Month: October 2018

Expanding disks in Linux

October 21, 2018 / / 0 Comments

So expanding disks in Linux seems to be somewhat of a headache sometimes. The easiest method I have found is once you have increased the space via your hypervisor, you will need to expand the disk by booting into a live ISO and using the partition manager there. Once that is done, apply the changes, reboot and expand the drive from inside the OS.

You will want to use the below commands to find the name of the volume – 

fdisk -l
df -h

Afterwards, you can use the below command to add the newly added free space to your volume – 

lvextend -r -l +100%FREE  /dev/mapper/***VOLUMEGOESHERE***

Replace Ubuntu Logo

October 21, 2018 / / 0 Comments

This might come in handy if you need to change the splash loading screen of the Ubuntu logo. However you will still have the purple loading dots just as an activity monitor.

Some important things to note about the script – 

If a file “branded.txt” exists in the “kiosk” user Document folder, it will stop the script from executing.

Once the system is “branded”, it will output the brand selection to the file “branded.txt” as can be seen in the script below.

Your custom logos need to be placed in a directory called “logos” in “/opt”

You need to have two copies of the same logo, but named differently in the directory /opt/logos and this should also reflect in the script.

The script relies on Zenity to be installed so that it can call a dialog box where it will ask for the logo number to be inputted.

If you have more than 4 logo’s which could be chosen, you can just extend the script and increase the input string number from “4” to your chosen amount.

!/bin/bash
inputStr=100
while [ $inputStr -gt 4 ]
do
if [ -e /home/kiosk/Documents/branded.txt ];
then
exit
else
inputStr=$(zenity --entry --title="Input Office Number" --text="Office Number:")
fi
case $inputStr in
1) mv /opt/logos/logo1.png /usr/share/plymouth/themes/ubuntu-logo/ubuntu-logo.png & /opt/logos/logo11.png /usr/share/plymouth/themes/ubuntu-logo/ubuntu-logo16.png
        echo 'branded1' >/home/kiosk/Documents/branded.txt
;;
2) mv /opt/logos/logo2.png /usr/share/plymouth/themes/ubuntu-logo/ubuntu-logo.png & /opt/logos/logo22.png /usr/share/plymouth/themes/ubuntu-logo/ubuntu-logo16.png
        echo 'branded2' >/home/kiosk/Documents/branded.txt
;;
3) mv /opt/logos/logo3.png /usr/share/plymouth/themes/ubuntu-logo/ubuntu-logo.png & /opt/logos/logo33.png /usr/share/plymouth/themes/ubuntu-logo/ubuntu-logo16.png
        echo 'branded3' >/home/kiosk/Documents/branded.txt
;;
4) mv /opt/logos/logo4.png /usr/share/plymouth/themes/ubuntu-logo/ubuntu-logo.png & /opt/logos/logo44.png /usr/share/plymouth/themes/ubuntu-logo/ubuntu-logo16.png
        echo 'branded4' >/home/kiosk/Documents/branded.txt
;;
esac
done

In addition to this script you will also need to edit the folder where the logos are placed by default for the system and also create the directory where you are storing your custom logos. You can do so by running the below commands

chmod +777 /usr/share/plymouth/themes/ubuntu-logo
mkdir /opt/logos
chmod +777 /opt/logos

Mikrotik Router hijack fix

October 21, 2018 / / 0 Comments

Mikrotik routers recently came under attack some time ago. An exploit was found to gain administrative access to them and would link them to a larger botnet network. The below will potentially help in removing the intruder and disable the security hole used by them to gain access. You should also upgrade the router to the latest available firmware

/sys backup save
/ip socks set enabled=no
/sys scheduler remove rsched1_
/sys scheduler remove schedule3_
/sys script remove script3_
/sys script remove rscript1_
/file remove mikrotik.php

Disable the services which are not required, only winbox allowed
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes

Commands explained – 

First we take a backup, then disable the ip socks feature. We remove the maliciously scheduled tasks and scripts and also remove the un-needed mikrotik.php file. Lastly we are disabling all the services which shouldn’t need to be activated on the firewall/router.

Bash script loops

October 21, 2018 / / 0 Comments

I’ve recently had to do some a project where I needed to launch a specific application on login of user account in an Ubuntu environment and where if it was closed, it would re-open again countless times. This is accomplished with the below – 

sudo install -b -m 755 /dev/stdin /opt/autolaunch.sh << EOF
!/bin/bash
xset -dpms
xset s off

while true; do
***APPLICATION COMMAND GOES HERE***
done
EOF

The above installs the script to launch at startup from the location /opt/autolaunch.sh. The first two commands are disabling power saving and the screensaver. The last part is the while loop.

Certificate Signing Request

October 19, 2018 / / 0 Comments

When deploying a new linux machine for a new domain and you intend on using LAMP services, you will most likely need to create an SSL certificate. Below is the command you will need to run from any directory to create the CSR request and eventual certificate key. 

openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr

Once you have run the command, you will be prompted to input some information such as company name, admin email, department and eventually a password. Please use a password with no spaces and keep it “simple” to letters and numbers. Once this is completed the two files will be created in your working directory.

Run the below command to output the contents to your terminal shell where you will be able to copy them from –

cat yourdomain.csr

You will want to upload the contents of the CSR file to your desired SSL certificate authority and download your certificate.

SSH Security on Linux

October 18, 2018 /

I have installed a service called “Fail2Ban” which I have found greatly useful as this dynamically updates your IP Tables on your machine by blocking IP’s which have had to many failures/attempts to login via SSH. You can configure with the commands below – 

  1. Install the application 
apt-get install fail2ban

2) Familiarise yourself with the sample config file /etc/fail2ban/jail.conf

3) Make a new “jail.local” file in the above directory with your favourite text editor. I use nano in my case. 

nano /etc/fail2ban/jail.local

4) Add the options you wish to use from the service, I’ve added the below to control my SSH – 

[DEFAULT]
[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 5
bantime = 3600

With the above options we have chosen to ban after 5 incorrect attempts with a total ban time of 3600 seconds. What’s good to note about the “jail.local” is that Fail2Ban keeps it’s configuration in /etc/fail2ban/jail.conf, however it can also load configuration from jail.local. So it’s best if we leave the default config file as is, since this might be changed in a version upgrade by the authors!

After the above is done, you will want to activate some basic IP Tables rules. Such as the below to allow SSH connections in the first place to the machine. I have also included port 80 and 443, as mine is a web server.

sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
sudo iptables -A INPUT -j DROP

You will now want to make these rules persistent, so that they do not disappear after a reboot.

sudo dpkg-reconfigure iptables-persistent

That’s it, we now have a setup ready to function and block/ban potentially malicious traffic attempts. Let’s restart the service and be done with it! ( I prefer stopping and starting services, just so I feel in control of what’s going on )

sudo service fail2ban stop
sudo service fail2ban start

One final step is to check whether the newly implemented rules are indeed working. Attempt to SSH into the server incorrectly the amount of times you chose above and once you cannot SSH into the machine with a response anymore, you should see a new IP Table rule created in your list. 

You may check that by issuing 

sudo iptables -S

You should see a rule similar to the below 

-A fail2ban-ssh -s X.X.X.X/32 -j REJECT --reject-with icmp-port-unreachable