Prohibit direct linking to your site

Sick of people direct linking images from your site ?

Put in .htaccess

This one would display the image owner.jpg :

RewriteEngine On
RewriteCond %{HTTP_REFERER} ^.*myspace.com.*$ [NC]
RewriteRule .*\.(gif|jpg|jpeg|swf|png)$ http://www.site.be/images/owner.jpg [NC]

This one would block direct linking, at all :

RewriteEngine On
RewriteCond %{HTTP_REFERER} ^.*myspace.com.*$ [NC]
ReWriteRule .*\.(gif|png|jpg|jpeg|swf)$ - [F]

APACHE dan MOD_EVASIVE ( HTTP/DDOS PROTECTION )

mod_evasive biasa digunakan untuk bertindak terhadap HTTP DoS or DDoS attack or brute force attack

download latest version mod_evasive dari http://www.zdziarski.com/projects/mod_evasive/

#tar -zxvf mod_evasive-xxx
#cd mod_evasive-xxx

A) sekiranya anda guna apache 1.3x lakukan

#apxs -iac mod_evasive.c
#pico /etc/apache/httpd.conf

masukkan


DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 10
DOSEmailNotify kawe@kawe.com
DOSSystemCommand "sudo /sbin/iptables -A INPUT -s %s -j DROP"
DOSLogDir "/var/lock/mod_evasive"


save dan exit

#visudo
masukkan ( tukar apache dengan user apache anda )

apache ALL= NOPASSWD: /sbin/iptables -A INPUT -s [0-9.]* -j DROP

:wq

restart Apache 1.3x

B) Jika versi apache 2.x

#apxs -i -a -c mod_evasive.c
#pico /etc/apache/httpd.conf

masukkan


DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 10
DOSEmailNotify kawe@kawe.com
DOSSystemCommand "sudo /sbin/iptables -A INPUT -s %s -j DROP"
DOSLogDir "/var/lock/mod_evasive"


save dan exit

#visudo
masukkan ( tukar apache dengan user apache anda )

apache ALL= NOPASSWD: /sbin/iptables -A INPUT -s [0-9.]* -j DROP

:wq

restart Apache 2.x


ok dah siap.. utk testing...

run :-

#perl test.pl

test.pl ada dalam folder mod_evasive tadi. output yang anda akan dapat..

HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden

IPTABLES : LAN connect ke squid port 3128 shj

tips berguna:-

rule iptables ini utk drop semua connection dari lan ke outside dan benarkan proxy access sahaja

server: 192.168.1.1
LAN : 192.168.1.0/24
----------------------------- MULA RULES --------------------------------------------
iptables -N SUKAT
iptables -A FORWARD -s 192.168.1.0/24 -j SUKAT

#reject semua connection dulu
iptables -I SUKAT -p tcp -j REJECT

#kasik server lepas semua port
iptables -I SUKAT -s 192.168.1.1 -j ACCEPT

#kasik LAN lepas port 3128
iptables -I SUKAT -p tcp -d 192.168.1.1 --dport 3128 -j ACCEPT

---------------------------- TAMAT ------------------------------------------------------

dengan cara ini LAN tidak dapat lepasi proxy sekalipun menggunakan proxy luar lain.. mudah kan!

block port dengan squid?

Cara block port

edit /etc/squid/squid.conf

tambah ACL

acl block_port port 1234
http_access deny block_port
http_access allow all

yang ni untuk skip ip tertentu

acl block_port port 1234
acl jgn_block_port src 192.168.1.5
http_access deny block_port !jgn_block_port
http_access allow all

Restart squid

# /etc/init.d/squid restart

user dan group dalam linux

emmm simple tapi sering lupa...

nak tambah user dengan group sendiri

adduser mamat

nak tambah user ke group admin

useradd -G admin mamat

nak buat group editor dan tambah mamat ke group editor

groupadd editor
usermod -g editor mamat ( akan tukar mamat dari mana-mana group ke group editor )
usermod -a -G editor mamat ( akan tambah mamat dalam group editor disamping kekalkan group yang ada sedia ada)
useradd -G editor mamat ( kalau mamat masih belum ada )

untuk lihat status user/group

id mamat

Clock Sync dengan NTPD

apt-get install ntp ntpdate

edit /etc/ntp.conf

uncomment bahagian server dan masukkan server malaysia ni
#server 0.debian.pool.ntp.org iburst dynamic
#server 1.debian.pool.ntp.org iburst dynamic
#server 2.debian.pool.ntp.org iburst dynamic
#server 3.debian.pool.ntp.org iburst dynamic

server 0.my.pool.ntp.org
server 0.asia.pool.ntp.org
server 2.asia.pool.ntp.org

/etc/init.d/ntp restart

MYSQL 4/5 ERROR : Host 'SERVER' is blocked because of many connection errors; unblock with 'mysqladmin flush-hosts'

masukkan dalam my.cnf atau my.ini ( windows ) bawah [mysqld]

max-connect_errors = 9999999999999
max_error_count = 9999999999999
max_user_connections = 9999999999999
skip-host-cache

restart mysqld

perlu flush juga host tapi boleh buat cronjob / schedule task ( windows )
buat skrip utk run:-

mysqladmin -u root -p flush-hosts

Motd dalam ETCH

aduss.. ingat susah.. rupanya senang aja.. asyik tukar /etc/motd tapi bila boot... atau ssh semula... kuar mesej sama.. emm camni nak buat..

rm -f /etc/motd
pico /etc/motd.kawe

taip ape2 yang nak display masa login... save dan exit

ln -s /etc/motd.kawe /etc/motd

dah....

cuba reboot atau ssh semula.. tq..

Squid - Malware protection { Msyamsuri }

masukkan dalam squid.conf

acl malware_block_list url_regex -i "/etc/squid/malware_block_list.txt"
http_access deny malware_block_list
deny_info http://malware.hiperlinks.com.br/denied.shtml malware_block_list

buat skrip dalam /etc/squid/malware.script dan masukkan

#!/bin/sh
wget -O - \
http://malware.hiperlinks.com.br/cgi/submitaction=list_squid > \
/etc/squid/malware_block_list.txt
squid -k reconfigure


save dan chmod 755

buat cron 2 jam sekali utk run /etc/squid/malware.script

My Debian APT

deb http://security.debian.org/ etch/updates main contrib
deb-src http://security.debian.org/ etch/updates main contrib
deb http://ftp.us.debian.org/debian/ etch main contrib non-free
deb-src http://ftp.us.debian.org/debian etch main non-free
#lenny utk HAproxy
deb http://ftp2.de.debian.org/debian/ lenny main

#qmail,vpopmail,qmailadmin dalam deb
#perlu buat wget http://debian.iuculano.it/AE3BE9AA.gpg -O- apt-key add -
#http://wiki.debian.iuculano.it utk info

deb http://debian.iuculano.it/apt etch main contrib non-free
deb-src http://debian.iuculano.it/apt etch main contrib non-free

Nagios Monitoring [ kawe panggil NAGO ]

#Yum -y install nagios nagios-plugins
atau buat laaa macammanapun... janji dapat install..
http://www.nagios.org

beres?


Configuration
-------------

edit /etc/httpd/httpd.conf

masukkan teks ni di bawah VirtualHost kita

############ HIDUP NAGO!! ###################

ScriptAlias /nagios/cgi-bin/ "/usr/lib/nagios/cgi/"


Options ExecCGI
AllowOverride None
Order allow,deny
#Allow from 127.0.0.1 192.168.0.128/255.255.255.128
Allow from all
AuthName "Mynux Nagios Access"
AuthType Basic
AuthUserFile /etc/nagios/htpasswd.users
Require valid-user



Alias /nagios/ "/usr/share/nagios/"


Options None
AllowOverride None
Order allow,deny
#Allow from 127.0.0.1 192.168.0.128/255.255.255.128
Allow from all
AuthName "Mynux Nagios Access"
AuthType Basic
AuthUserFile /etc/nagios/htpasswd.users
Require valid-user



############ TAMAT HIDUP NAGO!! ###################

save dan exit

#htpasswd -c /etc/nagios/htpasswd.users nago nagoapi123

ok.. masuk dah user nago ( sebagai admin ) dan password nagoapi123

lepas tu edit /etc/nagios/cgi.cfg dan pastikan semua authorized_for_xxxxx=nago
contoh:

authorized_for_system_information=nago
authorized_for_configuration_information=nago
.....
....
....


dan seterusnya... save dan exit

selebihnya biar dulu.. semua configuration dalam /etc/nagios

ok sekarang ni...

#/etc/init.d/httpd restart
#/etc/init.d/nagios restart

ok browse ke http://localhost/nagios

username nago
password nagoapi123


MASALAH!!

tak dapat view 3-D Status MAP.. asyik keluar suh pi download statuswrl aje... maksudnya.. hang punye browser tak support lagi vrml.. install leer

download di


http://www.parallelgraphics.com/products/cortona/download ( ie x jd laa.. emm... firefox ok )
http://cic.nist.gov/vrml/vbdetect.html
http://cic.nist.gov/vrml/cosmo/CosmoPlayer.zip <-- ni ok utk msie dan firefox
http://www.octaga.com/freedownloads/OctagaPlayer/current/setup.exe <-- ni ok utk msie dan firefox