Security - Revision history

Ooooo at 12:01, 30 June 2016

2016-06-30T12:01:26Z

← Older revision		Revision as of 12:01, 30 June 2016
Line 36:		Line 36:
	# try to uninstall & delete it and make sure we don't uninstall any important programme on the server which is actually used.		# try to uninstall & delete it and make sure we don't uninstall any important programme on the server which is actually used.

	====1) FIND ====		==== FIND ====

	=====USE CHANGELOG=====		=====USE CHANGELOG=====
Line 86:		Line 86:
	udp6 0 0 :::111 :::* 1707/rpcbind		udp6 0 0 :::111 :::* 1707/rpcbind

	====2) UNINSTALL===		==== UNINSTALL====

	Uninstall the package while verifying its dependencies		Uninstall the package while verifying its dependencies

Ooooo at 12:00, 30 June 2016

2016-06-30T12:00:41Z

← Older revision		Revision as of 12:00, 30 June 2016
Line 36:		Line 36:
	# try to uninstall & delete it and make sure we don't uninstall any important programme on the server which is actually used.		# try to uninstall & delete it and make sure we don't uninstall any important programme on the server which is actually used.

	==1) FIND ==		====1) FIND ====

	===USE CHANGELOG===		=====USE CHANGELOG=====

	Find in the Changelog whether somebody installed or changed the portmapper		Find in the Changelog whether somebody installed or changed the portmapper
Line 53:		Line 53:
	$ nano /root/Changelog		$ nano /root/Changelog

	===SEARCH===		=====SEARCH=====

	Where can we find the executable ?		Where can we find the executable ?
Line 86:		Line 86:
	udp6 0 0 :::111 :::* 1707/rpcbind		udp6 0 0 :::111 :::* 1707/rpcbind

	==2) UNINSTALL==		====2) UNINSTALL===

	Uninstall the package while verifying its dependencies		Uninstall the package while verifying its dependencies

Ooooo: /* Portmapper */

2016-06-30T11:53:08Z

Portmapper

← Older revision		Revision as of 11:53, 30 June 2016
Line 16:		Line 16:


	rpcinfo -T udp -p		What kind of rpc services are running on the server
			rpc is an intern process communication

			$ rpcinfo -T udp -p

	program vers proto port service		program vers proto port service
	100000 4 tcp 111 portmapper		100000 4 tcp 111 portmapper
Line 27:		Line 31:
	100024 1 tcp 45698 status		100024 1 tcp 45698 status

	~~what kind of rpc services are running on the server~~
	~~rpc is an intern process communication~~


	# find the executable files which contains portmapper		# find the executable files which contains portmapper
	# try to uninstall & delete it and make sure we don't uninstall any important programme on the server which is actually used.		# try to uninstall & delete it and make sure we don't uninstall any important programme on the server which is actually used.


	==1) FIND ==		==1) FIND ==

Ooooo: /* 2) UNINSTALL */

2016-06-30T11:52:05Z

2) UNINSTALL

← Older revision		Revision as of 11:52, 30 June 2016
Line 95:		Line 95:
	Reading state information... Done		Reading state information... Done
	The following packages were automatically installed and are no longer required:		The following packages were automatically installed and are no longer required:
	libgssglue1 libsasl2-modules wwwconfig-common		libgssglue1 libsasl2-modules wwwconfig-common
	Use 'apt-get autoremove' to remove them.		Use 'apt-get autoremove' to remove them.
	The following packages will be REMOVED:		The following packages will be REMOVED:
	nfs-common rpcbind		nfs-common rpcbind
	0 upgraded, 0 newly installed, 2 to remove and 151 not upgraded.		0 upgraded, 0 newly installed, 2 to remove and 151 not upgraded.
	After this operation, 805 kB disk space will be freed.		After this operation, 805 kB disk space will be freed.

Ooooo: /* SEARCH */

2016-06-30T11:51:12Z

← Older revision		Revision as of 11:51, 30 June 2016
Line 63:		Line 63:

	Find out in which package of our debian distribution the portmapper is active		Find out in which package of our debian distribution the portmapper is active

	$apt-cache search portmapper		$apt-cache search portmapper
	remotetea - Sun ONC/RPC support for Java		remotetea - Sun ONC/RPC support for Java

	Ask whether the package is installed:		Ask whether the package is installed:

	$dpkg -l\|grep remotetea		$dpkg -l\|grep remotetea

Line 75:		Line 77:

	As portmapper is active on port 111, we listen to open ports and what kind of services are running and find again the open port 111		As portmapper is active on port 111, we listen to open ports and what kind of services are running and find again the open port 111

	$ netstat -lnptu\|grep 111		$ netstat -lnptu\|grep 111

Line 80:		Line 83:
	tcp6 0 0 :::111 :::* LISTEN 1707/rpcbind		tcp6 0 0 :::111 :::* LISTEN 1707/rpcbind
	udp 0 0 0.0.0.0:111 0.0.0.0:* 1707/rpcbind		udp 0 0 0.0.0.0:111 0.0.0.0:* 1707/rpcbind
	udp6 0 0 :::111 :::* 1707/rpcbind		udp6 0 0 :::111 :::* 1707/rpcbind

	==2) UNINSTALL==		==2) UNINSTALL==

Ooooo at 11:50, 30 June 2016

2016-06-30T11:50:14Z

← Older revision		Revision as of 11:50, 30 June 2016
Line 30:		Line 30:
	rpc is an intern process communication		rpc is an intern process communication

	~~1) find the executable files which contains portmapper~~
	~~2) try to uninstall & delete it and make sure we don't uninstall any important programme on the server which is actually used.~~

	~~1) FIND~~		# find the executable files which contains portmapper
			# try to uninstall & delete it and make sure we don't uninstall any important programme on the server which is actually used.

	~~find in the changelog whether somebody installed or changed the portmapper~~
	~~grep -i portmapper Changelog~~

	~~If you do changes on the server use Changelog : changelog edit file~~		==1) FIND ==
	~~less Changelog~~
	~~nano /root/Changelog~~

	~~which portmapper~~		===USE CHANGELOG===
	~~where is the executable ?~~

	~~locate~~		Find in the Changelog whether somebody installed or changed the portmapper
	~~simply find a file~~

	find out in which package the portmapper is active		$ grep -i portmapper Changelog
	apt-cache search portmapper
			Consult Changelog

			$ less Changelog

			If you do changes on the server use Changelog.
			Changelog edit file

			$ nano /root/Changelog

			===SEARCH===

			Where can we find the executable ?

			$ which portmapper

			Simply find the file

			$locate portmapper

			Find out in which package of our debian distribution the portmapper is active
			$apt-cache search portmapper
	remotetea - Sun ONC/RPC support for Java		remotetea - Sun ONC/RPC support for Java

	dpkg -l\|grep remotetea		Ask whether the package is installed:
	~~gives list~~ of ~~installed packages, and~~		$dpkg -l\|grep remotetea
	~~it is not installed~~
			After reading online, whe realize that the portmapper is used for NFS systems which are managed by rpcbind. To verify whether portmapper is used, we show the description of a package:
			$ apt-cache show rpcbind

			Rpcbind uses portmapper!

	~~show~~ the ~~description of a package~~		As portmapper is active on port 111, we listen to open ports and what kind of services are running and find again the open port 111
	~~apt~~-~~cache show rpcbind~~		$ netstat -lnptu\|grep 111

	rpcbind ~~uses portmapper~~		tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1707/rpcbind
			tcp6 0 0 :::111 :::* LISTEN 1707/rpcbind
			udp 0 0 0.0.0.0:111 0.0.0.0:* 1707/rpcbind
			udp6 0 0 :::111 :::* 1707/rpcbind

	~~netstat -lnptu\|grep 111~~		==2) UNINSTALL==
	~~listens to open ports and what kind of services are running and finds the open port 111~~

	~~netstat -lnptu\|grep 111~~		Uninstall the package while verifying its dependencies
	~~tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1707/rpcbind~~
	~~tcp6 0 0 :::111 :::* LISTEN 1707/rpcbind~~
	~~udp 0 0 0.0.0.0:111 0.0.0.0:* 1707/rpcbind~~
	~~udp6 0 0 :::111 :::* 1707/rpcbind~~

	~~2) UNINSTALL~~		$ apt-get remove rpcbind
	apt-get remove rpcbind

	Reading package lists... Done		Reading package lists... Done
Line 84:		Line 99:
	After this operation, 805 kB disk space will be freed.		After this operation, 805 kB disk space will be freed.

	We don't consider lib's, because packages which are libraries, are not providing ~~anyy~~ services.		We don't consider lib's, because packages which are libraries, are not providing any services. So we autoremove packages&libraries, on which no other package depends and which where not manually installed.

	apt-get autoremove		$ apt-get autoremove

	~~remove packages&libraries,on which no other package depends and which where not manually installed~~

	how may packages are manually installed		To check how may packages are manually installed
	apt-mark showmanual\|wc -l		$ apt-mark showmanual\|wc -l

	=== iptables ===		=== iptables ===

Ooooo at 20:13, 29 June 2016

2016-06-29T20:13:53Z

← Older revision		Revision as of 20:13, 29 June 2016
Line 89:		Line 89:

	remove packages&libraries,on which no other package depends and which where not manually installed		remove packages&libraries,on which no other package depends and which where not manually installed

			how may packages are manually installed
			apt-mark showmanual\|wc -l

	=== iptables ===		=== iptables ===

Ooooo: /* Portmapper */

2016-06-29T20:10:49Z

Portmapper

← Older revision		Revision as of 20:10, 29 June 2016
Line 26:		Line 26:
	100024 1 udp 37209 status		100024 1 udp 37209 status
	100024 1 tcp 45698 status		100024 1 tcp 45698 status

			what kind of rpc services are running on the server
			rpc is an intern process communication

	1) find the executable files which contains portmapper		1) find the executable files which contains portmapper
Line 56:		Line 59:
	apt-cache show rpcbind		apt-cache show rpcbind

			rpcbind uses portmapper

			netstat -lnptu\|grep 111
			listens to open ports and what kind of services are running and finds the open port 111

			netstat -lnptu\|grep 111
			tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1707/rpcbind
			tcp6 0 0 :::111 :::* LISTEN 1707/rpcbind
			udp 0 0 0.0.0.0:111 0.0.0.0:* 1707/rpcbind
			udp6 0 0 :::111 :::* 1707/rpcbind

			2) UNINSTALL
			apt-get remove rpcbind

			Reading package lists... Done
			Building dependency tree
			Reading state information... Done
			The following packages were automatically installed and are no longer required:
			libgssglue1 libsasl2-modules wwwconfig-common
			Use 'apt-get autoremove' to remove them.
			The following packages will be REMOVED:
			nfs-common rpcbind
			0 upgraded, 0 newly installed, 2 to remove and 151 not upgraded.
			After this operation, 805 kB disk space will be freed.

			We don't consider lib's, because packages which are libraries, are not providing anyy services.

			apt-get autoremove

			remove packages&libraries,on which no other package depends and which where not manually installed

	=== iptables ===		=== iptables ===

Ooooo at 19:50, 29 June 2016

2016-06-29T19:50:39Z

← Older revision		Revision as of 19:50, 29 June 2016
Line 7:		Line 7:
	* Turn ''ServerSignature'' to ''Off''.		* Turn ''ServerSignature'' to ''Off''.
	* Restart Apache web server.		* Restart Apache web server.


			=== Portmapper ===

			The port mapper (rpc.portmap or just portmap, or rpcbind) is an Open Network Computing Remote Procedure Call (ONC RPC) service that runs on network nodes that provide other ONC RPC services. If you need to run this service, that is perfectly acceptable. However, if this is a mis-configuration, it would be a good idea to stop it.

			https://www.shadowserver.org/wiki/pmwiki.php/Services/Open-Portmapper


			rpcinfo -T udp -p
			program vers proto port service
			100000 4 tcp 111 portmapper
			100000 3 tcp 111 portmapper
			100000 2 tcp 111 portmapper
			100000 4 udp 111 portmapper
			100000 3 udp 111 portmapper
			100000 2 udp 111 portmapper
			100024 1 udp 37209 status
			100024 1 tcp 45698 status

			1) find the executable files which contains portmapper
			2) try to uninstall & delete it and make sure we don't uninstall any important programme on the server which is actually used.

			1) FIND

			find in the changelog whether somebody installed or changed the portmapper
			grep -i portmapper Changelog

			If you do changes on the server use Changelog : changelog edit file
			less Changelog
			nano /root/Changelog

			which portmapper
			where is the executable ?

			locate
			simply find a file

			find out in which package the portmapper is active
			apt-cache search portmapper
			remotetea - Sun ONC/RPC support for Java

			dpkg -l\|grep remotetea
			gives list of installed packages, and
			it is not installed

			show the description of a package
			apt-cache show rpcbind







	=== iptables ===		=== iptables ===

Ramona: /* Bogus http requests */

2015-09-27T12:44:38Z

Bogus http requests

← Older revision		Revision as of 12:44, 27 September 2015
Line 4:		Line 4:

	* Open up /etc/apache2/conf.d/security		* Open up /etc/apache2/conf.d/security
	* ~~Current setting is "~~ServerTokens OS~~". I recommend setting it~~ to "Prod"?		* Set ''ServerTokens OS'' to ''Prod''.
	* ServerSignature ~~is On. I recommend turning it~~ Off.		* Turn ''ServerSignature'' to ''Off''.
	* Restart Apache web server.		* Restart Apache web server.