KarkomaOnline

The OpenSSL Project is an Open Source implementation of the Secure Sockets Layer and Transport Layer Security protocols as well as a cryptography library. In this tip I will show you how to encrypt an individual file using the openssl tool.

Probably GPG is a better choice for simple file encryption, but in some ocassions (i.e. encrypt without building keys or certificates) OpenSSL could be very useful. It’s very simple:

openssl enc -aes-256-cbc -salt -in SuperSecretFile.txt -out SuperSecretFile.txt.enc

And your are done! Now to decrypt the file:

openssl enc -d -aes-256-cbc -in SuperSecretFile.txt.enc -out SuperSecretFile.txt

A note from the man pages.

use a salt in the key derivation routines. This option should *ALWAYS* be used unless compatibility with previous versions of OpenSSL or SSLeay is required. This option is only present on OpenSSL versions 0.9.5 or above.

Here goes a list of useful links to ports used by trojans and viruses…

• Linux firewall and security site
• This is from ISC
• Doshelp
• From Network ICE
• More on trojans and ports they like
• Simovits consulting

If you are aware of new links, post a comment please.

Imagine you are logged into a remote system and want to forward a local port to the remote system without logging out and logging in again. This little trick will tell you how to do this.

According to OpenSSH man pages:

Escape Characters
When a pseudo terminal has been requested, ssh supports a number of
functions through the use of an escape character.
....

The supported escapes (assuming the default `~') are:
.....

~C Open command line (only useful for adding port forwardings using
the -L and -R options)

.....

So, to add a local forward after logging into the remote system procede as follows:

ssh user@remote_host

Once logged in…

CR~C

Hit carriage return then ~ and the C and you’ll get a prompt where you could type something like this:

ssh> -L 8022:127.0.0.1:22
Forwarding port

According to NetSecurity …

The ip_setsockopt() function code is a subroutine of the setsockopt(2) system call. This function allows manipulation of various options of the IP socket. The MCAST_MSFILTER option can be used to provide the kernel with a list of multicast addresses to be received on the socket. This code has been introduced with the 2.4.22/2.6.1 kernel releases. Proper exploitation of this vulnerability leads to local privilege escalation giving an attacker full super-user privileges. Unsuccesfull exploitation of the vulnerability may lead to a denial-of-service attack causing machine crash or instant reboot.

This bug has been fixed in the 2.4.26 and 2.6.4 kernel releases.

References:

• NetSecurity

As you know, the main feature of OpenSSH is to establish secure connections to remote machines, so you get interactive sessions against them. However, OpenSSH also allows you to execute commands on remote machines. You can execute commands and have the output returned to the screen without logging in to the remote machine.

To execute a command remotely simply type:

ssh user@remote_host ‘ls -al /etc’

However, some commands require a terminal to run properly. For example, if you want to edit a remote file using vi you probably will try something like this:

ssh user@remote_host ‘vi /etc/passwd’

And you’ll get warnings like this:

Vim: Warning: Output is not to a terminal
Vim: Warning: Input is not from a terminal

To avoid such warnings and cleanly edit your remote files type the following:

ssh -t user@remote_host ‘vi /etc/passwd’

The -t option will… (from OpenSSH man pages)

Force pseudo-tty allocation. This can be used to execute arbitrary screen-based programs on a remote machine, which can be very useful, e.g., when implementing menu services. Multiple -t options force tty allocation, even if ssh has no local tty.