Install MRTG Mac
==========
first install mrtg via macports
===========
http://mrtg.darwinports.com/
If you haven’t already installed Darwin Ports, you can find easy instructions for doing so at themain Darwin Ports page.
Once Darwin Ports has been installed, in a terminal window and while online, type the following and hit return:
% cd /opt/local/bin/portslocation/dports/mrtg % sudo port install mrtg Password:
You will then be prompted for your root password, which you should enter. You may have to wait for a few minutes while the software is retrieved from the network and installed for you. Y ou should see something that looks similar to:
---> Fetching mrtg ---> Verifying checksum for mrtg ---> Extracting mrtg ---> Configuring mrtg ---> Building mrtg with target all ---> Staging mrtg into destroot ---> Installing mrtg
Make sure that you do not close the terminal window while Darwin Ports is working. Once the software has been installed, you can find further information about using mrtg with these commands:
% man mrtg % apropos mrtg % which mrtg % locate mrtg
Where to find more information:
========
configure and start macports
http://oss.oetiker.ch/mrtg/doc/mrtg-unix-guide.en.html
========
cfgmaker –global ‘WorkDir: /Users/xxxxx/erase/mrtg/work’ \ –global ‘Options[_]: bits,growright’ \ –output /Users/xxxxx/erase/mrtg/cfg/mrtg.cfg \ 10.0.1.1
which mrtg sudo env LANG=C /opt/local/bin/mrtg /Users/xxxxx/erase/mrtg/cfg/mrtg.cfg
=============
test snmp
=============
snmpwalk -v 2c -c public -M /usr/share/snmp/mibs:$HOME/share/mibs -m+AIRPORT-BASESTATION-3-MIB Dover.local 1.3.6.1.4.1.63.501
http://blog.cocoia.com/2007/graph-your-airport-express-extreme-data-throughput-and-more/
Posted under UncategorizedINSTALLING ON MAC OS X Unichars
INSTALLING ON MAC OS X Unichars
updgrade ports to latest
http://www.macports.org/install.php
$ port install glib2
$ gem install unichars
http://github.com/Manfred/unichars
Posted under UncategorizedInstall Ruby / Mysql on 64-bit Snow Leopard
http://weblog.rubyonrails.org/2009/8/30/upgrading-to-snow-leopard
sudo env ARCHFLAGS=”-arch x86_64″ gem install mysql — –with-mysql-config=/usr/local/mysql/bin/mysql_config
Posted under UncategorizedSSH Authorize Keys
How to do it
First log in on A as user a and generate a pair of authentication keys. Do not enter a passphrase:
a@A:~> ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/a/.ssh/id_rsa):
Created directory ‘/home/a/.ssh’.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/a/.ssh/id_rsa.
Your public key has been saved in /home/a/.ssh/id_rsa.pub.
The key fingerprint is:
3e:4f:05:79:3a:9f:96:7c:3b:ad:e9:58:37:bc:37:e4 a@A
Now use ssh to create a directory ~/.ssh as user b on B. (The directory may already exist, which is fine):
a@A:~> ssh b@B mkdir -p .ssh
b@B’s password:
Finally append a’s new public key to b@B:.ssh/authorized_keys and enter b’s password one last time:
a@A:~> cat .ssh/id_rsa.pub | ssh b@B ‘cat >> .ssh/authorized_keys’
b@B’s password:
From now on you can log into B as b from A as a without password:
a@A:~> ssh b@B hostname
B
A note from one of our readers: Depending on your version of SSH you might also have to do the following changes:
Put the public key in .ssh/authorized_keys2
Change the permissions of .ssh to 700
Change the permissions of .ssh/authorized_keys2 to 640
==RAILS EXAMPLE==
==RAILS EXAMPLE==
rm -rf MyWebsite.Api
rails MyWebsite.Api
cd MyWebsite.Api
script/generate nifty_scaffold book isbn:string ean:string title:string edition:string primaryauthor:string publishername:string index new edit show
script/generate nifty_scaffold account name:string email:string address:string index new edit show
script/generate nifty_layout
rake:db migrate
rake db:migrate RAILS_ENV=production
script/server
Posted under UncategorizedChmod Linux File Permissions
chmod u=rx file (Give the owner rx permissions, not w)
chmod go-rwx file (Deny rwx permission for group, others)
chmod g+w file (Give write permission to the group)
chmod a+x file1 file2 (Give execute permission to everybody)
chmod g+rx,o+x file (OK to combine like this with a comma)
Posted under UncategorizedObjective-C Check Object Size
NSLog(@”2 size of myObject: %zd %zd”, malloc_size(theContent),malloc_size(thing));
Posted under Uncategorizedtar command
tar -cvpzf alldatabases-$(date +%y%m%d).tar.gz alldatabases-$(date +%y%m%d).bak
Development App … Shyat Distributing App … Shyat
To debug
* use development provisioning file
* set get task allow to TRUE for entitlements.plist
Distribution Information
* add Entitlements.plst
* make sure get task allowed in Entitlements .plist is false
* go into target properties and set code-signing to Entitlements.plist
* project should be set to compile to device and not simulator
* delete all provisioning files from device
* remove all provisioning files from xcode -> organizer
* delete app from device
* delete app from itunes
Posted under UncategorizedLinux Admin
find biggest files
# find / -type f -size +20000k
list folder sizes
du -ch | grep M
Posted under UncategorizedBit.ly
curl “http://api.bit.ly/shorten?version=2.0.1&longUrl=http://www.site.com/?p=66&login=LOGIN&apiKey=APIKEY&history=1″
Posted under UncategorizedTop 20 OpenSSH Server Best Security Practices
Top 20 OpenSSH Server Best Security Practices
OpenSSH is the implementation of the SSH protocol. OpenSSH is recommended for remote login, making backups, remote file transfer via scp or sftp, and much more. SSH is perfect to keep confidentiality and integrity for data exchanged between two networks and systems. However, the main advantage is server authentication, through the use of public key cryptography. From time to time there are rumors about OpenSSH zero dayexploit. Here are a few things you need to tweak in order to improve OpenSSH server security.
Default Config Files and SSH Port
- /etc/ssh/sshd_config - OpenSSH server configuration file.
- /etc/ssh/ssh_config – OpenSSH client configuration file.
- ~/.ssh/ – Users ssh configuration directory.
- ~/.ssh/authorized_keys or ~/.ssh/authorized_keys – Lists the public keys (RSA or DSA) that can be used to log into the user’s account
- /etc/nologin – If this file exists, sshd refuses to let anyone except root log in.
- /etc/hosts.allow and /etc/hosts.deny : Access controls lists that should be enforced by tcp-wrappers are defined here.
- SSH default port : TCP 22
#1: Disable OpenSSH Server
Workstations and laptop can work without OpenSSH server. If you need not to provide the remote login and file transfer capabilities of SSH, disable and remove the SSHD server. CentOS / RHEL / Fedora Linux user can disable and remove openssh-server with yum command:
# chkconfig sshd off
# yum erase openssh-server
Debian / Ubuntu Linux user can disable and remove the same with apt-get command:
# apt-get remove openssh-server
You may need to update your iptables script to remove ssh exception rule. Under CentOS / RHEL / Fedora edit the files /etc/sysconfig/iptables and /etc/sysconfig/ip6tables. Once donerestart iptables service:
# service iptables restart
# service ip6tables restart
#2: Only Use SSH Protocol 2
SSH protocol version 1 (SSH-1) has man-in-the-middle attacks problems and security vulnerabilities. SSH-1 is obsolete and should be avoided at all cost. Open sshd_config file and make sure the following line exists:
Protocol 2
#3: Limit Users’ SSH Access
By default all systems user can login via SSH using their password or public key. Sometime you create UNIX / Linux user account for ftp or email purpose. However, those user can login to system using ssh. They will have full access to system tools including compilers and scripting languages such as Perl, Python which can open network ports and do many other fancy things. One of my client has really outdated php script and an attacker was able to create a new account on the system via a php script. However, attacker failed to get into box via ssh because it wasn’t in AllowUsers.
Only allow root, vivek and jerry user to use the system via SSH, add the following to sshd_config:
AllowUsers root vivek jerry
Alternatively, you can allow all users to login via SSH but deny only a few users, with the following line:
DenyUsers saroj anjali foo
You can also configure Linux PAM allows or deny login via the sshd server. You can allow list of group name to access or deny access to the ssh.
#4: Configure Idle Log Out Timeout Interval
User can login to server via ssh and you can set an idel timeout interval to avoid unattended ssh session. Open sshd_config and make sure following values are configured:
ClientAliveInterval 300 ClientAliveCountMax 0
You are setting an idle timeout interval in seconds (300 secs = 5 minutes). After this interval has passed, the idle user will be automatically kicked out (read as logged out). See how to automatically log BASH / TCSH / SSH users out after a period of inactivity for more details.
#5: Disable .rhosts Files
Don’t read the user’s ~/.rhosts and ~/.shosts files. Update sshd_config with the following settings:
IgnoreRhosts yes
SSH can emulate the behavior of the obsolete rsh command, just disable insecure access via RSH.
#6: Disable Host-Based Authentication
To disable host-based authentication, update sshd_config with the following option:
HostbasedAuthentication no
#7: Disable root Login via SSH
There is no need to login as root via ssh over a network. Normal users can use su or sudo (recommended) to gain root level access. This also make sure you get full auditing information about who ran privileged commands on the system via sudo. To disable root login via SSH, update sshd_config with the following line:
PermitRootLogin no
However, bob made excellent point:
Saying “don’t login as root” is h******t. It stems from the days when people sniffed the first packets of sessions so logging in as yourself and su-ing decreased the chance an attacker would see the root pw, and decreast the chance you got spoofed as to your telnet host target, You’d get your password spoofed but not root’s pw. Gimme a break. this is 2005 – We have ssh, used properly it’s secure. used improperly none of this 1989 will make a damn bit of difference. -Bob
#8: Enable a Warning Banner
Set a warning banner by updating sshd_config with the following line:
Banner /etc/issue
Sample /etc/issue file:
---------------------------------------------------------------------------------------------- You are accessing a XYZ Government (XYZG) Information System (IS) that is provided for authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: + The XYZG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. + At any time, the XYZG may inspect and seize data stored on this IS. + Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any XYZG authorized purpose. + This IS includes security measures (e.g., authentication and access controls) to protect XYZG interests--not for your personal benefit or privacy. + Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. ----------------------------------------------------------------------------------------------
Above is standard sample, consult your legal team for exact user agreement and legal notice details.
#8: Firewall SSH Port # 22
You need to firewall ssh port # 22 by updating iptables or pf firewall configurations. Usually, OpenSSH server must only accept connections from your LAN or other remote WAN sites only.
Netfilter (Iptables) Configuration
Update /etc/sysconfig/iptables (Redhat and friends specific file) to accept connection only from 192.168.1.0/24 and 202.54.1.5/29, enter:
-A RH-Firewall-1-INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 22 -j ACCEPT -A RH-Firewall-1-INPUT -s 202.54.1.5/29 -m state --state NEW -p tcp --dport 22 -j ACCEPT
If you’ve dual stacked sshd with IPv6, edit /etc/sysconfig/ip6tables (Redhat and friends specific file), enter:
-A RH-Firewall-1-INPUT -s ipv6network::/ipv6mask -m tcp -p tcp --dport 22 -j ACCEPT
Replace ipv6network::/ipv6mask with actual IPv6 ranges.
*BSD PF Firewall Configuration
If you are using PF firewall update /etc/pf.conf as follows:
pass in on $ext_if inet proto tcp from {192.168.1.0/24, 202.54.1.5/29} to $ssh_server_ip port ssh flags S/SA synproxy state
#9: Change SSH Port and Limit IP Binding
By default SSH listen to all available interfaces and IP address on the system. Limit ssh port binding and change ssh port (by default brute forcing scripts only try to connects to port # 22). To bind to 192.168.1.5 and 202.54.1.5 IPs and to port 300, add or correct the following line:
Port 300 ListenAddress 192.168.1.5 ListenAddress 202.54.1.5
A better approach to use proactive approaches scripts such as fail2ban or denyhosts (see below).
#10: Use Strong SSH Passwords and Passphrase
It cannot be stressed enough how important it is to use strong user passwords and passphrase for your keys. Brute force attack works because you use dictionary based passwords. You can force users to avoid passwords against a dictionary attack and use john the ripper tool to find out existing weak passwords. Here is a sample random password generator (put in your ~/.bashrc):
genpasswd() { local l=$1 [ "$l" == "" ] && l=20 tr -dc A-Za-z0-9_ < /dev/urandom | head -c ${l} | xargs }
Run it:
genpasswd 16
Output:
uw8CnDVMwC6vOKgW
#11: Use Public Key Based Authentication
Use public/private key pair with password protection for the private key. See how to use RSAand DSA key based authentication. Never ever use passphrase free key (passphrase key less) login.
#12: Use Keychain Based Authentication
keychain is a special bash script designed to make key-based authentication incredibly convenient and flexible. It offers various security benefits over passphrase-free keys. See how to setup and use keychain software.
#13: Chroot SSHD (Lock Down Users To Their Home Directories)
By default users are allowed to browse the server directories such as /etc/, /bin and so on. You can protect ssh, using os based chroot or use special tools such as rssh. With the release of OpenSSH 4.8p1 or 4.9p1, you no longer have to rely on third-party hacks such as rssh or complicated chroot(1) setups to lock users to their home directories. See this blog post about new ChrootDirectory directive to lock down users to their home directories.
#14: Use TCP Wrappers
TCP Wrapper is a host-based Networking ACL system, used to filter network access to Internet. OpenSSH does supports TCP wrappers. Just update your /etc/hosts.allow file as follows to allow SSH only from 192.168.1.2 172.16.23.12 :
sshd : 192.168.1.2 172.16.23.12
See this FAQ about setting and using TCP wrappers under Linux / Mac OS X and UNIX like operating systems.
#15: Disable Empty Passwords
You need to explicitly disallow remote login from accounts with empty passwords, update sshd_config with the following line:
PermitEmptyPasswords no
#16: Thwart SSH Crackers (Brute Force Attack)
Brute force is a method of defeating a cryptographic scheme by trying a large number of possibilities using a single or distributed computer network. To prevents brute force attacks against SSH, use the following softwares:
- DenyHosts is a Python based security tool for SSH servers. It is intended to prevent brute force attacks on SSH servers by monitoring invalid login attempts in the authentication log and blocking the originating IP addresses.
- Explains how to setup DenyHosts under RHEL / Fedora and CentOS Linux.
- Fail2ban is a similar program that prevents brute force attacks against SSH.
- security/sshguard-pf protect hosts from brute force attacks against ssh and other services using pf.
- security/sshguard-ipfw protect hosts from brute force attacks against ssh and other services using ipfw.
- security/sshguard-ipfilter protect hosts from brute force attacks against ssh and other services using ipfilter.
- security/sshblock block abusive SSH login attempts.
- security/sshit checks for SSH/FTP bruteforce and blocks given IPs.
- BlockHosts Automatic blocking of abusive IP hosts.
- Blacklist Get rid of those bruteforce attempts.
- Brute Force Detection A modular shell script for parsing application logs and checking for authentication failures. It does this using a rules system where application specific options are stored including regular expressions for each unique auth format.
- IPQ BDB filter May be considered as a fail2ban lite.
#17: Rate-limit Incoming Port # 22 Connections
Both netfilter and pf provides rate-limit option to perform simple throttling on incoming connections on port # 22.
Iptables Example
The following example will drop incoming connections which make more than 5 connection attempts upon port 22 within 60 seconds:
#!/bin/bash inet_if=eth1 ssh_port=22 $IPT -I INPUT -p tcp --dport ${ssh_port} -i ${inet_if} -m state --state NEW -m recent --set $IPT -I INPUT -p tcp --dport ${ssh_port} -i ${inet_if} -m state --state NEW -m recent --update --seconds 60 --hitcount 5 -j DROP
Call above script from your iptables scripts. Another config option:
$IPT -A INPUT -i ${inet_if} -p tcp --dport ${ssh_port} -m state --state NEW -m limit --limit 3/min --limit-burst 3 -j ACCEPT $IPT -A INPUT -i ${inet_if} -p tcp --dport ${ssh_port} -m state --state ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o ${inet_if} -p tcp --sport ${ssh_port} -m state --state ESTABLISHED -j ACCEPT # another one line example # $IPT -A INPUT -i ${inet_if} -m state --state NEW,ESTABLISHED,RELATED -p tcp --dport 22 -m limit --limit 5/minute --limit-burst 5-j ACCEPT
See iptables man page for more details.
*BSD PF Example
The following will limits the maximum number of connections per source to 20 and rate limit the number of connections to 15 in a 5 second span. If anyone breaks our rules add them to our abusive_ips table and block them for making any further connections. Finally, flush keyword kills all states created by the matching rule which originate from the host which exceeds these limits.
sshd_server_ip="202.54.1.5" table <abusive_ips> persist block in quick from <abusive_ips> pass in on $ext_if proto tcp to $sshd_server_ip port ssh flags S/SA keep state (max-src-conn 20, max-src-conn-rate 15/5, overload <abusive_ips> flush)
#18: Use Port Knocking
Port knocking is a method of externally opening ports on a firewall by generating a connection attempt on a set of prespecified closed ports. Once a correct sequence of connection attempts is received, the firewall rules are dynamically modified to allow the host which sent the connection attempts to connect over specific port(s). A sample port Knocking example for ssh using iptables:
$IPT -N stage1 $IPT -A stage1 -m recent --remove --name knock $IPT -A stage1 -p tcp --dport 3456 -m recent --set --name knock2 $IPT -N stage2 $IPT -A stage2 -m recent --remove --name knock2 $IPT -A stage2 -p tcp --dport 2345 -m recent --set --name heaven $IPT -N door $IPT -A door -m recent --rcheck --seconds 5 --name knock2 -j stage2 $IPT -A door -m recent --rcheck --seconds 5 --name knock -j stage1 $IPT -A door -p tcp --dport 1234 -m recent --set --name knock $IPT -A INPUT -m --state ESTABLISHED,RELATED -j ACCEPT $IPT -A INPUT -p tcp --dport 22 -m recent --rcheck --seconds 5 --name heaven -j ACCEPT $IPT -A INPUT -p tcp --syn -j doo
- fwknop is an implementation that combines port knocking and passive OS fingerprinting.
- Multiple-port knocking Netfilter/IPtables only implementation.
#19: Use Log Analyzer
Read your logs using logwatch or logcheck. These tools make your log reading life easier. It will go through your logs for a given period of time and make a report in the areas that you wish with the detail that you wish. Make sure LogLevel is set to INFO or DEBUG in sshd_config:
LogLevel INFO
#20: Patch OpenSSH and Operating Systems
It is recommended that you use tools such as yum, apt-get, freebsd-update and others to keep systems up to date with the latest security patches.
Other Options
To hide openssh version, you need to update source code and compile openssh again. Make sure following options are enabled in sshd_config:
# Turn on privilege separation UsePrivilegeSeparation yes # Prevent the use of insecure home directory and key file permissions StrictModes yes # Turn on reverse name checking VerifyReverseMapping yes # Do you need port forwarding? AllowTcpForwarding no X11Forwarding no # Specifies whether password authentication is allowed. The default is yes. PasswordAuthentication no
Verify your sshd_config file before restarting / reloading changes:
# /usr/sbin/sshd -t
Tighter SSH security with two-factor or three-factor (or more) authentication.
References:
- The official OpenSSH project.
- Forum thread: Failed SSH login attempts and how to avoid brute ssh attacks
- man pages sshd_config, ssh_config, tcpd, yum, and apt-get.
If you have a technique or handy software not mentioned here, please share in the comments below to help your fellow readers keep their openssh based server secure.
Download PDF version (193K).
Edited by Vivek Gite @ Oct 15, 10:45.
Featured Articles:
- 20 Linux System Monitoring Tools Every SysAdmin Should Know
- My 10 UNIX Command Line Mistakes
- Top 5 Email Client For Linux, Mac OS X, and Windows Users
- Top 20 OpenSSH Server Best Security Practices
- Top 10 Open Source Web-Based Project Management Software
- Top 5 Linux Video Editor Software
- Email this to a friend
- Printable version
- Rss Feed
- Last Updated: Oct/15/2009
20 Linux System Monitoring Tools Every SysAdmin Should Know
20 Linux System Monitoring Tools Every SysAdmin Should Know
Need to monitor Linux server performance? Try these built-in command and a few add-on tools. Most Linux distributions are equipped with tons of monitoring. These tools provide metrics which can be used to get information about system activities. You can use these tools to find the possible causes of a performance problem. The commands discussed below are some of the most basic commands when it comes to system analysis and debugging server issues such as:
- Finding out bottlenecks.
- Disk (storage) bottlenecks.
- CPU and memory bottlenecks.
- Network bottlenecks.
#1: top – Process Activity Command
The top program provides a dynamic real-time view of a running system i.e. actual process activity. By default, it displays the most CPU-intensive tasks running on the server and updates the list every five seconds.
Commonly Used Hot Keys
The top command provides several useful hot keys:
| Hot Key | Usage |
|---|---|
| t | Displays summary information off and on. |
| m | Displays memory information off and on. |
| A | Sorts the display by top consumers of various system resources. Useful for quick identification of performance-hungry tasks on a system. |
| f | Enters an interactive configuration screen for top. Helpful for setting up top for a specific task. |
| o | Enables you to interactively select the ordering within top. |
| r | Issues renice command. |
| k | Issues kill command. |
| z | Turn on or off color/mono |
=> Related: How do I Find Out Linux CPU Utilization?
#2: vmstat – System Activity, Hardware and System Information
The command vmstat reports information about processes, memory, paging, block IO, traps, and cpu activity.
# vmstat 3
Sample Outputs:
procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu------ r b swpd free buff cache si so bi bo in cs us sy id wa st 0 0 0 2540988 522188 5130400 0 0 2 32 4 2 4 1 96 0 0 1 0 0 2540988 522188 5130400 0 0 0 720 1199 665 1 0 99 0 0 0 0 0 2540956 522188 5130400 0 0 0 0 1151 1569 4 1 95 0 0 0 0 0 2540956 522188 5130500 0 0 0 6 1117 439 1 0 99 0 0 0 0 0 2540940 522188 5130512 0 0 0 536 1189 932 1 0 98 0 0 0 0 0 2538444 522188 5130588 0 0 0 0 1187 1417 4 1 96 0 0 0 0 0 2490060 522188 5130640 0 0 0 18 1253 1123 5 1 94 0 0
Display Memory Utilization Slabinfo
# vmstat -m
Get Information About Active / Inactive Memory Pages
# vmstat -a
=> Related: How do I find out Linux Resource utilization to detect system bottlenecks?
#3: w – Find Out Who Is Logged on And What They Are Doing
w command displays information about the users currently on the machine, and their processes.
# w username
# w vivek
Sample Outputs:
17:58:47 up 5 days, 20:28, 2 users, load average: 0.36, 0.26, 0.24 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT root pts/0 10.1.3.145 14:55 5.00s 0.04s 0.02s vim /etc/resolv.conf root pts/1 10.1.3.145 17:43 0.00s 0.03s 0.00s w
#4: uptime – Tell How Long The System Has Been Running
The uptime command can be used to see how long the server has been running. The current time, how long the system has been running, how many users are currently logged on, and the system load averages for the past 1, 5, and 15 minutes.
# uptime
Output:
18:02:41 up 41 days, 23:42, 1 user, load average: 0.00, 0.00, 0.00
1 can be considered as optimal load value. The load can change from system to system. For a single CPU system 1 – 3 and SMP systems 6-10 load value might be acceptable.
#5: ps – Displays The Processes
ps command will report a snapshot of the current processes. To select all processes use the -A or -e option:
# ps -A
Sample Outputs:
PID TTY TIME CMD
1 ? 00:00:02 init
2 ? 00:00:02 migration/0
3 ? 00:00:01 ksoftirqd/0
4 ? 00:00:00 watchdog/0
5 ? 00:00:00 migration/1
6 ? 00:00:15 ksoftirqd/1
....
.....
4881 ? 00:53:28 java
4885 tty1 00:00:00 mingetty
4886 tty2 00:00:00 mingetty
4887 tty3 00:00:00 mingetty
4888 tty4 00:00:00 mingetty
4891 tty5 00:00:00 mingetty
4892 tty6 00:00:00 mingetty
4893 ttyS1 00:00:00 agetty
12853 ? 00:00:00 cifsoplockd
12854 ? 00:00:00 cifsdnotifyd
14231 ? 00:10:34 lighttpd
14232 ? 00:00:00 php-cgi
54981 pts/0 00:00:00 vim
55465 ? 00:00:00 php-cgi
55546 ? 00:00:00 bind9-snmp-stat
55704 pts/1 00:00:00 ps
ps is just like top but provides more information.
Show Long Format Output
# ps -Al
To turn on extra full mode (it will show command line arguments passed to process):
# ps -AlF
To See Threads ( LWP and NLWP)
# ps -AlFH
To See Threads After Processes
# ps -AlLm
Print All Process On The Server
# ps ax
# ps axu
Print A Process Tree
# ps -ejH
# ps axjf
# pstree
Print Security Information
# ps -eo euser,ruser,suser,fuser,f,comm,label
# ps axZ
# ps -eM
See Every Process Running As User Vivek
# ps -U vivek -u vivek u
Set Output In a User-Defined Format
# ps -eo pid,tid,class,rtprio,ni,pri,psr,pcpu,stat,wchan:14,comm
# ps axo stat,euid,ruid,tty,tpgid,sess,pgrp,ppid,pid,pcpu,comm
# ps -eopid,tt,user,fname,tmout,f,wchan
Display Only The Process IDs of Lighttpd
# ps -C lighttpd -o pid=
OR
# pgrep lighttpd
OR
# pgrep -u vivek php-cgi
Display The Name of PID 55977
# ps -p 55977 -o comm=
Find Out The Top 10 Memory Consuming Process
# ps -auxf | sort -nr -k 4 | head -10
Find Out top 10 CPU Consuming Process
# ps -auxf | sort -nr -k 3 | head -10
#6: free – Memory Usage
The command free displays the total amount of free and used physical and swap memory in the system, as well as the buffers used by the kernel.
# free
Sample Output:
total used free shared buffers cached Mem: 12302896 9739664 2563232 0 523124 5154740 -/+ buffers/cache: 4061800 8241096 Swap: 1052248 0 1052248
=> Related: :
- Linux Find Out Virtual Memory PAGESIZE
- Linux Limit CPU Usage Per Process
- How much RAM does my Ubuntu / Fedora Linux desktop PC have?
#7: iostat – Average CPU Load, Disk Activity
The command iostat report Central Processing Unit (CPU) statistics and input/output statistics for devices, partitions and network filesystems (NFS).
# iostat
Sample Outputs:
Linux 2.6.18-128.1.14.el5 (www03.nixcraft.in) 06/26/2009
avg-cpu: %user %nice %system %iowait %steal %idle
3.50 0.09 0.51 0.03 0.00 95.86
Device: tps Blk_read/s Blk_wrtn/s Blk_read Blk_wrtn
sda 22.04 31.88 512.03 16193351 260102868
sda1 0.00 0.00 0.00 2166 180
sda2 22.04 31.87 512.03 16189010 260102688
sda3 0.00 0.00 0.00 1615 0
=> Related: : Linux Track NFS Directory / Disk I/O Stats
#8: sar – Collect and Report System Activity
The sar command is used to collect, report, and save system activity information. To see network counter, enter:
# sar -n DEV | more
To display the network counters from the 24th:
# sar -n DEV -f /var/log/sa/sa24 | more
You can also display real time usage using sar:
# sar 4 5
Sample Outputs:
Linux 2.6.18-128.1.14.el5 (www03.nixcraft.in) 06/26/2009 06:45:12 PM CPU %user %nice %system %iowait %steal %idle 06:45:16 PM all 2.00 0.00 0.22 0.00 0.00 97.78 06:45:20 PM all 2.07 0.00 0.38 0.03 0.00 97.52 06:45:24 PM all 0.94 0.00 0.28 0.00 0.00 98.78 06:45:28 PM all 1.56 0.00 0.22 0.00 0.00 98.22 06:45:32 PM all 3.53 0.00 0.25 0.03 0.00 96.19 Average: all 2.02 0.00 0.27 0.01 0.00 97.70
=> Related: : How to collect Linux system utilization data into a file
#9: mpstat – Multiprocessor Usage
The mpstat command displays activities for each available processor, processor 0 being the first one. mpstat -P ALL to display average CPU utilization per processor:
# mpstat -P ALL
Sample Output:
Linux 2.6.18-128.1.14.el5 (www03.nixcraft.in) 06/26/2009 06:48:11 PM CPU %user %nice %sys %iowait %irq %soft %steal %idle intr/s 06:48:11 PM all 3.50 0.09 0.34 0.03 0.01 0.17 0.00 95.86 1218.04 06:48:11 PM 0 3.44 0.08 0.31 0.02 0.00 0.12 0.00 96.04 1000.31 06:48:11 PM 1 3.10 0.08 0.32 0.09 0.02 0.11 0.00 96.28 34.93 06:48:11 PM 2 4.16 0.11 0.36 0.02 0.00 0.11 0.00 95.25 0.00 06:48:11 PM 3 3.77 0.11 0.38 0.03 0.01 0.24 0.00 95.46 44.80 06:48:11 PM 4 2.96 0.07 0.29 0.04 0.02 0.10 0.00 96.52 25.91 06:48:11 PM 5 3.26 0.08 0.28 0.03 0.01 0.10 0.00 96.23 14.98 06:48:11 PM 6 4.00 0.10 0.34 0.01 0.00 0.13 0.00 95.42 3.75 06:48:11 PM 7 3.30 0.11 0.39 0.03 0.01 0.46 0.00 95.69 76.89
=> Related: : Linux display each multiple SMP CPU processors utilization individually.
#10: pmap – Process Memory Usage
The command pmap report memory map of a process. Use this command to find out causes of memory bottlenecks.
# pmap -d PID
To display process memory information for pid # 47394, enter:
# pmap -d 47394
Sample Outputs:
47394: /usr/bin/php-cgi Address Kbytes Mode Offset Device Mapping 0000000000400000 2584 r-x-- 0000000000000000 008:00002 php-cgi 0000000000886000 140 rw--- 0000000000286000 008:00002 php-cgi 00000000008a9000 52 rw--- 00000000008a9000 000:00000 [ anon ] 0000000000aa8000 76 rw--- 00000000002a8000 008:00002 php-cgi 000000000f678000 1980 rw--- 000000000f678000 000:00000 [ anon ] 000000314a600000 112 r-x-- 0000000000000000 008:00002 ld-2.5.so 000000314a81b000 4 r---- 000000000001b000 008:00002 ld-2.5.so 000000314a81c000 4 rw--- 000000000001c000 008:00002 ld-2.5.so 000000314aa00000 1328 r-x-- 0000000000000000 008:00002 libc-2.5.so 000000314ab4c000 2048 ----- 000000000014c000 008:00002 libc-2.5.so ..... ...... .. 00002af8d48fd000 4 rw--- 0000000000006000 008:00002 xsl.so 00002af8d490c000 40 r-x-- 0000000000000000 008:00002 libnss_files-2.5.so 00002af8d4916000 2044 ----- 000000000000a000 008:00002 libnss_files-2.5.so 00002af8d4b15000 4 r---- 0000000000009000 008:00002 libnss_files-2.5.so 00002af8d4b16000 4 rw--- 000000000000a000 008:00002 libnss_files-2.5.so 00002af8d4b17000 768000 rw-s- 0000000000000000 000:00009 zero (deleted) 00007fffc95fe000 84 rw--- 00007ffffffea000 000:00000 [ stack ] ffffffffff600000 8192 ----- 0000000000000000 000:00000 [ anon ] mapped: 933712K writeable/private: 4304K shared: 768000K
The last line is very important:
- mapped: 933712K total amount of memory mapped to files
- writeable/private: 4304K the amount of private address space
- shared: 768000K the amount of address space this process is sharing with others
=> Related: : Linux find the memory used by a program / process using pmap command
#11 and #12: netstat and ss – Network Statistics
The command netstat displays network connections, routing tables, interface statistics, masquerade connections, and multicast memberships. ss command is used to dump socket statistics. It allows showing information similar to netstat. See the following resources about ss and netstat commands:
- ss: Display Linux TCP / UDP Network and Socket Information
- Get Detailed Information About Particular IP address Connections Using netstat Command
#13: iptraf – Real-time Network Statistics
The iptraf command is interactive colorful IP LAN monitor. It is an ncurses-based IP LAN monitor that generates various network statistics including TCP info, UDP counts, ICMP and OSPF information, Ethernet load info, node stats, IP checksum errors, and others. It can provide the following info in easy to read format:
- Network traffic statistics by TCP connection
- IP traffic statistics by network interface
- Network traffic statistics by protocol
- Network traffic statistics by TCP/UDP port and by packet size
- Network traffic statistics by Layer2 address
#14: tcpdump – Detailed Network Traffic Analysis
The tcpdump is simple command that dump traffic on a network. However, you need good understanding of TCP/IP protocol to utilize this tool. For.e.g to display traffic info about DNS, enter:
# tcpdump -i eth1 'udp port 53'
To display all IPv4 HTTP packets to and from port 80, i.e. print only packets that contain data, not, for example, SYN and FIN packets and ACK-only packets, enter:
# tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
To display all FTP session to 202.54.1.5, enter:
# tcpdump -i eth1 'dst 202.54.1.5 and (port 21 or 20'
To display all HTTP session to 192.168.1.5:
# tcpdump -ni eth0 'dst 192.168.1.5 and tcp and port http'
Use wireshark to view detailed information about files, enter:
# tcpdump -n -i eth1 -s 0 -w output.txt src or dst port 80
#15: strace – System Calls
Trace system calls and signals. This is useful for debugging webserver and other server problems. See how to use to trace the process and see What it is doing.
#16: /Proc file system – Various Kernel Statistics
/proc file system provides detailed information about various hardware devices and other Linux kernel information. See Linux kernel /proc documentations for further details. Common /proc examples:
# cat /proc/cpuinfo
# cat /proc/meminfo
# cat /proc/zoneinfo
# cat /proc/mounts
17#: Nagios – Server And Network Monitoring
Nagios is a popular open source computer system and network monitoring application software. You can easily monitor all your hosts, network equipment and services. It can send alert when things go wrong and again when they get better. FAN is “Fully Automated Nagios”. FAN goals are to provide a Nagios installation including most tools provided by the Nagios Community. FAN provides a CDRom image in the standard ISO format, making it easy to easilly install a Nagios server. Added to this, a wide bunch of tools are including to the distribution, in order to improve the user experience around Nagios.
18#: Cacti – Web-based Monitoring Tool
Cacti is a complete network graphing solution designed to harness the power of RRDTool’s data storage and graphing functionality. Cacti provides a fast poller, advanced graph templating, multiple data acquisition methods, and user management features out of the box. All of this is wrapped in an intuitive, easy to use interface that makes sense for LAN-sized installations up to complex networks with hundreds of devices. It can provide data about network, CPU, memory, logged in users, Apache, DNS servers and much more. See how to install and configure Cacti network graphing tool under CentOS / RHEL.
#19: KDE System Guard – Real-time Systems Reporting and Graphing
KSysguard is a network enabled task and system monitor application for KDE desktop. This tool can be run over ssh session. It provides lots of features such as a client/server architecture that enables monitoring of local and remote hosts. The graphical front end uses so-called sensors to retrieve the information it displays. A sensor can return simple values or more complex information like tables. For each type of information, one or more displays are provided. Displays are organized in worksheets that can be saved and loaded independently from each other. So, KSysguard is not only a simple task manager but also a very powerful tool to control large server farms.
See the KSysguard handbook for detailed usage.
#20: Gnome System Monitor – Real-time Systems Reporting and Graphing
The System Monitor application enables you to display basic system information and monitor system processes, usage of system resources, and file systems. You can also use System Monitor to modify the behavior of your system. Although not as powerful as the KDE System Guard, it provides the basic information which may be useful for new users:
- Displays various basic information about the computer’s hardware and software.
- Linux Kernel version
- GNOME version
- Hardware
- Installed memory
- Processors and speeds
- System Status
- Currently available disk space
- Processes
- Memory and swap space
- Network usage
- File Systems
- Lists all mounted filesystems along with basic information about each.
Bounce: Additional Tools
A few more tools:
- nmap – scan your server for open ports.
- lsof – list open files, network connections and much more.
- ntop web based tool – ntop is the best tool to see network usage in a way similar to what top command does for processes i.e. it is network traffic monitoring software. You can see network status, protocol wise distribution of traffic for UDP, TCP, DNS, HTTP and other protocols.
- Conky – Another good monitoring tool for the X Window System. It is highly configurable and is able to monitor many system variables including the status of the CPU, memory, swap space, disk storage, temperatures, processes, network interfaces, battery power, system messages, e-mail inboxes etc.
- GKrellM – It can be used to monitor the status of CPUs, main memory, hard disks, network interfaces, local and remote mailboxes, and many other things.
- vnstat – vnStat is a console-based network traffic monitor. It keeps a log of hourly, daily and monthly network traffic for the selected interface(s).
- htop – htop is an enhanced version of top, the interactive process viewer, which can display the list of processes in a tree form.
- mtr – mtr combines the functionality of the traceroute and ping programs in a single network diagnostic tool.
Did I miss something? Please add your favorite system motoring tool in the comments.
Download pdf version (489K)
Featured Articles:
- 20 Linux System Monitoring Tools Every SysAdmin Should Know
- My 10 UNIX Command Line Mistakes
- Top 5 Email Client For Linux, Mac OS X, and Windows Users
- Top 20 OpenSSH Server Best Security Practices
- Top 10 Open Source Web-Based Project Management Software
- Top 5 Linux Video Editor Software
- Email this to a friend
- Printable version
- Rss Feed
- Last Updated: Aug/8/2009
{ 69 comments… read them below or add one }
1 06.27.09 at 5:10 am
-
Pretty much common knowledge (or should be) but handy to have listed all in one place.
2 06.27.09 at 8:29 am
-
yeap most of them are must-have tools.
good job of collecting them in a post. 3 06.27.09 at 8:37 am
4 06.27.09 at 9:09 am
-
another useful tool is dstat , which combines vmstat, iostat, ifstat, netstat information and more. but this is a very useful list with some interesting examples!
5 06.27.09 at 9:23 am
-
pocess or process. haha, i love typos
6 06.27.09 at 9:40 am
-
What about Munin ? Lots easier and lighter than Cacti.
7 06.27.09 at 10:13 am
-
Nice list, worth bookmarking!
8 06.27.09 at 10:22 am
-
I have a step-by-step nagios implementation howto, some one may try that. please visit http://www.linux-bd.com/
and I always thanks vivek, to run such a nice site http://www.cyberciti.biz/ 9 06.27.09 at 10:53 am
-
Once again, great article!!
10 06.27.09 at 11:07 am
-
I can see that the best tool to monitor processes , CPU, memeory and disk bottleneck at once is atop …
But the tool itself can cause a lot of trouble in heavily loaded servers and it enables process accounting and has a service running all the time …
To use it efficiently on RHEL , CentOS;
1- install rpmforge repo
2- # yum install atop
3- # killalll atop
4- # chkconfig atop off
5- # rm -rf /tmp/atop.d/ /var/log/atop/
6- then don’t directly run “atop” command , but instead run it as follows;
# ATOPACCT=” atopThis tool has saved me hundreds of hours really! and helped me to diagnose bottlenecks and solve them that couldn’t otherwise be easily detected and would need many different tools
11 06.27.09 at 1:01 pm
12 06.27.09 at 1:26 pm
-
Great post, also great reference.
13 06.27.09 at 1:46 pm
-
Hi,
We have just added your latest post “20 Linux System Monitoring Tools
Every SysAdmin Should Know” to our Directory of Technology . You
can check the inclusion of the post here . We are delighted
to invite you to submit all your future posts to the directory and get a huge base of
visitors to your website.
Warm Regards
Techtrove.info Team
14 06.27.09 at 1:57 pm
-
You probably wanna add IFTOP tool, its really simple and light, very useful when u need to have a last moment remote access to a server to see hows the trific going.
15 06.27.09 at 3:40 pm
-
Yeah, well why a so good admin (I dig(g) your site) won’t you use spelling checkers?
Typo #2 Web-based __Monitioring__ Tool 16 06.27.09 at 4:17 pm
-
maybe it’s a typo too, but the title should be :
“.. Tools Every SysAdmin MUST Know”
and still, this is advanced user knowledge, at most. I would not trust a sysadmin that knows so few. And.. 17 06.27.09 at 10:56 pm
-
Hi guys,
good list – and some great submitted pointers to other useful tools.
to those carp-ing on about typo’s – give us all a break. you’ve never made a typo? ever?
Idea: How ’bout those who have never *ever* made an error in typing text be the first one(s) to give people grief about making a typo?
I _used_ to be a real PITA about this; then I grew up.
The purpose of this blog, and other forms of communication, is to *communicate* concepts and ideas. *If* you have received those clearly – in spite of the typos – then the purpose has been fulfilled.
/me gets down off his soapbox
.h
18 06.27.09 at 11:37 pm
19 06.27.09 at 11:54 pm
-
This blog is more impressive and more useful than ever. I need more help regarding proper installation document on “php-network weathermap” on Cacti as plugins
20 06.28.09 at 2:18 am
-
No love for whowatch ? Real time info on who’s logged in, how their connected (SSH, TTY, etc) and what process thay have running.
21 06.28.09 at 2:28 am
-
vi — tool used to examine and modify almost any configuration file.
22 06.28.09 at 5:38 am
-
dtrace is a notable mention for the picky hackers that wish to know more about the behavior of the operating system and it’s programs internals.
23 06.28.09 at 5:48 am
-
hi gud information , keep it up
ash
24 06.28.09 at 6:09 am
-
You missed: iftop & nethogs
25 06.28.09 at 7:09 am
-
Excellent list. Like Amr El-Sharnoby above, I also find atop indispensable and think itmust be installed on every system.
In addition I would like to add iotop to monitor disk usage per process and jnettop to very easily monitor bandwidth allocation between connections on a Linux system.
26 06.28.09 at 8:53 am
-
Well, the one i use right now is Pandora FMS 3.0 and its making my work easy.
27 06.28.09 at 12:56 pm
-
I would like to add
whoami ,who am i, finger, pinky , id commands 28 06.28.09 at 3:32 pm
-
i always love linux, great article
29 06.28.09 at 9:14 pm
-
One tool which seems to be missing from this list is LTTng. It is a system-wide tracing tool which helps understanding complex performance problems in multithreaded, multiprocess applications involving many userspace-kernel interactions.
The project is available at http://www.lttng.org. Recent SuSE distributions, WindRiver, Monta Vista and STLinux offer the tracer as distribution packages. The standard way to use it is to install a patched kernel though. It comes with a trace analyzer, LTTV, which provides nice view of the overall system behavior.
Mathieu
30 06.29.09 at 1:02 am
-
Very useful, well done. Thanks!
31 06.29.09 at 1:29 am
-
Very informative.
32 06.29.09 at 2:11 am
-
I love this website.
33 06.29.09 at 3:08 am
-
If we’re talking about a web server, apachetop is a nice tool to see Apache’s activity.
34 06.29.09 at 4:07 am
-
Dude you forgot the most important of ALL!
net-snmpd
With it you can collect vast amounts of information. Then with snmpwalk and scripts you can create your own web NMS to collect simple information like ping, disk space, services down.
35 06.29.09 at 5:15 am
-
`iotop` is nice one to be include in list. I used `vnstat` very much for keeping track of my download when I was on limited connection
36 06.29.09 at 7:03 am
37 06.29.09 at 10:01 am
-
Very useful, thinks for sharing.
Take a look to a great tools called nmon. I use it on AIX IBM system but works now on all GNU/linux system now.
38 06.29.09 at 10:21 am
-
mtr
39 06.29.09 at 10:21 am
-
I’m with @paul tergeist, tools every linux user should know. The ps samples are nice, thanks.
No reference to configuration management tools ?
cfengine/puppet/chef?
40 06.29.09 at 9:19 pm
-
Nice summary article.
If your “system” is large and/or distributed, and the performance issues you’re tackling are complex, you may wish to explore Performance Co-Pilot (PCP). It unifies all of the performance data from the tools you’ve mentioned (and more), can be extended to include new applications and service layers, works across the network and for clusters and provides both real-time and retrospective analysis.
See http://www.oss.sgi.com/projects/pcp
PCP is included in the Debian-based and SUSE distributions and is likely to appear in the RH distributions in the future.
As a bonus, PCP also works for monitoring non-Linux platforms (Windows and some of the Unix derivatives).
41 06.30.09 at 2:37 am
-
I love your collection.
I use about 25% of those regularly, and another 25% semi-regularly. I’ll have to add another 25% of those to my list of regulars.
Thanks for compiling this list.
42 06.30.09 at 6:01 am
-
Very nice collection of linux applications. I work with linux but I can’t say that i know them all.
43 06.30.09 at 9:28 am
-
REALLY ITS VERY GOOD N USEFULL FOR ALL ADMIN.
THANKS ONCE AGAIN 44 06.30.09 at 12:06 pm
-
Good post…already bookmarked… cheers
45 06.30.09 at 7:30 pm
-
I’ll just mention “ngrep” – network grep.
Great list, thanks!!
Aleksey
46 07.01.09 at 3:40 pm
-
Thanks for sharing this information..
47 07.01.09 at 8:20 pm
-
feilong, I agree. I use nmon on my linux boxes from years. It’s worth a look.
48 07.01.09 at 10:36 pm
-
Great article, many great suggestions.
Was surprised not to see these among the suggestions:
bmon – graphs/tracks network activity/bandwidth real time.
etherape – great visual indicator of what traffic is going where on the network
wireshark – tcpdump on steroids.
multitail – tail multiple files in a single terminal window
swatch – track your log files and fire off alerts 49 07.02.09 at 11:14 am
-
how the hell i missed this site this many days…
thank god i found it…
i love it… 50 07.04.09 at 5:23 pm
-
O personally much prefer htop to top. Displays everything very nicely.
phpsysinfo is another nice light web-based monitoring tool. Very easy to setup and use.
51 07.05.09 at 4:55 pm
-
Osmius: The Open Source Monitoring Tool is C++ and Java. Monitor “everything” connected to a network with incredible performance. Create and integrate Business Services, SLAs and ITIL processes such as availability management and capacity planning.
52 07.06.09 at 4:17 pm
-
thanks for sharing all the helpful tools.
53 07.07.09 at 7:13 pm
-
Nice compilation. As usual, always very useful.
It would be nice if some of you knowledgeable guys can shed some light on java heap monitoring thing, thread lock detection and analysis, heap analysis etc.
54 07.07.09 at 8:00 pm
-
nmon is a nice tool… try google for it, it rocks
55 07.12.09 at 5:50 pm
-
Very much Useful Information’s,
trafmon is one more useful tool 56 07.15.09 at 8:18 pm
-
And for those which like lightweight and concise graphical metering:
xosview +disk -ints -bat 57 07.19.09 at 3:03 am
-
Awesome. Especially love the ps tips. Very interesting
58 07.24.09 at 4:04 am
-
Thanks very good info!!!
59 07.27.09 at 7:39 am
-
It’s really nice
60 08.12.09 at 9:49 am
-
Excellent list!
61 08.29.09 at 4:53 am
-
Nice… very nice guy!!!!
62 09.04.09 at 11:00 am
-
From the guy who wrote the collect utility for Tru64:
Name : collectl Relocations: (not relocatable)
Version : 3.3.5 Vendor: Fedora Project
Release : 1.fc10 Build Date: Fri Aug 21 13:22:42 2009
Install Date: Tue Sep 1 18:10:34 2009 Build Host: x86-5.fedora.phx.redhat.com
Group : Applications/System Source RPM: collectl-3.3.5-1.fc10.src.rpm
Size : 1138212 License: GPLv2+ or Artistic
Signature : DSA/SHA1, Mon Aug 31 14:42:40 2009, Key ID bf226fcc4ebfc273
Packager : Fedora Project
URL : http://collectl.sourceforge.net
Summary : A utility to collect various linux performance data
Description :
A utility to collect linux performance dataBest regards, Bob
63 09.05.09 at 8:48 pm
-
For professional network monitoring use Zenoss:
Zenoss Core (open source): http://www.zenoss.com/product/network-monitoring 64 09.14.09 at 9:02 am
-
Hi,
Thanks for the nice collection with useful samples. Consider adding tools to monitor SAN storage, multipath etc. also.
Best Regards,
Somnath 65 09.17.09 at 8:41 am
-
I did not see ifconfig or iwconfig on the list
66 09.17.09 at 1:57 pm
-
openNMS
67 09.25.09 at 12:39 pm
-
Thanks for the article. I am not admin myself, but tools are very useful for me too.
Thanks for the comments also
68 09.28.09 at 6:02 pm
-
When I wrote collectl my goal was to replace as many utilities as possible for several reasons including:
- not all write to log files
- different output formats make correlation VERY difficult
- sar is close but still too many things it doesn’t collect
- I wanted option to generate data that can be easily plotted or loaded into spreadsheet
- I wanted sub-second monitoring
- I want an API and I want to be able to send data over sockets to other tools
- and a whole lot moreI think I succeeded on many fronts, in particular not having to worry if the right data is being collected. Just install rpm and type “/etc/init.d/collectl start” and you’re collecting everything such as slabs and processes every 60 seconds and everything else every 10 seconds AND using <0.1% of the CPU to do so. I personally believe if you’re collecting performance counters at a minute or coarser you’re not really seeing what your system is doing.
As for the API, I worked with some folks at PNNL to monitor their 2300 node cluster, pass the data to ganglia and from there they pass it to their own real-time plotting tool that can display counters for the entire cluster in 3D. They also collectl counters from individual CPUs and pass that data to collectl as well.
I put together a very simple mapping of ’standard’ utilities like sar to the equivilent collectl commands just to get a feel for how they compare. But also keep in mind there are a lot of things collectl does for which there is no equivalent system command, such as Infiniband or Lustre monitoring. How about buddyinfo? And more…
http://collectl.sourceforge.net/Matrix.html
-mark
69 09.29.09 at 5:33 am
-
Darn,
I’ve been using Linux since Windows 98 was the current MicroSnot FOPA.
I know all this stuff. I do not make typoous.
Why do you post this stuff?
We all know it.
Sure we do!
But do we remember it? I just read through it and found stuff that I used long ago and it was like I just learned it. I found stuff I didn’t know either.
Hummmm…… Imagine that!
Thanks, particularly for the PDF.
Saved me making one.
Hey, where’s the HTML to PDF howto?Thanks again.
Cloud Backup
/var/www/vhosts/xxxxx.com/archive/live-mysql-database-backup/dbbackup.sh
tar -cvpzf /var/CaptainMiddles/vhosts$(date +%y%m%d).tar /var/www/vhosts
Posted under UncategorizedCompressing web pages with mod_deflate
Compressing web pages with mod_deflate
mod_deflate allows the Apache2 web service to compress files and deliver them to clients (browsers) that can handle them. With mod_deflate you can compress HTML, text or XML files by up to 70% of their original sizes, thus saving you server traffic, and speeding up page loads.
STOP:
- If you currently do not have your root user enabled please visit the Root Access & Developer Tools section of your AccountCenter.
- An understanding of vi is required for this article. Please consult this article for further assistance.
NOTE:
- Compressing files will increase load on your server, but it is a small tradeoff considering your client’s connection times will decrease significantly.
- This will not exclude users with older browsers that cannot handle compressed content. Thebrowser negotiates with the server before any file is transferred, and if the browser does not have the capability to handle compressed content, the server delivers the files uncompressed.
- mod_deflate has replaced Apache 1.3’s mod_gzip in Apache2.
- This article shows how to enable mod_deflate globally across all the domains on your (dv) server. Should you only wish to enable for a single domain you’d need to add the AddOutputFilterByType and BrowserMatch rules below to the VirtualHost section in your configuration.
Steps
- Make sure that mod_deflate is enabled on your server. Your (dv) server should have it enabled by default. If the following command returns a line with a “#” at the beginning you will have to remove(uncomment) the “#” character using vi or the perl command below:
grep 'mod_deflate' /etc/httpd/conf/httpd.confIf the result was LoadModule deflate_module modules/mod_deflate.so you can continue. If the result was #LoadModule deflate_module modules/mod_deflate.so please run the following command:
perl -pi -e 's/# LoadModule mod_deflate/LoadModule mod_deflate/g' /etc/httpd/conf/httpd.conf - Now that we have verified that mod_deflate is in fact being loaded by Apache we must configure the module:
First backup your existing conf file in case you need to revert back:
cp /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf.bak - Using vi we will edit our Apache conf file and add the following lines at the very bottom of the file, making sure they are separated from any other configurations:
vi /etc/httpd/conf/httpd.conf# # Deflate output configuration # AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css BrowserMatch ^Mozilla/4 gzip-only-text/html BrowserMatch ^Mozilla/4\.0[678] no-gzip BrowserMatch \bMSIE !no-gzip !gzip-only-text/html - Save your file. Now we need to check that Apache likes our changes using the apachectl command:
/usr/sbin/apachectl -t - You should see a Syntax OK message. If not please check your file to make sure you modified the file correctly. Next we need to restart apache using the same apachectl command:
/usr/sbin/apachectl graceful
You have now enabled mod_deflate on your (dv) server! You can see whether the changes are in effect using the following tool at http://whatsmyip.org/mod_gzip_test/
Here is a quick before and after for a default Plesk index page for a domain. You can clearly see how this can benefit sites with rich content.
BEFORE:
AFTER:
creation-of-additional-ftp-users-for-plesk-linux
http://www.diademblogs.com/linux/creation-of-additional-ftp-users-for-plesk-linux
Register | Subscribe to our RSS feed | Log in
Diadem Tech Weblogs
Our official take on web hosting, web development, web marketing and everything in between.
Home
About Us
Diadem Technologies is a small but passionate web development services company specialising in Wordpress, Drupal and Joomla CMS development alongwith PHP/MySQL driven web application development. We also provide professional web hosting services using shared and dedicated hosting platforms to SME’s in India and across the globe.
15th
MAR
Creation of additional FTP users for Plesk Linux
Posted by ankur under Linux, Plesk Control Panel
Plesk is a great Control Panel in the shared hosting environment, but there are a few things that are not available in the Control Panel. For example, you cannot create additional FTP user in Plesk Control panel for Linux (this support is enabled in Plesk for windows). But some time it is required to have multiple FTP accounts to upload/download data. You need to have shell access since the Plesk control panel won’t allow it in the GUI.
Assuming you already have an existing domain (example.com) with the primary FTP user (jack) with password (schmidt) with home directory (/var/www/vhosts/example.com), and you wish to create additional ftp users (jill and bob) with the same access privileges as jack:
Procedure:
Login to server via SSH as root.
Issue the shell command:
#cat /etc/passwd |grep ‘jack’
This will show you a line similar to the following:
jack:x:10041:10001::/var/www/vhosts/example.com:/bin/false
The first number (after the 2nd colon : ) is 10041, so this is the UID of user jack. You will need this in the ‘useradd’ lines since useradd wants a number for the UID.
The second number (after the 3rd colon : ) is 10001, this is the GID (psacln), we won’t need that right now.
Then run the following shell commands to create the users and passwords:
#useradd -u 10041 -o -d /var/www/vhosts/example.com -g psacln -s /bin/false jill
#useradd -u 10041 -o -d /var/www/vhosts/example.com -g psacln -s /bin/false bob
#passwd jill (enter the new password and confirm it, does not have to be the same as jack’s)
#passwd bob (enter the new password and confirm it, does not have to be the same as jack’s)
You should now be able to use an FTP client to login with that user’s name and password.
User jill and bob should be able to see the example.com docroot just as user jack can. You should NOT be able to browse above the example.com docroot directory. All 3 users should have the same access to the files since they belong to the same group, so no matter which of the users created or edited the file(s), all should be able to access/edit/whatever the same files.
(NOTES: Since these are users defined at the OS level, when connecting with an FTP client, they would login with username ‘jill’, ‘bob’, or ‘jack’. They would NOT use ‘jill@example.com’. This also means that USERNAMES MUST BE UNIQUE.)
Subdomain FTP users:
If you wanted to change their default directory and limit them to a Plesk created subdomain docroot, in the useradd line above, you would change “/var/www/vhosts/example.com” to “/var/www/vhosts/example.com/subdomains/subname”. So if you wanted to create the same users, but for a subdomain called ‘admin’:
Then do the following shell commands to create the users and passwords:
#useradd -u 10041 -o -d /var/www/vhosts/example.com/subdomains/admin -g psacln -s /bin/false jill
#useradd -u 10041 -o -d /var/www/vhosts/example.com/subdomains/admin -g psacln -s /bin/false bob
#passwd jill (enter the new password and confirm it, does not have to be the same as jack’s)
#passwd bob (enter the new password and confirm it, does not have to be the same as jack’s)
Deleting an FTP user:
#userdel jill
(Note: this will not delete any files unless you use the -r option which you probably don’t want to do if they are sharing files!)
(2 votes, average: 4.00 out of 5)
ShareThis
Reader’s Comments
Ragnard | May 19th, 2009 at 3:25 am
Thanks! Works like a charm.
Blaine | May 27th, 2009 at 4:00 am
This is great – thanks! BUT can I restrict “jill” from uploading or deleting or changing file names in this shared folder? THAT would be truly awesome. Using proftp, btw.
ankur | May 27th, 2009 at 3:17 pm
Thanks for your comment. But you can’t restrict “jill” from uploading or deleting or changing file names in this shared folder, because the other FTP user “jill” having the privilege of actual FTP user “jack” who requires full permission to manage the other folders/files.
Blaine | May 27th, 2009 at 8:54 pm
Thank you so much for the quick reply, but IS there a way to have jill just be able to read?
Blaine | May 27th, 2009 at 10:40 pm
I figured it out. I made the UID and GID unique, then assigned the appropriate rights to the folder. This post was very helpful. Thank you.
Daz | June 6th, 2009 at 9:51 pm
Blaine – could you elaborate on how you changed UID/GID to restrict access to folders. What I’m trying to do is not only create multiple accounts on a subdomain (success) but restrict those accounts to specific directories within that doman, so that user Bob can only access his Bob directory that I set up under httpdocs.
ankur | June 8th, 2009 at 11:18 am
Hi Daz, Thank you for your comment, you can run the command as below:
useradd -d /var/www/vhosts/example.com/subdomains/subdomain-name/bob -s /bin/false bob
It will set the UID and GID unique, and then set the other users read permission only on the folder bob. This will make the other user (bob) can only read the files/folders. And as the user shell set to /bin/false, which will restrict the account to specific directory within that domain.
Tony Bianco | June 9th, 2009 at 3:21 pm
This is great, because I’m using Media Temple’s DV plan and they use Plesk. I’m needing to create multiple FTP accounts for the same domain but I need to restrict their access to a particular folder.
Also, I need that folder to not be in an area of the webroot where the public can access that folder.
How would I accomplish this?
ankur | June 11th, 2009 at 12:13 pm
Hi Tony, thank you for your comment, here we go
Create a folder anywhere you want, e.g. “/var/userftp/tony” then run the below command to create FTP user:
useradd -d /var/userftp/tony -s /bin/false tony (set the password)
And then use “chmod” command to set require permissions.
Tony Bianco | June 13th, 2009 at 1:55 am
Ankur,
Just so I’m understanding this correctly, because I’m new to this.
I would I issue the following commands to add a new FTP user that would be able to access a folder via FTP:
useradd -d /var/someFTPFolder -s /bin/false myUserName myPassword
Is that correct?
And is there way to assign that user to a general folder and then a user specific folder?
ankur | June 13th, 2009 at 3:06 pm
Tony,
“useradd -d /var/someFTPFolder -s /bin/false myUserName” is correct.
Change the user home directory path as per your choice (general folder or user specific folder), e.g. “/var/some-other-FTPFolder”.
Regards,
Ankur
Tony Bianco | June 15th, 2009 at 2:44 am
Thank you very much! If I ever want to change a user’s password how would I do that?
ankur | June 16th, 2009 at 1:30 pm
Thanks Tony, run the below command to change user password:
passwd username
Regards,
Ankur
Leave a Reply
Name (required)
Mail (will not be published) (required)
Website
Post Meta
March 15, 2009
Linux, Plesk Control Panel
13 Comments
Comments Feed
Diadem Tech Weblogs is powered by Wordpress.
Git Commands
git clone git@github.com:ccbetty/ccbetty-iphone.git
git rm
git commit -a
git push
Apple Push Notification
openssl pkcs12 -clcerts -nokeys -out cert.pem -in cert.p12
openssl pkcs12 -nocerts -out key.pem -in cert.p12
openssl rsa -in key.pem -out key.pem
cat certkey.pem > apns-prod.pem
apple_push_notification_production.pem.zip
http://developer.apple.com/iphone/library/documentation/NetworkingInternet/Conceptual/RemoteNotificationsPG/IPhoneOSClientImp/IPhoneOSClientImp.html
http://apnonrails.metabates.com/
http://blog.boxedice.com/2009/07/10/how-to-build-an-apple-push-notification-provider-server-tutorial/
http://apnonrails.metabates.com/
Posted under UncategorizedSSH Connection
ssh -i /Users/mudiaga/.ssh/name_rsa git@github.com
ssh-add /Users/mudiaga/.ssh/name_rsa
Posted under UncategorizedWordpress SQL
–get all the tags
SELECT distinct name FROM wp_terms wt
INNER JOIN wp_term_taxonomy wtt ON wt.term_id=wtt.term_id
INNER JOIN wp_term_relationships wtr ON wtr.term_taxonomy_id=wtt.term_taxonomy_id
LEFT JOIN wp_posts wp ON wp.ID=wtr.object_id
WHERE
taxonomy=’post_tag’
order by name
order by name
—- find posts of youtube, vidoe, playlists, etc for nmm
select post_title, CONCAT(‘http://www.nmm.com/index.php/’,post_name) from wp_posts where post_parent=0 and post_title like ‘% – picture%’ order by post_title
select post_title, CONCAT(‘http://www.nmm.com/index.php/’,post_name) from wp_posts where post_parent=0 and post_title like ‘%profile%’
select post_title, CONCAT(‘http://www.nmm.com/index.php/’,post_name) from wp_posts where post_parent=0 and post_title like ‘%profile%’
—find missing pictures for artist profiles
select
terms.term_id,terms.name,tax.taxonomy, tax.description, tax.parent
from
wp_term_taxonomy tax,
wp_terms terms
where
tax.term_id=terms.term_id
and tax.taxonomy=’category’
and parent=9
and terms.term_id not in (
select
terms.term_id
from
wp_term_taxonomy tax,
wp_terms terms,
wp_term_relationships rel,
wp_posts posts
where
tax.term_id=terms.term_id
and tax.taxonomy=’category’
and parent=9
and tax.term_taxonomy_id=rel.term_taxonomy_id
and rel.object_id=posts.id
and posts.post_title like ‘% – pictures%’
)
order by name
SELECT CATEGORY INFORMATION
select
terms.term_id,terms.name,tax.taxonomy, tax.description, tax.parent
from
wp_term_taxonomy tax,
wp_terms terms
where
tax.term_id=terms.term_id
and tax.taxonomy=’category’
and parent=9
order by name
————————————–
select all artist profile posts
select
terms.term_id,terms.name,tax.taxonomy, tax.description, tax.parent,posts.post_title
from
wp_term_taxonomy tax,
wp_terms terms,
wp_term_relationships rel,
wp_posts posts
where
tax.term_id=terms.term_id
and tax.taxonomy=’category’
and parent=9
and tax.term_taxonomy_id=rel.term_taxonomy_id
and rel.object_id=posts.id
and posts.post_title like ‘% – artist – profile%’
order by name

http://codex.wordpress.org/images/8/83/WP_27_dbsERD.png
cloud mysql rails database
do not use root user to login
mysql root user is called admin and its the T——– sequence
mysql -u admin -pT——–
ruby script/generate scaffold post title:string content:text
ruby script/generate scaffold video title:string desc:text url:string
ruby script/generate scaffold picture title:string desc:string url:string thumb:string
ruby script/generate scaffold gallery title:string description:text
create database xxx_development;
create database xxx_test;
create database xxx_production;
CREATE USER 'xxxx'@'localhost' IDENTIFIED BY 'yyyy';
CREATE USER 'xxxx'@'%' IDENTIFIED BY 'yyyy';
grant ALL PRIVILEGES on xxxx.* to 'yyyy'@'localhost' WITH GRANT OPTION;
grant ALL PRIVILEGES on xxxx.* to 'yyyy'@'%' WITH GRANT OPTION;
mongrel-cluster.yml
—
prefix: /zzzz
cwd: /var/www/vhosts/ssss.com/subdomains/yyyy/zzzz
log_file: log/mongrel.log
port: “4010″
environment: development
address: 127.0.0.1
pid_file: tmp/pids/mongrel.pid
servers: 3
Posted under Uncategorizedwhen i was little i thought the 2000’s would have flying cars……nah just sensitve niazz and fake gangstas…..
Flex Application Development Process
Flex Application Development Process
- Define an application interface using a set of pre-defined components (forms, buttons, and so on)
- Arrange components into a user interface design
- Use styles and themes to define the visual design
- Add dynamic behavior (one part of the application interacting with another, for example)
- Define and connect to data services as needed
- Build the source code into an SWF file that runs in the Flash Play
development methodology
Development Methodology
manipulating strings in objective-c
Configure MySQL On Mac OX 10.5
gives u sql version
select @@version;
SHOW GLOBAL VARIABLES LIKE ‘version_compile_machine’;
Posted under UncategorizedAuto Create Scaffolding for object in rails
first note your version numbers
gem -v
ruby -v
rails -v
then make sure your system library is up to date
$ sudo gem update –system - this command updates the ruby gems package manager (this update is required by the latest version of rails)
$ sudo gem install rails - updates and installs the latest version of rails including the dependencies
$ sudo gem update rake - updates the rake tool which is used by rails
$ sudo gem update sqlite3-ruby - updates the ruby sqlite3 bindings, you can skip this command if you don’t use sqlite as your database
Testing
You will get visual updates as the update process goes on but if you still feel like testing the update once you are done, type this command in the terminal
$ rails -v
and to get a list of all the gems currently installed on your mac displayed with their version numbers use the following command
$ gem list
Posted under UncategorizedCreate A New Ruby Project And Specify MySQL As The Database
rails shovell -d mysql
rails [appname] – mysql
if u using sqll lite do the following
#rails api -d mysql
rails api
cd api
ruby script/server
ruby script/generate scaffold KokoPicture title:string desc:string url:string created_at:datetime modified_at:datetime
ruby script/generate scaffold KokoFan displayname:string email:string password:string created_at:datetime modified_at:datetime
ruby script/generate scaffold KokoVideo title:string desc:string url:string created_at:datetime modified_at:datetime
ruby script/generate scaffold KokoPost title:string content:string created_at:datetime modified_at:datetime
ruby script/generate scaffold KokoAudio title:string desc:string url:string created_at:datetime modified_at:datetime
ruby script/generate scaffold test title:string desc:string url:string created_at:datetime modified_at:datetime
ruby script/generate migration
rake db:migrate
Posted under UncategorizedI’m So Excited About “Le Nuage”
“Le Nuage” … French for “The Cloud” … these days I wake up with an irresistable itch that I can’t scratch. The economy is in recession, the world in the doldrums, yet I an so freakin excited about the next generation of web apps that for the most part already exist, but are about to take off like wildfire.
Yeah none of this is new but then untapped potential is enormous. I can’t wait.
Posted under UncategorizedLoading Data Into Google AppEngine
Table Basics
Creating SQL Statements To Load Via CURL
Viewing Data
Deleting Data
Posted under Uncategorized










{ 45 comments… read them below or add one }
A honeypot for the SSH Service.
http://kojoney.sourceforge.net/
BTW, I haven’t used it before
A very nice tutorial.
I think you have a typo here. Did you want to say
~/.ssh/authorized_keys or ~/.ssh/authorized_keys2
instead of
~/.ssh/authorized_keys or ~/.ssh/authorized_keys
? (notice the trailing number)
Anyway very nice tutorial! Thanks!
I think this tutorial concludes various how-tos around web this…is simply most comprehensive,easy to understand article on ssh.
Thanks vivek yaar …keep rocking
nice one…
Hmmm again as I always say AWSOME Dude Thanks.. Really helpfull…
RGD
Charanjit Cheema
RHCT
There is still some (small) merit to disallowing root login. Virtually every unix-type system has a “root” account, so allowing root to log in means one less thing that an attacker has to guess (at the least). Of course, if you’re only allowing public key authentication this is sort of moot, and otherwise, depending on your set-up, it might be more inconvenience than it is worth, but it is still something to take into account.
Another potential problem with disallowing root login is in case you use central authentication (e.g. LDAP) in your infrastructure and your LDAP server(s) are unavailable, then you would really appreciate being able to login using the local root account.
I generally ignore advice from people who can’t make communicate without cursing like a sailor. You might consider editing out some of bob’s more colorful language — it’s very juvenile and cheapens the point he is trying to make.
In any case, bob is making a straw man argument and ignoring an obvious benefit. Disabling root login means crackers first have to figure out (enabled) ssh user logins to launch a successful brute force attack. It buys the sysadmin more time, and it’s another layer in the security onion.
Should have read: “… from people who can’t communicate…”
@Chris, Older versions of openssh has differentiated files for authorized keys by version.
@anomie, Thanks, I’ve edited out bob’s colourful language.
@Ashwani / Charanjit / pradeep, Happy to know you like this post.
@Geoge: if you add a local user to passwd, then you don’t need root.
ssh nbensa@ldap
nbensa@ldap:~$ su -
root@ldap:
Bob’s comments in the article, regarding the futileness of disabling root logins may be appropriate for home systems, but for a corporate environment, it is vital. Unless you for your users to log in with their own user account prior to using su/super to become root, you lose all accountability. How are you supposed to know which dimwit broke things?!?
@George – If you are using central authentication, you should also consider using something like pam-ccreds and/or libnss-db to keep cached copies of critical accounts. That way you can still get in, even if contact with the central auth server is broken.
Can we please stop the misbelief that ClientAlive* and ServerAlive* have ANYTHING TO DO WITH Idle timeout? It is used to detect is the remote side still exists. It has absolutely nothing to do with a session being idle.
- Ben
Strange. You say to disable host-based authentication. Yet you say to use TCP wrappers, which applies host-based permissions!
Check out the MaxStartups directive for preventing brute force cracks. Easier than adjusting your firewall rules an potentially locking yourself out.
If you use Moonshine for deployment, there’s a plugin that makes all of this easy and provides secure defaults.
Another point of disallowing root logins is that if bob logs in and messes up the system, you can (theoretically) trace that. If root logs in and messes up something, who is root?
There are times where root logins are appropriate, such as a larger scale of environment. If you are an admin with 100+ systems that need to be patched (thus requiring root privs), then you would have to:
1) scp files to each system using an unprivileged account
2) ssh into each system using an unprivileged account
3) sudo to install the patch
That doesn’t exactly scale well in terms of efficiency.
If you employ Kerberos authentication *with ticket passing* (allowed users are listed in ~root/.k5login) while using SSH, then allowing a direct root login is not a problem as each access is directly attributable to someone’s Kerberos ticket.
Combine Kerberos & SSH and suddenly those three steps listed above become two steps inside a for-loop. Enter your password *once* to establish your Kerberos ticket, and come back in a bit to smile glibly at your efficiency!
You can use the file /etc/ssh/sshrc and/or the folder ~/.ssh/rc for execute a personal script at the connection (see man sshd)
Regarding root logon…
When I was browsing my security log for some weeks ago I discovered that there had been several attempts to login as root on my home server. (And it was more than one attempt that had been going on for days, so some zombie machines in China were just executing it’s evil script).
So… evil zombie machines are trying to login as root on other machines every day, why not just turn off the ssh-login for root.
I know that the probability for finding the right password is extremely low, but if nothing stops these zombie-machines/botnets/whatever from trying they sooner or later (ok, probably almost never) will find the right password.
But as we all rarely need to login as root, it’s for the sake of security better to take the extra time so login and su:ing whatever we need to do.
Chris: script it. If you’re feeling daring, you could even put the script into the ’shell’ for the ‘non-privileged user’, such that whenever someone with an authorized ssh key connects to that account with scp, it accepts the scp, and then automatically kicks off a ’sudo install ‘. This would, of course, require automating the install prompts also.
Vivek Gite: If that’s bob’s language *fixed*, I’d hate to see the original.
If you’ve Firewalled the SSH server (#8), then using TCP Wrappers (#14) is pointless, as TCP wrappers are pretty much an expensive firewall (as it forks for every new connection attempt.) TCP wrappers used to add some capability that didn’t come built-in to the OS. But since Linux has iptables built in, TCP wrappers isn’t necessary. (As I recall, TCP wrappers was still useful back in the days of the original Linux firewall. But sometime between then and now, I believe all of its features have been incorporated. Certainly everything that was mentioned here has been.) As such, putting the block in TCP wrappers would just add yet another place for me to configure the same stuff.
Thanks great post! Have been looking for a decent article on OpenSSH for a while now! Stumbled upon this by chance!
Nice Tutorial
great.Really helpful.tahnks
i don’t want more replies. how do i unsubscribe from this blog?
@nbensa,
Removed. FYI, there is link at the bottom to manage your thread subscription i.e. “Manage subscriptions” link.
Great suggestions as usual Vivek! Thanks!
thanks man, very useful…
Very effective your post, really i dont know about security of the ssh server, but now i can implements in my system.
greetings!
Hi,
What is the difference between Protocol 2 and Protocol 2,1 ?
and which is better to use and why?
Thanks a lot
Very nice tutorial….Having all the info. you put together in one place…I was looking through my bookmarks on SSH and I think I had 20+ different url’s for this info and not as well explained…Thanks for taking the time and putting this together in one easy to follow tutorial…Keep up the good work!
jabellon,
If you specify both ssh protocols, the order is significant. Only the first in the order is considered.
SSH Protocol 2 provides additional mechanisms for confidentiality (the traffic is encrypted using 3DES, Blowfish, CAST128 or Arcfour) and integrity (hmac-md5, hmac-sha1). Note that protocol 1 lacks a strong mechanism for ensuring the integrity of the connection.
Some of the major advantages of Portocol 2 over Protocol 1 are listed below.
- Separate transport, authentication, and connection protocols
- Strong cryptographic integrity check
- Any number of session channels per connection
- Supports Publick key authentication which includes DSA, RSA and OpenPGP ( RSA has been recently added)
- User authentication exchange is more flexible, and allows requiring multiple forms of authentication for access.
Use programs like denyhosts or fail2ban. Ideal for brute force attacks.
Use scponly as shell, with *forwarding disabled, for customers and such which need to copy files only. It’s better then using ftp or something stupid like that,
Nice tuto.
But if you install DenyHosts and these kind of tools be careful about IP spoofing.
What happend if someone spoof your workstation ip address and does brut force your server ? You can’t login !!
Very good, i don’t have problem!!! Surely, my openSSH is more secure
Hi,
Did you faced with situation that users scape from their resctricted shell directory using putty to send a remote “bash” command ?
Thank you, good tutorial. I’m learning Linux it is very helpful tutorial. Thank you again!!!
Forget the point “Bob” made with item 7 disabling root login. It is not horseshit…you’re giving automated brute force programs a username to try with a dictionary. 50% of the login authentication will automatically be cracked if user root is a valid account then all that is left is to guess the password.
About #9:
A better approach to use proactive approaches scripts such as fail2ban or
denyhosts (see below).
and some later comments.
“fail2ban” and “denyhost” are NOT proactive. They _react_ to stuff that they see in the logs AFTER they happened.
And they don’t avoid attacks as such, but only slow them down. They don’t help very much against a botnet (the login attempts will come from lots of dfferent IPs) and depending on your ban action might develop into an unintended denial of service attack by themselves. (So be careful what your ban action does and which resources it uses.)
Changing the default ssh port IS proactive as it avoids every unaimed ssh attack, be it brute force password guessing, denial of service, or attacks that use vulnerabilities in ssh that are exposed before authentication is finished. (Yes, there were such vulnerabilities in the history of ssh (not sure if openssh was vulnerable) ).
As others have said, I don’t allow root login. I do use denyhosts but if brute force attackers only need the password half the battle is won. For this reason I use strong usernames too
One of the things I did some time ago on one of my ssh servers was to install incrond (a daemon that listens to inotify and then runs a script)
http://inotify.aiken.cz/?section=incron&page=faq&lang=en
I then made it run a script that consitsted of “et call home” and shutdown the machine if certain special filess were touched (/bin/ls passwd /etc/shadow etc etc)
I am sure that similer tricks can be pulled of for the other OS’s.
Good tutorial. Thank’s.
Firstly, good tutorial. I had never thought my server can be attacked until logwatch rang some bells. I have installed denyhost, with an option to send me a mail whenever an ip was blocked. This woke me up (literally via Blackberry) when I received at least one brute force attack a day. I agree with Henrik about a possible DOS opportunity with denyhost and furthermore, the longer the list, the longer it takes to log in. I have received attacks from parts of the world I did not think existed on the Internet. I will give yours & Henrik’s suggestion of moving the SSH port a try. It is a good suggestion. Thanks again.
And, Yeah. I agree with anome. Bob needs a mouth wash (your edit was not good enough).