The find command - use it to search anything

One best tool exists in linux is the find command. I will try to add the different ways to use the find command.

1) To find files of a particular owner/group:

        # find /tmp -user
       eg.
       # find /tmp -user foo
       [shall search files owned by user foo in the /tmp folder]

        # find /tmp -group
        eg.
        # find /tmp -group foo
       [shall search files belonged to group  foo in the /tmp folder]

2) To find files  that were accessed last 33 days ago:


       # find  . -type f -atime +33 -exec ls -l '{}' \; 

When a Malware attacks a Linux System....

It is now a fact  that Linux is quietly taking over the world as a trusted and easy to use Operating Systems.  Its being used widely both in  a Server and a desktop environment.  As gaining popularity has its advantages and disadvantages.  When we talk of disadvantages  in any OS, it is about any vulnerability that can be exploited or loop holes that can be hacked. And then we see different methods to hack these vulnerabilities.  The Malwares! Nowadays, the most common  malwares attacking the LINUX OS are  the Trojans, Bitcoin Miners. They have become an headache for a Linux system administrator.

When a Trojan / Bitcoin miner  attacks a linux system, it starts increasing the CPU utilization and generates heavy network traffic.  The strength of these processes are its  capability  to regenerate with different names. These malware initiates entry via network services mostly via any web services running on the system.

Some common methods used by Malware:

1) creates a cron job in /etc/cron.d/ or /etc/cron.hourly. Adds an entry in /etc/crontab

2) Starts creating services in /etc/init.d/ and then creates starting of the services at various system run levels i.e in /etc/rc.*.d

3) Some adds a file in /lib/libudev.so . This is a 32 bit file also found in a 64 bit machine.

4) Some malware executes behind another binary

5) Some randomly generated binaries found in /bin and /usr/bin

Mitigation Strategies: In Linux,  with great easiness such malwares can be handled. Commands that can be used to analyse and take necessary actions:  

1) When a server utilization is very high without reason, the first command to use is TOP. 

           #top -H -c

            -H  shall display all individual threads

            -c   shall display the command line process

Check for the process that uses the highest cpu utilization.

2) Check for any unusual suspected cronjobs in /etc/cron.d/  and or /etc/cron.hourly. Check any entry  in /etc/crontab.

3) Any binaries in /bin and /usr/bin.

4)  Check for any internet network traffic, connecting to any C&C servers or any  other blacklisted ip's.  Check with the below command:

          

            #netstat -tunpl

           #lsof -i

   This will show files connecting the internet.

Lastly but not the least, there could be many other ways to detect and be in action against malwares.

Updating a Fedora Standalone System (without internet connectvity)

Installing the latest updates of fedora on a standalone system which has not internet connection.
 I. Create a Fedora Update Repository:-

1) Take a System with Freshly installed Fedora OS connected to the internet for downloading the updates. The Fedora release versions should be the same as of the standalone system.

2) Create a folder to save to downloaded update.

            # mkdir /yumdownloader/

3) Execute the below command to download the latest packages with dependencies:

             # yum check-update | grep -v "anaconda\|Obsoleting" | awk '(NR >=2)' | cut -d " " -f 1 | tr "\n" " " | xargs -r yumdownloader --resolve --destdir /yumdownloader/

4) After completing the download, create an ISO image of the folder.

  

         # genisoimage -o fedora-updatesdeps.iso /yumdownloader

II. Installing updates on standalone system:-

         METHOD 1:-

      1. Mount the iso fedora-updatesdeps.iso on the standalone System which is required to be updated.

  

         # mkdir /mnt/iso/updates

       

       # mount -o loop /dev/sr0 /mnt/iso/updates

       # cd /mnt/iso

  

       # createrepo  .

       (install createrepo package if not present).

        # yum clean all

Then create a cdrepo.repo config file in /etc/yum.repos.d/

        # vi cdupdates.repo

 Add the below entries and save in the file:

        

         [cdupdates]

         name=CD REPOSITORY

     baseurl=file:///mnt/iso

     enabled=1

If required disable the other repos in the /etc/yum.repos.d/. In each file, change the setting enable=1 to enable=0

Once the above is done, execute the below command:

      # yum check-update

This should show the updates in the cdrepo. Then execute:

      # yum update

       Method 2:

    1.  The below method can also be followed:  

     # cd /mnt/iso/updates

        

         # rpm -Uvh *.rpm

NOTE:-

Method 1 shall keep a backup of the previous kernel version and can be seen in the GRUB menu, while Method 2 shall remove the previous kernel after upgrading.

 

Load Test And Performance Test on Squid Proxy Server

Subject:  Shell Script based test tool for Squid Proxy Server

In my endeavour to achieve the best performance  from squid proxy server and for doing a load test, created a shell script tool. The script uses Apache HTTP Server Benchmarking tool. 


Basically this script shall best run on

• Bash version 4.3.0 & above. This is because the same script observed some syntax error in bash ver. 3.1.17. 
• Apache HTTP Server Benchmarking tool version 2.3 and above. The option -r [ - Don't exit on socket receive errors] was missing in version below 2.3,

Named it as LinTool

  1 #!/bin/bash
  2 #
  3 #
  4 BlackBg='\033[40m'
  5 echo -e "\n$BlackBg\e[1;92mLinTool - A Network Traffic based Load Test and Performance based test tool for Proxy Server \e[0m\n\e[0m "
  6 #functions
  7 PreCond ()
  8 {
  9    if type ab > /dev/null 2>&1
 10       then
 11            echo -ne '  Checking compatibility .....                     (33%)\r';
 12            sleep 1;
 13            echo -ne '  Checking compatibility .............             (66%)\r';
 14            sleep 1;
 15            echo -ne '  Checking compatibility ....................... [ \e[0;32mOK\e[0m ]   (100%)\r';
 16            echo -ne '\n';
 17            echo -e "\n " ;
 18            return 0;
 19        else
 20            echo -ne '  Checking compatibility .....                     (33%)\r';
 21            sleep 1;
 22            echo -ne '  Checking compatibility .............             (66%)\r';
 23            sleep 1;
 24            echo -ne '  Checking compatibility ....................... [ \e[0;31mFailed\e[0m ]   (100%)\r';
 25            echo -ne '\n';
 26            echo -e >&2 "\n\e[1;95m  Alert:- To run this script install the  "Apache HTTP Server Benchmarking Tool" package.\n  Please install the pre-requisite and     the execute the script.\n  LinTool Aborted...!!!\n\e[0m";
 27            exit;
 28    fi;
 29 }
 30 RequestNumber ()
 31 {
 32    read -p  "^[[34m  Enter Number of requests to perform for the benchmarking session: `echo $'\n  => '` ^[[0m  " Req;
 33    if  ! [[ "$Req" =~ ^[0-9]+$ ]];
 34         then
 35            echo -e "\n\e[1;31m  Invalid Value:- Enter only Numeric Integers.\n  Please re-enter or CTRL+C to quit.\n\e[0m";
 36            RequestNumber;
 37         else
 38            # 0 = true
 39            return 0;
 40    fi;
 41 }
 42 ConcurrentNumber ()
 43 {
 44    read -p  " ^[[34m  Enter Number of multiple Concurrent requests to perform at a time: `echo $'\n  => '` ^[[0m "  Con;
 45    if  [[ "$Con" =~ ^[0-9]+$ ]];
 46         then
 47             if (( $Req < $Con  ));
 48                 then
 49                     echo -e "\n\e[1;31m  Invalid Value:- Number of multiple concurrent request must be less than Number of Requests to perform.\n  Please re-enter o    r CTRL+C to quit.\n\e[0m";
 50                     ConcurrentNumber;
 51                  else
 52                     return 0;
 53             fi;
 54          else
 55              echo -e "\n\e[1;31m  Invalid Value:- Enter only Numeric Integers.\n  Please re-enter or CTRL+C to quit.\n\e[0m";
 56              ConcurrentNumber;
 57          fi;
 58 }
 59 Domains ()
 60 {
 61    read -p " ^[[34m  Enter a vallid domain in the format www.somedomain.com: `echo $'\n  => '` ^[[0m " DM;
 62    domreg1='^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(\.[A-Za-z]{2,})';
 63    ipreg1='(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])';
 64    if ! [[ "$DM" =~ $domreg1 || "$DM" =~ $ipreg1 ]];
 65         then
 66            echo -e "\n\e[1;31m  Invalid Value:- Not a valid Domain name. Domain format [www.somedomain.com]\n  Please re-enter or CTRL+C to quit.\n\e[0m";
 67            Domains;
 68         else
 69            return 0;
 70    fi;
 71 }
 72
 73 ProxyPort ()
 74 {
 75    read -p "^[[34m  Enter Proxy IP & Port [IP:PORT]: `echo $'\n  => '` ^[[0m " PP;
 76    if ! [[ "$PP" =~ ^[0-9]{1,3}[.]{1}[0-9]{1,3}[.]{1}[0-9]{1,3}[.]{1}[0-9]{1,3}[\:]{1}[1-9]{3,}$ ]];
 77         then
 78           echo -e "\n\e[1;31m  Invalid Value:- Enter the Proxy and Port to access the internet. Format [IP:PORT].\n  Please re-enter or CTRL+C to quit.\n\e[0m";
 79           ProxyPort;
 80     else
 81           read  -p "^[[34m  Does your proxy require Authentication? [Y/N]: ^[[0m" response;
 82           respreg='^([yY][eE][sS]|[yY])$';
 83           if [[ "$response" =~ $respreg ]];
 84              then
 85                  read -p  "^[[34m  Enter User Name: ^[[0m" username;
 86                  echo -n "^[[34m  Password: ^[[0m" ;
 87                  read -s password;
 88                  echo -e "\n ";
 89                  return 1;
 90              else
 91                  echo -e "\n ";
 92                  return 0;
 93           fi;
 94                         fi;
 95 }
 96 #main
 97 if PreCond $0;
 98    then
 99       if RequestNumber $0;
100          then
101             if ConcurrentNumber $0;
102                then
103                   if Domains $0;
104                      then
105                         if ProxyPort $0;
106                         LEN=$(echo $DM |
107                         awk -F/ '{print $2}' |
108                         while read STR ; do expr  "${STR}" : '.*';
109                         done ;)
110                            then
111                               if [[ $LEN == 0 ]];
112                                  then
113                                      ab  -q -S -r -X $PP -n $Req -c $Con http://$DM/;
114                                  else
115                                      ab  -q -S -r -X $PP -n $Req -c $Con http://$DM;
116                               fi;
117                            else
118                               if [[ $LEN == 0 ]];
119                                  then
120                                     ab -q -S -P $username:$password -r -X $PP -n $Req -c $Con http://$DM/;
121                                  else
122                                     ab -q -S -P $username:$password -r -X $PP -n $Req -c $Con http://$DM;
123                               fi;
124                         fi;
125                   fi;
126             fi;
127       fi;
128 fi;

I hope this does helps the community....

Steps to create a RAMDISK i.e. /dev/ram

Subject: Commands to create a /dev/ram block device in debian

While checking in Debian 6,  it was observed that the /dev/ram disks are not created by default. To create the block device:

1) Login as root from the terminal and create the block device:

     root@lino90:~ mknod -m 660 /dev/ram b 1 1

    Command description:

                      mknod - make block or character special files

    Options:

               -m --mode=MODE

                       set file permission bits to MODE, not a=rw - umask

                b      create a block (buffered) special file

2) Then,  zero out the space that need to be on the ramdisk
    

     root@lino90:~ sudo dd if=/dev/zero of=/dev/ram bs=1K count=16K

To create a file system on the ramdisk and mount the ramdisk, refer to my earlier blog Optimizing Squid - (Part 1).

How to make sendmail use hosts file as well as the DNS for name resolutions ?

Subject: Configure Sendmail for name resolutions using hosts file and DNS server.

To make the Sendmail look for the hosts file as well as the DNS for name resolutions:

1) create a service.switch file in /etc/mail folder.
   
2) vi the service.switch file and add the below entry

    hosts    file    dns

    This will query the hosts file before querying the DNS server.


3) execute the below command

    # kill -HUP `head -1 /var/run/sendmail.pid`

    This will bring the changes into effect

Exclude folder using TAR command during backup process

Subject: Tar command
 
In tar command one can exclude the so called not so required folder & sub-folders during backup by:

[root@lino ~] # tar -cvf backup.tar projects/ --exclude="<folder path to be excluded>"

For excluding multiple folders:

[root@lino ~] # tar -cvf backup.tar projects/ --exclude="<folder-1 path to be excluded>" --exclude="<folder-2 path to be excluded>"

-c    creates a new archive  file
-v    verbosely lists files processed
-f    use archive file or device F (default "-", meaning stdin/stdout)
--exclude    will exclude the folders and files

Optimizing SQUID - (Part 2)

Subject: Squid's cache_swap_low & cache_swap_high disk space watermarks

In continuation to my testing of squid for optimization [refer Optimizing SQUID - (Part 1) ] , I then used Squid's configuration directive cache_swap_low and cache_swap_high. Thus performance of squid does improves but probably it won't be  noticeable. But, it definately reduces the chances  of squid's slow down or performance degradation.

The cache_swap_low and cache_swap_high directives controls the replacement of cache objects stored on disk. The values are in percentage (%) of the cache size (i.e.sum of all the cache_dir sizes).

I have set the following configurationg for the directives in squid.conf

cache_swap_low  60

cache_swap_high 65

So, until and unless disk usage is below the 60 %, replacement does not take place and, it begins only when it is above the low water mark. Replacement is more aggressive when disk utilization is close to the high water mark.

This could help in replacing the stale cache records as well.

Optimizing SQUID - (Part 1)

Subject: Use Ramdisk for Caching

(I have been working on an issue related to squid slowing down gradually thus slowing down internet access by network users. As it made me more enthusiastic what could be the reason or could be there an alternative way to resolve this. Thus, I can across the so called RAMDISK and tried to use it with squid.

I tried my way to use RAMDISK with SQUID. I found squid was doing good....so here I blogged......to get the better view of my result.


INTRODUCTION:

RAM disk is a section of the RAM (memory) which is configured as a disk drive. Data stored in RAM disk can be accessed faster than the data stored in a hard disk drive.

Usually, Squid is configured to cache its information of visited websites in the hard disk. Using a RAM Disk for storing this information will enable the squid to access the cache more faster than the one stored in cache. Though, data stored in the RAM DISK are TEMPORARY (i.e. data will be stored only until the system is up and running), I recommend to have multiple cache directories storage: one in RAMDISK and another as well as in Hard-disk.



I. CREATING RAMDISK for SQUID cache storage:

1) Check if ramdisk has been created?

root@lino90:~# ls -l /dev/ram*

By default only ram0 - ram15 are usable

root@lino90:~# ls -l /dev/ram*

lrwxrwxrwx 1 root root 4 Jul 20 12:37 /dev/ram -> ram1
brw-r----- 1 root disk 1, 0 Jul 20 12:38 /dev/ram0
brw-r----- 1 root disk 1, 1 Jul 20 12:36 /dev/ram1
brw-r----- 1 root disk 1, 10 Jul 20 12:36 /dev/ram10
brw-r----- 1 root disk 1, 11 Jul 20 12:36 /dev/ram11
brw-r----- 1 root disk 1, 12 Jul 20 12:36 /dev/ram12
brw-r----- 1 root disk 1, 13 Jul 20 12:36 /dev/ram13
brw-r----- 1 root disk 1, 14 Jul 20 12:36 /dev/ram14
brw-r----- 1 root disk 1, 15 Jul 20 12:36 /dev/ram15
brw-r----- 1 root disk 1, 2 Jul 20 12:36 /dev/ram2
brw-r----- 1 root disk 1, 3 Jul 20 12:36 /dev/ram3
brw-r----- 1 root disk 1, 4 Jul 20 12:36 /dev/ram4
brw-r----- 1 root disk 1, 5 Jul 20 12:36 /dev/ram5
brw-r----- 1 root disk 1, 6 Jul 20 12:36 /dev/ram6
brw-r----- 1 root disk 1, 7 Jul 20 12:36 /dev/ram7
brw-r----- 1 root disk 1, 8 Jul 20 12:36 /dev/ram8
brw-r----- 1 root disk 1, 9 Jul 20 12:36 /dev/ram9
lrwxrwxrwx 1 root root 4 Jul 20 12:37 /dev/ramdisk -> ram0

2) To Check the size of ramdisk:

root@lino90:~# dmesg | grep RAMDISK
RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize
root@lino90:~#

This shows that the default ramdisk size is 4MB.

3) To increase the size of the ramdisk for eg. 16MB
A command has to be passed to the kernel during booting. This can be done in the grub.conf  by  passing  an entry in ramdisk_size=[enter the size in 1024-byte blocks]

root@lino90:~# vi /etc/grub.conf
     
# grub.conf generated by anaconda
#
# Note that you do not have to rerun grub after making changes to this file
# NOTICE: You do not have a /boot partition. This means that
# all kernel and initrd paths are relative to /, eg.
# root (hd0,0)
# kernel /boot/vmlinuz-version ro root=/dev/sda1
# initrd /boot/initrd-version.img
# boot=/dev/sda
default=0
timeout=5
splashimage=(hd0,0)/boot/grub/splash.xpm.gz
hiddenmenu
title Red Hat Enterprise Linux Server (2.6.18-8.el5)
root (hd0,0)
kernel /boot/vmlinuz-2.6.18-8.el5 ro root=LABEL=/1 rhgb quiet ramdisk_size=16000
initrd /boot/initrd-2.6.18-8.el5.img

Save the file and reboot. After the reboot, confirm with the below command to check the new size of the ramdisk

root@lino90:~# dmesg | grep RAMDISK
RAMDISK driver initialized: 16 RAM disks of 16000K size 1024 blocksize
root@lino90:~#

4) Format the ramdisk as a journaling file system eg.ext2 file system. In case if only one ramdisk, we will use /dev/ram0

root@lino90:~# mke2fs -m 0 /dev/ram0

mke2fs 1.41.3 (12-Oct-2008)
Filesystem label=
OS type: Linux
Block size=1024 (log=0)
Fragment size=1024 (log=0)
16384 inodes, 65536 blocks
0 blocks (0.00%) reserved for the super user
First data block=1
Maximum filesystem blocks=67108864
8 block groups
8192 blocks per group, 8192 fragments per group
2048 inodes per group
Superblock backups stored on blocks:
8193, 24577, 40961, 57345

Writing inode tables: done
Writing superblocks and filesystem accounting information: done

This filesystem will be automatically checked every 29 mounts or
80 days, whichever comes first. Use tune2fs -c or -i to override.

5) mounting ramdisk

a) Create a directory (In case of squid you can create the directory where the squid cache is stored)

root@lino90:~# mkdir /var/spool/squid_ram

b) mount the ramdisk to the above directory

root@lino90:~ # mount /dev/ram0 /var/spool/squid_ram

c) To verify the ramdisk mount

root@lino90:~# mount | grep ram0
OR
root@lino90:~# df -h | grep ram0

d) Change the ownership as per squid requirement

root@lino90:~# chown squid:squid -R /var/spool/squid_mem

e) Change the permission as per squid requirement

root@lino90:~# chmod 755 -R /var/spool/squid_mem

f) To check the details of the new ramdisk

root@lino90:~# tune2fs -l /dev/ram0

g) To create and Automount ramdisk at boot time add the below entry in rc.local

root@lino90:~# vi /etc/rc.local

/sbin/mke2fs -q -m 0 /dev/ram0
/bin/mount /dev/ram0 /var/spool/squid_mem
/bin/chown squid:squid /var/spool/squid_mem
/bin/chmod 0755 /var/spool/squid_mem
/usr/sbin/squid -z

Save the rc.local and exit.

II. CONFIGURING SQUID TO USE RAMDISK

1) Adding Ramdisk for cache store in addition to the existing cache store.

root@lino90:~# vi /etc/squid/squid.conf

2) Search for cache_dir entry in your squid.conf. Your orginal entry could be like below:

#
#Default:
cache_dir aufs /var/spool/squid 1000 20 256

Add the RAMDISK mount directory in the squid.conf

#
#Default:
cache_dir aufs /var/spool/squid_mem 45 100 100
cache_dir aufs /var/spool/squid 1000 20 256

The setting of "cache_dir aufs /var/spool/squid_mem 45 100 100" is ideally for a 50 MB of ramdisk. In this case we have configured 45MB out of 50MB randisk for cache store, leaving 5MB unused. The  number of irst level sub-directories created will be 100 and number of second level sub-directories created will be 100

Here, you need to check if squid can create the defined number of 1st level and 2nd level of cache directoies in the RAMDISK by running the below command

root@lino90:~# squid -z

In case if it is unable to create it will display an error

root@lino90:~# squid -z
Creating Swap Directories
FATAL: Failed to make swap directory /var/spool/squid_mem/77/4B: (28) No space left on device
Squid Cache (Version 2.6.STABLE6): Terminated abnormally.
CPU Usage: 0.157 seconds = 0.000 user + 0.157 sys
Maximum Resident Size: 0 KB
Page faults with physical i/o: 0

Then, in this case you will have to modify the number of cache directories (a balance number of cache directories)

Run the command squid -z, until you only get the below message

root@lino90:~# squid -z
2010/07/21 14:01:17
Creating Swap Directories
root@lino90:~#

Once Done start the squid service.

root@lino90:~ /etc/init.d/squid start

Note: Disable the squid service startup during bootup, as this will fail because at that time ramdisk will not be mounted.

root@lino90:~ chkconfig squid off


End Note: I scheduled a regular backup of the /var/spool/squid_mem, so the same can be restored in case if the system restarts. This, I have configured to load on booting.