Strength & Honor

Rise Of The Phoenix … It Begins … Again

Aug-23-2010

WordPress : 10+ Life Saving SQL Queries

http://www.catswhocode.com/blog/wordpress-10-life-saving-sql-queries
Posted under Uncategorized
Aug-8-2010

Install MRTG Mac

==========

first install mrtg via macports

===========

http://mrtg.darwinports.com/

If you haven’t already installed Darwin Ports, you can find easy instructions for doing so at themain Darwin Ports page.

Once Darwin Ports has been installed, in a terminal window and while online, type the following and hit return:

    %  cd /opt/local/bin/portslocation/dports/mrtg
    %  sudo port install mrtg
    Password:

You will then be prompted for your root password, which you should enter. You may have to wait for a few minutes while the software is retrieved from the network and installed for you. Y ou should see something that looks similar to:

    --->  Fetching mrtg
    --->  Verifying checksum for mrtg
    --->  Extracting mrtg
    --->  Configuring mrtg
    --->  Building mrtg with target all
    
    --->  Staging mrtg into destroot
    
    --->  Installing mrtg

Make sure that you do not close the terminal window while Darwin Ports is working. Once the software has been installed, you can find further information about using mrtg with these commands:

    %  man mrtg
    %  apropos mrtg
    %  which mrtg
    %  locate mrtg

Where to find more information:

========

configure and start macports

http://oss.oetiker.ch/mrtg/doc/mrtg-unix-guide.en.html

========

cfgmaker –global ‘WorkDir: /Users/xxxxx/erase/mrtg/work’  \
–global ‘Options[_]: bits,growright’ \
–output /Users/xxxxx/erase/mrtg/cfg/mrtg.cfg    \
10.0.1.1
which mrtg
sudo env LANG=C  /opt/local/bin/mrtg /Users/xxxxx/erase/mrtg/cfg/mrtg.cfg

cfgmaker –global ‘WorkDir: /Users/xxxxx/erase/mrtg/work’  \          –global ‘Options[_]: bits,growright’ \          –output /Users/xxxxx/erase/mrtg/cfg/mrtg.cfg    \           10.0.1.1
which mrtg           sudo env LANG=C  /opt/local/bin/mrtg /Users/xxxxx/erase/mrtg/cfg/mrtg.cfg

=============

test snmp

=============

snmpwalk -v 2c -c public -M /usr/share/snmp/mibs:$HOME/share/mibs -m+AIRPORT-BASESTATION-3-MIB Dover.local 1.3.6.1.4.1.63.501

http://blog.cocoia.com/2007/graph-your-airport-express-extreme-data-throughput-and-more/

Posted under Uncategorized
Aug-7-2010

INSTALLING ON MAC OS X Unichars

INSTALLING ON MAC OS X Unichars

updgrade ports to latest

http://www.macports.org/install.php

$ port install glib2
$ gem install unichars

http://github.com/Manfred/unichars

Posted under Uncategorized
Jul-21-2010

Install Ruby / Mysql on 64-bit Snow Leopard

http://weblog.rubyonrails.org/2009/8/30/upgrading-to-snow-leopard

sudo env ARCHFLAGS=”-arch x86_64″ gem install mysql — –with-mysql-config=/usr/local/mysql/bin/mysql_config

Posted under Uncategorized
Jun-14-2010

SSH Authorize Keys

How to do it

First log in on A as user a and generate a pair of authentication keys. Do not enter a passphrase:

a@A:~> ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/a/.ssh/id_rsa):
Created directory ‘/home/a/.ssh’.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/a/.ssh/id_rsa.
Your public key has been saved in /home/a/.ssh/id_rsa.pub.
The key fingerprint is:
3e:4f:05:79:3a:9f:96:7c:3b:ad:e9:58:37:bc:37:e4 a@A
Now use ssh to create a directory ~/.ssh as user b on B. (The directory may already exist, which is fine):

a@A:~> ssh b@B mkdir -p .ssh
b@B’s password:
Finally append a’s new public key to b@B:.ssh/authorized_keys and enter b’s password one last time:

a@A:~> cat .ssh/id_rsa.pub | ssh b@B ‘cat >> .ssh/authorized_keys’
b@B’s password:
From now on you can log into B as b from A as a without password:

a@A:~> ssh b@B hostname
B
A note from one of our readers: Depending on your version of SSH you might also have to do the following changes:

Put the public key in .ssh/authorized_keys2
Change the permissions of .ssh to 700
Change the permissions of .ssh/authorized_keys2 to 640

Posted under Uncategorized
Apr-9-2010

Cron Jobs

sort by day, hour, minute

crontab -l | sort -k3 -k2 -k1

Posted under Uncategorized
Mar-26-2010

==RAILS EXAMPLE==

==RAILS EXAMPLE==

rm -rf MyWebsite.Api

rails MyWebsite.Api

cd MyWebsite.Api

script/generate nifty_scaffold book isbn:string ean:string title:string edition:string primaryauthor:string publishername:string index new edit show

script/generate nifty_scaffold account name:string email:string address:string index new edit show

script/generate nifty_layout

rake:db migrate

rake db:migrate RAILS_ENV=production

script/server

Posted under Uncategorized
Jan-26-2010

Chmod Linux File Permissions

 chmod u=rx file        (Give the owner rx permissions, not w)
     chmod go-rwx file      (Deny rwx permission for group, others)
     chmod g+w file         (Give write permission to the group)
     chmod a+x file1 file2  (Give execute permission to everybody)
     chmod g+rx,o+x file    (OK to combine like this with a comma)
Posted under Uncategorized
Jan-17-2010

Objective-C Check Object Size

NSLog(@”2 size of myObject: %zd %zd”, malloc_size(theContent),malloc_size(thing));

Posted under Uncategorized
Jan-12-2010

tar command

tar -cvpzf alldatabases-$(date +%y%m%d).tar.gz alldatabases-$(date +%y%m%d).bak

tar -cvpzf  twinmm.tar.gz /nice
tar -cvpxf target.tar.gz source
tar -cvpzf sites-$(date +%y%m%d).tar.gz ~/sites
tar -cvpzf documents-$(date +%y%m%d).tar.gz ~/Documents
tar -cvpzf twitter-nmm-$(date +%y%m%d).tar.gz /volumes/8gb/twitter-nmm
Posted under Uncategorized
Jan-6-2010

Development App … Shyat Distributing App … Shyat

To debug
* use development provisioning file
* set get task allow to TRUE for entitlements.plist

Distribution Information

* add Entitlements.plst

* make sure get task allowed in Entitlements .plist is false

* go into target properties and set code-signing to Entitlements.plist

* project should be set to compile to device and not simulator

* delete all provisioning files from device

* remove all provisioning files from xcode -> organizer

* delete app from device

* delete app from itunes

Posted under Uncategorized
Dec-29-2009

Linux Admin

find biggest files
# find / -type f -size +20000k

list folder sizes

du -ch | grep M

Posted under Uncategorized
Nov-13-2009

Bit.ly

curl “http://api.bit.ly/shorten?version=2.0.1&longUrl=http://www.site.com/?p=66&login=LOGIN&apiKey=APIKEY&history=1″

Posted under Uncategorized
Oct-29-2009

mysql database administration

Backup All Databases

  • mysqldump –all-databases> alldatabases.sql
Posted under Uncategorized
Oct-24-2009

Mac Networking

FLUSH DNS

dscacheutil -flushcache
Posted under Uncategorized
Oct-15-2009

Top 20 OpenSSH Server Best Security Practices

Top 20 OpenSSH Server Best Security Practices

by VIVEK GITE · 45 COMMENTS

Don't tell anyone that I'm free

OpenSSH is the implementation of the SSH protocol. OpenSSH is recommended for remote login, making backups, remote file transfer via scp or sftp, and much more. SSH is perfect to keep confidentiality and integrity for data exchanged between two networks and systems. However, the main advantage is server authentication, through the use of public key cryptography. From time to time there are rumors about OpenSSH zero dayexploit. Here are a few things you need to tweak in order to improve OpenSSH server security.

Default Config Files and SSH Port

  • /etc/ssh/sshd_config - OpenSSH server configuration file.
  • /etc/ssh/ssh_config – OpenSSH client configuration file.
  • ~/.ssh/ – Users ssh configuration directory.
  • ~/.ssh/authorized_keys or ~/.ssh/authorized_keys – Lists the public keys (RSA or DSA) that can be used to log into the user’s account
  • /etc/nologin – If this file exists, sshd refuses to let anyone except root log in.
  • /etc/hosts.allow and /etc/hosts.deny : Access controls lists that should be enforced by tcp-wrappers are defined here.
  • SSH default port : TCP 22
SSH Session in Action

SSH Session in Action

#1: Disable OpenSSH Server

Workstations and laptop can work without OpenSSH server. If you need not to provide the remote login and file transfer capabilities of SSH, disable and remove the SSHD server. CentOS / RHEL / Fedora Linux user can disable and remove openssh-server with yum command:
# chkconfig sshd off
# yum erase openssh-server

Debian / Ubuntu Linux user can disable and remove the same with apt-get command:
# apt-get remove openssh-server
You may need to update your iptables script to remove ssh exception rule. Under CentOS / RHEL / Fedora edit the files /etc/sysconfig/iptables and /etc/sysconfig/ip6tables. Once donerestart iptables service:
# service iptables restart
# service ip6tables restart

#2: Only Use SSH Protocol 2

SSH protocol version 1 (SSH-1) has man-in-the-middle attacks problems and security vulnerabilities. SSH-1 is obsolete and should be avoided at all cost. Open sshd_config file and make sure the following line exists:

Protocol 2

#3: Limit Users’ SSH Access

By default all systems user can login via SSH using their password or public key. Sometime you create UNIX / Linux user account for ftp or email purpose. However, those user can login to system using ssh. They will have full access to system tools including compilers and scripting languages such as Perl, Python which can open network ports and do many other fancy things. One of my client has really outdated php script and an attacker was able to create a new account on the system via a php script. However, attacker failed to get into box via ssh because it wasn’t in AllowUsers.

Only allow root, vivek and jerry user to use the system via SSH, add the following to sshd_config:

AllowUsers root vivek jerry

Alternatively, you can allow all users to login via SSH but deny only a few users, with the following line:

DenyUsers saroj anjali foo

You can also configure Linux PAM allows or deny login via the sshd server. You can allow list of group name to access or deny access to the ssh.

#4: Configure Idle Log Out Timeout Interval

User can login to server via ssh and you can set an idel timeout interval to avoid unattended ssh session. Open sshd_config and make sure following values are configured:

ClientAliveInterval 300
ClientAliveCountMax 0

You are setting an idle timeout interval in seconds (300 secs = 5 minutes). After this interval has passed, the idle user will be automatically kicked out (read as logged out). See how to automatically log BASH / TCSH / SSH users out after a period of inactivity for more details.

#5: Disable .rhosts Files

Don’t read the user’s ~/.rhosts and ~/.shosts files. Update sshd_config with the following settings:

IgnoreRhosts yes

SSH can emulate the behavior of the obsolete rsh command, just disable insecure access via RSH.

#6: Disable Host-Based Authentication

To disable host-based authentication, update sshd_config with the following option:

HostbasedAuthentication no

#7: Disable root Login via SSH

There is no need to login as root via ssh over a network. Normal users can use su or sudo (recommended) to gain root level access. This also make sure you get full auditing information about who ran privileged commands on the system via sudo. To disable root login via SSH, update sshd_config with the following line:

PermitRootLogin no

However, bob made excellent point:

Saying “don’t login as root” is h******t. It stems from the days when people sniffed the first packets of sessions so logging in as yourself and su-ing decreased the chance an attacker would see the root pw, and decreast the chance you got spoofed as to your telnet host target, You’d get your password spoofed but not root’s pw. Gimme a break. this is 2005 – We have ssh, used properly it’s secure. used improperly none of this 1989 will make a damn bit of difference. -Bob

#8: Enable a Warning Banner

Set a warning banner by updating sshd_config with the following line:

Banner /etc/issue

Sample /etc/issue file:

----------------------------------------------------------------------------------------------
You are accessing a XYZ Government (XYZG) Information System (IS) that is provided for authorized use only.
By using this IS (which includes any device attached to this IS), you consent to the following conditions:

+ The XYZG routinely intercepts and monitors communications on this IS for purposes including, but not limited to,
penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM),
law enforcement (LE), and counterintelligence (CI) investigations. 

+ At any time, the XYZG may inspect and seize data stored on this IS.

+ Communications using, or data stored on, this IS are not private, are subject to routine monitoring,
interception, and search, and may be disclosed or used for any XYZG authorized purpose.

+ This IS includes security measures (e.g., authentication and access controls) to protect XYZG interests--not
for your personal benefit or privacy.

+ Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching
or monitoring of the content of privileged communications, or work product, related to personal representation
or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work
product are private and confidential. See User Agreement for details.
----------------------------------------------------------------------------------------------

Above is standard sample, consult your legal team for exact user agreement and legal notice details.

#8: Firewall SSH Port # 22

You need to firewall ssh port # 22 by updating iptables or pf firewall configurations. Usually, OpenSSH server must only accept connections from your LAN or other remote WAN sites only.

Netfilter (Iptables) Configuration

Update /etc/sysconfig/iptables (Redhat and friends specific file) to accept connection only from 192.168.1.0/24 and 202.54.1.5/29, enter:

-A RH-Firewall-1-INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -s 202.54.1.5/29 -m state --state NEW -p tcp --dport 22 -j ACCEPT

If you’ve dual stacked sshd with IPv6, edit /etc/sysconfig/ip6tables (Redhat and friends specific file), enter:

 -A RH-Firewall-1-INPUT -s ipv6network::/ipv6mask -m tcp -p tcp --dport 22 -j ACCEPT

Replace ipv6network::/ipv6mask with actual IPv6 ranges.

*BSD PF Firewall Configuration

If you are using PF firewall update /etc/pf.conf as follows:

pass in on $ext_if inet proto tcp from {192.168.1.0/24, 202.54.1.5/29} to $ssh_server_ip port ssh flags S/SA synproxy state

#9: Change SSH Port and Limit IP Binding

By default SSH listen to all available interfaces and IP address on the system. Limit ssh port binding and change ssh port (by default brute forcing scripts only try to connects to port # 22). To bind to 192.168.1.5 and 202.54.1.5 IPs and to port 300, add or correct the following line:

Port 300
ListenAddress 192.168.1.5
ListenAddress 202.54.1.5

A better approach to use proactive approaches scripts such as fail2ban or denyhosts (see below).

#10: Use Strong SSH Passwords and Passphrase

It cannot be stressed enough how important it is to use strong user passwords and passphrase for your keys. Brute force attack works because you use dictionary based passwords. You can force users to avoid passwords against a dictionary attack and use john the ripper tool to find out existing weak passwords. Here is a sample random password generator (put in your ~/.bashrc):

genpasswd() {
	local l=$1
       	[ "$l" == "" ] && l=20
      	tr -dc A-Za-z0-9_ < /dev/urandom | head -c ${l} | xargs
}

Run it:
genpasswd 16
Output:

uw8CnDVMwC6vOKgW

#11: Use Public Key Based Authentication

Use public/private key pair with password protection for the private key. See how to use RSAand DSA key based authentication. Never ever use passphrase free key (passphrase key less) login.

#12: Use Keychain Based Authentication

keychain is a special bash script designed to make key-based authentication incredibly convenient and flexible. It offers various security benefits over passphrase-free keys. See how to setup and use keychain software.

#13: Chroot SSHD (Lock Down Users To Their Home Directories)

By default users are allowed to browse the server directories such as /etc/, /bin and so on. You can protect ssh, using os based chroot or use special tools such as rssh. With the release of OpenSSH 4.8p1 or 4.9p1, you no longer have to rely on third-party hacks such as rssh or complicated chroot(1) setups to lock users to their home directories. See this blog post about new ChrootDirectory directive to lock down users to their home directories.

#14: Use TCP Wrappers

TCP Wrapper is a host-based Networking ACL system, used to filter network access to Internet. OpenSSH does supports TCP wrappers. Just update your /etc/hosts.allow file as follows to allow SSH only from 192.168.1.2 172.16.23.12 :

sshd : 192.168.1.2 172.16.23.12

See this FAQ about setting and using TCP wrappers under Linux / Mac OS X and UNIX like operating systems.

#15: Disable Empty Passwords

You need to explicitly disallow remote login from accounts with empty passwords, update sshd_config with the following line:

PermitEmptyPasswords no

#16: Thwart SSH Crackers (Brute Force Attack)

Brute force is a method of defeating a cryptographic scheme by trying a large number of possibilities using a single or distributed computer network. To prevents brute force attacks against SSH, use the following softwares:

  • DenyHosts is a Python based security tool for SSH servers. It is intended to prevent brute force attacks on SSH servers by monitoring invalid login attempts in the authentication log and blocking the originating IP addresses.
  • Explains how to setup DenyHosts under RHEL / Fedora and CentOS Linux.
  • Fail2ban is a similar program that prevents brute force attacks against SSH.
  • security/sshguard-pf protect hosts from brute force attacks against ssh and other services using pf.
  • security/sshguard-ipfw protect hosts from brute force attacks against ssh and other services using ipfw.
  • security/sshguard-ipfilter protect hosts from brute force attacks against ssh and other services using ipfilter.
  • security/sshblock block abusive SSH login attempts.
  • security/sshit checks for SSH/FTP bruteforce and blocks given IPs.
  • BlockHosts Automatic blocking of abusive IP hosts.
  • Blacklist Get rid of those bruteforce attempts.
  • Brute Force Detection A modular shell script for parsing application logs and checking for authentication failures. It does this using a rules system where application specific options are stored including regular expressions for each unique auth format.
  • IPQ BDB filter May be considered as a fail2ban lite.

#17: Rate-limit Incoming Port # 22 Connections

Both netfilter and pf provides rate-limit option to perform simple throttling on incoming connections on port # 22.

Iptables Example

The following example will drop incoming connections which make more than 5 connection attempts upon port 22 within 60 seconds:

#!/bin/bash
inet_if=eth1
ssh_port=22
$IPT -I INPUT -p tcp --dport ${ssh_port} -i ${inet_if} -m state --state NEW -m recent  --set
$IPT -I INPUT -p tcp --dport ${ssh_port} -i ${inet_if} -m state --state NEW -m recent  --update --seconds 60 --hitcount 5 -j DROP

Call above script from your iptables scripts. Another config option:

$IPT -A INPUT  -i ${inet_if} -p tcp --dport ${ssh_port} -m state --state NEW -m limit --limit 3/min --limit-burst 3 -j ACCEPT
$IPT -A INPUT  -i ${inet_if} -p tcp --dport ${ssh_port} -m state --state ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -o ${inet_if} -p tcp --sport ${ssh_port} -m state --state ESTABLISHED -j ACCEPT
# another one line example
# $IPT -A INPUT -i ${inet_if} -m state --state NEW,ESTABLISHED,RELATED -p tcp --dport 22 -m limit --limit 5/minute --limit-burst 5-j ACCEPT

See iptables man page for more details.

*BSD PF Example

The following will limits the maximum number of connections per source to 20 and rate limit the number of connections to 15 in a 5 second span. If anyone breaks our rules add them to our abusive_ips table and block them for making any further connections. Finally, flush keyword kills all states created by the matching rule which originate from the host which exceeds these limits.

sshd_server_ip="202.54.1.5"
table <abusive_ips> persist
block in quick from <abusive_ips>
pass in on $ext_if proto tcp to $sshd_server_ip port ssh flags S/SA keep state (max-src-conn 20, max-src-conn-rate 15/5, overload <abusive_ips> flush)

#18: Use Port Knocking

Port knocking is a method of externally opening ports on a firewall by generating a connection attempt on a set of prespecified closed ports. Once a correct sequence of connection attempts is received, the firewall rules are dynamically modified to allow the host which sent the connection attempts to connect over specific port(s). A sample port Knocking example for ssh using iptables:

$IPT -N stage1
$IPT -A stage1 -m recent --remove --name knock
$IPT -A stage1 -p tcp --dport 3456 -m recent --set --name knock2

$IPT -N stage2
$IPT -A stage2 -m recent --remove --name knock2
$IPT -A stage2 -p tcp --dport 2345 -m recent --set --name heaven

$IPT -N door
$IPT -A door -m recent --rcheck --seconds 5 --name knock2 -j stage2
$IPT -A door -m recent --rcheck --seconds 5 --name knock -j stage1
$IPT -A door -p tcp --dport 1234 -m recent --set --name knock

$IPT -A INPUT -m --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -p tcp --dport 22 -m recent --rcheck --seconds 5 --name heaven -j ACCEPT
$IPT -A INPUT -p tcp --syn -j doo
  • fwknop is an implementation that combines port knocking and passive OS fingerprinting.
  • Multiple-port knocking Netfilter/IPtables only implementation.

#19: Use Log Analyzer

Read your logs using logwatch or logcheck. These tools make your log reading life easier. It will go through your logs for a given period of time and make a report in the areas that you wish with the detail that you wish. Make sure LogLevel is set to INFO or DEBUG in sshd_config:

LogLevel INFO

#20: Patch OpenSSH and Operating Systems

It is recommended that you use tools such as yumapt-getfreebsd-update and others to keep systems up to date with the latest security patches.

Other Options

To hide openssh version, you need to update source code and compile openssh again. Make sure following options are enabled in sshd_config:

#  Turn on privilege separation
UsePrivilegeSeparation yes
# Prevent the use of insecure home directory and key file permissions
StrictModes yes
# Turn on  reverse name checking
VerifyReverseMapping yes
# Do you need port forwarding?
AllowTcpForwarding no
X11Forwarding no
#  Specifies whether password authentication is allowed.  The default is yes.
PasswordAuthentication no

Verify your sshd_config file before restarting / reloading changes:
# /usr/sbin/sshd -t

Tighter SSH security with two-factor or three-factor (or more) authentication.

References:

  1. The official OpenSSH project.
  2. Forum thread: Failed SSH login attempts and how to avoid brute ssh attacks
  3. man pages sshd_config, ssh_config, tcpd, yum, and apt-get.

If you have a technique or handy software not mentioned here, please share in the comments below to help your fellow readers keep their openssh based server secure.

Download PDF version (193K).

Edited by Vivek Gite @ Oct 15, 10:45.

Featured Articles:

Want to read Linux tips and tricks, but don’t have time to check our blog everyday? Subscribe to our daily email newsletter to make sure you don’t miss a single tip/tricks. Subscribe to ourweekly newsletter here!

{ 45 comments… read them below or add one }

1Ahmed 07.25.09 at 1:12 am

A honeypot for the SSH Service.
http://kojoney.sourceforge.net/
BTW, I haven’t used it before

2Rezaul Karim 07.25.09 at 10:34 am

A very nice tutorial.

3Chris 07.25.09 at 1:18 pm

I think you have a typo here. Did you want to say

~/.ssh/authorized_keys or ~/.ssh/authorized_keys2

instead of

~/.ssh/authorized_keys or ~/.ssh/authorized_keys

? (notice the trailing number)

Anyway very nice tutorial! Thanks!

4Ashwani 07.25.09 at 1:43 pm

I think this tutorial concludes various how-tos around web this…is simply most comprehensive,easy to understand article on ssh.

Thanks vivek yaar …keep rocking :-)

5pradeep 07.25.09 at 3:59 pm

nice one…

6Charanjit Singh 07.25.09 at 5:19 pm

Hmmm again as I always say AWSOME Dude Thanks.. Really helpfull…

RGD
Charanjit Cheema
RHCT

7derDrache 07.25.09 at 5:50 pm

There is still some (small) merit to disallowing root login. Virtually every unix-type system has a “root” account, so allowing root to log in means one less thing that an attacker has to guess (at the least). Of course, if you’re only allowing public key authentication this is sort of moot, and otherwise, depending on your set-up, it might be more inconvenience than it is worth, but it is still something to take into account.

8George 07.26.09 at 2:10 am

Another potential problem with disallowing root login is in case you use central authentication (e.g. LDAP) in your infrastructure and your LDAP server(s) are unavailable, then you would really appreciate being able to login using the local root account.

9anomie 07.26.09 at 3:56 pm

I generally ignore advice from people who can’t make communicate without cursing like a sailor. You might consider editing out some of bob’s more colorful language — it’s very juvenile and cheapens the point he is trying to make.

In any case, bob is making a straw man argument and ignoring an obvious benefit. Disabling root login means crackers first have to figure out (enabled) ssh user logins to launch a successful brute force attack. It buys the sysadmin more time, and it’s another layer in the security onion.

10anomie 07.26.09 at 3:58 pm

Should have read: “… from people who can’t communicate…”

11Vivek Gite 07.26.09 at 4:27 pm

@Chris, Older versions of openssh has differentiated files for authorized keys by version.

@anomie, Thanks, I’ve edited out bob’s colourful language.

@Ashwani / Charanjit / pradeep, Happy to know you like this post.

12nbensa 07.26.09 at 5:50 pm

@Geoge: if you add a local user to passwd, then you don’t need root.

ssh nbensa@ldap
nbensa@ldap:~$ su -
root@ldap:

13mossholderm 07.26.09 at 6:23 pm

Bob’s comments in the article, regarding the futileness of disabling root logins may be appropriate for home systems, but for a corporate environment, it is vital. Unless you for your users to log in with their own user account prior to using su/super to become root, you lose all accountability. How are you supposed to know which dimwit broke things?!? :)

14mossholderm 07.26.09 at 6:26 pm

@George – If you are using central authentication, you should also consider using something like pam-ccreds and/or libnss-db to keep cached copies of critical accounts. That way you can still get in, even if contact with the central auth server is broken.

15Mouring 07.27.09 at 2:55 am

#4: Configure Idle Log Out Timeout Interval

User can login to server via ssh and you can set an idel timeout interval to avoid unattended ssh session. Open sshd_config and make sure following values are configured:

ClientAliveInterval 300
ClientAliveCountMax 0

Can we please stop the misbelief that ClientAlive* and ServerAlive* have ANYTHING TO DO WITH Idle timeout? It is used to detect is the remote side still exists. It has absolutely nothing to do with a session being idle.

- Ben

16Lawrence D’Oliveiro 07.27.09 at 11:12 am

Strange. You say to disable host-based authentication. Yet you say to use TCP wrappers, which applies host-based permissions!

17Rob Lingle 07.27.09 at 4:48 pm

Check out the MaxStartups directive for preventing brute force cracks. Easier than adjusting your firewall rules an potentially locking yourself out.

If you use Moonshine for deployment, there’s a plugin that makes all of this easy and provides secure defaults.

18Mauro 07.27.09 at 8:02 pm

Another point of disallowing root logins is that if bob logs in and messes up the system, you can (theoretically) trace that. If root logs in and messes up something, who is root?

19Chris 07.27.09 at 8:47 pm

There are times where root logins are appropriate, such as a larger scale of environment. If you are an admin with 100+ systems that need to be patched (thus requiring root privs), then you would have to:

1) scp files to each system using an unprivileged account
2) ssh into each system using an unprivileged account
3) sudo to install the patch

That doesn’t exactly scale well in terms of efficiency.

If you employ Kerberos authentication *with ticket passing* (allowed users are listed in ~root/.k5login) while using SSH, then allowing a direct root login is not a problem as each access is directly attributable to someone’s Kerberos ticket.

Combine Kerberos & SSH and suddenly those three steps listed above become two steps inside a for-loop. Enter your password *once* to establish your Kerberos ticket, and come back in a bit to smile glibly at your efficiency!

20richard 07.27.09 at 10:10 pm

You can use the file /etc/ssh/sshrc and/or the folder ~/.ssh/rc for execute a personal script at the connection (see man sshd)

21Per H 07.27.09 at 10:14 pm

Regarding root logon…
When I was browsing my security log for some weeks ago I discovered that there had been several attempts to login as root on my home server. (And it was more than one attempt that had been going on for days, so some zombie machines in China were just executing it’s evil script).
So… evil zombie machines are trying to login as root on other machines every day, why not just turn off the ssh-login for root.

I know that the probability for finding the right password is extremely low, but if nothing stops these zombie-machines/botnets/whatever from trying they sooner or later (ok, probably almost never) will find the right password.

But as we all rarely need to login as root, it’s for the sake of security better to take the extra time so login and su:ing whatever we need to do.

22Ed 07.28.09 at 4:06 pm

Chris: script it. If you’re feeling daring, you could even put the script into the ’shell’ for the ‘non-privileged user’, such that whenever someone with an authorized ssh key connects to that account with scp, it accepts the scp, and then automatically kicks off a ’sudo install ‘. This would, of course, require automating the install prompts also.

Vivek Gite: If that’s bob’s language *fixed*, I’d hate to see the original.

If you’ve Firewalled the SSH server (#8), then using TCP Wrappers (#14) is pointless, as TCP wrappers are pretty much an expensive firewall (as it forks for every new connection attempt.) TCP wrappers used to add some capability that didn’t come built-in to the OS. But since Linux has iptables built in, TCP wrappers isn’t necessary. (As I recall, TCP wrappers was still useful back in the days of the original Linux firewall. But sometime between then and now, I believe all of its features have been incorporated. Certainly everything that was mentioned here has been.) As such, putting the block in TCP wrappers would just add yet another place for me to configure the same stuff.

23sasdaman 07.28.09 at 10:47 pm

Thanks great post! Have been looking for a decent article on OpenSSH for a while now! Stumbled upon this by chance!

24Kapil 07.29.09 at 8:23 am

Nice Tutorial

25swapnil 07.29.09 at 6:24 pm

great.Really helpful.tahnks

26nbensa 07.29.09 at 6:55 pm

i don’t want more replies. how do i unsubscribe from this blog?

27Vivek Gite 07.29.09 at 7:57 pm

@nbensa,

Removed. FYI, there is link at the bottom to manage your thread subscription i.e. “Manage subscriptions” link.

28Leszek 07.29.09 at 8:40 pm

Great suggestions as usual Vivek! Thanks!

29Andrés Aquino 07.30.09 at 6:08 pm

thanks man, very useful…

30lyonn 08.04.09 at 8:32 pm

Very effective your post, really i dont know about security of the ssh server, but now i can implements in my system.

greetings!

31jabellon 08.05.09 at 10:54 am

Hi,

What is the difference between Protocol 2 and Protocol 2,1 ?
and which is better to use and why?

Thanks a lot

32Dot2Kode 08.14.09 at 10:59 pm

Very nice tutorial….Having all the info. you put together in one place…I was looking through my bookmarks on SSH and I think I had 20+ different url’s for this info and not as well explained…Thanks for taking the time and putting this together in one easy to follow tutorial…Keep up the good work!

33BlueNile 08.19.09 at 10:13 am

jabellon,

If you specify both ssh protocols, the order is significant. Only the first in the order is considered.

SSH Protocol 2 provides additional mechanisms for confidentiality (the traffic is encrypted using 3DES, Blowfish, CAST128 or Arcfour) and integrity (hmac-md5, hmac-sha1). Note that protocol 1 lacks a strong mechanism for ensuring the integrity of the connection.

Some of the major advantages of Portocol 2 over Protocol 1 are listed below.

- Separate transport, authentication, and connection protocols
- Strong cryptographic integrity check
- Any number of session channels per connection
- Supports Publick key authentication which includes DSA, RSA and OpenPGP ( RSA has been recently added)
- User authentication exchange is more flexible, and allows requiring multiple forms of authentication for access.

34anonym2 08.26.09 at 9:11 pm

Use programs like denyhosts or fail2ban. Ideal for brute force attacks.

35Lennie 08.31.09 at 1:23 am

Use scponly as shell, with *forwarding disabled, for customers and such which need to copy files only. It’s better then using ftp or something stupid like that,

36ungeekdeplus 09.01.09 at 7:57 am

Nice tuto.

But if you install DenyHosts and these kind of tools be careful about IP spoofing.
What happend if someone spoof your workstation ip address and does brut force your server ? You can’t login !!

37Ricardo 09.14.09 at 5:32 pm

Very good, i don’t have problem!!! Surely, my openSSH is more secure

38Marlon 09.17.09 at 1:46 pm

Hi,

Did you faced with situation that users scape from their resctricted shell directory using putty to send a remote “bash” command ?

39Nina 09.30.09 at 7:44 am

Thank you, good tutorial. I’m learning Linux it is very helpful tutorial. Thank you again!!!

40Theodis Butler 09.30.09 at 5:18 pm

Forget the point “Bob” made with item 7 disabling root login. It is not horseshit…you’re giving automated brute force programs a username to try with a dictionary. 50% of the login authentication will automatically be cracked if user root is a valid account then all that is left is to guess the password.

41Henrik 10.02.09 at 1:07 pm

About #9:
A better approach to use proactive approaches scripts such as fail2ban or
denyhosts (see below).

and some later comments.

“fail2ban” and “denyhost” are NOT proactive. They _react_ to stuff that they see in the logs AFTER they happened.

And they don’t avoid attacks as such, but only slow them down. They don’t help very much against a botnet (the login attempts will come from lots of dfferent IPs) and depending on your ban action might develop into an unintended denial of service attack by themselves. (So be careful what your ban action does and which resources it uses.)

Changing the default ssh port IS proactive as it avoids every unaimed ssh attack, be it brute force password guessing, denial of service, or attacks that use vulnerabilities in ssh that are exposed before authentication is finished. (Yes, there were such vulnerabilities in the history of ssh (not sure if openssh was vulnerable) ).

42Sean 10.03.09 at 4:59 pm

As others have said, I don’t allow root login. I do use denyhosts but if brute force attackers only need the password half the battle is won. For this reason I use strong usernames too

43Greg Bowyer 10.10.09 at 10:25 am

One of the things I did some time ago on one of my ssh servers was to install incrond (a daemon that listens to inotify and then runs a script)
http://inotify.aiken.cz/?section=incron&page=faq&lang=en

I then made it run a script that consitsted of “et call home” and shutdown the machine if certain special filess were touched (/bin/ls passwd /etc/shadow etc etc)

I am sure that similer tricks can be pulled of for the other OS’s.

44Wirasto S. Karim 10.13.09 at 1:52 pm

Good tutorial. Thank’s.

45Michael Lam 10.15.09 at 5:09 am

Firstly, good tutorial. I had never thought my server can be attacked until logwatch rang some bells. I have installed denyhost, with an option to send me a mail whenever an ip was blocked. This woke me up (literally via Blackberry) when I received at least one brute force attack a day. I agree with Henrik about a possible DOS opportunity with denyhost and furthermore, the longer the list, the longer it takes to log in. I have received attacks from parts of the world I did not think existed on the Internet. I will give yours & Henrik’s suggestion of moving the SSH port a try. It is a good suggestion. Thanks again.

And, Yeah. I agree with anome. Bob needs a mouth wash (your edit was not good enough).

Posted under Uncategorized
Oct-15-2009

20 Linux System Monitoring Tools Every SysAdmin Should Know

20 Linux System Monitoring Tools Every SysAdmin Should Know

by VIVEK GITE · 69 COMMENTS

Need to monitor Linux server performance? Try these built-in command and a few add-on tools. Most Linux distributions are equipped with tons of monitoring. These tools provide metrics which can be used to get information about system activities. You can use these tools to find the possible causes of a performance problem. The commands discussed below are some of the most basic commands when it comes to system analysis and debugging server issues such as:

  1. Finding out bottlenecks.
  2. Disk (storage) bottlenecks.
  3. CPU and memory bottlenecks.
  4. Network bottlenecks.

#1: top – Process Activity Command

The top program provides a dynamic real-time view of a running system i.e. actual process activity. By default, it displays the most CPU-intensive tasks running on the server and updates the list every five seconds.

Fig.01: Linux top command

Fig.01: Linux top command

Commonly Used Hot Keys

The top command provides several useful hot keys:

Hot Key Usage
t Displays summary information off and on.
m Displays memory information off and on.
A Sorts the display by top consumers of various system resources. Useful for quick identification of performance-hungry tasks on a system.
f Enters an interactive configuration screen for top. Helpful for setting up top for a specific task.
o Enables you to interactively select the ordering within top.
r Issues renice command.
k Issues kill command.
z Turn on or off color/mono

=> Related: How do I Find Out Linux CPU Utilization?

#2: vmstat – System Activity, Hardware and System Information

The command vmstat reports information about processes, memory, paging, block IO, traps, and cpu activity.
# vmstat 3
Sample Outputs:

procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu------
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
 0  0      0 2540988 522188 5130400    0    0     2    32    4    2  4  1 96  0  0
 1  0      0 2540988 522188 5130400    0    0     0   720 1199  665  1  0 99  0  0
 0  0      0 2540956 522188 5130400    0    0     0     0 1151 1569  4  1 95  0  0
 0  0      0 2540956 522188 5130500    0    0     0     6 1117  439  1  0 99  0  0
 0  0      0 2540940 522188 5130512    0    0     0   536 1189  932  1  0 98  0  0
 0  0      0 2538444 522188 5130588    0    0     0     0 1187 1417  4  1 96  0  0
 0  0      0 2490060 522188 5130640    0    0     0    18 1253 1123  5  1 94  0  0

Display Memory Utilization Slabinfo

# vmstat -m

Get Information About Active / Inactive Memory Pages

# vmstat -a
=> Related: How do I find out Linux Resource utilization to detect system bottlenecks?

#3: w – Find Out Who Is Logged on And What They Are Doing

w command displays information about the users currently on the machine, and their processes.
# w username
# w vivek

Sample Outputs:

 17:58:47 up 5 days, 20:28,  2 users,  load average: 0.36, 0.26, 0.24
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
root     pts/0    10.1.3.145       14:55    5.00s  0.04s  0.02s vim /etc/resolv.conf
root     pts/1    10.1.3.145       17:43    0.00s  0.03s  0.00s w

#4: uptime – Tell How Long The System Has Been Running

The uptime command can be used to see how long the server has been running. The current time, how long the system has been running, how many users are currently logged on, and the system load averages for the past 1, 5, and 15 minutes.
# uptime
Output:

 18:02:41 up 41 days, 23:42,  1 user,  load average: 0.00, 0.00, 0.00

1 can be considered as optimal load value. The load can change from system to system. For a single CPU system 1 – 3 and SMP systems 6-10 load value might be acceptable.

#5: ps – Displays The Processes

ps command will report a snapshot of the current processes. To select all processes use the -A or -e option:
# ps -A
Sample Outputs:

  PID TTY          TIME CMD
    1 ?        00:00:02 init
    2 ?        00:00:02 migration/0
    3 ?        00:00:01 ksoftirqd/0
    4 ?        00:00:00 watchdog/0
    5 ?        00:00:00 migration/1
    6 ?        00:00:15 ksoftirqd/1
....
.....
 4881 ?        00:53:28 java
 4885 tty1     00:00:00 mingetty
 4886 tty2     00:00:00 mingetty
 4887 tty3     00:00:00 mingetty
 4888 tty4     00:00:00 mingetty
 4891 tty5     00:00:00 mingetty
 4892 tty6     00:00:00 mingetty
 4893 ttyS1    00:00:00 agetty
12853 ?        00:00:00 cifsoplockd
12854 ?        00:00:00 cifsdnotifyd
14231 ?        00:10:34 lighttpd
14232 ?        00:00:00 php-cgi
54981 pts/0    00:00:00 vim
55465 ?        00:00:00 php-cgi
55546 ?        00:00:00 bind9-snmp-stat
55704 pts/1    00:00:00 ps

ps is just like top but provides more information.

Show Long Format Output

# ps -Al
To turn on extra full mode (it will show command line arguments passed to process):
# ps -AlF

To See Threads ( LWP and NLWP)

# ps -AlFH

To See Threads After Processes

# ps -AlLm

Print All Process On The Server

# ps ax
# ps axu

Print A Process Tree

# ps -ejH
# ps axjf
# pstree

Print Security Information

# ps -eo euser,ruser,suser,fuser,f,comm,label
# ps axZ
# ps -eM

See Every Process Running As User Vivek

# ps -U vivek -u vivek u

Set Output In a User-Defined Format

# ps -eo pid,tid,class,rtprio,ni,pri,psr,pcpu,stat,wchan:14,comm
# ps axo stat,euid,ruid,tty,tpgid,sess,pgrp,ppid,pid,pcpu,comm
# ps -eopid,tt,user,fname,tmout,f,wchan

Display Only The Process IDs of Lighttpd

# ps -C lighttpd -o pid=
OR
# pgrep lighttpd
OR
# pgrep -u vivek php-cgi

Display The Name of PID 55977

# ps -p 55977 -o comm=

Find Out The Top 10 Memory Consuming Process

# ps -auxf | sort -nr -k 4 | head -10

Find Out top 10 CPU Consuming Process

# ps -auxf | sort -nr -k 3 | head -10

#6: free – Memory Usage

The command free displays the total amount of free and used physical and swap memory in the system, as well as the buffers used by the kernel.
# free
Sample Output:

            total       used       free     shared    buffers     cached
Mem:      12302896    9739664    2563232          0     523124    5154740
-/+ buffers/cache:    4061800    8241096
Swap:      1052248          0    1052248

=> Related: :

  1. Linux Find Out Virtual Memory PAGESIZE
  2. Linux Limit CPU Usage Per Process
  3. How much RAM does my Ubuntu / Fedora Linux desktop PC have?

#7: iostat – Average CPU Load, Disk Activity

The command iostat report Central Processing Unit (CPU) statistics and input/output statistics for devices, partitions and network filesystems (NFS).
# iostat
Sample Outputs:

Linux 2.6.18-128.1.14.el5 (www03.nixcraft.in) 	06/26/2009

avg-cpu:  %user   %nice %system %iowait  %steal   %idle
           3.50    0.09    0.51    0.03    0.00   95.86

Device:            tps   Blk_read/s   Blk_wrtn/s   Blk_read   Blk_wrtn
sda              22.04        31.88       512.03   16193351  260102868
sda1              0.00         0.00         0.00       2166        180
sda2             22.04        31.87       512.03   16189010  260102688
sda3              0.00         0.00         0.00       1615          0

=> Related:Linux Track NFS Directory / Disk I/O Stats

#8: sar – Collect and Report System Activity

The sar command is used to collect, report, and save system activity information. To see network counter, enter:
# sar -n DEV | more
To display the network counters from the 24th:
# sar -n DEV -f /var/log/sa/sa24 | more
You can also display real time usage using sar:
# sar 4 5
Sample Outputs:

Linux 2.6.18-128.1.14.el5 (www03.nixcraft.in) 		06/26/2009

06:45:12 PM       CPU     %user     %nice   %system   %iowait    %steal     %idle
06:45:16 PM       all      2.00      0.00      0.22      0.00      0.00     97.78
06:45:20 PM       all      2.07      0.00      0.38      0.03      0.00     97.52
06:45:24 PM       all      0.94      0.00      0.28      0.00      0.00     98.78
06:45:28 PM       all      1.56      0.00      0.22      0.00      0.00     98.22
06:45:32 PM       all      3.53      0.00      0.25      0.03      0.00     96.19
Average:          all      2.02      0.00      0.27      0.01      0.00     97.70

=> Related:How to collect Linux system utilization data into a file

#9: mpstat – Multiprocessor Usage

The mpstat command displays activities for each available processor, processor 0 being the first one. mpstat -P ALL to display average CPU utilization per processor:
# mpstat -P ALL
Sample Output:

Linux 2.6.18-128.1.14.el5 (www03.nixcraft.in)	 	06/26/2009

06:48:11 PM  CPU   %user   %nice    %sys %iowait    %irq   %soft  %steal   %idle    intr/s
06:48:11 PM  all    3.50    0.09    0.34    0.03    0.01    0.17    0.00   95.86   1218.04
06:48:11 PM    0    3.44    0.08    0.31    0.02    0.00    0.12    0.00   96.04   1000.31
06:48:11 PM    1    3.10    0.08    0.32    0.09    0.02    0.11    0.00   96.28     34.93
06:48:11 PM    2    4.16    0.11    0.36    0.02    0.00    0.11    0.00   95.25      0.00
06:48:11 PM    3    3.77    0.11    0.38    0.03    0.01    0.24    0.00   95.46     44.80
06:48:11 PM    4    2.96    0.07    0.29    0.04    0.02    0.10    0.00   96.52     25.91
06:48:11 PM    5    3.26    0.08    0.28    0.03    0.01    0.10    0.00   96.23     14.98
06:48:11 PM    6    4.00    0.10    0.34    0.01    0.00    0.13    0.00   95.42      3.75
06:48:11 PM    7    3.30    0.11    0.39    0.03    0.01    0.46    0.00   95.69     76.89

=> Related:Linux display each multiple SMP CPU processors utilization individually.

#10: pmap – Process Memory Usage

The command pmap report memory map of a process. Use this command to find out causes of memory bottlenecks.
# pmap -d PID
To display process memory information for pid # 47394, enter:
# pmap -d 47394
Sample Outputs:

47394:   /usr/bin/php-cgi
Address           Kbytes Mode  Offset           Device    Mapping
0000000000400000    2584 r-x-- 0000000000000000 008:00002 php-cgi
0000000000886000     140 rw--- 0000000000286000 008:00002 php-cgi
00000000008a9000      52 rw--- 00000000008a9000 000:00000   [ anon ]
0000000000aa8000      76 rw--- 00000000002a8000 008:00002 php-cgi
000000000f678000    1980 rw--- 000000000f678000 000:00000   [ anon ]
000000314a600000     112 r-x-- 0000000000000000 008:00002 ld-2.5.so
000000314a81b000       4 r---- 000000000001b000 008:00002 ld-2.5.so
000000314a81c000       4 rw--- 000000000001c000 008:00002 ld-2.5.so
000000314aa00000    1328 r-x-- 0000000000000000 008:00002 libc-2.5.so
000000314ab4c000    2048 ----- 000000000014c000 008:00002 libc-2.5.so
.....
......
..
00002af8d48fd000       4 rw--- 0000000000006000 008:00002 xsl.so
00002af8d490c000      40 r-x-- 0000000000000000 008:00002 libnss_files-2.5.so
00002af8d4916000    2044 ----- 000000000000a000 008:00002 libnss_files-2.5.so
00002af8d4b15000       4 r---- 0000000000009000 008:00002 libnss_files-2.5.so
00002af8d4b16000       4 rw--- 000000000000a000 008:00002 libnss_files-2.5.so
00002af8d4b17000  768000 rw-s- 0000000000000000 000:00009 zero (deleted)
00007fffc95fe000      84 rw--- 00007ffffffea000 000:00000   [ stack ]
ffffffffff600000    8192 ----- 0000000000000000 000:00000   [ anon ]
mapped: 933712K    writeable/private: 4304K    shared: 768000K

The last line is very important:

  • mapped: 933712K total amount of memory mapped to files
  • writeable/private: 4304K the amount of private address space
  • shared: 768000K the amount of address space this process is sharing with others

=> Related:Linux find the memory used by a program / process using pmap command

#11 and #12: netstat and ss – Network Statistics

The command netstat displays network connections, routing tables, interface statistics, masquerade connections, and multicast memberships. ss command is used to dump socket statistics. It allows showing information similar to netstat. See the following resources about ss and netstat commands:

#13: iptraf – Real-time Network Statistics

The iptraf command is interactive colorful IP LAN monitor. It is an ncurses-based IP LAN monitor that generates various network statistics including TCP info, UDP counts, ICMP and OSPF information, Ethernet load info, node stats, IP checksum errors, and others. It can provide the following info in easy to read format:

  • Network traffic statistics by TCP connection
  • IP traffic statistics by network interface
  • Network traffic statistics by protocol
  • Network traffic statistics by TCP/UDP port and by packet size
  • Network traffic statistics by Layer2 address
Fig.02: General interface statistics: IP traffic statistics by network interface

Fig.02: General interface statistics: IP traffic statistics by network interface

Fig.03 Network traffic statistics by TCP connection

Fig.03 Network traffic statistics by TCP connection

#14: tcpdump – Detailed Network Traffic Analysis

The tcpdump is simple command that dump traffic on a network. However, you need good understanding of TCP/IP protocol to utilize this tool. For.e.g to display traffic info about DNS, enter:
# tcpdump -i eth1 'udp port 53'
To display all IPv4 HTTP packets to and from port 80, i.e. print only packets that contain data, not, for example, SYN and FIN packets and ACK-only packets, enter:
# tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
To display all FTP session to 202.54.1.5, enter:
# tcpdump -i eth1 'dst 202.54.1.5 and (port 21 or 20'
To display all HTTP session to 192.168.1.5:
# tcpdump -ni eth0 'dst 192.168.1.5 and tcp and port http'
Use wireshark to view detailed information about files, enter:
# tcpdump -n -i eth1 -s 0 -w output.txt src or dst port 80

#15: strace – System Calls

Trace system calls and signals. This is useful for debugging webserver and other server problems. See how to use to trace the process and see What it is doing.

#16: /Proc file system – Various Kernel Statistics

/proc file system provides detailed information about various hardware devices and other Linux kernel information. See Linux kernel /proc documentations for further details. Common /proc examples:
# cat /proc/cpuinfo
# cat /proc/meminfo
# cat /proc/zoneinfo
# cat /proc/mounts

17#: Nagios – Server And Network Monitoring

Nagios is a popular open source computer system and network monitoring application software. You can easily monitor all your hosts, network equipment and services. It can send alert when things go wrong and again when they get better. FAN is “Fully Automated Nagios”. FAN goals are to provide a Nagios installation including most tools provided by the Nagios Community. FAN provides a CDRom image in the standard ISO format, making it easy to easilly install a Nagios server. Added to this, a wide bunch of tools are including to the distribution, in order to improve the user experience around Nagios.

18#: Cacti – Web-based Monitoring Tool

Cacti is a complete network graphing solution designed to harness the power of RRDTool’s data storage and graphing functionality. Cacti provides a fast poller, advanced graph templating, multiple data acquisition methods, and user management features out of the box. All of this is wrapped in an intuitive, easy to use interface that makes sense for LAN-sized installations up to complex networks with hundreds of devices. It can provide data about network, CPU, memory, logged in users, Apache, DNS servers and much more. See how to install and configure Cacti network graphing tool under CentOS / RHEL.

#19: KDE System Guard – Real-time Systems Reporting and Graphing

KSysguard is a network enabled task and system monitor application for KDE desktop. This tool can be run over ssh session. It provides lots of features such as a client/server architecture that enables monitoring of local and remote hosts. The graphical front end uses so-called sensors to retrieve the information it displays. A sensor can return simple values or more complex information like tables. For each type of information, one or more displays are provided. Displays are organized in worksheets that can be saved and loaded independently from each other. So, KSysguard is not only a simple task manager but also a very powerful tool to control large server farms.

Fig.05 KDE System Guard

Fig.05 KDE System Guard {Image credit: Wikipedia}

See the KSysguard handbook for detailed usage.

#20: Gnome System Monitor – Real-time Systems Reporting and Graphing

The System Monitor application enables you to display basic system information and monitor system processes, usage of system resources, and file systems. You can also use System Monitor to modify the behavior of your system. Although not as powerful as the KDE System Guard, it provides the basic information which may be useful for new users:

  • Displays various basic information about the computer’s hardware and software.
  • Linux Kernel version
  • GNOME version
  • Hardware
  • Installed memory
  • Processors and speeds
  • System Status
  • Currently available disk space
  • Processes
  • Memory and swap space
  • Network usage
  • File Systems
  • Lists all mounted filesystems along with basic information about each.
Fig.06 The Gnome System Monitor application

Fig.06 The Gnome System Monitor application

Bounce: Additional Tools

A few more tools:

  • nmap – scan your server for open ports.
  • lsof – list open files, network connections and much more.
  • ntop web based tool – ntop is the best tool to see network usage in a way similar to what top command does for processes i.e. it is network traffic monitoring software. You can see network status, protocol wise distribution of traffic for UDP, TCP, DNS, HTTP and other protocols.
  • Conky – Another good monitoring tool for the X Window System. It is highly configurable and is able to monitor many system variables including the status of the CPU, memory, swap space, disk storage, temperatures, processes, network interfaces, battery power, system messages, e-mail inboxes etc.
  • GKrellM – It can be used to monitor the status of CPUs, main memory, hard disks, network interfaces, local and remote mailboxes, and many other things.
  • vnstat – vnStat is a console-based network traffic monitor. It keeps a log of hourly, daily and monthly network traffic for the selected interface(s).
  • htop – htop is an enhanced version of top, the interactive process viewer, which can display the list of processes in a tree form.
  • mtr – mtr combines the functionality of the traceroute and ping programs in a single network diagnostic tool.

Did I miss something? Please add your favorite system motoring tool in the comments.

Download pdf version (489K)

Featured Articles:

Want to read Linux tips and tricks, but don’t have time to check our blog everyday? Subscribe to ourdaily email newsletter to make sure you don’t miss a single tip/tricks. Subscribe to our weekly newsletter here!

{ 69 comments… read them below or add one }

1VonSkippy 06.27.09 at 5:10 am

Pretty much common knowledge (or should be) but handy to have listed all in one place.

2robb 06.27.09 at 8:29 am

yeap most of them are must-have tools.
good job of collecting them in a post.

3Chris 06.27.09 at 8:37 am

Nice list. For systems with just a few nodes I recommend Munin. It’s easy to install and configure. My favorite tool for monitoring a linux cluster is Ganglia.

P.S. I think you should change this “#2: vmstat – Network traffic statistics by TCP connection …”

4ftaurino 06.27.09 at 9:09 am

another useful tool is dstat , which combines vmstat, iostat, ifstat, netstat information and more. but this is a very useful list with some interesting examples!

5James 06.27.09 at 9:23 am

pocess or process. haha, i love typos

6Artur 06.27.09 at 9:40 am

What about Munin ? Lots easier and lighter than Cacti.

7Raj 06.27.09 at 10:13 am

Nice list, worth bookmarking!

8rkarim 06.27.09 at 10:22 am

I have a step-by-step nagios implementation howto, some one may try that. please visit http://www.linux-bd.com/
and I always thanks vivek, to run such a nice site http://www.cyberciti.biz/

9kaosmonk 06.27.09 at 10:53 am

Once again, great article!!

10Amr El-Sharnoby 06.27.09 at 11:07 am

I can see that the best tool to monitor processes , CPU, memeory and disk bottleneck at once is atop …

But the tool itself can cause a lot of trouble in heavily loaded servers and it enables process accounting and has a service running all the time …

To use it efficiently on RHEL , CentOS;
1- install rpmforge repo
2- # yum install atop
3- # killalll atop
4- # chkconfig atop off
5- # rm -rf /tmp/atop.d/ /var/log/atop/
6- then don’t directly run “atop” command , but instead run it as follows;
# ATOPACCT=” atop

This tool has saved me hundreds of hours really! and helped me to diagnose bottlenecks and solve them that couldn’t otherwise be easily detected and would need many different tools

11Vivek Gite 06.27.09 at 1:01 pm

@Chris / James

Thanks for the heads-up!

12Solaris 06.27.09 at 1:26 pm

Great post, also great reference.

13quba 06.27.09 at 1:46 pm

Hi,

We have just added your latest post “20 Linux System Monitoring Tools

Every SysAdmin Should Know” to our Directory of Technology . You

can check the inclusion of the post here . We are delighted

to invite you to submit all your future posts to the directory and get a huge base of

visitors to your website.

Warm Regards

Techtrove.info Team

http://www.techtrove.info

14Cristiano 06.27.09 at 1:57 pm

You probably wanna add IFTOP tool, its really simple and light, very useful when u need to have a last moment remote access to a server to see hows the trific going.

15Peko 06.27.09 at 3:40 pm

Yeah, well why a so good admin (I dig(g) your site) won’t you use spelling checkers?
Typo #2 Web-based __Monitioring__ Tool

16paul tergeist 06.27.09 at 4:17 pm

maybe it’s a typo too, but the title should be :
“.. Tools Every SysAdmin MUST Know”
and still, this is advanced user knowledge, at most. I would not trust a sysadmin that knows so few. And..

17harrywwc 06.27.09 at 10:56 pm

Hi guys,

good list – and some great submitted pointers to other useful tools.

to those carp-ing on about typo’s – give us all a break. you’ve never made a typo? ever?

Idea: How ’bout those who have never *ever* made an error in typing text be the first one(s) to give people grief about making a typo?

I _used_ to be a real PITA about this; then I grew up.

The purpose of this blog, and other forms of communication, is to *communicate* concepts and ideas. *If* you have received those clearly – in spite of the typos – then the purpose has been fulfilled.

/me gets down off his soapbox

.h

18Pádraig Brady 06.27.09 at 11:37 pm

A script I use often to show the real memory usage of programs on linux, isps_mem.py

I also summarised a few linux monitoring tools here

I’d also mention the powertop utility

19Saad 06.27.09 at 11:54 pm

This blog is more impressive and more useful than ever. I need more help regarding proper installation document on “php-network weathermap” on Cacti as plugins

20Jack 06.28.09 at 2:18 am

No love for whowatch ? Real time info on who’s logged in, how their connected (SSH, TTY, etc) and what process thay have running.

http://www.pttk.ae.krakow.pl/~mike/#whowatch

21Ponzu 06.28.09 at 2:28 am

vi — tool used to examine and modify almost any configuration file.

22Eric schulman 06.28.09 at 5:38 am

dtrace is a notable mention for the picky hackers that wish to know more about the behavior of the operating system and it’s programs internals.

23Ashok kumar 06.28.09 at 5:48 am

hi gud information , keep it up

ash

24Enzo 06.28.09 at 6:09 am

You missed: iftop & nethogs

25Adrian Fita 06.28.09 at 7:09 am

Excellent list. Like Amr El-Sharnoby above, I also find atop indispensable and think itmust be installed on every system.

In addition I would like to add iotop to monitor disk usage per process and jnettop to very easily monitor bandwidth allocation between connections on a Linux system.

26Knightsream 06.28.09 at 8:53 am

Well, the one i use right now is Pandora FMS 3.0 and its making my work easy.

27praveen k 06.28.09 at 12:56 pm

I would like to add
whoami ,who am i, finger, pinky , id commands

28create own website 06.28.09 at 3:32 pm

i always love linux, great article

29Mathieu Desnoyers 06.28.09 at 9:14 pm

One tool which seems to be missing from this list is LTTng. It is a system-wide tracing tool which helps understanding complex performance problems in multithreaded, multiprocess applications involving many userspace-kernel interactions.

The project is available at http://www.lttng.org. Recent SuSE distributions, WindRiver, Monta Vista and STLinux offer the tracer as distribution packages. The standard way to use it is to install a patched kernel though. It comes with a trace analyzer, LTTV, which provides nice view of the overall system behavior.

Mathieu

30Andy Leo 06.29.09 at 1:02 am

Very useful, well done. Thanks!

31Aveek Sen 06.29.09 at 1:29 am

Very informative.

32The Hulk 06.29.09 at 2:11 am

I love this website.

33kburger 06.29.09 at 3:08 am

If we’re talking about a web server, apachetop is a nice tool to see Apache’s activity.

34Ram 06.29.09 at 4:07 am

Dude you forgot the most important of ALL!

net-snmpd

With it you can collect vast amounts of information. Then with snmpwalk and scripts you can create your own web NMS to collect simple information like ping, disk space, services down.

35Kartik Mistry 06.29.09 at 5:15 am

`iotop` is nice one to be include in list. I used `vnstat` very much for keeping track of my download when I was on limited connection :)

36Vivek Gite 06.29.09 at 7:03 am

@Everyone

Thanks for sharing all your tools with us.

37feilong 06.29.09 at 10:01 am

Very useful, thinks for sharing.

Take a look to a great tools called nmon. I use it on AIX IBM system but works now on all GNU/linux system now.

38boz 06.29.09 at 10:21 am

mtr

39Scyldinga 06.29.09 at 10:21 am

I’m with @paul tergeist, tools every linux user should know. The ps samples are nice, thanks.

No reference to configuration management tools ?

cfengine/puppet/chef?

40Ken McDonell 06.29.09 at 9:19 pm

Nice summary article.

If your “system” is large and/or distributed, and the performance issues you’re tackling are complex, you may wish to explore Performance Co-Pilot (PCP). It unifies all of the performance data from the tools you’ve mentioned (and more), can be extended to include new applications and service layers, works across the network and for clusters and provides both real-time and retrospective analysis.

See http://www.oss.sgi.com/projects/pcp

PCP is included in the Debian-based and SUSE distributions and is likely to appear in the RH distributions in the future.

As a bonus, PCP also works for monitoring non-Linux platforms (Windows and some of the Unix derivatives).

41Lance 06.30.09 at 2:37 am

I love your collection.

I use about 25% of those regularly, and another 25% semi-regularly. I’ll have to add another 25% of those to my list of regulars.

Thanks for compiling this list.

42bogo 06.30.09 at 6:01 am

Very nice collection of linux applications. I work with linux but I can’t say that i know them all.

43MEHTA GHANSHYAM 06.30.09 at 9:28 am

REALLY ITS VERY GOOD N USEFULL FOR ALL ADMIN.
THANKS ONCE AGAIN

44fasil 06.30.09 at 12:06 pm

Good post…already bookmarked… cheers

45Aleksey Tsalolikhin 06.30.09 at 7:30 pm

I’ll just mention “ngrep” – network grep.

Great list, thanks!!

Aleksey

46Abdul Kayyum 07.01.09 at 3:40 pm

Thanks for sharing this information..

47Aurelio 07.01.09 at 8:20 pm

feilong, I agree. I use nmon on my linux boxes from years. It’s worth a look.

48komradebob 07.01.09 at 10:36 pm

Great article, many great suggestions.

Was surprised not to see these among the suggestions:

bmon – graphs/tracks network activity/bandwidth real time.
etherape – great visual indicator of what traffic is going where on the network
wireshark – tcpdump on steroids.
multitail – tail multiple files in a single terminal window
swatch – track your log files and fire off alerts

49pradeep 07.02.09 at 11:14 am

how the hell i missed this site this many days… :P thank god i found it… :) i love it…

50Jay 07.04.09 at 5:23 pm

O personally much prefer htop to top. Displays everything very nicely.

phpsysinfo is another nice light web-based monitoring tool. Very easy to setup and use.

51Manuel Fraga 07.05.09 at 4:55 pm

Osmius: The Open Source Monitoring Tool is C++ and Java. Monitor “everything” connected to a network with incredible performance. Create and integrate Business Services, SLAs and ITIL processes such as availability management and capacity planning.

52aR 07.06.09 at 4:17 pm

thanks for sharing all the helpful tools.

53Shailesh Mishra 07.07.09 at 7:13 pm

Nice compilation. As usual, always very useful.

It would be nice if some of you knowledgeable guys can shed some light on java heap monitoring thing, thread lock detection and analysis, heap analysis etc.

54Bjarne Rasmussen 07.07.09 at 8:00 pm

nmon is a nice tool… try google for it, it rocks

55Balaji 07.12.09 at 5:50 pm

Very much Useful Information’s,
trafmon is one more useful tool

56Stefan 07.15.09 at 8:18 pm

And for those which like lightweight and concise graphical metering:
xosview +disk -ints -bat

57Raja 07.19.09 at 3:03 am

Awesome. Especially love the ps tips. Very interesting

58Rajat 07.24.09 at 4:04 am

Thanks very good info!!!

59nima0102 07.27.09 at 7:39 am

It’s really nice :)

60David Thomas 08.12.09 at 9:49 am

Excellent list!

61Vinidog 08.29.09 at 4:53 am

Nice… very nice guy!!!! ;-)

62Bob Marcan 09.04.09 at 11:00 am

From the guy who wrote the collect utility for Tru64:

Name : collectl Relocations: (not relocatable)
Version : 3.3.5 Vendor: Fedora Project
Release : 1.fc10 Build Date: Fri Aug 21 13:22:42 2009
Install Date: Tue Sep 1 18:10:34 2009 Build Host: x86-5.fedora.phx.redhat.com
Group : Applications/System Source RPM: collectl-3.3.5-1.fc10.src.rpm
Size : 1138212 License: GPLv2+ or Artistic
Signature : DSA/SHA1, Mon Aug 31 14:42:40 2009, Key ID bf226fcc4ebfc273
Packager : Fedora Project
URL : http://collectl.sourceforge.net
Summary : A utility to collect various linux performance data
Description :
A utility to collect linux performance data

Best regards, Bob

63Tman 09.05.09 at 8:48 pm

For professional network monitoring use Zenoss:
Zenoss Core (open source): http://www.zenoss.com/product/network-monitoring

64Somnath Pal 09.14.09 at 9:02 am

Hi,

Thanks for the nice collection with useful samples. Consider adding tools to monitor SAN storage, multipath etc. also.

Best Regards,
Somnath

65Eddy 09.17.09 at 8:41 am

I did not see ifconfig or iwconfig on the list

66Kestev 09.17.09 at 1:57 pm

openNMS

67Sergiy 09.25.09 at 12:39 pm

Thanks for the article. I am not admin myself, but tools are very useful for me too.

Thanks for the comments also :)

68Mark Seger 09.28.09 at 6:02 pm

When I wrote collectl my goal was to replace as many utilities as possible for several reasons including:
- not all write to log files
- different output formats make correlation VERY difficult
- sar is close but still too many things it doesn’t collect
- I wanted option to generate data that can be easily plotted or loaded into spreadsheet
- I wanted sub-second monitoring
- I want an API and I want to be able to send data over sockets to other tools
- and a whole lot more

I think I succeeded on many fronts, in particular not having to worry if the right data is being collected. Just install rpm and type “/etc/init.d/collectl start” and you’re collecting everything such as slabs and processes every 60 seconds and everything else every 10 seconds AND using <0.1% of the CPU to do so. I personally believe if you’re collecting performance counters at a minute or coarser you’re not really seeing what your system is doing.

As for the API, I worked with some folks at PNNL to monitor their 2300 node cluster, pass the data to ganglia and from there they pass it to their own real-time plotting tool that can display counters for the entire cluster in 3D. They also collectl counters from individual CPUs and pass that data to collectl as well.

I put together a very simple mapping of ’standard’ utilities like sar to the equivilent collectl commands just to get a feel for how they compare. But also keep in mind there are a lot of things collectl does for which there is no equivalent system command, such as Infiniband or Lustre monitoring. How about buddyinfo? And more…

http://collectl.sourceforge.net/Matrix.html

-mark

69PeteG 09.29.09 at 5:33 am

Darn,
I’ve been using Linux since Windows 98 was the current MicroSnot FOPA.
I know all this stuff. I do not make typoous.
Why do you post this stuff?
We all know it.
Sure we do!
But do we remember it? I just read through it and found stuff that I used long ago and it was like I just learned it. I found stuff I didn’t know either.
Hummmm…… Imagine that!
Thanks, particularly for the PDF.
Saved me making one.
Hey, where’s the HTML to PDF howto?

Thanks again.

Posted under Uncategorized
Oct-14-2009

Cloud Backup

/var/www/vhosts/xxxxx.com/archive/live-mysql-database-backup/dbbackup.sh

tar -cvpzf /var/CaptainMiddles/vhosts$(date +%y%m%d).tar /var/www/vhosts

Posted under Uncategorized
Oct-13-2009

Compressing web pages with mod_deflate

Compressing web pages with mod_deflate

  • APPLIES TO:(dv) 3.5
  • DIFFICULTY:Medium
  • TIME NEEDED:10 minutes
  • TOOLS NEEDED:ssh vi root

mod_deflate allows the Apache2 web service to compress files and deliver them to clients (browsers) that can handle them. With mod_deflate you can compress HTML, text or XML files by up to 70% of their original sizes, thus saving you server traffic, and speeding up page loads.

STOP:

  • If you currently do not have your root user enabled please visit the Root Access & Developer Tools section of your AccountCenter.
  • An understanding of vi is required for this article.  Please consult this article for further assistance.

NOTE:

  • Compressing files will increase load on your server,  but it is a small tradeoff considering your client’s connection times will decrease significantly.
  • This will not exclude users with older browsers that cannot handle compressed content. Thebrowser negotiates with the server before any file is transferred, and if the browser does not have the capability to handle compressed content, the server delivers the files uncompressed.
  • mod_deflate has replaced Apache 1.3’s mod_gzip in Apache2.
  • This article shows how to enable mod_deflate globally across all the domains on your (dv) server.  Should you only wish to enable for a single domain you’d need to add the AddOutputFilterByType and BrowserMatch rules below to the VirtualHost section in your configuration.

Steps

  1. Make sure that mod_deflate is enabled on your server.  Your (dv) server should have it enabled by default.  If the following command returns a line with a “#” at the beginning you will have to remove(uncomment) the “#” character using vi or the perl command below:
     grep 'mod_deflate' /etc/httpd/conf/httpd.conf
    

    If the result was LoadModule deflate_module modules/mod_deflate.so you can continue.  If the result was #LoadModule deflate_module modules/mod_deflate.so please run the following command:

     perl -pi -e 's/# LoadModule mod_deflate/LoadModule mod_deflate/g' /etc/httpd/conf/httpd.conf
    
    
  2. Now that we have verified that mod_deflate is in fact being loaded by Apache we must configure the module:

    First backup your existing conf file in case you need to revert back:

    cp /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf.bak 
  3. Using vi we will edit our Apache conf file and add the following lines at the very bottom of the file, making sure they are separated from any other configurations:
    vi /etc/httpd/conf/httpd.conf 
    #
    # Deflate output configuration
    #
    AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css
    BrowserMatch ^Mozilla/4 gzip-only-text/html
    BrowserMatch ^Mozilla/4\.0[678] no-gzip
    BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
  4. Save your file.  Now we need to check that Apache likes our changes using the apachectl command:
     /usr/sbin/apachectl -t
    
  5. You should see a Syntax OK message.  If not please check your file to make sure you modified the file correctly.  Next we need to restart apache using the same apachectl command:
     /usr/sbin/apachectl graceful

You have now enabled mod_deflate on your (dv) server!  You can see whether the changes are in effect using the following tool at http://whatsmyip.org/mod_gzip_test/
Here is a quick before and after for a default Plesk index page for a domain.  You can clearly see how this can benefit sites with rich content.

BEFORE:

1567_1

AFTER:

1567_2

Posted under Uncategorized
Sep-30-2009

creation-of-additional-ftp-users-for-plesk-linux

http://www.diademblogs.com/linux/creation-of-additional-ftp-users-for-plesk-linux

Register | Subscribe to our RSS feed | Log in
Diadem Tech Weblogs
Our official take on web hosting, web development, web marketing and everything in between.

Home
About Us

Diadem Technologies is a small but passionate web development services company specialising in Wordpress, Drupal and Joomla CMS development alongwith PHP/MySQL driven web application development. We also provide professional web hosting services using shared and dedicated hosting platforms to SME’s in India and across the globe.
15th
MAR
Creation of additional FTP users for Plesk Linux
Posted by ankur under Linux, Plesk Control Panel
Plesk is a great Control Panel in the shared hosting environment, but there are a few things that are not available in the Control Panel. For example, you cannot create additional FTP user in Plesk Control panel for Linux (this support is enabled in Plesk for windows). But some time it is required to have multiple FTP accounts to upload/download data. You need to have shell access since the Plesk control panel won’t allow it in the GUI.

Assuming you already have an existing domain (example.com) with the primary FTP user (jack) with password (schmidt) with home directory (/var/www/vhosts/example.com), and you wish to create additional ftp users (jill and bob) with the same access privileges as jack:

Procedure:
Login to server via SSH as root.

Issue the shell command:

#cat /etc/passwd |grep ‘jack’

This will show you a line similar to the following:

jack:x:10041:10001::/var/www/vhosts/example.com:/bin/false

The first number (after the 2nd colon : ) is 10041, so this is the UID of user jack. You will need this in the ‘useradd’ lines since useradd wants a number for the UID.

The second number (after the 3rd colon : ) is 10001, this is the GID (psacln), we won’t need that right now.

Then run the following shell commands to create the users and passwords:

#useradd -u 10041 -o -d /var/www/vhosts/example.com -g psacln -s /bin/false jill
#useradd -u 10041 -o -d /var/www/vhosts/example.com -g psacln -s /bin/false bob
#passwd jill (enter the new password and confirm it, does not have to be the same as jack’s)
#passwd bob (enter the new password and confirm it, does not have to be the same as jack’s)

You should now be able to use an FTP client to login with that user’s name and password.

User jill and bob should be able to see the example.com docroot just as user jack can. You should NOT be able to browse above the example.com docroot directory. All 3 users should have the same access to the files since they belong to the same group, so no matter which of the users created or edited the file(s), all should be able to access/edit/whatever the same files.

(NOTES: Since these are users defined at the OS level, when connecting with an FTP client, they would login with username ‘jill’, ‘bob’, or ‘jack’. They would NOT use ‘jill@example.com’. This also means that USERNAMES MUST BE UNIQUE.)

Subdomain FTP users:
If you wanted to change their default directory and limit them to a Plesk created subdomain docroot, in the useradd line above, you would change “/var/www/vhosts/example.com” to “/var/www/vhosts/example.com/subdomains/subname”. So if you wanted to create the same users, but for a subdomain called ‘admin’:

Then do the following shell commands to create the users and passwords:

#useradd -u 10041 -o -d /var/www/vhosts/example.com/subdomains/admin -g psacln -s /bin/false jill
#useradd -u 10041 -o -d /var/www/vhosts/example.com/subdomains/admin -g psacln -s /bin/false bob
#passwd jill (enter the new password and confirm it, does not have to be the same as jack’s)
#passwd bob (enter the new password and confirm it, does not have to be the same as jack’s)

Deleting an FTP user:

#userdel jill

(Note: this will not delete any files unless you use the -r option which you probably don’t want to do if they are sharing files!)
(2 votes, average: 4.00 out of 5)

ShareThis

Reader’s Comments

Ragnard | May 19th, 2009 at 3:25 am
Thanks! Works like a charm.

Blaine | May 27th, 2009 at 4:00 am
This is great – thanks! BUT can I restrict “jill” from uploading or deleting or changing file names in this shared folder? THAT would be truly awesome. Using proftp, btw.

ankur | May 27th, 2009 at 3:17 pm
Thanks for your comment. But you can’t restrict “jill” from uploading or deleting or changing file names in this shared folder, because the other FTP user “jill” having the privilege of actual FTP user “jack” who requires full permission to manage the other folders/files.

Blaine | May 27th, 2009 at 8:54 pm
Thank you so much for the quick reply, but IS there a way to have jill just be able to read?

Blaine | May 27th, 2009 at 10:40 pm
I figured it out. I made the UID and GID unique, then assigned the appropriate rights to the folder. This post was very helpful. Thank you.

Daz | June 6th, 2009 at 9:51 pm
Blaine – could you elaborate on how you changed UID/GID to restrict access to folders. What I’m trying to do is not only create multiple accounts on a subdomain (success) but restrict those accounts to specific directories within that doman, so that user Bob can only access his Bob directory that I set up under httpdocs.

ankur | June 8th, 2009 at 11:18 am
Hi Daz, Thank you for your comment, you can run the command as below:

useradd -d /var/www/vhosts/example.com/subdomains/subdomain-name/bob -s /bin/false bob

It will set the UID and GID unique, and then set the other users read permission only on the folder bob. This will make the other user (bob) can only read the files/folders. And as the user shell set to /bin/false, which will restrict the account to specific directory within that domain.

Tony Bianco | June 9th, 2009 at 3:21 pm
This is great, because I’m using Media Temple’s DV plan and they use Plesk. I’m needing to create multiple FTP accounts for the same domain but I need to restrict their access to a particular folder.

Also, I need that folder to not be in an area of the webroot where the public can access that folder.

How would I accomplish this?

ankur | June 11th, 2009 at 12:13 pm
Hi Tony, thank you for your comment, here we go
Create a folder anywhere you want, e.g. “/var/userftp/tony” then run the below command to create FTP user:

useradd -d /var/userftp/tony -s /bin/false tony (set the password)

And then use “chmod” command to set require permissions.

Tony Bianco | June 13th, 2009 at 1:55 am
Ankur,

Just so I’m understanding this correctly, because I’m new to this.

I would I issue the following commands to add a new FTP user that would be able to access a folder via FTP:

useradd -d /var/someFTPFolder -s /bin/false myUserName myPassword

Is that correct?

And is there way to assign that user to a general folder and then a user specific folder?

ankur | June 13th, 2009 at 3:06 pm
Tony,

“useradd -d /var/someFTPFolder -s /bin/false myUserName” is correct.

Change the user home directory path as per your choice (general folder or user specific folder), e.g. “/var/some-other-FTPFolder”.

Regards,
Ankur

Tony Bianco | June 15th, 2009 at 2:44 am
Thank you very much! If I ever want to change a user’s password how would I do that?

ankur | June 16th, 2009 at 1:30 pm
Thanks Tony, run the below command to change user password:

passwd username

Regards,
Ankur

Leave a Reply

Name (required)
Mail (will not be published) (required)
Website

Post Meta
March 15, 2009
Linux, Plesk Control Panel
13 Comments
Comments Feed
Diadem Tech Weblogs is powered by Wordpress.

Posted under Uncategorized
Sep-30-2009

Git Commands

git clone git@github.com:ccbetty/ccbetty-iphone.git

git rm
git commit -a
git push

Posted under Uncategorized
Aug-31-2009

Apple Push Notification

openssl pkcs12 -clcerts -nokeys -out cert.pem -in cert.p12
openssl pkcs12 -nocerts -out key.pem -in cert.p12

openssl rsa -in key.pem -out key.pem

cat certkey.pem > apns-prod.pem

apple_push_notification_production.pem.zip

http://developer.apple.com/iphone/library/documentation/NetworkingInternet/Conceptual/RemoteNotificationsPG/IPhoneOSClientImp/IPhoneOSClientImp.html

http://apnonrails.metabates.com/

http://blog.boxedice.com/2009/07/10/how-to-build-an-apple-push-notification-provider-server-tutorial/

http://apnonrails.metabates.com/

Posted under Uncategorized
Aug-18-2009

Solr

rake solr:rebuild_all

rake solr:start

rake solr:stop

Posted under Uncategorized
Aug-17-2009

SSH Connection

ssh -i /Users/mudiaga/.ssh/name_rsa git@github.com

ssh-add /Users/mudiaga/.ssh/name_rsa

Posted under Uncategorized
Aug-6-2009

Wordpress SQL

–get all the tags
SELECT distinct name FROM wp_terms wt
INNER JOIN wp_term_taxonomy wtt ON wt.term_id=wtt.term_id
INNER JOIN wp_term_relationships wtr ON wtr.term_taxonomy_id=wtt.term_taxonomy_id
LEFT JOIN wp_posts wp ON wp.ID=wtr.object_id
WHERE
taxonomy=’post_tag’
order by name

order by name

—- find posts of youtube, vidoe, playlists, etc for nmm
select post_title, CONCAT(‘http://www.nmm.com/index.php/’,post_name) from wp_posts where post_parent=0 and post_title like ‘% – picture%’ order by post_title
select post_title, CONCAT(‘http://www.nmm.com/index.php/’,post_name) from wp_posts where post_parent=0 and post_title like ‘%profile%’
select post_title, CONCAT(‘http://www.nmm.com/index.php/’,post_name) from wp_posts where post_parent=0 and post_title like ‘%profile%’

—find missing pictures for artist profiles
select
terms.term_id,terms.name,tax.taxonomy, tax.description, tax.parent
from
wp_term_taxonomy tax,
wp_terms terms
where
tax.term_id=terms.term_id
and tax.taxonomy=’category’
and parent=9
and terms.term_id not in (
select
terms.term_id
from
wp_term_taxonomy tax,
wp_terms terms,
wp_term_relationships rel,
wp_posts posts
where
tax.term_id=terms.term_id
and tax.taxonomy=’category’
and parent=9
and tax.term_taxonomy_id=rel.term_taxonomy_id
and rel.object_id=posts.id
and posts.post_title like ‘% – pictures%’
)
order by name

SELECT CATEGORY INFORMATION

select
terms.term_id,terms.name,tax.taxonomy, tax.description, tax.parent
from
wp_term_taxonomy tax,
wp_terms terms
where
tax.term_id=terms.term_id
and tax.taxonomy=’category’
and parent=9
order by name

————————————–
select all artist profile posts
select
terms.term_id,terms.name,tax.taxonomy, tax.description, tax.parent,posts.post_title
from
wp_term_taxonomy tax,
wp_terms terms,
wp_term_relationships rel,
wp_posts posts
where
tax.term_id=terms.term_id
and tax.taxonomy=’category’
and parent=9
and tax.term_taxonomy_id=rel.term_taxonomy_id
and rel.object_id=posts.id
and posts.post_title like ‘% – artist – profile%’
order by name

http://codex.wordpress.org/images/8/83/WP_27_dbsERD.png

http://codex.wordpress.org/images/8/83/WP_27_dbsERD.png

Posted under Uncategorized
Aug-5-2009

cloud mysql rails database

do not use root user to login

mysql root user is called admin and its the T——– sequence

mysql -u admin -pT——–

ruby script/generate scaffold post title:string content:text

ruby script/generate scaffold video title:string desc:text url:string

ruby script/generate scaffold picture title:string desc:string url:string thumb:string

ruby script/generate scaffold gallery title:string description:text

create database xxx_development;

create database xxx_test;

create database xxx_production;

CREATE USER 'xxxx'@'localhost' IDENTIFIED BY 'yyyy';

CREATE USER 'xxxx'@'%' IDENTIFIED BY 'yyyy';

grant ALL PRIVILEGES on xxxx.* to 'yyyy'@'localhost' WITH GRANT OPTION;

grant ALL PRIVILEGES on xxxx.* to 'yyyy'@'%' WITH GRANT OPTION;

mongrel-cluster.yml

prefix: /zzzz

cwd: /var/www/vhosts/ssss.com/subdomains/yyyy/zzzz

log_file: log/mongrel.log

port: “4010″

environment: development

address: 127.0.0.1

pid_file: tmp/pids/mongrel.pid

servers: 3

Posted under Uncategorized
Jul-20-2009

Run Ruby On Separate Port

ruby script/server -p 9191
Posted under Uncategorized
Jun-16-2009

when i was little i thought the 2000’s would have flying cars……nah just sensitve niazz and fake gangstas…..

Posted under Uncategorized
Jun-16-2009

Flex Application Development Process

Flex Application Development Process

Everything below is directly sourced from the help file in version 2.0 Beta 3:
  • Define an application interface using a set of pre-defined components (forms, buttons, and so on)
  • Arrange components into a user interface design
  • Use styles and themes to define the visual design
  • Add dynamic behavior (one part of the application interacting with another, for example)
  • Define and connect to data services as needed
  • Build the source code into an SWF file that runs in the Flash Play
Posted under Uncategorized
Jun-16-2009

development methodology

Development Methodology

1. figure out what class is supposed to do
2. list instance variables and methods
3. write pseudocode
4. write test code (this is a practice of Extreme Programming)
5. implement the class
6. test the methods
7. debug and reimplement as needed
Xtreme Programming
1. small, frequent releases
2. develop in interation cycles
3.  don’t put in anything that is not in the spec
4. write the test code first
5. no killer schedules; regular work hours
6. refactor (improve the code) whenever and whereever you notice the opportunity
7. don’t release anything until it passes all the tests
8. set realistic schedules, based around small releases
9. keep it simple
10.  program in pairs and move everyone around so that everybody knows prett much everything about the code
Posted under Uncategorized
Jun-16-2009

manipulating strings in objective-c

NSString *stringFromUTFString = [[NSString alloc] initWithUTF8String:utf8String];
NSString *hwString = [hString stringByAppendingString:@", world!"];
NSString *greeting = NSLocalizedStringFromTable 
    (@”Hello”, @”greeting to present in first launch panel”, @”greetings”); 
NSString *source = @”0123456789″; 
NSString *firstFour = [source substringToIndex:4]; 
// firstFour is @”0123″ 
NSString *allButFirstThree = [source substringFromIndex:3]; 
// allButFirstThree is @”3456789″ 
NSRange twoToSixRange = NSMakeRange(2, 4); 
NSString *twoToSix = [source substringWithRange:twoToSixRange]; 
// twoToSix is @”2345″ 
NSArray *split = [source componentsSeparatedByString:@"45"]; 
// split contains { @”0123″, @”6789″ }
Posted under Uncategorized
Jun-13-2009

Configure MySQL On Mac OX 10.5

gives u sql version

select @@version;

 SHOW GLOBAL VARIABLES LIKE ‘version_compile_machine’;

Posted under Uncategorized
Jun-12-2009

Auto Create Scaffolding for object in rails

first note your version numbers

gem -v

ruby -v

rails -v

then make sure your system library is up to date 


$ sudo gem update –system - this command updates the ruby gems package manager (this update is required by the latest version of rails)

$ sudo gem install rails - updates and installs the latest version of rails including the dependencies

$ sudo gem update rake - updates the rake tool which is used by rails

$ sudo gem update sqlite3-ruby - updates the ruby sqlite3 bindings, you can skip this command if you don’t use sqlite as your database

Testing

You will get visual updates as the update process goes on but if you still feel like testing the update once you are done, type this command in the terminal

$ rails -v

and to get a list of all the gems currently installed on your mac displayed with their version numbers use the following command

$ gem list

Posted under Uncategorized
Jun-10-2009

Create A New Ruby Project And Specify MySQL As The Database

rails shovell -d mysql 

rails [appname] – mysql

 

if u using sqll lite do the following

 

#rails api -d mysql

rails api

cd api

ruby script/server

ruby script/generate scaffold KokoPicture title:string desc:string url:string created_at:datetime modified_at:datetime

ruby script/generate scaffold KokoFan displayname:string email:string password:string created_at:datetime modified_at:datetime

ruby script/generate scaffold KokoVideo title:string desc:string url:string created_at:datetime modified_at:datetime

ruby script/generate scaffold KokoPost title:string content:string created_at:datetime modified_at:datetime

ruby script/generate scaffold KokoAudio title:string desc:string url:string created_at:datetime modified_at:datetime

ruby script/generate scaffold test title:string desc:string url:string created_at:datetime modified_at:datetime

ruby script/generate migration

rake db:migrate

Posted under Uncategorized
Apr-8-2009

I’m So Excited About “Le Nuage”

“Le Nuage” … French for “The Cloud” … these days I wake up with an irresistable itch that I can’t scratch.  The economy is in recession, the world in the doldrums, yet I an so freakin excited about the next generation of web apps that for the most part already exist, but are about to take off like wildfire.  

 

Yeah none of this is new but then untapped potential is enormous.  I can’t wait.

Posted under Uncategorized
Feb-1-2009

Loading Data Into Google AppEngine

Table Basics

 

Creating SQL Statements To Load Via CURL

 

Viewing Data

 

Deleting Data

Posted under Uncategorized