Archive for May 29, 2010

Case Study: SSH / FTP Honeypot

I have been reviewing my auth.log file on my server and have been noticing an increasing amount of breakin attempts to my FTP and SSH servers. The IPs the attacks generate from can be traced back to China, Russia or South America using a reverse ip lookup. I am sure this is just a proxy the attacker is using to mask his real location.  I can only speculate as to the intention of these various attackers. My hypothesis is the attackers are trying to create a botnet they can use for phishing / spam/ DDoS attacks.

My plan is to create a virtual machine  using VirtualBox with LAMP, FTP and SSH installed.

It will be located in a DMZ (all ports open)

I will create accounts with easily hackable passwords  such as: username admin / password: admin ; username: admin / password: password

If things get really out of hand  I can just close the virtual machine or just take the IP out of the DMZ and back behind my firewall. I will be starting on this project very soon. Once it gets going I will copy some of the output from my log files so it can be shown exactly what these guys are trying to do.  Look for an update soon.

Share

How to install Joomla on Ubuntu 10.04 LTS

Joomla is an open source CMS (Content Management System) that can be easily used to be professional looking dynamic websites.  It is a little more advanced than WordPress ; however, once you learn how to use the interface and search for plugins in the Joomla Extensions Directory, you will be cranking out websites in no time at all.  When most people install Ubuntu they do it via a “1-click install” method from their webhost such as Dreamhost of Hostgator. The first time I ever installed Joomla on a web server it was from this method and I must say it was quite painless. However, if you do not want to pay for hosting, or want to install it on your home webserver or local machine, there are a few steps that are not easily defined in the installation manual. The main problem I had with the installation of Joomla 1.5.17 on my home web server was file permissions.

Prerequisites:

1. Ubuntu 10.04 LTS Server or Desktop (Download it for free from here.)

2. LAMP Package  (You can find info in this here)

3. Joomla Installation Package (make sure to get the latest in tar.gz format)

4. Basic understand of Linux command line interface

Before you start the installation you should create a MYSQL database for your Joomla installation to use. Refer to the link in Prerequisite 2 for details on how to do this.

Once you have the package downloaded, you can either place the installation file in your /var/www directory or you can make a subdirectory by typing mkdir /var/www/joomla at the command prompt. If you choose to make a subdirecotry make sure to put the proper permission on it with chmod 755  joomla

After the directory is made copy the code below into an editor

#!/bin/bash

# Created May 20, 2010
# Written by: Ron Messana
# change variable below to the install package being used
JOOMLA="Joomla_1.5.17-Stable-Full_Package.tar.gz"
tar -vxpzf $JOOMLA
chmod -c 777 administrator/backups/
chmod -c 777 administrator/components/
chmod -c 777 administrator/language/
chmod -c 777 administrator/language/en-GB/
chmod -c 777 administrator/modules/
chmod -c 777 administrator/templates/
chmod -c 777 components/
chmod -c 777 images/
chmod -c 777 images/banners/
chmod -c 777 images/stories/
chmod -c 777 language/
chmod -c 777 language/en-GB/
chmod -c 777 language/pdf_fonts/
chmod -c 777 media/
chmod -c 777 modules/
chmod -c 777 plugins/
chmod -c 777 plugins/content/
chmod -c 777 plugins/editors/
chmod -c 777 plugins/editors-xtd/
chmod -c 777 plugins/search/
chmod -c 777 plugins/system/
chmod -c 777 plugins/user/
chmod -c 777 plugins/xmlrpc/
chmod -c 777 templates/
chmod -c 777 cache/
chmod -c 777 administrator/cache/
chmod -c 777 logs/
chmod -c 777 tmp/
echo ""
echo "creating configuration.php"
echo ""
touch configuration.php
echo "making configuration.php writable"
chmod 666 configuration.php
echo ""
echo ""
echo "fin"

**** Make sure to change the JOOMLA variable to list the name of the current package you are trying to install ***

Once you have that code save it to a filename you can remember such as joomlainstall.sh  and place it into the same directory you have your joomla installation tar.gz file. You then want to make that script executable with chmod +x joomlainstall.sh

You now have a script that you can use to unpack Joomla , create a writable configuration.php file and  prepare the necessary directories for installation.

Execute the script  by typing .  joomlainstall.sh

You will now see all of the files unpack and directories change to permission 777

By changing the directory permission to 777 you will avoid the issue of not being able to install plugins/modules.

Now navigate your web browser to the directory you unpacked the files to and the installation will begin.

The installation will now begin. Be sure to read  the Licensing Agreement and and proceed past it. When asked for the Database information choose MYSQL and enter your database usernmame, password and database name. You should be able to use ‘localhost’ for the location of the database.

Once the install finished you will be forced to delete the /installation directory. Once the directory is deleted you can then use Joomla!

If this is just a development/test installation that has no access from the outside world you can leave your file permissions at 777 for those directories.  If this install goes into production on the web you will want to change the permissions back to 755 for security. You can use the script below to do that.

#!/bin/bash
chmod -c 755 administrator/backups/
chmod -c 755 administrator/components/
chmod -c 755 administrator/language/
chmod -c 755 administrator/language/en-GB/
chmod -c 755 administrator/modules/
chmod -c 755 administrator/templates/
chmod -c 755 components/
chmod -c 755 images/
chmod -c 755 images/banners/
chmod -c 755 images/stories/
chmod -c 755 language/
chmod -c 755 language/en-GB/
chmod -c 755 language/pdf_fonts/
chmod -c 755 media/
chmod -c 755 modules/
chmod -c 755 plugins/
chmod -c 755 plugins/content/
chmod -c 755 plugins/editors/
chmod -c 755 plugins/editors-xtd/
chmod -c 755 plugins/search/
chmod -c 755 plugins/system/
chmod -c 755 plugins/user/
chmod -c 755 plugins/xmlrpc/
chmod -c 755 templates/
chmod -c 755 cache/
chmod -c 755 administrator/cache/
chmod -c 755 logs/
chmod -c 755 tmp/


When you want to install modules just change all of the 755 to 777 and run the script. Don’t forget to change it back to 755 once you are done installing your plugins/modules!

Share