Mariadb secure configuration on CentOS 7

For secure your MariaDB by setting up the following,
1. Set up root password
2. Disabling remote root login
3. Removing test database 
4. Removing anonymous users
Finally reload the privileges.



[root@server ~]# mysql_secure_installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user.  If you've just installed MariaDB, and
you haven't set the root password yet, the password will be blank,
so you should just press enter here.

Enter current password for root (enter for none):
OK, successfully used password, moving on...

Setting the root password ensures that nobody can log into the MariaDB
root user without the proper authorisation.

Set root password? [Y/n] y
New password:
Re-enter new password:
Password updated successfully!
Reloading privilege tables..
 ... Success!


By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] y
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] y
 ... Success!
 
By default, MariaDB comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] y
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] y
 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!
 
[root@server ~]#

[root@server ~]# mysql -u root -p
Enter password:
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 657
Server version: 5.5.60-MariaDB MariaDB Server

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> 


MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
+--------------------+
3 rows in set (0.00 sec)

MariaDB [(none)]>

 

Create files and Directory with Single Linux Command

In linux to create a direcotry use mkdir command and to create a file use touch command.

To create a new directory

[sysads@sysads ~]$  mkdir folder

To create a new directory with sub-directories,

[sysads@sysads ~]$  mkdir -p folder_1/folder_11/folder_111

              -p  ----> --parents (no error if existing, make parent directories as needed )


To create a new directory with multiple sub-directories,

[sysads@sysads ~]$  mkdir -p folder_2/{folder_21,folder_22,folder_23,folder_24,folder_25}

To create a new directory with multiple sub-directories and sub-directories with multiple sub-directories,

[sysads@sysads ~]$  mkdir -p folder_3/{folder_31/{folder_311,folder_312},folder_32,folder_33}


To create an n number of folders where the numbers increment

[sysads@sysads ~]$  mkdir -p folder_100/folder_1{01..20}

To create an n number of files with extension (i.e .txt) where the numbers increment

[sysads@sysads ~]$  touch folder_100/file_1{01..20}.txt

Git Basic Commands

Today we will see some useful Git commands,

To check git version
$ git --version

To set config values
$ git config --global user.name "Manivel Rajendran"
$ git config --global user.email "example@gmail.com"
 

To list config values
$ git config --list

 

To reset the config values

$ rm ~/.gitconfig
 

To getting help with git
$ git help config

   Example :
      $ git config --help
      $ git add --help

Initialize the git
   $ git init

To check status of the file
   $ git status

Add files or folder from working area to staging area

        Add a file or folder  
           $ git add file_name

       Add all files or folder
           $ git add -A

Remove files or folder from working area to staging area

       Remove a file or folder
             $ git reset file_name

       Remove all files or folder
             $ git reset


Commit the change with message
   $ git commit -m "Initial Commit"

To view changes between commits
   $ git diff

To view commit log
   $ git log


List, Create, Merge and Delete branches

       To list the branch
           $ git branch

       To list all the branch (Local and Remote)
           $ git branch -a

       To create a branch
           $ git branch branch_name

       To change one branch to another
           $ git checkout branch_name
      
       To merge a branch with current branch
           $ git merge branch_name

       To check everything merged with current branch
           $ git branch --merged

       To delete branch on local
           $ git branch -d branch_name

       To delete branch on Remote
       $ git push origin --delete branch_name
  


Specifies untracked files in .gitignore

    $ vim .gitignore
         *.pyc
        .htaccess
        documents

Clone a repository into a new directory

     Clone from upstream
         $ git clone https://github.com/manivel23/repository.git  .
 
     Clone from local
          $ git clone  ../repository.git  .


Manage set of tracked repositories

       View remote repository info
            $ git remote -v

       To add a remote repository
            $ git remote add staging https://github.com/manivel23/repository.git

Pull and Push
     
      To pull latest commit remote repository to local
      $ git pull origin master

              origin --> name of the remote repository
              master --> name of the remote repostory branch
    
      To push latest commit local to remote
      $ git push origin master
 
      To push all branch local to remote

      $ git push --all origin

         

       To pull latest commit a specific brancha name from remote repository to local
        $ git pull -u orgin specific_branch_name
     
               -u  ---> set-upstream
   
To disable SSL verification

$git config --global http.sslverify "false"

Renew letsencrypt certificate in nginx on Centos

To renew your letsencrypt certificate,

please follow the following steps

First you need to stop the nginx service on centos using the following command

[root@manivel]# service nginx stop
Stopping nginx:                                            [  OK  ]

[root@manivel]#Go to the letsencrypt folder and run the following commands to renew the certificate,


[root@manivel letsencrypt]# ./certbot-auto renew

./certbot-auto renewSaving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/manivel.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator standalone, Installer None
Renewing an existing certificate
Performing the following challenges:
tls-sni-01 challenge for nginx.manivel.com
tls-sni-01 challenge for mail.manivel.com
Waiting for verification...Cleaning up challenges

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
new certificate deployed without reload, fullchain is
/etc/letsencrypt/live/manivel.com/fullchain.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Congratulations, all renewals succeeded. The following certs have been renewed:
  /etc/letsencrypt/live/manivel.com/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[root@manivel letsencrypt]# 


Start the nginx service using the following command


[root@manivel letsencrypt]# service nginx start 
Startting nginx:                                            [  OK  ]

[root@manivel letsencrypt]#
Now you have successfully renewed your letsencrypt ssl certificate.

Web Application Fingerprinting

Description

First steps when performing a web application penetration test is to find the version of the web server and the web application. The reason for that is, it permits us to discover all the known vulnerabilities that are affecting the web server and the web application. For doing this we will get a lot of information like application name, software version, web server info, OS, and more

How to Test  

There are several way to identify the web server and web application details. here we will use some of them.

HTTP response header to Fingerprint Web Server and Web Application.

It can be perform different way but here we will do with netcat and telnet command. 

We will send an HTTP request by using the HEAD method through  Netcat command

 We will send an HTTP request by using the HEAD method via telnet command

As we can identify from the above HTTP response header,

1. Type of the web server from the Server filed name along with the version.

2. Type of the technology from the X-Powered-By field name along with the version.

3. Web application is running on the web server which is a Ubuntu.

Cookies to Fingerprint Web Application

Another way to determine the web application framework are looking for framework specific cookies.

HTML Source code to fingerprint web application

In some cases the web application framework and version can be discovered through source code inspection. So it is always to look there as well.You can see in the following example that we have discovered the application framework by looking at the comments and footer tag.

File Extensions to fingerprint web application

Some time file extension will disclosure the web application technology.

 

In above post we saw few methods to identify the web server and web application fingerprinting. There are more methods and different tools available to verify the fingerprinting result precisely.

 

Reference:

https://www.owasp.org/index.php/Testing_for_Web_Application_Fingerprint_(OWASP-IG-004)