fsniper init script on Centos

Create a file name  "fsniper"  and add below content

[root@fsniper-1.3.1] vim /etc/init.d/fsniper


export HOME=/root

case "$1" in
start)
echo -n "Starting Fsniper: "
/usr/local/bin/fsniper --daemon
echo -e "... [ \e[00;32mOK\e[00m ]"
;;
stop)
echo -n "Shutdown Fsniper: "
kill -9 `ps aux | grep "fsniper --daemon" | grep -v grep | awk {'print $2'}`
echo -e "... [ \e[00;32mOK\e[00m ]"
;;
restart)
$0 stop
sleep 1
$0 start
;;
*)
echo "Usage: `basename $0` start|stop|restart"
exit 1
esac

exit 0

that's it, save and exit.

use below command to set execute permission for /etc/init.d/fsniper file

[root@fsniper-1.3.1] chmod +x /etc/init.d/fsniper


Start the fsniper service using below command

[root@fsniper-1.3.1] service fsniper start

or

[root@fsniper-1.3.1] /etc/init.d/fsniper start

After started the fsniper, we can check the fsniper process whether running or not

[root@fsniper-1.3.1] ps -aux | grep fsniper

Warning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.8/FAQ
root      2788  0.0  0.0  13588  1412 ?        S    Jul19   0:00 /usr/local/bin/fsniper --daemon
root     17060  0.0  0.0 103248   896 pts/2    S+   20:20   0:00 grep fsniper

[root@fsniper-1.3.1] 

How to install and Configure Fsniper on Centos

Fsniper is a useful tool for directory monitor, and execute predefined actions on files created or modified in that directory

Fsniper Installation

First we need to install require package for Fsniper

[root@manivel ~]# yum install file-libs file-devel pcre pcre-devel

Download Fsniper source blow link

[root@manivel ~]# wget http://projects.l3ib.org/fsniper/files/fsniper-1.3.1.tar.gz

[root@manivel ~]# tar xzf fsniper-1.3.1.tar.gz

[root@manivel ~] cd fsniper-1.3.1/

Compile and Install Fsniper  from source using below command

[root@fsniper-1.3.1] ./configure
[root@fsniper-1.3.1] make
[root@fsniper-1.3.1] make install

Fsniper Configuration

Open fsniper config file and change the path which directory need to monitor

[root@fsniper-1.3.1] vim /root/.config/fsniper/config


watch {
   # watch the "/test/django/test/media" directory for new files
   /test/django/test/media {
       recurse = true
       # matches any file ending with .php
       *.php {
           # remove files with extension .php
           handler = rm -f %%
       }
       *.html {
           # remove files with extension .html
           handler = rm -f %%
       }
       *.htm {
           # remove files with extension .htm
           handler = rm -f %%
       }
   }


Start Fsniper as Daemon using below command


[root@manivel ~]# fsniper --daemon

We can check the fsniper process id

[root@manivel ~]# pgrep fsniper
13080
[root@manivel ~]#

Logrotate Configuation for iptables on Centos

Create a file 'iptables' inside  /etc/logrotate.d/ and give it a little content

[root@test]# vim /etc/logrotate.d/iptables

 /var/log/iptables/iptables.log
{
        weekly
        missingok
        notifempty
        delaycompress
        postrotate
                invoke-rc.d rsyslog reload > /dev/null
        endscript
}

Now restart the rsyslog service using below command

[root@test]# service rsyslog restart
Shutting down system logger:                               [  OK  ]
Starting system logger:                                    [  OK  ]
[root@test]#

OSSIM

OSSIM – Open Source Security information management

Logging iptables to a Separate File on Centos

Here i will show you how to make iptables log to a separate file on centos.

First i will create a folder for iptables log

        [root@test]# mkdir /var/log/iptables/

Now i need to  create a file "/etc/rsyslog.d/iptables.conf " and give it a little content

        [root@test]# vim /etc/rsyslog.d/iptables.conf

            :msg, startswith, "iptables: " -/var/log/iptables/iptables.log
            &~

Open your rsyslog.conf file and modify below things

        [root@test]# vim /etc/rsyslog.conf

           # Don't log private authentication messages!
           *.info;mail.none;authpriv.none;cron.none;kern.none       /var/log/messages


          # iptables log
           kern.*                            /var/log/iptables/iptables.log


use below command to restart the rsyslog

[root@test]# service rsyslog restart
Shutting down system logger:                               [  OK  ]
Starting system logger:                                    [  OK  ]
[root@test]# 

Now you can see all the iptables message logged to a separate file "iptables.log"

 [root@test]# tailf /var/log/iptables/iptables.log

Feb 09 23:39:46 test kernel: iptables_InvalidDrop IN=eth0 OUT= MAC=38:60:77:ef:df:d8:00:26:88:75:e7:84:08:00 SRC=83.243.58.157 DST=192.168.1.100 LEN=40 TOS=0x00 PREC=0x00 TTL=56 ID=0 DF PROTO=TCP SPT=57543 DPT=80 WINDOW=0 RES=0x00 RST URGP=0
 
Feb 09 23:39:46 test kernel: iptables_InvalidDrop IN=eth0 OUT= MAC=38:60:77:ef:df:d8:00:26:88:75:e7:84:08:00 SRC=83.243.58.157 DST=192.168.1.100 LEN=40 TOS=0x00 PREC=0x00 TTL=56 ID=0 DF PROTO=TCP SPT=57543 DPT=80 WINDOW=0 RES=0x00 RST URGP=0
 
Feb 09 23:39:46 test kernel: iptables_InvalidDrop IN=eth0 OUT= MAC=38:60:77:ef:df:d8:00:26:88:75:e7:84:08:00 SRC=83.243.58.157 DST=192.168.1.100 LEN=40 TOS=0x00 PREC=0x00 TTL=56 ID=0 DF PROTO=TCP SPT=57543 DPT=80 WINDOW=0 RES=0x00 RST URGP=0
 
Feb 09 23:39:46 test kernel: iptables_InvalidDrop IN=eth0 OUT= MAC=38:60:77:ef:df:d8:00:26:88:75:e7:84:08:00 SRC=83.243.58.157 DST=192.168.1.100 LEN=40 TOS=0x00 PREC=0x00 TTL=56 ID=0 DF PROTO=TCP SPT=57543 DPT=80 WINDOW=0 RES=0x00 RST URGP=0
 
Feb 09 23:39:46 test kernel: iptables_InvalidDrop IN=eth0 OUT= MAC=38:60:77:ef:df:d8:00:26:88:75:e7:84:08:00 SRC=83.243.58.157 DST=192.168.1.100 LEN=40 TOS=0x00 PREC=0x00 TTL=56 ID=0 DF PROTO=TCP SPT=57543 DPT=80 WINDOW=0 RES=0x00 RST URGP=0

AIDE Installation and Configuration on Centos

AIDE stands for Advance Intrustion Detection Environment. AIDE  is a file and directory integrity checker.

AIDE Installation

I installed aide using yum command

[root@mail-server ~]# yum install aide

Loaded plugins: fastestmirror, security
Loading mirror speeds from cached hostfile
epel/metalink                                            | 5.4 kB     00:00    
 * base: mirrors.kernel.org
 * epel: mirrors.vinahost.vn
 * extras: centosg4.centos.org
 * updates: centosi3.centos.org
base                                                                                                                                             | 3.7 kB     00:00    
extras                                                                                                                                           | 3.4 kB     00:00    
updates                                                                                                                                          | 3.4 kB     00:00    
updates/primary_db                                                                                                                               | 1.4 MB     00:07    
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package aide.x86_64 0:0.14-3.el6_2.2 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

========================================================================================================================================================================
 Package                              Arch                                   Version                                         Repository                            Size
========================================================================================================================================================================
Installing:
 aide                                 x86_64                                 0.14-3.el6_2.2                                  base                                 123 k

Transaction Summary
========================================================================================================================================================================
Install       1 Package(s)

Total download size: 123 k
Installed size: 297 k
Is this ok [y/N]: y
Downloading Packages:aide-0.14-3.el6_2.2.x86_64.rpm                                                                                                                   | 123 kB     00:01    
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
  Installing : aide-0.14-3.el6_2.2.x86_64                                                                                                                           1/1
  Verifying  : aide-0.14-3.el6_2.2.x86_64                                                                                                                           1/1

Installed:
  aide.x86_64 0:0.14-3.el6_2.2                                                                                                                                         

Complete!
[root@mail-server ~]#

Otherwise you can download and Install from this link  http://sourceforge.net/projects/aide/files/latest/download

 

Configuration

I copped aide.conf for testing purpose from main configuration file /etc/aide.conf

[root@mail-server ~]# cp /etc/aide.conf /root/

[root@mail-server ~]# cat /root/aide.conf

# Example configuration file for AIDE.

@@define DBDIR /var/lib/aide   ---->  This is the Database directory (you can change the directory path )
@@define LOGDIR /var/log/aide 
---->  This is the Log directory (you can change the log path )
 

# The location of the database to be read.
database=file:@@{DBDIR}/aide.db.gz

 

# The location of the database to be written. #database_out=sql:host:port:database:login_name:passwd:table
#database_out=file:aide.db.new
 

database_out=file:@@{DBDIR}/aide.db.new.gz

# Whether to gzip the output to database
gzip_dbout=yes

# Default.
verbose=5

report_url=file:@@{LOGDIR}/aide.log
report_url=stdout
#report_url=stderr
#NOT IMPLEMENTED report_url=mailto:root@foo.com
#NOT IMPLEMENTED report_url=syslog:LOG_AUTH

# These are the default rules.
#
#p:      permissions
#i:      inode:
#n:      number of links
#u:      user
#g:      group
#s:      size
#b:      block count
#m:      mtime
#a:      atime
#c:      ctime
#S:      check for growing size
#acl:           Access Control Lists
#selinux        SELinux security context
#xattrs:        Extended file attributes
#md5:    md5 checksum
#sha1:   sha1 checksum
#sha256:        sha256 checksum
#sha512:        sha512 checksum
#rmd160: rmd160 checksum
#tiger:  tiger checksum

#haval:  haval checksum (MHASH only)
#gost:   gost checksum (MHASH only)
#crc32:  crc32 checksum (MHASH only)
#whirlpool:     whirlpool checksum (MHASH only)

#R:             p+i+n+u+g+s+m+c+acl+selinux+xattrs+md5
#L:             p+i+n+u+g+acl+selinux+xattrs
#E:             Empty group
#>:             Growing logfile p+u+g+i+n+S+acl+selinux+xattrs

# You can create custom rules like this.
# With MHASH...
# ALLXTRAHASHES = sha1+rmd160+sha256+sha512+whirlpool+tiger+haval+gost+crc32
ALLXTRAHASHES = sha1+rmd160+sha256+sha512+tiger
# Everything but access time (Ie. all changes)
EVERYTHING = R+ALLXTRAHASHES

# Sane, with multiple hashes
# NORMAL = R+rmd160+sha256+whirlpool
NORMAL = R+rmd160+sha256

# For directories, don't bother doing hashes
DIR = p+i+n+u+g+acl+selinux+xattrs

# Access control only
PERMS = p+i+u+g+acl+selinux

# Logfile are special, in that they often change
LOG = >

# Just do md5 and sha256 hashes
LSPP = R+sha256

# Some files get updated automatically, so the inode/ctime/mtime change
# but we want to know when the data inside them changes
DATAONLY =  p+n+u+g+s+acl+selinux+xattrs+md5+sha256+rmd160+tiger

 

# Next decide what directories/files you want in the database.

# I removed all the below rules. I added only /etc directory

# 

/etc    NORMAL    
 

:wq

I initialized the AIDE database using below command

[root@mail-server ~]# aide --init --config=/root/aide.conf

AIDE, version 0.14

### AIDE database at /var/lib/aide/aide.db.new.gz initialized.

[root@mail-server ~]#
Then copy the first time initialized database because next time aide to be read this database.

[root@mail-server ~]# cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

/var/lib/aide/aide.db.new.gz  ---> AIDE to be written

/var/lib/aide/aide.db.gz          ---> AIDE to be read

First time AIDE checking

 [root@mail-server ~]# aide -c /root/aide.conf --check

AIDE, version 0.14

### All files match AIDE database. Looks okay!

[root@mail-server ~]#

Now i created one file inside /etc directory for testing

[root@mail-server ~]# touch /etc/test.txt
 

I checked AIDE next time.It gave the created file details.It is like below

[root@mail-server ~]# aide -c /root/aide.conf --check
 

AIDE found differences between database and filesystem!!
Start timestamp: 2014-01-29 23:08:25

Summary:
  Total number of files:    2079
  Added files:            0
  Removed files:        0
  Changed files:        1
---------------------------------------------------
Changed files:
---------------------------------------------------
 

changed: /etc/test.txt

--------------------------------------------------
Detailed information about changes:
---------------------------------------------------

File: /etc/test.txt
  Mtime    : 2014-01-29 22:32:36              , 2014-01-29 23:08:20
  Ctime    : 2014-01-29 22:32:36              , 2014-01-29 23:08:20
[root@mail-server ~]#

Another MySQL daemon already running with the same unix socket. mysqld failed

Today i restarted mysql service in my machine. It stopped but not starting

[root@backup-server ~]# service mysqld stop
Stopping mysqld:                                           [  OK  ]

[root@backup-server ~]# service mysqld start
Another MySQL daemon already running with the same unix socket.
Starting mysqld:                                           [FAILED]

Just I rename the mysql.sock file after that it is working fine.

[root@backup-server ~]# mv /var/lib/mysql/mysql.sock /var/lib/mysq /mysql.sock.bak

[root@backup-server ~]# service mysqld start
Starting mysqld:                                           [  OK  ]

My issue resolved...

Understanding linux commands

This is very useful site for understanding linux commands.

http://explainshell.com/

Ignore a specific alert for specific IP address in Snort

If we want to ignore a specific snort rule for specific IP or network, we can use "suppression" in threshold.conf file under /etc/snort.

[root@snort rules]# vim /etc/snort/threshold.conf