Linux DDoS Hardening

If you server is under ddos attack, please harden  sysctl.conf and install apf ,ddos deflate.
==================
Hardening of sysctl.conf

servertechs# nano -w  /etc/sysctl.conf

Add this to the /etc/sysctl.conf

#  Enable IP spoofing protection, turn on Source Address Verification
net.ipv4.conf.all.rp_filter = 1
# Enable TCP SYN Cookie Protection
net.ipv4.tcp_syncookies = 1
Add the below code in /etc/rc.local and restart network
for f in /proc/sys/net/ipv4/conf/*/rp_filter;
do echo 1 > done
echo 1 > /proc/sys/net/ipv4/tcp_syncookies

==================
Installation DDoS Deflate
This works with apf to block  ips , ensure that you have apf installed on the server.
Installation:

wget http://www.inetbase.com/scripts/ddos/install.sh
chmod 0700 install.sh
./install.sh

Vodafone Smart Prime 6 - VN-895F - unbrick

Vodafone Smart Prime 6 ( VN-895F )
unbrick + root + custom ROM

 

:: Links ::

Stock ROM              https://uloz.to/!AVVOAqRbDIZr/lrx22g-v9w7n-0-zip

CyanogenMod 12.1 https://uloz.to/!pvfevRcsH6fI/cm-lmy49j-vf-895n-zip

TWRP 3.0.0.2          https://uloz.to/!NBdIpS4zH3X6/twrp-3-0-2-0-vf895n-img

Flashify (google play)

:: HowTO ::

- Get into Recovery mode (Power + Vol Up)

- English, Write Protect Switch off, reboot

- when back in OS - download Kingoroot, install and "Start Root"

- you might decline the security checks, i let them working

- download the Stock ROM 5.0.2 / multilanguage

- download the TWRP recovery

> https://uloz.to/!NBdIpS4zH3X6/twrp-3-0-2-0-vf895n-img <

- copy both on SD card ( /external_sd ) 

- you can use ADB - push + shell or mount the phone directly

- download + install Flashify

- backup your kernel + recovery with Flashify and flash TWRP recovery

- reboot into TWRP (Power + Vol Up)

- you are in the touch-based recovery GUI with access to terminal etc. ...

- wipe everything (Advanced) except your /external_sd 

- so wipe out /system, /data, /cache, /Dalvik

- in case of error - repeat with repair fs before wipe

- install Stock ROM / LRX22G-w9V7N ( 5.0.2 multilingual CZ )

> https://uloz.to/!AVVOAqRbDIZr/lrx22g-v9w7n-0-zip <

- wipe cache + Dalvik and reboot

- this Stock ROM is without bloatware and extra apps, just basics

*** you can use this ROM as it is stable and fast ***

- if you want you can try unofficial CM 12.1 (5.1.1)

> https://uloz.to/!pvfevRcsH6fI/cm-lmy49j-vf-895n-zip <

 - wifi / sim card / 2g,3g,4g working / buttons LEDs working / flashlight LED working

- but getting unstable after 2-3 days ...unfortunatelly

 

:: Final TIPS ::

- - BACKUP! kernel, rom, OS - just everything!

- in case that you see device Aquaris E5, manufacturer BQ - no stress ;o)

- give it a little longer time after flashing Stock ROM or Cyanogen 

- 15-20mins  it will be looking like nothing is happening

*ad ADB 

- for ADB to work - your device will need to show up as:

usb 2-5: new high-speed USB device number 119 using xhci_hcd
usb 2-5: New USB device found, idVendor=18d1, idProduct=4ee2
usb 2-5: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 2-5: Product: VF895N
usb 2-5: Manufacturer: Vodafone
usb 2-5: SerialNumber: xxxxxxxx 

- if it shows as :

usb 2-5: new high-speed USB device number 121 using xhci_hcd
usb 2-5: New USB device found, idVendor=05c6, idProduct=9008
usb 2-5: New USB device strings: Mfr=0, Product=2, SerialNumber=0
usb 2-5: Product: QHSUSB__BULK
qcserial 2-5:1.0: Qualcomm USB modem converter detected
usb 2-5: Qualcomm USB modem converter now attached to ttyUSB0 

- it means it is in pre-booting process - get into recovery to move away from loop

 

Enjoy@!

VLAN in Linux - permanent solution

VLAN's in Linux - permanent solution

copy file


/etc/sysconfig/network-scripts/ifcfg-eth0 

to

/etc/sysconfig/network-scripts/ifcfg-eth0.2

• eth0 – Your regular network interface
• eth0.2 – Your virtual interface that use untagged frame

edit ifcfg-eth0.2
sudo nano /etc/sysconfig/network-scripts/ifcfg-eth0.2

replace 
DEVICE=ifcfg-eth0  


with
DEVICE=ifcfg-eth0.2

add
VLAN=yes

Remove gateway entry from all other network config files. Only add gateway to /etc/sysconfig/network

service  network   restart

Nginx Web Server - LEMP

Nginx Web Server - LEMP

Ubuntu 16.04 (DigitalOcean VPS)

::NGINX install::

    sudo apt-get update
    sudo apt-get install nginx

ufw app list

ufw allow 22

ufw allow "nginx http"

ufw enable

ufw status

::How to find Public IP address::

ip addr show eth0 | grep inet | awk '{ print $2; }' | sed 's/\/.*$//'

curl -4 icanhazip.com

Now go to visit http://<server-ip/dns>

 If you see Welcome to NGINX! -- nginx working ok

::MySQL Server setup::

sudo apt-get install mysql-server

sudo mysql_secure_installation

..on all Q answer yes.. only root pass N!

::PHP install::

sudo apt-get install php-fpm php-mysql

sudo nano /etc/php/7.0/fpm/php.ini

ctrl+w --> search for cgi.fix_pathinfo

uncomment and change to 0 (zero) -- Security Reasons

sudo service php7.0-fpm restart

sudo nano /etc/nginx/sites-available/default

server {
    listen 80 default_server;
    listen [::]:80 default_server;

    root /var/www/html;
    index index.php index.html index.htm index.nginx-debian.html;

    server_name server_domain_or_IP;

    location / {
        try_files $uri $uri/ =404;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php7.0-fpm.sock;
    }

    location ~ /\.ht {
        deny all;
    }
}

-- Check syntax errors

sudo nginx -t 

sudo systemctl reload nginx

sudo service nginx reload

touch /var/www/html/info.php

echo "<?php" >> /var/www/html/test.php

echo "phpinfo();" > /var/www/html/test.php

(sudo nano /var/www/html/info.php)

Now go to visit http://<server-ip/dns>/test.php

If you see PHP info page -- > DONE!

Almost ... just remove test.php file if you don't want to be hacked soon...

sudo rm /var/www/html/info.php

Docker 32bit on VPS Ubuntu

Docker 32bit on VPS Ubuntu

:~# git clone https://github.com/docker/docker.git
:~# cd docker/
:~/docker#  mv Dockerfile Dockerfile.backup
:~/docker# sudo apt-get install build-essential
:~/docker# sudo make build
:~/docker# git clone https://github.com/docker-32bit/ubuntu.git
:~/docker# cd ubuntu

:~/docker/ubuntu# bash build-image.sh

:~/docker/ubuntu# sudo service docker start

:~/docker/ubuntu# sudo groupadd docker

:~/docker/ubuntu# sudo usermod -aG docker magvpn
:~/docker/ubuntu# exit
logout
Connection to <ip address> closed.
:~# apt-cache policy docker-engine

:~# uname -r
4.4.0-38-generic
:~# sudo apt-get install linux-image-extra-$(uname -r) linux-image-extra-virtual

:~#sudo reboot




:~# sudo service docker restart
:~#sudo service docker status

:~# sudo nano /etc/apt/sources.list.d/docker.list


:~# sudo apt-get install linux-image-extra-$(uname -r) linux-image-extra-virtual
:~# sudo reboot
#  docker images -a
# docker ps -a

# docker ps -a
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS                      PORTS               NAMES
52bb703212fa        1c76a4c59dc5        "/bin/bash"         55 minutes ago      Exited (0) 55 minutes ago                       32buntu

from command docker ps -a use Image-ID and run with -ti options

#docker run -t -i 1c76a4c59dc5 /bin/bash

 

root@4e8daaf147d5:/# uname -a
Linux 4e8daaf147d5 4.4.0-38-generic #57-Ubuntu SMP Tue Sep 6 15:41:41 UTC 2016 i686 i686 i686 GNU/Linuxroot@4e8daaf147d5:/#
oot@4e8daaf147d5:/# uname -m
i686
root@4e8daaf147d5:/


root@ubuntu-512mb-fra1-01:~# docker run hello-world
docker: Error response from daemon: rpc error: code = 2 desc = "oci runtime error: exec format error".

# docker version
Client:
 Version:      1.11.2
 API version:  1.23
 Go version:   go1.6.2
 Git commit:   b9f10c9
 Built:        Thu, 16 Jun 2016 21:17:51 +1200
 OS/Arch:      linux/386

Server:
 Version:      1.11.2
 API version:  1.23
 Go version:   go1.6.2
 Git commit:   b9f10c9
 Built:        Thu, 16 Jun 2016 21:17:51 +1200
 OS/Arch:      linux/386

#

Docker 32bit on VPS Ubuntu

Docker 32bit on VPS Ubuntu

:~# git clone https://github.com/docker/docker.git
:~# cd docker/
:~/docker#  mv Dockerfile Dockerfile.backup
:~/docker# sudo apt-get install build-essential
:~/docker# sudo make build
:~/docker# git clone https://github.com/docker-32bit/ubuntu.git
:~/docker# cd ubuntu

:~/docker/ubuntu# bash build-image.sh

:~/docker/ubuntu# sudo service docker start

:~/docker/ubuntu# sudo groupadd docker

:~/docker/ubuntu# sudo usermod -aG docker magvpn
:~/docker/ubuntu# exit
logout
Connection to <ip address> closed.
:~# apt-cache policy docker-engine

:~# uname -r
4.4.0-38-generic
:~# sudo apt-get install linux-image-extra-$(uname -r) linux-image-extra-virtual

:~#sudo reboot




:~# sudo service docker restart
:~#sudo service docker status

:~# sudo nano /etc/apt/sources.list.d/docker.list


:~# sudo apt-get install linux-image-extra-$(uname -r) linux-image-extra-virtual
:~# sudo reboot
#  docker images -a
# docker ps -a

# docker ps -a
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS                      PORTS               NAMES
52bb703212fa        1c76a4c59dc5        "/bin/bash"         55 minutes ago      Exited (0) 55 minutes ago                       32buntu

from command docker ps -a use Image-ID and run with -ti options

#docker run -t -i 1c76a4c59dc5 /bin/bash

 

root@4e8daaf147d5:/# uname -a
Linux 4e8daaf147d5 4.4.0-38-generic #57-Ubuntu SMP Tue Sep 6 15:41:41 UTC 2016 i686 i686 i686 GNU/Linuxroot@4e8daaf147d5:/#
oot@4e8daaf147d5:/# uname -m
i686
root@4e8daaf147d5:/


root@ubuntu-512mb-fra1-01:~# docker run hello-world
docker: Error response from daemon: rpc error: code = 2 desc = "oci runtime error: exec format error".

# docker version
Client:
 Version:      1.11.2
 API version:  1.23
 Go version:   go1.6.2
 Git commit:   b9f10c9
 Built:        Thu, 16 Jun 2016 21:17:51 +1200
 OS/Arch:      linux/386

Server:
 Version:      1.11.2
 API version:  1.23
 Go version:   go1.6.2
 Git commit:   b9f10c9
 Built:        Thu, 16 Jun 2016 21:17:51 +1200
 OS/Arch:      linux/386

#

Virtual Private Server / Cloud Server

Cloud Server / VPS - Virtual Private Server in Cloud

It's really nice and easy to get 2 months free from DigitalOcean ($10 starting budget) or also you can try Amazon Free-Tier's or Google Cloud. And don't forget Azure.

ssh -l <username> <ipaddress>

sudo apt-get install knockd

sudo nano /etc/default/knockd

change START_KNOCKD=0 >>> 
START_KNOCKD=1

sudo service knockd start

 knock <server_ip_address> 65123 65321 65123

sudo nano /etc/knockd.conf

sudo service knockd restart

::Final Command::

knock <server_ip_address> 5438 3428 3280 4479 && ssh <user>@<server_ip_address>

Raise Network Interfaces failed... Boot.Wait.Online - howto fix it

Raise Network Interfaces failed
(& how-to fix solution)

:~$ systemctl status networking.service 

* networking.service - Raise network interfaces
    Loaded: loaded (/lib/systemd/system/networking.service; enabled; vendor preset: enabled)
   Drop-In: /run/systemd/generator/networking.service.d
            `-50-insserv.conf-$network.conf
    Active: failed (Result: exit-code) since Sun 2016-08-14 17:02:50 PDT; 39min ago
    Docs: man:interfaces(5)
  Main PID: 893 (code=exited, status=1/FAILURE)

 Aug 14 17:02:41 sheeva systemd[1]: Starting Raise network interfaces...
 Aug 14 17:02:46 sheeva ifup[893]: /sbin/ifup: waiting for lock on /run/network/ifstate.eth0
 Aug 14 17:02:49 sheeva ifup[893]: RTNETLINK answers: File exists
 Aug 14 17:02:49 sheeva ifup[893]: Failed to bring up eth0.
 Aug 14 17:02:50 sheeva systemd[1]: networking.service: Main process exited, code=exited, status=1/FAILURE
 Aug 14 17:02:50 sheeva systemd[1]: Failed to start Raise network interfaces.
 Aug 14 17:02:50 sheeva systemd[1]: networking.service: Unit entered failed state.
 Aug 14 17:02:50 sheeva systemd[1]: networking.service: Failed with result 'exit-code'.

However the interface *is* up:

 :~$ ifconfig
 eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500

*****************************************************

Here is a possibly relevant config file

#Original Line
auto ens34
iface ens34 inet dhcp

#New line
allow-hotplug ens34
iface ens34 inet dhcp 

 --------- /etc/network/interfaces ------------
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo eth0
iface lo inet loopback

# The primary network interface
allow-hotplug eth0
iface eth0 inet dhcp

(iface eth0 inet static)
address 192.168.3.111
 netmask 255.255.240.000
 network 192.168.0.0
 broadcast 192.168.15.255
 gateway 192.168.1.1

iface eth0 inet6 static
       address 2001:1234:2d2:1:f2ad:4eff:fe00:3077
       netmask 64
--------- /etc/network/interfaces ------------ 

systemctl status <systemd or NetworkManager below>

systemd-networkd-wait-online.service

NetworkManager-wait-online.service

 
sudo systemctl disable systemd-networkd-wait-online.service

 sudo systemctl disable etworkManager-wait-online.service

...or you can also reduce the timeout

sudo nano /etc/systemd/system/network-online.targets.wants/networking.service 

 TimeoutStartSec=10sec

save (CTRL + x, y, Enter) and  

sudo systemctl daemon-reload 

systemctl status networking.service

networkctl

ifconfig enp5s0f1 up  

networkctl

ifconfig enp5s0f1 down

 ip link set enp5s0f1 name eth0

systemctl restart networking

*** ABOVE IS ONLY TEMP SOLUTION ***

 it won't persist after reboot. Create a 

 sudo touch /etc/udev/rules.d/70-persistent-net.rules 

(should contain smthng like:
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="smsc95xx", ATTR{address}=="*", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="eth0"

iPhone 4 - untethered

If your iPhone is stuck in Recovery Mode, this fix should restore your iPhone to the factory settings, but a backup should have been created automatically when the OS was updated so you will have the option to restore from backup once the repair is made.

If iTunes is open, exit iTunes
Disconnect iPhone from computer USB
Click Start menu on desktop
Go to Control Panel
Go to Programs
Go to Programs and Features
Select Apple Mobile Device Support and click repair
Connect iPhone to computer USB (device should install automatically)
Open iTunes
When prompted, click restore iPhone
OS should install now and restore factory settings

iPhone will automatically restart when OS is successfully installed, and you will have the option to setup as new or restore from backup

Well that was a bit scary. I've just updated the firmware on my iPhone to 2.2 (the horrors!). Actually, this normally shouldn't be too much of a trial. The difference here is that I did it from Windows running inside VMWare on a Linux host.
I initially tried the naive approach of applying the update normally using iTunes (but running inside VMWware). Don't do this! The host (Linux) USB subsystem gets in the way leaving you with a somewhat useless iPhone in "recovery mode". It seems that the iPhone firmware upgrade procedure does something tricky with USB that doesn't play nicely with VMWare running on Linux.
To workaround the issue, some USB modules have to not be loaded on the Linux host during the upgrade. Extending the tips on Stephen Laniel's blog I created a blacklist file for modprobe that prevents certain USB modules from loading. Just unloading the modules manually isn't enough. The iPhone reconnects to the USB bus at least once during the upgrade process causing udev to reload the modules you've manually unloaded.
So before attempting the upgrade, create a file named something like /etc/modprobe.d/blacklist-usb with the following contents:

blacklist snd_usb_audio
blacklist usbhid
blacklist ehci_hcd

I'm not sure if ehci_hcd needs to be disabled, but I did this in my case.
Reload udev so that it knows about the new modprobe config file:

sudo /etc/init.d/udev reload

Now make sure these modules aren't already loaded:

sudo /sbin/modprobe -r snd_usb_audio
sudo /sbin/modprobe -r usbhid
sudo /sbin/modprobe -r usbhid

Now go back to VMWare, cross your fingers and attempt the firmware upgrade using iTunes. Things should progress along slowly.
You might find that at one point during the upgrade that iTunes sits there with a dialog saying "Preparing iPhone for upgrade". If this goes on for several minutes it could be that the iPhone isn't connected to VMWare anymore. iTunes is just waiting for the device to appear. If this happens, reattach the iPhone to VMWare using the "Removable Devices" option on VMWare's VM menu. It's a good idea to occasionally check that the iPhone is connected to VMWare during the upgrade.
Once the upgrade is complete you can remove the modprobe config file and reload VMWare:

sudo rm /etc/modprobe.d/blacklist-usb
sudo /etc/init.d/udev reload

For the record, this was done using iTunes 8 running on Vista running inside VMware Workstation 6.5.0 build-118166 on Ubuntu Intrepid (8.10).

National Demos advice - to not repeat Catalunya protestants errors

Police not attacking until attacked
demonstrants having flags -- sticks to fight / might have spears on end
firesticks / lighters

-- important are drums and other sound support --> i.e.: made from barrels
-- avoid molotovs until extrem force used by police / no mercy for extreme violence

-- sound and light effects pyro >> causing same fear in police as in demonstrators

https://www.youtube.com/watch?v=LSEsYxg12wk
==================================================================
Catalunya -- errors and mistake made by demonstrants

https://www.youtube.com/watch?v=BZSyBfXC6-U
https://www.youtube.com/watch?v=t88Jl3hyuKI

===================================================================

France

https://www.youtube.com/watch?v=xPpdo_SnPsU

=======================================================================

To better understand a Riot control:
https://www.youtube.com/watch?v=yT9bit2-1pg

======================================================================
Military Engineers: Roman Strategy a Technniques

======================================================================
 

proxy NL free

Free proxy in Netherlands

Change your IP with Digital Ocean

Many of us are looking for a possibility to hide / change the IP address. We don't need to be a terrorists or hackers. To avoid attacks from outside "wild" internet, it's good to follow the basic rules. 

One of them is to hide your identity. You can start with supplying a different browser's header. You can follow up with supplying different OS header as well. You can use virtualized OS to access & surf the web or even better -- using virtualized App takes much less resources. Try it with Docker for example ;)

Also there is a possibility to go through Proxy server -- even that it has some hidden dangers as well. Do you really trust your provider? And what about your proxy provider? 

Was trying to build a proxy on AWS -- traffic was growing in a light speed! As an "user" of free services, maybe better to say tester --- unacceptable. Was searching for an easy plus free solution. Until i found Digital Ocean -- if you are using Mozilla search for Browsec. Fast&Easy solution without hidden costs or stress that you will go over the limit. 

Tested with OOKLA (whatismyipaddress.com)

Last Result:
Download Speed: 2971 kbps (371.4 KB/sec transfer rate)
Upload Speed: 46541 kbps (5817.6 KB/sec transfer rate)
Latency: 208 ms
Jitter: 15 ms
2. 9. 2016 10:07:41

*********

and below w/out proxy - not so big deal

Last Result:
Download Speed: 15810 kbps (1976.3 KB/sec transfer rate)
Upload Speed: 32818 kbps (4102.3 KB/sec transfer rate)
Latency: 176 ms
Jitter: 40 ms
2. 9. 2016 10:22:08

Docker + full machine virtualization

Docker + QEMU + KVM + VMWare

So, lightweight Docker is good for app virtualizations or even for small systems. Of course if you need a full-scale OS running there are better tools.

sudo apt install docker

sudo apt install docker.io \
virt-manager libvirt libvirt-python libvirt-client

 Also not all laptops are having enabled virtualization! Even with i3 and i5 CPU's the manufacturer just banned it ... Not possible to activate it from the BIOS, even that CPU and MB are supporting it.

Check out if your machine is ok with it:
lsmod | grep kvm
and
cat /proc/cpuinfo | grep vmx
(-- on http://www.tecmint.com is similar >> grep -e 'vmx' /proc/cpuinfo; check it out, Matei's How-To is better than mine)

Now we can run-up the daemon and use virtualized applications! 

sudo service docker status

● docker.service - Docker Application Container Engine
   Loaded: loaded (/lib/systemd/system/docker.service; enabled; vendor preset: enabled)
   Active: active (running)
           <omitted>

systemd[1]: Started Docker Application Container Engine.

 You see that it looks good and is up.
Now we can start up 'Hello World' -- > testing image. Basically you should see a message confirming that all is working correctly.

docker run hello-world 

docker info

docker version

docker --help 

docker images

docker search ubuntu

docker pull ubuntu

Now we need to run it inside the Docker's container

 docker run ubuntu cat /etc/issue

we need to know which container is running already

 docker ps -l 

 docker start c629b7d70666

>> Ctrl+P and Ctrl+Q - will move you back and forth the original OS.   

 but who should remember this number?
What if we want to run more apps?   Let's Give him a name!

docker run --name myname  ubuntu cat /etc/debian_version 

docker run -it ubuntu bash 

 docker attach c692...

 docker ps

docker kill 

NetFlow + NtopNG

NetFlow + Ntop-NG

-- after few hours pulling my hairs finally have NetFlow Collector up and running

-- Finally went for Ntop with NBOX webGUI and must admit that graphics is just COOOL!!! :)

-- Dashboard and all working with it is done with precision and experiences

-- can be installed from repositories ;)

sudo dpkg -i apt-ntop-stable.deb

sudo apt-get clean all

sudo apt update

sudo apt install pfring /
nprobe ntopng ntopng-data n2disk cento nbox pfring-drivers-zc-dkms

sudo apt update

sudo apt install ntopng
(yes, it is really twice here -- first time didn't resolve all dependencies)

To activate the new configuration, you need to run:
  service apache2 reload
insserv: warning: script 'K01nfsen' missing LSB tags and overrides
insserv: warning: script 'nfsen' missing LSB tags and overrides
[ ok ] Reloading apache2 configuration (via systemctl): apache2.service.
[ ok ] Restarting apache2 (via systemctl): apache2.service.

*** IMPORTANT IMPORTANT IMPORTANT IMPORTANT IMPORTANT ***

You can now point your browser to https://localhost/

The default user is nbox with password nbox

*** IMPORTANT IMPORTANT IMPORTANT IMPORTANT IMPORTANT ***


So you can go ahead and check it - don't forget to change default password and restart apache2 after ... :D