel Security [MLS]

It is the application of a computer system to process information with different sensitive or security levels, permit simultaneous access by users with different security clearances & needs to know & prevent users from obtaining access to information for which they lack authentication.

1) MLS as a Security Environment or Security mode:
A community whose users have differing security clearances may perceive MLA as a data sharing capability. A system should not be operated in a mode for which it is not worthy of trust.

2) MLS as capability:Developers & products or systems intended to allow MLS data sharing tend to loosely perceive it in terms of a capability to enforce data sharing restrictions or a security policy. A system is MLS capable if it is shown to robustly implement a security policy.

Types of Cryptographic functions:

1) Symmetric Key Cryptography:Symmetric key cryptography refers to encryption methods in which both the sender & receiver share the same key. The Modern study of symmetric key ciphers relates mainly to the study of block ciphers & stream ciphers.
a) Block Ciphers: It takes an input a block of plain text & a key and output a block of cipher text of the same size. E.g. DES [Data Encryption Standard], AES [Advanced Encryption Standards].
b) Stream Ciphers: It creates an ordinary long stream of key material, which is combined with plaintext bit-by-bit or character-by-character. In stream cipher output stream is created based on a hidden internal state, which changes as the cipher operates.

c) Cryptographic Hash Functions: They take a message of any length as input & output a short fixed length hash which can be used in digital signature.
Good Hash Functions: An attacker can’t find 2 messages that produce same hash.
E.g. MD4, MD5

2) Public Key Cryptography:Symmetric key cryptosystems use the same key for encryption & decryption of a message, though a message or a group of messages may have a different key than others.
In public key cryptosystems the public key is typically used for encryption, while the private or secret key is used for decryption. It is also used for a digital signature. They are easy for a user to produce & different for anyone else to break.
Hash Function: A hash function is any well-defined procedure or mathematical function that converts a large, possibly variable sized data into a small datum, usually a single integer that may same as an index or array.
The values returned by hash function are called, “ hash values”, “hash codes”, “hash sums”, or “hashes”.
Hash functions are used to finding items in a data table, detecting duplicate or similar records in a large file, finding similar stretches in DNA sequences etc.

Applications:

1) Hash Tables: used to quickly locate a data record given its search key.

2) Caches: used for large datasets stored in slow media.

3) Finding duplicate records: these are the same records with different key.

4) Finding similar records: Records are not identical but key is identical.

Properties of a Good Hash Function:

a) Low Cost: numbers of comparisons with keys are treated as cost of hash function.
b) Determination: for a given input value it must always generate same hash value.
c) Uniformity: every hash value in the output range shall be generated with roughly the same probability.
d) Data Normalization.
e) Continuity: the hash function used to search the data must be as continuous as possible. The inputs that differ by a little should be mapped to equal or nearly equal hash values.

Hash Function Algorithms:

1) Trivial Hash Function:
If the datum to be hashed is small enough, one can use the datum itself as the hashed value. For a PC having 1Gb memory 30 bits of hash values required.

2) Perfect Hashing: A hash function that maps each valid input to a different hash is said to be perfect. Direct location of desired entries is possible.

3) Minimal Perfect Hashing: A perfect hash function for ‘n’ keys is said to be minimal if its range consists of ‘n’ consecutive integers.



Cookie


A cookie is also called as a web cookie, browser cookie or a HTTP Cookie. In computing , a cookie is a small piece of text stored on a user computer by a web browser. Cookie consists of one or more name value pairs containing bits of information such as user preferences, session identifier & other data used by websites.

A cookie can be used for authenticating, session tracking (session maintenance) & remembering specific information about users, such as site preferences. Coolies are simple piece of text hence not executable. As they allow users to be tracked when they visit various sites, cookies are detected by many anti-spyware products.

Uses: - 1) Session Management: Cookies may be used to maintain data related to the user during navigation, possibly across multiple visits. Allowing users to log in to a website is a frequent use of cookies. Typically the web server will first send a cookie containing a unique session identifier. Users then submit their credentials and the web application authenticates the session and allows the user access to services.

2) Personalization: Cookies may be used to remember the information about the user who has visited a website in order to show relevant content in the future. For example a web server may send a cookie containing the username last used to log in to a web site so that it may be filled in for future visits.

Many websites use cookies for personalization based on users' preferences. Users select their preferences by entering them in a web form and submitting the form to the server. The server encodes the preferences in a cookie and sends the cookie back to the browser. This way, every time the user accesses a page, the server is also sent the cookie where the preferences are stored, and can personalize the page according to the user preferences.

3) Tracking: Tracking cookie used to track internet users using the IP address of computer requesting the page. This can be done for example as follows:

a) if the user request a page of the site, but server presumes that this is the first page visited by the user, the server creates a random string & sends it as a cookie back to the browser together with the requested page.

b) from this point on, the cookie will be automatically sent by the browser to the server every time a new page from the page as usual, but also stores the URL of the requested page, the date n time of the request & the coolie in a log file

4) Third Party Cookies: websites contain advertise from different sources these are called as third party cookies. When viewing a Web page, images or other objects contained within this page may reside on servers besides just the URL shown in your browser. While rendering the page, the browser downloads all these objects. Most modern websites that you view contain information from lots of different sources. For example, if you type www.domain.com into your browser, widgets and advertisements within this page are often served from a different domain source. While this information is being retrieved, some of these sources may set cookies in your browser. First-party cookies are cookies that are set by the same domain that is in your browser's address bar. Third-party cookies are cookies being set by one of these widgets or other inserts coming from a different domain. Modern browsers, such as Mozilla Firefox, Internet Explorer and Opera, by default, allow third-party cookies, although users can change the settings to block them. There is no inherent security risk of third-party cookies (they do not harm the user's computer) and they make lots of functionality of the web possible, however some internet users disable them because they can be used to track a user browsing from one website to another. This tracking is most often done by on-line advertising companies to assist in targeting advertisements.

Internet Explorer stores 300 cookies of 4 kb each. Cookies with expiration date are called, ‘ Persistent’. These cookies survive across session. Cookie may also contain expiration date, a path, and a domain name whether intend encrypted connections.

Drawbacks:

1) In accurate Identification: if more than one browser is used on a computer, each usually has a separate storage area for cookies. Hence cookies do not identify a person, but a combination of user account, a computer & a web browser. Thus anyone who uses multiple accounts, computers, browsers has multiple sets of cookies. Cookies do not differentiate between multiple users sharing same user account.

2) Cookie Hijacking: cookie theft is the act of intercepting cookies by an unauthorized party. Session Hijacking : using programs called,’ packet sniffers’ attacker reads cookies. Cross site scripting: attacker sends a html code to the advertise or active content.

3) Cookie theft: The cookie specifications constrain cookies to be sent back only to the servers in the same domain as the server from which they originate. However, the value of cookies can be sent to other servers using means different from the Cookie header. In particular, scripting languages such as JavaScript and JScript are usually allowed to access cookie values and have some means to send arbitrary values to arbitrary servers on the Internet. These facts are used in combination with sites allowing users to post HTML content that other users can see. As an example, an attacker running the domain example.com may post a comment containing the following link to a popular blog they do not otherwise control:

Click here!

When another user clicks on this link, the browser executes the piece of code within the onclick attribute, thus replacing the string document.cookie with the list of cookies of the user that are active for the page. As a result, this list of cookies is sent to the example.com server, and the attacker is then able to collect the cookies of other users.

This type of attack is difficult to detect on the user side because the script is coming from the same domain that has set the cookie, and the operation of sending the value appears to be authorized by this domain. It is usually considered the responsibility of the administrators running sites where users can post to disallow the posting of such malicious code.

Cookies are not directly visible to client-side programs such as JavaScript if they have been sent with the HttpOnly flag. From the point of view of the server, the only difference with respect of the normal case is that the set-cookie header line is added a new field containing the string `HttpOnly':

Set-Cookie: RMID=732423sdfs73242; expires=Fri, 31-Dec-2010 23:59:59 GMT; path=/; domain=.example.net; HttpOnly

When the browser receives such a cookie, it is supposed to use it as usual in the following HTTP exchanges, but not to make it visible to client-side scripts.

4) Cookie Poisoning: Cookie must be unchanged, but attacker modifies the value of the cookies before sending them back to the server it is called, ‘cookie poisoning’.

5) Cross site cooking: it is similar to cookie poisoning, but attacker adds code to the browsers.

Cookie expiry

Persistent cookies have been criticized by privacy experts for not being set to expire soon enough, and thereby allowing websites to track users and build up a profile of them over time. This aspect of cookies also compounds the issue of session hijacking, because a stolen persistent cookie can potentially be used to impersonate a user for a considerable period of time.

Saturday, April 4, 2009

Firewall

Firewall
A firewall is an integrated collection of security measures designed to prevent unauthorized electronic access to a networked computer system. It is also a device or set of devices configured to permit, deny, encrypt, decrypt, or proxy all computer traffic between different security domains based upon a set of rules and other criteria.
A system designed to prevent unauthorized access to or from a private network. Firewalls can be implemented in both hardware and software, or a combination of both. Firewalls are frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets. All messages entering or leaving the intranet pass through the firewall, which examines each message and blocks those that do not meet the specified security criteria.
There are several types of firewall techniques:
Packet filter: Looks at each packet entering or leaving the network and accepts or rejects it based on user-defined rules. Packet filtering is fairly effective and transparent to users, but it is difficult to configure. In addition, it is susceptible to IP spoofing.
Application gateway: Applies security mechanisms to specific applications, such as FTP and Telnet servers. This is very effective, but can impose a performance degradation.
Circuit-level gateway: Applies security mechanisms when a TCP or UDP connection is established. Once the connection has been made, packets can flow between the hosts without further checking.
Proxy server: Intercepts all messages entering and leaving the network. The proxy server effectively hides the true network addresses.

Wednesday, April 1, 2009

( Reference www.Wikipedia.com)
Red Hat, Inc. (NYSE: RHT) is a company in the free and open source software sector, and a major Linux distribution vendor. Founded in 1995, Red Hat has its corporate headquarters in Raleigh, North Carolina with satellite offices worldwide.
Red Hat has become associated to a large extent with its enterprise operating system Red Hat Enterprise Linux and with the acquisition of open-source enterprise middleware vendor JBoss. Red Hat provides operating-system platforms along with middleware, applications, and management products, as well as support, training, and consulting services.

<<<--- GOING PAST :
In 1993 Bob Young incorporated the ACC Corporation, a catalog business that sold Linux and UNIX software accessories. In 1994 Marc Ewing created his own Linux distribution, which he named Red Hat Linux. Ewing released it in October, and it became known as the Halloween release. Young bought Ewing's business in 1995, and the two merged to become Red Hat Software, with Young serving as chief executive officer (CEO).
Red Hat went public on August 11, 1999, the eighth-biggest first-day gain in the history of Wall Street.[5] Matthew Szulik succeeded Bob Young as CEO in November of that year.

On November 15, 1999, Red Hat acquired Cygnus Solutions. Cygnus provided commercial support for free software and housed maintainers of GNU software products such as the GNU Debugger and GNU Binutils. One of the founders of Cygnus, Michael Tiemann, became the chief technical officer of Red Hat and by 2008[update] the vice president of open source affairs. Later Red Hat acquired WireSpeed, C2Net and Hell's Kitchen Systems.
In February 2000, InfoWorld awarded Red Hat its fourth consecutive "Operating System Product of the Year" award for Red Hat Linux 6.1. Red Hat acquired Planning Technologies, Inc in 2001 and in 2004 AOL's iPlanet directory and certificate-server software.
Red Hat moved its headquarters from Durham, NC, to N.C. State University's Centennial Campus in Raleigh, North Carolina in February 2002. In the following month Red Hat introduced the first enterprise-class Linux operating system: Red Hat Advanced Server, later re-named Red Hat Enterprise Linux (RHEL). Dell, IBM, HP and Oracle Corporation announced their support of the platform.
In December 2005 CIO Insight magazine conducted its annual "Vendor Value Survey", in which Red Hat ranked #1 in value for the second year in a row. Red Hat stock became part of the NASDAQ-100 on December 19, 2005.
Red Hat acquired open-source middleware provider JBoss on June 5, 2006 and JBoss became a division of Red Hat. In 2007 Red Hat acquired MetaMatrix and made an agreement with Exadel to distribute its software. On September 18, 2006, Red Hat released the Red Hat Application Stack, the first certified stack integrating JBoss technology. On December 12, 2006, Red Hat moved from NASDAQ (RHAT) to the New York Stock Exchange (RHT).
On March 15, 2007, Red Hat released Red Hat Enterprise Linux 5, and in June acquired Mobicents. On March 13, 2008, Red Hat acquired Amentra, a provider of systems integration services for service-oriented architecture, business process management, systems development and enterprise data services. Amentra operates as an independent Red Hat company.
Utilities and tools :
Over and above Red Hat's major products and acquisitions, Red Hat programmers have produced software programming tools and utilities to supplement standard Unix and Linux software. Some of these Red Hat "products" have found their way from specifically Red Hat operating environments via open-source channels to a wider community. Such utilities include:
1) Disk Druid (for disk partitioning)
2) rpm (for package management)
3) sos (for gathering information on system hardware and configuration)
4) sysreport (gathers system hardware and configuration details)
5) systemtap (tracing tool for linux kernel)
The Red Hat web site has a list of their major involvements in free and open source software projects.