Archive for 2006

DNS recursion and DDOS

Wednesday, March 22nd, 2006

According to security news, it seems that Sysadmins are becoming more and more concerned about poorly configured DNS servers, specially when recent reports show an increase of distributed denial of service attacks targeted to recursive DNS servers. Next I’ll show you some very basic tips to protect your machines against this kind of attacks.

As you probably know, a recursive DNS server (a caching DNS) tells clients the answers to queries for various DNS records. Queries not resolvable directly (non-local records) are forwarded to servers that can resolve them. Once it get answers they are stored in its cache for future use (note that this data is not cached forever).

On the other hand, a DNS server only shows to the world DNS records for a specific domain and is known to be authoritative for that domain.

Nowadays everybody with some security skills seems to agree in the importance of separating DNS caches from DNS servers. Even Bind (the most widely used DNS implementation) seems to follow this recommendation.

The easiest way to limit recursion in Bind9 is to put something like this in your config file:

options { allow-query { any; }; allow-recursion { 192.168.1.0/24; localhost; };

This will allow recursion from your internal net and from localhost. A better solution… SWITCH TO DJBDNS!!

And now some interesting links:

Package management in Debian

Friday, February 24th, 2006

I use Debian since a while and i must say that i consider that it is the simpler distribution that i know. Well you can ever become some difficulties to install some drivers from proprietary stuff or new brand hardware but once you have your system running, believe me it is the simplest for maintaining, installing and removing in your system. And dpkg/apt are not least in the last assumption.

The first front-end at which you will stick is dselect, which is a menu based program.

I will not be extended with it because it is simple. What you need to know is that you can update the list of available packages with update, you can select which of them you will install with select. In this option, you go out of the help (going out of the help is the more tricky part) with the space bar (ubuntu like i thing it is with “enter”).

You can look for a package named for example firebird tipping “/fire” (without quote), and it will look for the first in the list named fire-something package and typing “n” you go through this list. Of course it is better typping “firebird”. If you want to select for installing you tip “+” (“-” for deinstalling) and dselect present you the list of conflicting, recommended … packages that you can choose with the same +- method (you go out of the list by typing enter). Once you’re satisfied, you tip “enter” and it go through the install process.

dselect is easy, not always the more flexible but the more secure and stable you can dream about. But let me present you the second soft of the debian classical tools collection: DPKG.

dpkg is a command line based tool. You can save the list of the installed packages on your system with:

dpkg –get-selections > selections.dpkg

Don’t be so shy and edit this text file. If you want to recover the state of your package selections you type:

dpkg –set-selections (no description available)
pn lynx-cur-wrapp (no description available)
un lynx-ssl (no description available)

and if you wish to know all the files that install or simply modify the installation of a package:

dpkg -L lynx

/.
/usr
/usr/bin
/usr/bin/lynx.stable
/usr/share
/usr/share/man
/usr/share/man/man1
/usr/share/man/man1/lynx.1.gz

/etc
/etc/lynx.cfg

You want the information on a package (lynx for example)?

dpkg -p lynx

Package: lynx
Priority: optional
Section: web
Installed-Size: 4292
Maintainer: James Troup
Architecture: i386

Description: Text-mode WWW Browser
Lynx is a fully-featured World Wide Web (WWW) client for users
running cursor-addressable, character-cell display devices (e.g.,

That is what a look at /var/lib/dpkg/available will give you after a painful search.

The status of the package can be found with:

dpkg -s lynx

Imagine that you find a strange file in you system (bad news…), and you want to make sure which package it comes from:

dpkg -S /etc/lynx.cfg

lynx: /etc/lynx.cfg

And you can run again the pre-installation process thanks to:

dpkg-reconfigure xserver-xfree86

It will replay the pre/post install script at wich you can take a look at /var/lib/dpkg/info/. For example, we had in my company a problem with bacula director’s instalation because there was a mistake in /var/lib/dpkg/info/bacula-director-mysql.postinst. We had this faultly line:

MYSQL_PSWD_STRING=”-p”$MYSQL_ROOT_PASSWORD”"

So the given root password was never the one bacula use to connect to mysql as root, we had to transform in:

MYSQL_PSWD_STRING=”-p $MYSQL_ROOT_PASSWORD”

(without the escaped quote)

Of course we have tried to reach the packager. But that’s not all folks. Now comes the bestpart: <i>apt</i>. You do not have to download the lynx_2.8.5-sarge1_i386.deb and after install with dpkg -i. No! Just lauch your branded 16k modem to become the line up and type:

apt-get install lynx

You have heard about a new security update, retrieve it with…

apt-get update

Same effect as…

dselect upgrade

…with:

apt-get upgrade

If you wish to look into the code:

apt-get source lynx

And all the magic stuff is controlled through /etc/apt/sources.list.

deb file:///cdrom/ sarge main
deb http://ftp.de.debian.org/debian/ sarge main non-free contrib
deb-src http://ftp.de.debian.org/debian/ sarge main non-free contrib
deb http://security.debian.org/ sarge/updates main contrib non-free

Or better with a mirror:

deb http://ftp.rediris.es/debian/ stable main non-free contrib
deb-src http://ftp.rediris.es/debian/ stable main non-free contrib

Or the best, an apt-proxy which proxies your downloads (karkoma, will you write an apt-proxy article, don’t you?):

deb http://aptserv.dmz:9999/debian/ sarge main non-free contrib
deb-src http://aptserv.dmz:9999/debian sarge main non-free contrib
deb http://aptserv.dmz:9999/debian-volatile sarge/volatile main
deb http://aptserv.dmz:9999/security/ sarge/updates main contrib non-free

Note the debian-volatile: this is for the highly upgraded packages like clamav, dcc,…

Another file that can be quite useful is /etc/apt/apt.conf. For example if you have an http proxy for going out in internet you will add in this file:

Acquire::http::Proxy “http://proxy.yourcompany:3128″;;

Or you can simply set the http_proxy=http://proxy.yourcompany:3128 in your environment). In the precedent case of the apt-proxy, if you have an http_proxy and of course you don’t want to proxy your apt-proxy you can control it by adding in this file:

Acquire
{
http
{
Proxy::no_proxy=comm.dmz;
}
}

Or add no_proxy=http://aptserv.dmz:9999 in your environment). Note that you have two syntaxes (the first one is the old one and the second one is the new). Don’t be confused with upgrade and update: update is when the source-list has been changed to synchronize the list of the mirrors and upgrade is to synchronize the list of the new availables packages.

One good tool in case of problems with apt is apt-config. dump> will dump for you your configuration with all the parameters (the defaults too):

$ apt-config dump
APT “”;
APT::Architecture “i386″;
APT::Build-Essential “”;

DPkg::Pre-Install-Pkgs:: “/usr/sbin/dpkg-preconfigure –apt || true”;
Acquire “”;
Acquire::http “”;

Caution! When you upgrade to a new distribution of debian (it occurs once every two years more or less, that could be the only criticism of debian), change your source-list, perform an apt-get update, an apt-get upgrade and after that an apt-get dist-upgrade.

One last word. Comes aptitude, a new tool (there is a lot of graphical tools that i don’t know…). but for sarge it seems to me that the old ones do a better works (i must take a closer look…).

Enjoy Debian without moderation…

Debian deborphan

Wednesday, February 8th, 2006

As you install packages in your Debian system it is possible that you end up with a bunch of packages that are not needed. These are orphaned packages, packages that are not required by another package. To handle this situation you have the deborphan utility. From the man pages:

deborphan finds packages that have no packages depending on them. The default operation is to search only within the libs and oldlibs sections to hunt down unused libraries.

To install deborphan proceed as usual:

apt-get install deborphan

Now to see orphaned packages simply type…

deborphan

Note that it will not remove the packages listed, it will simply list packages that should be removed. If you want to definitely remove the package…

deborphan | xargs apt-get –purge remove -y

An advice: be carefull to first check what packages are to be removed to avoid potential mistakes of deborphan. For more information take a look at man pages.

Limit display other user’s processes

Wednesday, January 25th, 2006

One of the security enhancements that Solaris 10 provides is the ability to restrict the output of the ps command so that users can only see processes that they own.

So to globally control if users are able to watch processes belonging to other users edit the /etc/security/policy.conf file and add the following entry:

PRIV_DEFAULT=basic,!proc_info

Now users will only be able to see processes that they own. Note however, that this obviously will not affect the root user.

If you are interested in Solaris privileges, you’ll find a good intro from Casper Dik’s Weblog.

DNS cache with DJBDNS for Debian

Sunday, January 8th, 2006

In order to inaugurate this new Debian section here we go with an easy and quick way to setup your own DNS cache. So let’s go!

A DNS caching resolver performs the function of caching answers to previous queries so that there is no need to repeatedly query for the same information. Setting up such a thing with djbdns is a trivial task. Proceed as follows:

NOTE: This instructions assume Debian Sarge but I guess this is not much different with other Debians.

apt-get install daemontools-installer djbdns-installer ucspi-tcp-src

Then build the packages following the instructions provided by APT (build-daemontool, build-djbdns, etc…).

Once installed proceed with the configuration:

dnscache-conf dnscache dnslog /etc/dnscache
ln -s /etc/dnscache /service
sleep 5
svstat /service/dnscache

Now edit your resolver configuration file to look like this:

nameserver 127.0.0.1

I have had some problems with the init script that Debian Sarge installed (note that I’ve created the files in /etc/dnscache), so I modified a couple of lines and now looks like this:

…..
start)
echo -n “Starting djbdns: ”
#for i in `ls -d /var/lib/svscan/dnscache* /var/lib/svscan/tinydns* /var/lib/svscan/axfrdns* 2>/dev/null`; do
for i in `ls -d /service/dnscache* 2>/dev/null`; do
…..
stop)
echo -n “Stopping djbdns: ”
#for i in `ls -d /var/lib/svscan/dnscache* /var/lib/svscan/tinydns* /var/lib/svscan/axfrdns* 2>/dev/null`; do
for i in `ls -d /service/dnscache* 2>/dev/null`; do
…..

That’s all folks!

References: