DNS (Domain Name Service) server is a server that translate an IP address into a name that will be easy to remember or do the opposite way.

The administrative job is done in Server side. For client side just set the machine to connect the DNS server.

Before we start, I assume that you are connected to Internet already. For, text editor, you can use any program that you are familiar with. In this sample, I use vim.

The installation is as easy as below:

Step 1. Install the bind9

Open Linux Terminal (Applications>Accessories>Terminal), type: sudo apt-get install bind9

Installation finished.

Read the rest of this entry »

What is iptable? Iptables is a generic table structure that defines rules and commands as part of the netfilter framework that facilitates Network Address Translation (NAT), packet filtering, and packet mangling in the Linux 2.4 and later operating systems. NAT is the process of converting an Internet Protocol address (IP address) into another IP address. Packet filtering is the process of passing or blocking packets at a network interface based on source and destination addresses, ports, or protocols. Packet mangling is the ability to alter or modify packets before and/or after routing.

Iptables and netfilter are the successor to ipchains and ipfwadm in earlier versions of Linux. Netfilter and iptables are often combined into the single expression netfilter /iptables, which refers to the Linux 2.4 and later subsystems for NAT, firewall, and advanced packet processing.

How do I block an IP address or subnet under Linux operating system?

In order to block an IP on your Linux server you need to use iptables tools (administration tool for IPv4 packet filtering and NAT) and netfilter firewall. First you need to log into shell as root user. To block IP address you need to type iptables command as follows:
Syntax to block an IP address under Linux

Replace IP-ADDRESS with actual IP address. For example if you wish to block ip address 65.55.44.100 for whatever reason then type command as follows:

If you have IP tables firewall script, add above rule to your script.

If you just want to block access to one port from an ip 65.55.44.100 to port 25 then type command:
# iptables -A INPUT -s 65.55.44.100 -p tcp –destination-port 25 -j DROP
The above rule will drop all packets coming from IP 65.55.44.100 to port mail server port 25.

You can also create Security Shell Script to block the ips: Create /root/iptables/blocked.ips file as follows with list of ips and subnets to block entering your dedicated server.

I wrote a denyhack shell scripts to restrict the hacking users from the server. It was my development with bash script. I am using it for the past three years. Recently, While doing google search, I find an open source (source-forge) software denyhosts,written in python, which does the same function.

Here are some tips to make your Linux server safer from intruders.

I have recently viewed by log files in linux and noticed a few hundreds failed logins from different hosts on my sshd service.

I wanted to secure it using iptables, but this reduced my mobility quite a lot. By denying packets from all hosts and accepting just from a few trusted ones, I ended up not being able to access my server from everywhere i want.

So I started searching on the Internet for an alternative; and I found something called Deny Hosts, an open source project from Sourceforge. This python script is very useful, bringing many options that are an advantage in the fight against hackers.

It’s features include allowed and denied host list files that dynamically update by analyzing the attempts in service’s log files, e-mailing functions to notify you if something happens and a synchronization tool that gets all the hosts that were banned several times around the world and denies them on your server too.

Downloading the script

To download the script, go to http://denyhosts.sourceforge.net/ or if you are using Fedore Core, try “yum install denyhosts”. Read the rest of this entry »

Crontab (normally they call cron job) are scheduler for an user.

Using this, you can schedule jobs for specified interval, like minutes, hours, days,  weeks, and month.

I do not want to provide details description.

Login to linux, say “crontab -e” (without quotes)

Just cut and paste code here.

You are done. As you guess, one job runs every 15 mins, another 20 mins….

####################################################################
#
#min hour day_of_month month day_of_week  user   command
*/15 * * * * /root/crons/denyhack > /dev/null 2>&1
*/20 * * * * /root/crons/denyhack2 > /dev/null 2>&1
*/25 * * * * /root/crons/denyhack3 > /dev/null 2>&1
*/35 * * * * /root/crons/denyhack4 > /dev/null 2>&1

####################################################################

So they way cron works is it looks at its config file, the ‘crontab’ and when the conditions are met for an entry, it will run that entry. What this means is that you will have to write a script for cron to call that does everything you want it to do. If you have any experience with perl, it would probably be a good choice here. Otherwise any other programming language will do.

As far as the actual cron job goes:

* * * * * command to be executed
- – – – -
‘ ‘ ‘ ‘ ‘
‘ ‘ ‘ ‘ +—– day of week (0 – 6) (Sunday=0)
‘ ‘ ‘ +——- month (1 – 12)
‘ ‘ +——— day of month (1 – 31)
‘ +———– hour (0 – 23)
+————- min (0 – 59)

source here

Hackers

If you own a server or host a site, hackers are always trying to get in. I have seen many autorobot programs are checking for weak or generated passwords. In the past, I have seen them repeatedly trying with many programs available in the internet. These intruders may hit your server one day or others and their presence in your server, in no way, going to help. It is better to avoid them coming through. It is not possible for you to look at the secure or other logs daily/periodically. Hence, I wrote a simple cronjob scripts that watches in a regular interval and deny the access by placing their IPs in hosts.deny.

Warning:

a) Keep at least 5 or more tries. Otherwise, you may block yourself from the server!

b) This will block public ips. If they try through some proxy servers, these servers are blocked and not the original intruders ip.

c) No implicit or explicit warranty. Free free to download, use and modify.

Jay

#*********************eof**********************************

source here