Case Study: SSH / FTP Honeypot

I have been reviewing my auth.log file on my server and have been noticing an increasing amount of breakin attempts to my FTP and SSH servers. The IPs the attacks generate from can be traced back to China, Russia or South America using a reverse ip lookup. I am sure this is just a proxy the attacker is using to mask his real location.  I can only speculate as to the intention of these various attackers. My hypothesis is the attackers are trying to create a botnet they can use for phishing / spam/ DDoS attacks.

My plan is to create a virtual machine  using VirtualBox with LAMP, FTP and SSH installed.

It will be located in a DMZ (all ports open)

I will create accounts with easily hackable passwords  such as: username admin / password: admin ; username: admin / password: password

If things get really out of hand  I can just close the virtual machine or just take the IP out of the DMZ and back behind my firewall. I will be starting on this project very soon. Once it gets going I will copy some of the output from my log files so it can be shown exactly what these guys are trying to do.  Look for an update soon.

  • Share/Bookmark

Comments (1)

How to install Joomla on Ubuntu 10.04 LTS

Joomla is an open source CMS (Content Management System) that can be easily used to be professional looking dynamic websites.  It is a little more advanced than Wordpress ; however, once you learn how to use the interface and search for plugins in the Joomla Extensions Directory, you will be cranking out websites in no time at all.  When most people install Ubuntu they do it via a “1-click install” method from their webhost such as Dreamhost of Hostgator. The first time I ever installed Joomla on a web server it was from this method and I must say it was quite painless. However, if you do not want to pay for hosting, or want to install it on your home webserver or local machine, there are a few steps that are not easily defined in the installation manual. The main problem I had with the installation of Joomla 1.5.17 on my home web server was file permissions.

Prerequisites:

1. Ubuntu 10.04 LTS Server or Desktop (Download it for free from here.)

2. LAMP Package  (You can find info in this here)

3. Joomla Installation Package (make sure to get the latest in tar.gz format)

4. Basic understand of Linux command line interface

Before you start the installation you should create a MYSQL database for your Joomla installation to use. Refer to the link in Prerequisite 2 for details on how to do this.

Once you have the package downloaded, you can either place the installation file in your /var/www directory or you can make a subdirectory by typing mkdir /var/www/joomla at the command prompt. If you choose to make a subdirecotry make sure to put the proper permission on it with chmod 755  joomla

After the directory is made copy the code below into an editor

#!/bin/bash

# Created May 20, 2010
# Written by: Ron Messana
# change variable below to the install package being used
JOOMLA="Joomla_1.5.17-Stable-Full_Package.tar.gz"
tar -vxpzf $JOOMLA
chmod -c 777 administrator/backups/
chmod -c 777 administrator/components/
chmod -c 777 administrator/language/
chmod -c 777 administrator/language/en-GB/
chmod -c 777 administrator/modules/
chmod -c 777 administrator/templates/
chmod -c 777 components/
chmod -c 777 images/
chmod -c 777 images/banners/
chmod -c 777 images/stories/
chmod -c 777 language/
chmod -c 777 language/en-GB/
chmod -c 777 language/pdf_fonts/
chmod -c 777 media/
chmod -c 777 modules/
chmod -c 777 plugins/
chmod -c 777 plugins/content/
chmod -c 777 plugins/editors/
chmod -c 777 plugins/editors-xtd/
chmod -c 777 plugins/search/
chmod -c 777 plugins/system/
chmod -c 777 plugins/user/
chmod -c 777 plugins/xmlrpc/
chmod -c 777 templates/
chmod -c 777 cache/
chmod -c 777 administrator/cache/
chmod -c 777 logs/
chmod -c 777 tmp/
echo ""
echo "creating configuration.php"
echo ""
touch configuration.php
echo "making configuration.php writable"
chmod 666 configuration.php
echo ""
echo ""
echo "fin"

**** Make sure to change the JOOMLA variable to list the name of the current package you are trying to install ***

Once you have that code save it to a filename you can remember such as joomlainstall.sh  and place it into the same directory you have your joomla installation tar.gz file. You then want to make that script executable with chmod +x joomlainstall.sh

You now have a script that you can use to unpack Joomla , create a writable configuration.php file and  prepare the necessary directories for installation.

Execute the script  by typing .  joomlainstall.sh

You will now see all of the files unpack and directories change to permission 777

By changing the directory permission to 777 you will avoid the issue of not being able to install plugins/modules.

Now navigate your web browser to the directory you unpacked the files to and the installation will begin.

The installation will now begin. Be sure to read  the Licensing Agreement and and proceed past it. When asked for the Database information choose MYSQL and enter your database usernmame, password and database name. You should be able to use ‘localhost’ for the location of the database.

Once the install finished you will be forced to delete the /installation directory. Once the directory is deleted you can then use Joomla!

If this is just a development/test installation that has no access from the outside world you can leave your file permissions at 777 for those directories.  If this install goes into production on the web you will want to change the permissions back to 755 for security. You can use the script below to do that.

#!/bin/bash
chmod -c 755 administrator/backups/
chmod -c 755 administrator/components/
chmod -c 755 administrator/language/
chmod -c 755 administrator/language/en-GB/
chmod -c 755 administrator/modules/
chmod -c 755 administrator/templates/
chmod -c 755 components/
chmod -c 755 images/
chmod -c 755 images/banners/
chmod -c 755 images/stories/
chmod -c 755 language/
chmod -c 755 language/en-GB/
chmod -c 755 language/pdf_fonts/
chmod -c 755 media/
chmod -c 755 modules/
chmod -c 755 plugins/
chmod -c 755 plugins/content/
chmod -c 755 plugins/editors/
chmod -c 755 plugins/editors-xtd/
chmod -c 755 plugins/search/
chmod -c 755 plugins/system/
chmod -c 755 plugins/user/
chmod -c 755 plugins/xmlrpc/
chmod -c 755 templates/
chmod -c 755 cache/
chmod -c 755 administrator/cache/
chmod -c 755 logs/
chmod -c 755 tmp/


When you want to install modules just change all of the 755 to 777 and run the script. Don’t forget to change it back to 755 once you are done installing your plugins/modules!

  • Share/Bookmark

Comments (3)

How to make your own Joomla / Wordpress Templates with Artisteer

A couple months ago I was looking for a template to use for one of my Joomla sites I was building. I searched high and low, but could not anything that really fit the site I was making. I eventually stumbled across Artisteer. This is a Windows-based application that allows you to customize the template you are looking to make. Here are some of the product’s best features in my opinion

  • You can control everything from page width to transparency
  • There are plenty of color schemes and stock photos to choose from.
  • It is VERY user friendly.
  • If you need help, there is a free support forum that delivers timely and accurate responses
  • There is a free evaluation copy you can use to test it out.
  • It also has support for Drupal, HTML, ASP.NET ,  and Blogger templates
  • You do not have to search the web for hours looking around for premade templates

The evaluation copy will place watermarks on all of the images the program generates for you ; however, you will still be able to experience how powerful the application is. If you decide you like it, you can buy it. If you do not see the value, you can easily uninstall cleanly through Add/Remove. This product is a must-have for Webmasters, Affiliate Marketers, or small business owners looking to design their own website.

Click Here to check it out

  • Share/Bookmark

Comments (2)

Linux BASH Backup to FTP Script

The other day  I was trying to figure out how I can automate my backup process on my Ubuntu boxes, so I ventured out into Google and started searching for some scripts that someone else with the same goals might have written.  I found  a few different scripts ; however, none of them did what I wanted them to do, or they did not work. This was my first attempt at making a BASH script.  As a kid I used to make DOS batch files all day, doing all sorts of silly things, so making this script brought back some good memories.

This script backs up certain directories in your /home/user folder. In my script, I only have it backing up my /home/ron/Desktop and /home/ron/Documents, this those are the two directories I use the most.  As you see below, the script compresses the folders in a nice tar.gz file, date stamps the file, then uploads it to a remote FTP.

Here it is


#!/bin/bash
#  Individual Directory Backup Script

#  Created December 23, 2009

#  Last edited December 23, 2009
#  Written by: Ron Messana
#
# Backup TimeStamp
BUTDSTAMP=$(date +%Y%m%d)
# System Identifier
SYSTEM="ron-laptop"
# Directories to Backup // MAKE SURE YOU CHANGE THE MPUT AND TAR.GZ LINE WHEN ADDING/REMOVING DIRECTORIES TO BE BACKED UP
DIR1="/home/ron/Desktop"
DIR1NICK="desktop"
DIR2="/home/ron/Documents"
DIR2NICK="documents"
DIR3=""
DIR3NICK=""
DIR4=""
DIR4NICK=""
DIR5=""
DIR5NICK=""
# ftp credentials
USERNAME="username"
PASSWORD="password"
# ftp server hostname
SERVER="ftp.server.com"
# local directory to pickup *.tar.gz file
FILE="/home/ron/backup"
# remote server directory to upload backup
BACKUPDIR="/bu"
clear
echo "            DIRECTORY BACKUP SCRIPT STARTING"
echo "                BACKING UP $DIR1"
echo "                BACKING UP $DIR2"
echo ""
echo ""
echo ""
echo ::
# Compressing directories as a tar gzip file // CHANGE LINES TO CORRESPONG WITH THE AMOUNT OF DIRECTORIES BEING BACKED UP
tar -pzcvf $SYSTEM-$DIR1NICK-$BUTDSTAMP.tar.gz $DIR1
tar -pzcvf $SYSTEM-$DIR2NICK-$BUTDSTAMP.tar.gz $DIR2
ls *.tar.gz
mv *.tar.gz /home/ron/backup
#
# login to remote server // CHANGE MPUT LINE(s) TO CORRESPOND WITH THE AMOUNT OF DIRECTORIES BEING BACKED UP
echo ""
echo ""
echo "Uploading to $SERVER via FTP"
echo "Please wait, this may take some time, depending on your connection speed"
echo ""
ftp -n -i $SERVER <<EOF
user $USERNAME $PASSWORD
cd $BACKUPDIR
lcd $FILE
mput $SYSTEM-$DIR1NICK-$BUTDSTAMP.tar.gz
mput $SYSTEM-$DIR2NICK-$BUTDSTAMP.tar.gz
quit
EOF
echo ""
echo " Removing local archives"
echo ""
rm /home/ron/backup/*.tar.gz
echo " Finished"
#
#
#

Linux Backup Script

  • Share/Bookmark

Comments (1)

Initial Blog Post

So I decided to make a blog (again). This domain has had multiple purposes throughout the year I have owned it.  Primarily it has been a sandbox for me to play around in. Today I decided to make a blog where I can discuss the various things that interest me.  I will mostly discuss topics of Web Design, Linux and Video Games. I am always tinkering with something, and will start to document my adventures here.

I made the decision to use WordPress because it is highly stable, SEO friendly and has massive plugin support. Just about anything you ever wanted to do, you can do with Wordpress.  I’m going to start typing now, so I can install the All in ONE SEO pack , and setup Google Analytics.

  • Share/Bookmark

Comments (2)