Hack The Sec-Leading Resource Of Linux Tutorial: Centos

How to Install mlocate (locate and updatedb Commands) on CentOS 7

<div dir="ltr" style="text-align: left;" trbidi="on">
Install mlocate (locate and updatedb Commands) 
mlocate is a merging locate and database package. "Merging" means updatedb reuses the existing database to avoid re-reading most of the file system. This makes the database update faster and does not tax the system caches.  
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOdAujBZtED3tf86nxI9jOXfF-AMydvhNsLdHrgrvBCBxBY9mB7k2dTHoVz_SXVnzS1Z8Q1JG6zQJHLJ4VMOCsOVbpHZcTeo_GPdWeDzBxDEHZGJK81wfhMYk1_FWwQKVQ3lSVQs6ddMxT/s1600/hackthesec.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOdAujBZtED3tf86nxI9jOXfF-AMydvhNsLdHrgrvBCBxBY9mB7k2dTHoVz_SXVnzS1Z8Q1JG6zQJHLJ4VMOCsOVbpHZcTeo_GPdWeDzBxDEHZGJK81wfhMYk1_FWwQKVQ3lSVQs6ddMxT/s1600/hackthesec.jpg" /></a></div>
 
mlocate can index several file systems including network file systems for network shares. This package is essential when attempting to quickly find documents in a terminal. 
Install mlocate 
 
As a matter of best practice we'll update our packages: 
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); clear: none !important; margin-bottom: 10px !important; margin-top: 10px !important; outline: 0px; overflow: auto; padding: 10px !important; vertical-align: baseline; width: auto !important; word-break: break-all;">yum -y update</pre>
Then let's install mlocate and any required packages: 
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); clear: none !important; margin-bottom: 10px !important; margin-top: 10px !important; outline: 0px; overflow: auto; padding: 10px !important; vertical-align: baseline; width: auto !important; word-break: break-all;">yum -y install mlocate</pre>
Updating mlocate 
The following command will update the search databases: 
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); clear: none !important; margin-bottom: 10px !important; margin-top: 10px !important; outline: 0px; overflow: auto; padding: 10px !important; vertical-align: baseline; width: auto !important; word-break: break-all;">updatedb</pre>
mlocate installs a cron job that will run daily to update search databases at: 
 
 
/etc/cron.daily/mlocate.cron 
 
<a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a> 
 </div>

How to Install mlocate (locate and updatedb Commands) on CentOS 7

Install mlocate (locate and updatedb Commands) mlocate is a merging locate and database package. "Merging" means updatedb reuse...

How to install and setup Icinga Monitoring Tool on CentOS 7 / RHEL 7

<div dir="ltr" style="text-align: left;" trbidi="on">
Setup Icinga Monitoring Tool on CentOS 7 / RHEL 7 
Icinga is an open source computer system and network monitoring application. It was originally created as a fork of the Nagios system monitoring application in 2009. 
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtbWp0y0o_B3MQiZ4bjwJQ4f43t1N5Cu4j8oHUv4wcD_bkuIBuA-wAMchSWbUMTNe1SgmJUhspgJq0dsb2kp8QLI4CnMkGSp9dFA6V4R4yYEg7gWQd3NeqgPOiQ_25aaQsXopeXhALg_wf/s1600/icinga_logo.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtbWp0y0o_B3MQiZ4bjwJQ4f43t1N5Cu4j8oHUv4wcD_bkuIBuA-wAMchSWbUMTNe1SgmJUhspgJq0dsb2kp8QLI4CnMkGSp9dFA6V4R4yYEg7gWQd3NeqgPOiQ_25aaQsXopeXhALg_wf/s1600/icinga_logo.png" /></a></div>
 
Icinga is attempting to get past perceived short-comings in Nagios' development process, as well as adding new features such as a modern Web 2.0 style user interface, additional database connectors (for MySQL, Oracle, and PostgreSQL), and a REST API that lets administrators integrate numerous extensions without complicated modification of the Icinga core. 
Before we go ahead, lets install the required packages for Icinga. 
 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"># yum -y install wget httpd mod_ssl gd gd-devel mariadb-server php-mysql php-xmlrpc gcc mariadb libdbi libdbi-devel libdbi-drivers libdbi-dbd-mysql</pre>
Disable SELinux. 
 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config</pre>
Reboot once done. 
 
Create icinga user and icinga-cmd group (allowing the external commands to be executed through the web interface) , add  icinga and apache user to the part of icinga-cmd group. 
 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"># useradd icinga
# groupadd icinga-cmd
# usermod -a -G icinga-cmd icinga
# usermod -a -G icinga-cmd apache</pre>
Download latest Icinga source tarball. 
 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"># cd /tmp/
# wget http://downloads.sourceforge.net/project/icinga/icinga/1.10.1/icinga-1.10.1.tar.gz
# tar -zxvf /tmp/icinga-1.10.1.tar.gz
# cd /tmp/icinga-1.10.1</pre>
Compile and Install Icinga: 
 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"># ./configure --with-command-group=icinga-cmd --enable-idoutils
# make all
# make install
# make install-init
# make install-config
# make install-commandmode
# make install-webconf
# make install-idoutils</pre>
Configure Icinga: 
 
Sample configuration files have now been installed in the /usr/local/icinga/etc/ directory. These sample files should work fine for getting started with Icinga. You’ll need to make just one change before you proceed. Edit the /usr/local/icinga/etc/objects/contacts.cfg config file with your favorite editor and change the email address associated with the nagiosadmin contact definition to the address you’d like to use for receiving alerts. 
 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"># vi /usr/local/icinga/etc/objects/contacts.cfg</pre>
Change the Email address field to receive the notification. 
 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">email icinga@localhost</pre>
to 
 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">email icinga@hackthesec.co.in</pre>
Move sample idoutils configuration files to Icinga base directory. 
 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"># cd /usr/local/icinga/etc/
# mv idomod.cfg-sample idomod.cfg
# mv ido2db.cfg-sample ido2db.cfg
# cd modules/
# mv idoutils.cfg-sample idoutils.cfg</pre>
Create database for idoutils: 
 
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;"># systemctl start mariadb.service
# mysql -u root -p
MariaDB [(none)]> CREATE DATABASE icinga;
MariaDB [(none)]> GRANT USAGE ON icinga.* TO 'icinga'@'localhost' IDENTIFIED BY 'icinga' WITH MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0;
MariaDB [(none)]> FLUSH PRIVILEGES;
MariaDB [(none)]> quit</pre>
Import Database. 
 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"># mysql -u root -p icinga < /tmp/icinga 1.10.1/module/idoutils/db/mysql/mysql.sql</pre>
Configure Web Interface: 
 
Create a icingaadmin account for logging into the Icinga web interface. Remember the password that you assign to this user – you’ll need it later. 
 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"># htpasswd -c /usr/local/icinga/etc/htpasswd.users icingaadmin</pre>
Restart Apache to make the new settings take effect. 
 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">systemctl restart httpd.service</pre>
Download and Install Nagios Plugins: 
 
Download Nagios Plugins to /tmp directory. 
 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"># cd /tmp
# wget http://nagios-plugins.org/download/nagios-plugins-2.0.3.tar.gz
# tar -zxvf /tmp/nagios-plugins-2.0.3.tar.gz
# cd /tmp/nagios-plugins-2.0.3/</pre>
Compile and install the plugins. 
 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"># ./configure --prefix=/usr/local/icinga --with-cgiurl=/icinga/cgi-bin --with-nagios-user=icinga --with-nagios-group=icinga
# make
# make install</pre>
Starting Icinga: 
 
Verify the sample Icinga configuration files. 
 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"># /usr/local/icinga/bin/icinga -v /usr/local/icinga/etc/icinga.cfg</pre>
If there are no errors, start Nagios and Idoutils. 
 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"># /etc/init.d/icinga start
# /etc/init.d/ido2db start</pre>
Start Icinga and Idoutils on system startup. 
 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"># chkconfig ido2db on
# chkconfig icinga on
# systemctl enable httpd.service
# systemctl enable mariadb.service</pre>
Access Web Interface: 
 
Now access Icinga web interface using the following URL. You'll be prompted for the username (icingaadmin) and password you specified earlier. 
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0PhYekAkOCAtvydkM0jNq7qOMIsvmjx1BVH4fv3VrMj0xK6rFZdrRYxsruVzHDPwBkLcMhEfT31yBN69Tgc7PF5RneGSkbmtrKT50LUfahzo-_gxItZknEjr3zf_2fZwnTLeNGKe-fwNA/s1600/CentOS-7-Icinga-localhost-Service-details_hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0PhYekAkOCAtvydkM0jNq7qOMIsvmjx1BVH4fv3VrMj0xK6rFZdrRYxsruVzHDPwBkLcMhEfT31yBN69Tgc7PF5RneGSkbmtrKT50LUfahzo-_gxItZknEjr3zf_2fZwnTLeNGKe-fwNA/s1600/CentOS-7-Icinga-localhost-Service-details_hackthesec.co.in.jpg" /></a></div>
 
<a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a> 
 
 </div>

How to install and setup Icinga Monitoring Tool on CentOS 7 / RHEL 7

Setup Icinga Monitoring Tool on CentOS 7 / RHEL 7 Icinga is an open source computer system and network monitoring application. It was orig...

Allow/deny,disable or drop/block ping packets on Linux serves

<div dir="ltr" style="text-align: left;" trbidi="on">
Allow/deny,disable or drop/block ping request 
Ping is a computer network administration software utility used to test the reachability of a host on an Internet Protocol (IP) network, and to measure the round-trip time for messages sent from the originating host to a destination computer and echoed back to the source.  
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgMkvanWwL3sQ5vslmP9RJn-wN23GzG7XOupgaiHDMQJzpuqMvvq8LlJAZ6Q0fGyREUOXoCHIEyBnFXFWJFq0YlnOGnfGnZmTFBoPHoDn4etpw8Fi6u-G95vqTG-_KDlTEvCd2xtpZxzRHE/s1600/security.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgMkvanWwL3sQ5vslmP9RJn-wN23GzG7XOupgaiHDMQJzpuqMvvq8LlJAZ6Q0fGyREUOXoCHIEyBnFXFWJFq0YlnOGnfGnZmTFBoPHoDn4etpw8Fi6u-G95vqTG-_KDlTEvCd2xtpZxzRHE/s1600/security.jpg" /></a></div>
 
The name comes from active sonar terminology that sends a pulse of sound and listens for the echo to detect objects under water,although it is sometimes interpreted as a backronym to packet Internet groper 
Blocking PING on server is helpful sometimes, if the server is continue to face any type of DDoS attack by using the PING feature. By using <a href="http://www.hackthesec.co.in/search/label/Iptables" target="_blank">iptables </a>we can simply stop the PING option. 
STEP : 1 
You can setup kernel variable to drop all ping packets. Type the following command at shell prompt: 
This instructs the kernel to simply ignore all ping requests. 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all</pre>
To enable ping request type the command: 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all</pre>
You can add following line to /etc/sysctl.conf file: 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"># vi /etc/sysctl.conf </pre>
Append following line: 
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">net.ipv4.icmp_echo_ignore_all = 1</pre>
Save and close the file. 
STEP : 2 
Also we can manage it by the help of '<a href="http://www.hackthesec.co.in/search/label/Iptables" target="_blank">iptables</a>'. The 'ping' is using ICMP to communicate. We can simply manage the 'icmp : Internet Controlled Message Protocol'from iptables. 
The below pasted switches are required for creating a rule for managing icmp. 
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">-A : Add a rule
-D : Delete rule from table
-p : To specify protocol (here 'icmp')
--icmp-type : For specifying type
-J : Jump to target</pre>
Normally using icmp types and its Codes Click here for ICMP Types and Codes 
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">echo-request : 8
echo-reply : 0
</pre>
<div>
How to block PING to your server with an error message?</div>
In this way you can partially block the PING with an error message 'Destination Port Unreachable'. Add the following iptables rules to block the PING with an error message. (Use REJECT as Jump to target) 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">iptables -A INPUT -p icmp --icmp-type echo-request -j REJECT</pre>
Result : -  
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">[root@redhat ~]# ping hackthesec.co.in
Pinging hackthesec.co.in [216.239.34.21] with 32 bytes of data:
From 216.239.34.2 icmp_seq=1 Destination Port Unreachable
From 216.239.34.2 icmp_seq=2 Destination Port Unreachable
From 216.239.34.2 icmp_seq=3 Destination Port Unreachable</pre>
To block without any messages use DROP as Jump to target. 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j DROP</pre>
Allow Ping from Outside to Inside 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT</pre>
How to block PING from your server? 
In this way you can block PING option from your server to outside. Add these rules to your iptables to do the same. 
 
Block PING operation with message 'Operation not permitted' 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">iptables -A OUTPUT -p icmp --icmp-type echo-request -j DROP</pre>
Result:- 
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">root@test [~]# ping google.com
PING google.com (173.194.34.136) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted</pre>
To block with out any error messages 
For this, DROP the echo-reply to the INPUT chain of your iptables. 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">iptables -A OUTPUT -p icmp --icmp-type echo-request -j DROP
iptables -A INPUT -p icmp --icmp-type echo-reply -j DROP</pre>
Allow Ping from Inside to Outside 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT</pre>
You can use the icmp code instead of icmp-type name for adding rule to iptables. 
 
<a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></div>

Allow/deny,disable or drop/block ping packets on Linux serves

Allow/deny,disable or drop/block ping request Ping is a computer network administration software utility used to test the reachability of ...

How to Delete Files Older than X Number of Days in Linux

<div dir="ltr" style="text-align: left;" trbidi="on">
<h2 class="title single-title title20" style="background-color: white; border: 0px; font-family: 'Open Sans'; font-size: 24px; line-height: 30px; margin: 0px 0px 5px; opacity: 1; outline: 0px; padding: 0px; transition: opacity 0.24s ease-in-out; vertical-align: baseline; visibility: visible;">
Delete Files Older than X Number of Days in Linux</h2>
<div>
How to keep limited amount of backup files or how to delete backup files or any file than older then x number of Days.</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1XyDsm5bthyO-_-OqpH89oK8Sw-efgEPeY_inf32JcMAXIYo2vTx-PBhzPdnMbUz0aJXJSiqDm9USNl0cM4lj24WhhGm858N8_Wl43zO7AKVMzSdgXeLDYmhRyHQraYf_12AoDqRPhk4Z/s1600/delete_x_number_files_hackthesec.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1XyDsm5bthyO-_-OqpH89oK8Sw-efgEPeY_inf32JcMAXIYo2vTx-PBhzPdnMbUz0aJXJSiqDm9USNl0cM4lj24WhhGm858N8_Wl43zO7AKVMzSdgXeLDYmhRyHQraYf_12AoDqRPhk4Z/s1600/delete_x_number_files_hackthesec.jpg" /></a></div>
<div>
 </div>
<div>
<div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
Using find utility we can easily figure out files older than x number of days and then use the rm command to delete them.</div>
<div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
Here is combination of find and rm command to find and delete older files using some interesting arguments.</div>
<div style="font-family: verdana, geneva, sans-serif;">
Find All Files Inside Directory and Delete Files which is Older Than 10 Days</div>
<div>
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">find /location/to/find/files/* -mtime +10 -exec rm {} \;</pre>
</div>
<div>
Command Explanation:</div>
<div>
 </div>
<div>
<div>
1) find /location/to/find/files/*</div>
<div>
=This command use to find files in Linux operating system. Next part of this command is /locatin/to/find/files/ which means find files inside this directory suppose I have directory on root named backup so my command will be "find /backup/*".</div>
</div>
<div>
 </div>
<div>
<div>
2) mtime +10</div>
<div style="color: #333333;">
=The next argument -mtime, is used to specify the number of days. In our example we uses -mtime +10 so it will find files older than 10 days.</div>
</div>
<div>
<div>
3) -exec rm {} \;</div>
<div>
=The last argument contains two parts, "-exec" allows you to pass an other command such as rm, and the second part "{} \; " is required to end the command.</div>
</div>
<div>
 </div>
<div>
Delete Files which is Older Than 5 Days With .tar File Extension.</div>
<div>
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">find /backup -name "*.tar" -type f -mtime +5 -exec rm -fr {} \;</pre>
</div>
<div>
Very Important: Be VERY careful to supply an absolute path while using "rm" commands!</div>
<div>
Find and Delete Files using Find Command.</div>
<div>
Same task you can perform using find command only. See below example:</div>
<div>
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">find /location/to/find/files/* -mtime +10 -type f -delete</pre>
</div>
<div>
Tip:- you can add this command in bash script and automate this process using <a href="http://www.hackthesec.co.in/2016/03/how-to-setup-linux-crontab.html" target="_blank">cron job utility</a>.</div>
<div>
 </div>
<div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
<a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></div>
</div>
</div>

How to Delete Files Older than X Number of Days in Linux

Delete Files Older than X Number of Days in Linux How to keep limited amount of backup files or how to delete backup files or any file t...

How to Configure Squid 3.x as Transparent Proxy on CentOS 7 / RHEL 7

<div dir="ltr" style="text-align: left;" trbidi="on">
<h2 class="post-heading" style="background-color: white; border: 0px; font-family: sans-serif; font-size: 24px; line-height: 30px; margin: 30px 0px 15px; opacity: 1; outline: 0px; padding: 0px; transition: opacity 0.24s ease-in-out; vertical-align: baseline; visibility: visible;">
Configure Squid 3.x as Transparent Proxy on CentOS 7 / RHEL 7</h2>
<div>
There are several benefits of using a transparent proxy. First of all, for end users, a transparent proxy can enhance their web browsing performance by caching frequently accessed web content, while introducing minimal configuration overhead for them. For administrators, it can be used to enforce various administrative policies such as content/URL/IP filtering, rate limiting, etc.</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1VrRyKPmaAN8_k1ni3Alq0RVqEPZim4tvw83TXom35GD6ZGJrboNOHhJ97rT251n4G6I7iWctMMqdO5wN9jm5mrF3yErWGe65h2lNz-DioH6G_eOWTR2IFdWRyI2pi9EiwY8B7F-8CN0J/s1600/squid-installation-hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1VrRyKPmaAN8_k1ni3Alq0RVqEPZim4tvw83TXom35GD6ZGJrboNOHhJ97rT251n4G6I7iWctMMqdO5wN9jm5mrF3yErWGe65h2lNz-DioH6G_eOWTR2IFdWRyI2pi9EiwY8B7F-8CN0J/s1600/squid-installation-hackthesec.co.in.jpg" /></a></div>
<div>
 </div>
<div>
A proxy server acts as an intermediary between a client and a destination server. The client sends requests to the proxy server which then evaluates the requests and takes necessary actions. In this tutorial, we will be setting up a web proxy server using Squid, which is a robust, customizable and stable proxy server. Personally, I had administered a Squid server with 400+ client workstations for about a year. Although I had to restart the service about once a month in average, CPU and storage utilization, throughput and client response time were all great.</div>
<div>
Squid Installation and Configuration</div>
<div>
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"># yum install squid –y</pre>
</div>
<div>
<div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
Edit squid configuration file</div>
<div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
Before you edit default configuration file it is highly recommended to keep backup.</div>
<div>
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"># cp /etc/squid/squid.conf /etc/squid/squid.conf.bk-26-05-2016</pre>
</div>
</div>
<div>
Open configuration file and add below mentioned parameters</div>
<div>
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"># vi /etc/squid/squid.conf</pre>
</div>
<div>
Add transparent proxy setting and add and allow our network</div>
<div>
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"># vi /etc/squid/squid.conf</pre>
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"># Allow LAN Network
acl our_network src 192.168.2.0/24

# Allow Network ACL Allow/Deny Section#
http_access allow our_network

# Transparent Proxy Parameters
http_port 3128 intercept

visible_hostname pxy.hackthesec.co.in</pre>
</div>
<div>
<div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
Save & Exit</div>
<div style="color: #333333; font-family: verdana, geneva, sans-serif; font-size: 15px; line-height: 26px;">
Now start squid service and make sure it is added on startup.</div>
<div>
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"># systemctl start squid
# systemctl enable squid</pre>
</div>
</div>
<div>
Add necessary iptables rules to setup squid as transparent proxy.</div>
<div>
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">ptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 192.168.2.100:3128
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables --t nat -A POSTROUTING --out-interface eth1 -j MASQUERADE</pre>
</div>
<div>
Now you can save your iptable rules by following command:</div>
<div>
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">service iptables save</pre>
</div>
<div>
That’s It, Now squid should work smoothly in transparent proxy mode.</div>
<div>
 </div>
<div>
<a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></div>
</div>

How to Configure Squid 3.x as Transparent Proxy on CentOS 7 / RHEL 7

Configure Squid 3.x as Transparent Proxy on CentOS 7 / RHEL 7 There are several benefits of using a transparent proxy. First of all, for...

How to Configure PXE(Network Boot) installation Server on CentOS/RHEL 7.x

<div dir="ltr" style="text-align: left;" trbidi="on">
<h1 class="post-title entry-title" style="background-color: white; border: 0px; font-family: 'PT Serif', serif; font-stretch: inherit; font-weight: 400; letter-spacing: -1px; line-height: 1.3em; margin: 0px 0px 10px; padding: 0px; vertical-align: baseline; word-wrap: break-word;">
PXE (Network Boot) installation Server on CentOS/RHEL 7.x</h1>
<div>
<div>
The Preboot eXecution Environment (PXE, sometimes pronounced as pixie) specification describes a standardized client-server environment that boots a software assembly, retrieved from a network, on PXE-enabled clients. On the client side it requires only a PXE-capable network interface controller (NIC), and uses a small set of industry-standard network protocols such as DHCP and TFTP.</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjmF16zm4kuOIUfZQaaIbFQnusI56E4j4EBWIYDkc97QQ5EcHr3uJnTCfkGt7rDH2upuKmTpUGNGlN97_7-195tXCgGF7Dy4f_jF4atnEO39yPfrks1m-f06TEXhDF04l1nF_xMfEebkAYI/s1600/Setting-PXE-Network-Boot-in-CentOS_hackthesec.co.in.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjmF16zm4kuOIUfZQaaIbFQnusI56E4j4EBWIYDkc97QQ5EcHr3uJnTCfkGt7rDH2upuKmTpUGNGlN97_7-195tXCgGF7Dy4f_jF4atnEO39yPfrks1m-f06TEXhDF04l1nF_xMfEebkAYI/s1600/Setting-PXE-Network-Boot-in-CentOS_hackthesec.co.in.png" /></a></div>
<div>
 </div>
<div>
The concept behind the PXE originated in the early days of protocols like BOOTP/DHCP/TFTP, and as of 2015 it forms part of the Unified Extensible Firmware Interface (UEFI) standard. Given fast and reliable local area networks (LANs), PXE is the most frequent choice for operating system booting, installation and deployment.</div>
</div>
<div>
Install required packages for PXE Setup</div>
<div>
To install and Configure pxe server on centos 7.x we need the following packages.</div>
<div>
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); color: white; font-family: Monaco, 'Courier New', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', monospace; font-stretch: inherit; line-height: 19px; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline; white-space: pre-wrap;">[root@pxeserver ~]# yum install dhcp tftp tftp-server syslinux vsftpd xinetd</pre>
</div>
<div>
Configure DHCP Server for PXE</div>
<div>
<div style="font-size: 15px;">
Install dhcp package then a sample configuration file of dhcp server is created at "/usr/share/doc/dhcp*/dhcpd.conf.example", though the configuration file of dhcp is at '/etc/dhcp/dhcpd.conf'.</div>
<div style="font-size: 15px;">
Copy the following lines into the file '/etc/dhcp/dhcpd.conf', replace the ip subnet and other details as per your environment.</div>
<div>
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); color: white; font-family: Monaco, 'Courier New', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', monospace; font-stretch: inherit; line-height: 19px; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline; white-space: pre-wrap;">[root@pxeserver~]# vi /etc/dhcp/dhcpd.conf

# DHCP Server Configuration file.

ddns-update-style interim;
ignore client-updates;
authoritative;
allow booting;
allow bootp;
allow unknown-clients;

# internal subnet for my DHCP Server
subnet 192.168.2.0 netmask 255.255.255.0 {
range 192.168.2.21 192.168.2.151;
option domain-name-servers 192.168.2.11;
option domain-name "pxeserver.hackthesec.co.in";
option routers 192.168.2.11;
option broadcast-address 192.168.2.255;
default-lease-time 600;
max-lease-time 7200;

# IP of PXE Server
next-server 192.168.2.11;
filename "pxelinux.0";
}</pre>
</div>
</div>
<div>
<div style="font-size: 15px;">
Edit and Config tftp server (/etc/xinetd.d/tftp)</div>
<div style="color: #333333; font-size: 15px;">
TFTP (Trivial File Transfer Protocol ) is used to transfer files from data server to its clients without any kind of authentication. In case of PXE server setup tftp is used for bootstrap loading. To config tftp server, edit its configuration file '/etc/xinetd.d/tftp', change the parameter ‘disable = yes' to 'disable = no' and leave the other parameters as it is.</div>
<div style="color: #333333;">
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); color: white; font-family: Monaco, 'Courier New', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', monospace; font-stretch: inherit; line-height: 19px; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline; white-space: pre-wrap;">[root@pxeserver ~]# vi /etc/xinetd.d/tftp
service tftp
{
 socket_type = dgram
 protocol = udp
 wait = yes
 user = root
 server = /usr/sbin/in.tftpd
 server_args = -s /var/lib/tftpboot
 disable = no
 per_source = 11
 cps = 100 2
 flags = IPv4
}</pre>
</div>
</div>
<div>
<div>
tftp root directory "/var/lib/tftpboot"</div>
<div>
Run the following commands to copy required network boot files in '/var/lib/tftpboot/'</div>
</div>
<div>
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); color: white; font-family: Monaco, 'Courier New', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', monospace; font-stretch: inherit; line-height: 19px; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline; white-space: pre-wrap;">[root@pxeserver ~]# cp -v /usr/share/syslinux/pxelinux.0 /var/lib/tftpboot
[root@pxeserver ~]# cp -v /usr/share/syslinux/menu.c32 /var/lib/tftpboot
[root@pxeserver ~]# cp -v /usr/share/syslinux/memdisk /var/lib/tftpboot
[root@pxeserver ~]# cp -v /usr/share/syslinux/mboot.c32 /var/lib/tftpboot
[root@pxeserver ~]# cp -v /usr/share/syslinux/chain.c32 /var/lib/tftpboot
[root@pxeserver ~]# mkdir /var/lib/tftpboot/pxelinux.cfg
[root@pxeserver ~]# mkdir /var/lib/tftpboot/networkboot</pre>
</div>
<div>
<div>
Mount CentOS 7.x ISO file and copy its contents to local ftp server</div>
<div style="color: #333333;">
Run the following commands to mount iso file and copy its contents in ftp server’s directory '/var/ftp/pub'</div>
</div>
<div>
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); color: white; font-family: Monaco, 'Courier New', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', monospace; font-stretch: inherit; line-height: 19px; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline; white-space: pre-wrap;">[root@pxeserver ~]# mount -o loop CentOS-7-x86_64-DVD-1511.iso /mnt/
mount: /dev/loop0 is write-protected, mounting read-only
[root@pxeserver ~]# cd /mnt/
[root@pxeserver mnt]# cp -av * /var/ftp/pub/</pre>
</div>
<div>
Copy Kernel file (vmlimz) and initrd file from mounted iso file to '/var/lib/tftpboot/networkboot/'</div>
<div>
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); color: white; font-family: Monaco, 'Courier New', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', monospace; font-stretch: inherit; line-height: 19px; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline; white-space: pre-wrap;">[root@pxeserver ~]# cp /mnt/images/pxeboot/vmlinuz /var/lib/tftpboot/networkboot/
[root@pxeserver ~]# cp /mnt/images/pxeboot/initrd.img /var/lib/tftpboot/networkboot/</pre>
</div>
<div>
<div>
Create kickStart & PXE menu file.</div>
<div>
Before creating kickstart file, let's first create the root password in an encrypted string because we will using that encrypted password string in kickstart file</div>
</div>
<div>
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); color: white; font-family: Monaco, 'Courier New', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', monospace; font-stretch: inherit; line-height: 19px; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline; white-space: pre-wrap;">[root@pxeserver ~]# openssl passwd -1 Pxese@123#
$1$e2wrcGGw$tZOPMCSXVhNmbiGg66seGH</pre>
</div>
<div>
<div>
System default kickstart file is placed under /root/anaconda-ks.cfg. and we will be creating a new kickstart under the folder /var/ftp/pub with the name'centos7.cfg'</div>
<div>
Copy the following content into the new kickstart file. Please modify the kickstart file as per your needs.</div>
</div>
<div>
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); color: white; font-family: Monaco, 'Courier New', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', monospace; font-stretch: inherit; line-height: 19px; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline; white-space: pre-wrap;">[root@pxeserver ~]# vi /var/ftp/pub/centos7.cfg

#platform=x86, AMD64, or Intel EM64T
#version=DEVEL
# Firewall configuration
firewall --disabled
# Install OS instead of upgrade
install
# Use FTP installation media
url --url="ftp://192.168.2.11/pub/"
# Root password
rootpw --iscrypted $1$e2wrcGGX$tZPQKPsXVhNmbiGg53MN41
# System authorization information
auth useshadow passalgo=sha512
# Use graphical install
graphical
firstboot disable
# System keyboard
keyboard us
# System language
lang en_US
# SELinux configuration
selinux disabled
# Installation logging level
logging level=info
# System timezone
timezone asia/kolkata
# System bootloader configuration
bootloader location=mbr
clearpart --all --initlabel
part swap --asprimary --fstype="swap" --size=1024
part /boot --fstype xfs --size=300
part pv.01 --size=1 --grow
volgroup root_vg01 pv.01
logvol / --fstype xfs --name=lv_01 --vgname=root_vg01 --size=1 --grow
%packages
@^minimal
@core
%end
%addon com_redhat_kdump --disable --reserve-mb='auto'
%end</pre>
</div>
<div>
Create a PXE menu file (/var/lib/tftpboot/pxelinux.cfg/default), copy the following contents into the pxe menu file.</div>
<div>
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); color: white; font-family: Monaco, 'Courier New', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', monospace; font-stretch: inherit; line-height: 19px; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline; white-space: pre-wrap;">[root@pxeserver ~]# vi /var/lib/tftpboot/pxelinux.cfg/default

default menu.c32
prompt 0
timeout 30
MENU TITLE Hack The Sec PXE Menu
LABEL centos7_x64
MENU LABEL CentOS 7_X64
KERNEL /networkboot/vmlinuz
APPEND initrd=/networkboot/initrd.img inst.repo=ftp://192.168.2.11/pub ks=ftp://192.168.2.11/pub/centos7.cfg</pre>
</div>
<div>
<div>
Start and enable xinetd, dhcp and vsftpd service.</div>
<div style="color: #333333;">
Use the fllowing commands to start and enable xinetd, dhcp and vsftpd.</div>
</div>
<div>
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); color: white; font-family: Monaco, 'Courier New', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', monospace; font-stretch: inherit; line-height: 19px; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline; white-space: pre-wrap;">[root@pxeserver ~]# systemctl start xinetd
[root@pxeserver ~]# systemctl enable xinetd
[root@pxeserver ~]# systemctl start dhcpd.service
[root@pxeserver ~]# systemctl enable dhcpd.service
Created symlink from /etc/systemd/system/multi-user.target.wants/dhcpd.service to /usr/lib/systemd/system/dhcpd.service.
[root@pxeserver ~]# systemctl start vsftpd
[root@pxeserver ~]# systemctl enable vsftpd
Created symlink from /etc/systemd/system/multi-user.target.wants/vsftpd.service to /usr/lib/systemd/system/vsftpd.service.</pre>
</div>
<div>
If your SELinux is enabled, then set the following selinux rule for ftp server.</div>
<div>
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); color: white; font-family: Monaco, 'Courier New', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', monospace; font-stretch: inherit; line-height: 19px; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline; white-space: pre-wrap;">[root@pxeserver ~]# setsebool -P allow_ftpd_full_access 1</pre>
</div>
<div>
Open the ports in the OS firewall using following firewall-cmd commands</div>
<div>
<pre style="background: rgb(54, 54, 54); border-radius: 7px; border: 1px solid rgb(221, 221, 221); color: white; font-family: Monaco, 'Courier New', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', monospace; font-stretch: inherit; line-height: 19px; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline; white-space: pre-wrap;">[root@pxeserver ~]# firewall-cmd --add-service=ftp --permanent
success
[root@pxeserver ~]# firewall-cmd --add-service=dhcp --permanent
success
[root@pxeserver ~]# firewall-cmd --add-port=69/tcp --permanent 
success
[root@pxeserver ~]# firewall-cmd --add-port=69/udp --permanent 
success
[root@pxeserver ~]# firewall-cmd --add-port=4011/udp --permanent
success
[root@pxeserver ~]# firewall-cmd --reload
success</pre>
</div>
<div>
Boot the clients with pxe boot option.</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgg8EnQTjKh4JgQ4uO0VVOgJWWb2rohVQMgKAtyHHrcf6WHAu2_LaDbDp275psy5sfvtY9Uen9FLfVnAB5fFYSr-fl7aISWzPGErof7AIeqdEKlPjWrtk5QmZVPvHy37Z9dDByByWpm8urw/s1600/pxe-boot_hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgg8EnQTjKh4JgQ4uO0VVOgJWWb2rohVQMgKAtyHHrcf6WHAu2_LaDbDp275psy5sfvtY9Uen9FLfVnAB5fFYSr-fl7aISWzPGErof7AIeqdEKlPjWrtk5QmZVPvHy37Z9dDByByWpm8urw/s1600/pxe-boot_hackthesec.co.in.jpg" /></a></div>
<div>
 </div>
<div>
<a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></div>
</div>

How to Configure PXE(Network Boot) installation Server on CentOS/RHEL 7.x

PXE (Network Boot) installation Server on CentOS/RHEL 7.x The Preboot eXecution Environment (PXE, sometimes pronounced as pixie) specif...

Configure vsftpd SSL/TLS and Jail for Any User Writing as www-data to Web Server

<div dir="ltr" style="text-align: left;" trbidi="on">
Configure vsftpd SSL/TLS and Jail for Any User Writing as www-data to Web Server 
 
<a href="http://www.hackthesec.co.in/search/label/vsftp">vsftpd</a>, (or very secure FTP daemon), is an <a href="http://www.hackthesec.co.in/search/label/ftp">FTP</a> server for Unix-like systems, including Linux. It is licensed under the GNU General Public License. It supports IPv6 and SSL. 
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj4DuFEKA7uUfUyq3NjeiqEJRsKfjRKEhgoqMczS8lnDImAetVPJDFKrFZBqXmvnIqSTcGW1Eu_1ZXgnxBItoUatI4cACW4RhWhC5mF0e7AkpqaFjbQx4-a7q59cZLWqYOc4HzZXW68ubfU/s1600/vsftpd_hackthesec.co.in.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj4DuFEKA7uUfUyq3NjeiqEJRsKfjRKEhgoqMczS8lnDImAetVPJDFKrFZBqXmvnIqSTcGW1Eu_1ZXgnxBItoUatI4cACW4RhWhC5mF0e7AkpqaFjbQx4-a7q59cZLWqYOc4HzZXW68ubfU/s1600/vsftpd_hackthesec.co.in.png" /></a></div>
 
vsftpd supports explicit (since 2.0.0) and implicit (since 2.1.0) FTPS. 
 
vsftpd is the default FTP server in the Ubuntu, CentOS, Fedora, NimbleX, Slackware and RHEL Linux distributions. 
INSTALL VSFTPD 
<div style="background-color: white; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px;">
Debian <span class="xtypo_sticky" style="background-attachment: initial; background-clip: initial; background-color: #5c5d5f; background-image: url("/templates/yoo_nano3/css/assets/shadow.png"); background-origin: initial; background-position: 50% 100%; background-repeat: repeat-x; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 3px; border: 1px solid rgb(92, 93, 95); box-shadow: rgb(204, 204, 204) 0px 0px 3px; color: white; display: block; font-family: Arial, Helvetica, sans-serif; font-size: 15px; margin: 5px 0px; padding: 5px 15px; text-shadow: rgb(102, 102, 102) 0px -1px 0px;"># apt-get install vsftpd</div>
<div style="background-color: white; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px;">
RedHat <span class="xtypo_sticky" style="background-attachment: initial; background-clip: initial; background-color: #5c5d5f; background-image: url("/templates/yoo_nano3/css/assets/shadow.png"); background-origin: initial; background-position: 50% 100%; background-repeat: repeat-x; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 3px; border: 1px solid rgb(92, 93, 95); box-shadow: rgb(204, 204, 204) 0px 0px 3px; color: white; display: block; font-family: Arial, Helvetica, sans-serif; font-size: 15px; margin: 5px 0px; padding: 5px 15px; text-shadow: rgb(102, 102, 102) 0px -1px 0px;"># yum -y install vsftpd</div>
<div style="background-color: white; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px;">
Arch Linux <span class="xtypo_sticky" style="background-attachment: initial; background-clip: initial; background-color: #5c5d5f; background-image: url("/templates/yoo_nano3/css/assets/shadow.png"); background-origin: initial; background-position: 50% 100%; background-repeat: repeat-x; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 3px; border: 1px solid rgb(92, 93, 95); box-shadow: rgb(204, 204, 204) 0px 0px 3px; color: white; display: block; font-family: Arial, Helvetica, sans-serif; font-size: 15px; margin: 5px 0px; padding: 5px 15px; text-shadow: rgb(102, 102, 102) 0px -1px 0px;"># pacman -S vsftpd</div>
<div style="background-color: white; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px;">
FreeBSD <span class="xtypo_sticky" style="background-attachment: initial; background-clip: initial; background-color: #5c5d5f; background-image: url("/templates/yoo_nano3/css/assets/shadow.png"); background-origin: initial; background-position: 50% 100%; background-repeat: repeat-x; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 3px; border: 1px solid rgb(92, 93, 95); box-shadow: rgb(204, 204, 204) 0px 0px 3px; color: white; display: block; font-family: Arial, Helvetica, sans-serif; font-size: 15px; margin: 5px 0px; padding: 5px 15px; text-shadow: rgb(102, 102, 102) 0px -1px 0px;"># pkg install vsftpd</div>
<div style="background-color: white; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px;">
FreeBSD to enable vsftpd you would enter: <span class="xtypo_sticky" style="background-attachment: initial; background-clip: initial; background-color: #5c5d5f; background-image: url("/templates/yoo_nano3/css/assets/shadow.png"); background-origin: initial; background-position: 50% 100%; background-repeat: repeat-x; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 3px; border: 1px solid rgb(92, 93, 95); box-shadow: rgb(204, 204, 204) 0px 0px 3px; color: white; display: block; font-family: Arial, Helvetica, sans-serif; font-size: 15px; margin: 5px 0px; padding: 5px 15px; text-shadow: rgb(102, 102, 102) 0px -1px 0px;"># vim /etc/rc.conf</div>
Add line below to enable and start vsftpd during startup: 
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">vsftpd_enable="YES"</pre>
Start vsftpd: 
<div style="background-color: white; color: #444444; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px;">
<span class="xtypo_sticky" style="background: url("/templates/yoo_nano3/css/assets/shadow.png") 50% 100% repeat-x rgb(92, 93, 95); border-radius: 3px; border: 1px solid rgb(92, 93, 95); box-shadow: rgb(204, 204, 204) 0px 0px 3px; color: white; display: block; font-family: Arial, Helvetica, sans-serif; font-size: 15px; margin: 5px 0px; padding: 5px 15px; text-shadow: rgb(102, 102, 102) 0px -1px 0px;">$ sudo /usr/local/etc/rc.d/vsftpd start</div>
<div style="background-color: white; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px;">
Some settings in FreeBSD vsftpd.conf are a little different. I'll create a article specifically for FreeBSD vsftpd.</div>
<div style="background-color: white; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px;">
Gentoo <span class="xtypo_sticky" style="background-attachment: initial; background-clip: initial; background-color: #5c5d5f; background-image: url("/templates/yoo_nano3/css/assets/shadow.png"); background-origin: initial; background-position: 50% 100%; background-repeat: repeat-x; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 3px; border: 1px solid rgb(92, 93, 95); box-shadow: rgb(204, 204, 204) 0px 0px 3px; color: white; display: block; font-family: Arial, Helvetica, sans-serif; font-size: 15px; margin: 5px 0px; padding: 5px 15px; text-shadow: rgb(102, 102, 102) 0px -1px 0px;"># emerge vsftpd</div>
<div style="background-color: white; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px;">
Adding and starting Gentoo vsftpd at startup:</div>
<div style="background-color: white; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px;">
OpenRC <span class="xtypo_sticky" style="background-attachment: initial; background-clip: initial; background-color: #5c5d5f; background-image: url("/templates/yoo_nano3/css/assets/shadow.png"); background-origin: initial; background-position: 50% 100%; background-repeat: repeat-x; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 3px; border: 1px solid rgb(92, 93, 95); box-shadow: rgb(204, 204, 204) 0px 0px 3px; color: white; display: block; font-family: Arial, Helvetica, sans-serif; font-size: 15px; margin: 5px 0px; padding: 5px 15px; text-shadow: rgb(102, 102, 102) 0px -1px 0px;"># rc-update add vsftpd default # /etc/init.d/vsftpd start</div>
<div style="background-color: white; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px;">
systemd <span class="xtypo_sticky" style="background-attachment: initial; background-clip: initial; background-color: #5c5d5f; background-image: url("/templates/yoo_nano3/css/assets/shadow.png"); background-origin: initial; background-position: 50% 100%; background-repeat: repeat-x; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 3px; border: 1px solid rgb(92, 93, 95); box-shadow: rgb(204, 204, 204) 0px 0px 3px; color: white; display: block; font-family: Arial, Helvetica, sans-serif; font-size: 15px; margin: 5px 0px; padding: 5px 15px; text-shadow: rgb(102, 102, 102) 0px -1px 0px;"># systemctl enable vsftpd # systemctl start vsftpd</div>
<div style="background-color: white; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px;">
Add user to login to the vsftpd server <span class="xtypo_sticky" style="background-attachment: initial; background-clip: initial; background-color: #5c5d5f; background-image: url("/templates/yoo_nano3/css/assets/shadow.png"); background-origin: initial; background-position: 50% 100%; background-repeat: repeat-x; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 3px; border: 1px solid rgb(92, 93, 95); box-shadow: rgb(204, 204, 204) 0px 0px 3px; color: white; display: block; font-family: Arial, Helvetica, sans-serif; font-size: 15px; margin: 5px 0px; padding: 5px 15px; text-shadow: rgb(102, 102, 102) 0px -1px 0px;"># adduser ftpuser</div>
<div style="background-color: white; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px;">
Change password: <span class="xtypo_sticky" style="background-attachment: initial; background-clip: initial; background-color: #5c5d5f; background-image: url("/templates/yoo_nano3/css/assets/shadow.png"); background-origin: initial; background-position: 50% 100%; background-repeat: repeat-x; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 3px; border: 1px solid rgb(92, 93, 95); box-shadow: rgb(204, 204, 204) 0px 0px 3px; color: white; display: block; font-family: Arial, Helvetica, sans-serif; font-size: 15px; margin: 5px 0px; padding: 5px 15px; text-shadow: rgb(102, 102, 102) 0px -1px 0px;"># passwd ftpuser</div>
<div style="background-color: white; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px;">
Create a folder for the user we just created in the root or your web server: <span class="xtypo_sticky" style="background-attachment: initial; background-clip: initial; background-color: #5c5d5f; background-image: url("/templates/yoo_nano3/css/assets/shadow.png"); background-origin: initial; background-position: 50% 100%; background-repeat: repeat-x; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 3px; border: 1px solid rgb(92, 93, 95); box-shadow: rgb(204, 204, 204) 0px 0px 3px; color: white; display: block; font-family: Arial, Helvetica, sans-serif; font-size: 15px; margin: 5px 0px; padding: 5px 15px; text-shadow: rgb(102, 102, 102) 0px -1px 0px;"># mkdir /var/www/html/ftpuser</div>
<div style="background-color: white; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px;">
Add rights to the directory for the user: <span class="xtypo_sticky" style="background-attachment: initial; background-clip: initial; background-color: #5c5d5f; background-image: url("/templates/yoo_nano3/css/assets/shadow.png"); background-origin: initial; background-position: 50% 100%; background-repeat: repeat-x; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 3px; border: 1px solid rgb(92, 93, 95); box-shadow: rgb(204, 204, 204) 0px 0px 3px; color: white; display: block; font-family: Arial, Helvetica, sans-serif; font-size: 15px; margin: 5px 0px; padding: 5px 15px; text-shadow: rgb(102, 102, 102) 0px -1px 0px;"># chmod -R ftpuser:ftpuser /var/www/html/ftpuser</div>
<div style="background-color: white; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px;">
Add the following in: <span class="xtypo_sticky" style="background: url("/templates/yoo_nano3/css/assets/shadow.png") 50% 100% repeat-x rgb(92, 93, 95); border-radius: 3px; border: 1px solid rgb(92, 93, 95); box-shadow: rgb(204, 204, 204) 0px 0px 3px; color: white; display: block; font-family: Arial, Helvetica, sans-serif; font-size: 15px; margin: 5px 0px; padding: 5px 15px; text-shadow: rgb(102, 102, 102) 0px -1px 0px;"># vim /etc/vsftpd.conf</div>
Add the following lines: 
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">listen=YES
anonymous_enable=NO
local_enable=YES
virtual_use_local_privs=YES
write_enable=YES
connect_from_port_20=YES
secure_chroot_dir=/var/run/vsftpd
pam_service_name=vsftpd
guest_enable=YES
ftp_username=www-data
chmod_enable=YES
chown_uploads=YES
chown_username=www-data
guest_username=www-data
force_dot_files=YES
pasv_enable=YES
pasv_promiscuous=YES
pasv_min_port=1024
pasv_max_port=65535
syslog_enable=YES
max_clients=10
max_per_ip=10
port_promiscuous=YES
port_enable=YES
listen_port=21
ftp_data_port=20
user_sub_token=$USER
hide_ids=YES
user_config_dir=/etc/vsftpd
chroot_local_user=YES
allow_writeable_chroot=YES
seccomp_sandbox=NO</pre>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">SSL lines
ssl_enable=YES
rsa_cert_file=/etc/ssl/linuxsecrets-bundle.crt
rsa_private_key_file=/etc/ssl/linuxsecrets_com.key
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
require_ssl_reuse=NO
ssl_ciphers=HIGH</pre>
Save the file if using vi or vim hit : then x. 
Change Default vsftpd Port 
 
If you like you can change the vsftpd default ports to non-standard to listen on 1234 
<div class="xtypo_sticky" style="background: url("/templates/yoo_nano3/css/assets/shadow.png") 50% 100% repeat-x rgb(92, 93, 95); border-radius: 3px; border: 1px solid rgb(92, 93, 95); box-shadow: rgb(204, 204, 204) 0px 0px 3px; color: white; font-family: Arial, Helvetica, sans-serif; font-size: 15px; line-height: 20px; margin-bottom: 5px; margin-top: 5px; padding: 5px 15px; text-shadow: rgb(102, 102, 102) 0px -1px 0px;">
# vim /etc/vsftpd.conf</div>
<div style="background-color: white; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px;">
Set this to NO:</div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">connect_from_port_20=NO
ftp_data_port=1233
listen_port=1234</pre>
Custom vsftpd Logs 
<div class="xtypo_sticky" style="background: url("/templates/yoo_nano3/css/assets/shadow.png") 50% 100% repeat-x rgb(92, 93, 95); border-radius: 3px; border: 1px solid rgb(92, 93, 95); box-shadow: rgb(204, 204, 204) 0px 0px 3px; color: white; font-family: Arial, Helvetica, sans-serif; font-size: 15px; line-height: 20px; margin-bottom: 5px; margin-top: 5px; padding: 5px 15px; text-shadow: rgb(102, 102, 102) 0px -1px 0px;">
# vim /etc/vsftpd.conf</div>
<div style="background-color: white; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px;">
Default log – enable and change for custom location/name</div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">xferlog_file=/var/log/vsftpd.log</pre>
Make sure you disable syslog_enable=NO 
 
This will show all files moving through the webserver, but if you want to view all the activity, including connections and commands you need to add: 
<div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">log_ftp_protocol=YES</pre>
</div>
After making changes to the ports you need to restart the service 
<div style="background-color: white; color: #444444; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px;">
<span class="xtypo_sticky" style="background: url("/templates/yoo_nano3/css/assets/shadow.png") 50% 100% repeat-x rgb(92, 93, 95); border-radius: 3px; border: 1px solid rgb(92, 93, 95); box-shadow: rgb(204, 204, 204) 0px 0px 3px; color: white; display: block; font-family: Arial, Helvetica, sans-serif; font-size: 15px; margin: 5px 0px; padding: 5px 15px; text-shadow: rgb(102, 102, 102) 0px -1px 0px;"># service vsftpd restart</div>
<div style="background-color: white; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px;">
Verify port:</div>
<div style="background-color: white; color: #444444; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px;">
<span class="xtypo_sticky" style="background: url("/templates/yoo_nano3/css/assets/shadow.png") 50% 100% repeat-x rgb(92, 93, 95); border-radius: 3px; border: 1px solid rgb(92, 93, 95); box-shadow: rgb(204, 204, 204) 0px 0px 3px; color: white; display: block; font-family: Arial, Helvetica, sans-serif; font-size: 15px; margin: 5px 0px; padding: 5px 15px; text-shadow: rgb(102, 102, 102) 0px -1px 0px;"># netstat -nuptl | grep ftp</div>
<div style="background-color: white; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px;">
Output:</div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">tcp 0 0 0.0.0.0:1234 0.0.0.0:* LISTEN 4136/vsftpd</pre>
<div style="background-color: white; margin-bottom: 20px;">
Options Defined Bellow:-</div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">listen - vsftpd itself will take care of listening and handling incoming connections. Default setting is NO.
anonymous_enable - Allow anonymous FTP? (Beware - allowed by default if you comment this out). Set this to NO
local_enable - Controls whether local logins are permitted or not. If enabled, normal user accounts in /etc/passwd (or wherever your PAM config references) may be used to log in.
virtual_use_local_privs - If enabled, virtual users will use the same privileges as local users. By default, virtual users will use the same privileges as anonymous users, which tends to be more restrictive (especially in terms of write access).
write_enable - This controls whether any FTP commands which change the filesystem are allowed or not. These commands are: STOR, DELE, RNFR, RNTO, MKD, RMD, APPE and SITE.
connect_from_port_20 - This controls whether PORT style data connections use port 20 (ftp-data) on the server machine. 
secure_chroot_dir - This option should be the name of a directory which is empty. Also, the directory should not be writable by the ftp user. This directory is used as a secure chroot() jail at times vsftpd does not require filesystem access.
pam_service_name - PAM (pluggable authentication modules). A virtual user is a user login which does not exist as a real login on the system in /etc/passwd and /etc/shadow file.
guest_enable - If enabled, all non-anonymous logins are classed as "guest" logins. A guest login is remapped to the user specified in the guest_username setting.
ftp_username - This is the name of the user we use for handling anonymous FTP. The home directory of this user is the root of the anonymous FTP area. Default is ftp.
chmod_enable - When enabled, allows use of the SITE CHMOD command. NOTE! This only applies to local users. Anonymous users never get to use SITE CHMOD.
chown_uploads - If enabled, all anonymously uploaded files will have the ownership changed to the user specified in the setting chown_username. This is useful from an administrative, and perhaps security, standpoint.
chown_username - This is the name of the user who is given ownership of anonymously uploaded files. This option is only relevant if another option, chown_uploads, is set.
guest_username - See the boolean setting guest_enable for a description of what constitutes a guest login. This setting is the real username which guest users are mapped to.
force_dot_files - If activated, files and directories starting with . will be shown in directory listings even if the "a" flag was not used by the client. This override excludes the "." and ".." entries.
pasv_enable - Set to NO if you want to disallow the PASV method of obtaining a data connection.
pasv_promiscuous - Set to YES if you want to disable the PASV security check that ensures the data connection originates from the same IP address as the control connection. Only enable if you know what you are doing! The only legitimate use for this is in some form of secure tunnelling scheme, or perhaps to facilitate FXP support.
pasv_min_port - The minimum port to allocate for PASV style data connections. Can be used to specify a narrow port range to assist firewalling.
pasv_max_port - The maximum port to allocate for PASV style data connections. Can be used to specify a narrow port range to assist firewalling.
syslog_enable - If enabled, then any log output which would have gone to /var/log/vsftpd.log goes to the system log instead. Logging is done under the FTPD facility.
max_clients - If vsftpd is in standalone mode, this is the maximum number of clients which may be connected. Any additional clients connecting will get an error message.
max_per_ip - If vsftpd is in standalone mode, this is the maximum number of clients which may be connected from the same source internet address. A client will get an error message if they go over this limit.
port_promiscuous - Set to YES if you want to disable the PORT security check that ensures that outgoing data connections can only connect to the client. Only enable if you know what you are doing!
port_enable - Set to NO if you want to disallow the PORT method of obtaining a data connection.
listen_port - If vsftpd is in standalone mode, this is the port it will listen on for incoming FTP connections.
ftp_data_port - The port from which PORT style connections originate (as long as the poorly named connect_from_port_20 is enabled).
user_sub_token - This option is useful is conjunction with virtual users. It is used to automatically generate a home directory for each virtual user, based on a template. For example, if the home directory of the real user specified via guest_username is /home/virtual/$USER, and user_sub_token is set to $USER, then when virtual user fred logs in, he will end up (usually chroot()'ed) in the directory /home/virtual/fred. This option also takes affect if local_root contains user_sub_token.
hide_ids - If enabled, all user and group information in directory listings will be displayed as "ftp".
user_config_dir - This powerful option allows the override of any config option specified in the manual page, on a per-user basis. Usage is simple, and is best illustrated with an example. If you set user_config_dir to be /etc/vsftpd_user_conf and then log on as the user "chris", then vsftpd will apply the settings in the file /etc/vsftpd_user_conf/chris for the duration of the session. The format of this file is as detailed in this manual page! PLEASE NOTE that not all settings are effective on a per-user basis. For example, many settings only prior to the user's session being started. Examples of settings which will not affect any behviour on a per-user basis include listen_address, banner_file, max_per_ip, max_clients, xferlog_file, etc.
chroot_local_user - If set to YES, local users will be (by default) placed in a chroot() jail in their home directory after login. Warning: This option has security implications, especially if the users have upload permission, or shell access. Only enable if you know what you are doing. Note that these security implications are not vsftpd specific. They apply to all FTP daemons which offer to put local users in chroot() jails.
allow_writeable_chroot - Writeable enabled to specificed location by setting to = YES
seccomp_sandbox - is a computer security facility that provides an application sandboxing mechanism in the Linux kernel. Setting to NO resolves some errors. </pre>
<div style="background-color: white; margin-bottom: 20px;">
SSL Lines Defined Bellow:-</div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">sl_enable - Enables SSL support
rsa_cert_file - Specify localtion of you webserver crt like: /etc/ssl/bundle.crt
rsa_private_key_file - Specify location to /etc/ssl/linuxsecrets.key from webserver.
allow_anon_ssl - Disallow anaymous logins set to NO
force_local_data_ssl - Only applies if ssl_enable is activated. If activated, all non-anonymous logins are forced to use a secure SSL connection in order to send and receive data on data connections.
force_local_logins_ssl - Only applies if ssl_enable is activated. If activated, all non-anonymous logins are forced to use a secure SSL connection in order to send the password.
ssl_tlsv1 - Only applies if ssl_enable is activated. If enabled, this option will permit TLS v1 protocol connections. TLS v1 connections are preferred.
ssl_sslv2 - Only applies if ssl_enable is activated. If enabled, this option will permit SSL v2 protocol connections. TLS v1 connections are preferred.
ssl_sslv3 - Only applies if ssl_enable is activated. If enabled, this option will permit SSL v3 protocol connections. TLS v1 connections are preferred.
require_ssl_reuse - If set to yes, all SSL data connections are required to exhibit SSL session reuse (which proves that they know the same master secret as the control channel). Although this is a secure default, it may break many FTP clients, so you may want to disable it.
ssl_ciphers - This option can be used to select which SSL ciphers vsftpd will allow for encrypted SSL connections. See the ciphers man page for further details. Note: that restricting ciphers can be a useful security precaution as it prevents malicious remote parties forcing a cipher which they have found problems with. </pre>
<div style="background-color: white; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px;">
Start the vsftpd service<span class="xtypo_sticky" style="background-attachment: initial; background-clip: initial; background-color: #5c5d5f; background-image: url("/templates/yoo_nano3/css/assets/shadow.png"); background-origin: initial; background-position: 50% 100%; background-repeat: repeat-x; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 3px; border: 1px solid rgb(92, 93, 95); box-shadow: rgb(204, 204, 204) 0px 0px 3px; color: white; display: block; font-family: Arial, Helvetica, sans-serif; font-size: 15px; margin: 5px 0px; padding: 5px 15px; text-shadow: rgb(102, 102, 102) 0px -1px 0px;"># service vsftpd start</div>
<div style="background-color: white; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px;">
Verify you have the correct port or custom port assigned and working. <span class="xtypo_sticky" style="background-attachment: initial; background-clip: initial; background-color: #5c5d5f; background-image: url("/templates/yoo_nano3/css/assets/shadow.png"); background-origin: initial; background-position: 50% 100%; background-repeat: repeat-x; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 3px; border: 1px solid rgb(92, 93, 95); box-shadow: rgb(204, 204, 204) 0px 0px 3px; color: white; display: block; font-family: Arial, Helvetica, sans-serif; font-size: 15px; margin: 5px 0px; padding: 5px 15px; text-shadow: rgb(102, 102, 102) 0px -1px 0px;"># netstat -nuptl | grep ftp</div>
<div style="background-color: white; color: #444444; font-family: 'Open Sans'; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px;">
Output:</div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 4136/vsftpd</pre>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;"><a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></pre>
</div>