How To Install and Configure Fail2Ban on Ubuntu 16.04LTS

Please Note Before !!:  (you need to be root!!)
When the Apache server is running and is enabled, you can go ahead and install fail2ban
sudo apt-get update ; sudo apt-get install fail2ban
Please note! By default, fail2ban is configured to only ban failed SSH login attempts.
We need to enable some rules that will configure it to check our Apache
logs for patterns that indicate malicious activity.

To enable and protect your Apache:   
#cd /etc/fail2ban/jail.d/ ;  nano defaults-debian.conf
[php-url-fopen]
enabled = true
[apache-modsecurity]
enabled = true
[apache-fakegooglebot]
enabled = true
[apache-botsearch]
enabled = true
[apache-nohome]
enabled = true
[apache-overflows]
enabled = true
[apache-noscript]
enabled = true
[apache-auth]
enabled = true

Please note :
To make modifications, we need to copy this file to /etc/fail2ban/jail.local.
please do, so you are not overwriteing the conf file.:
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Open the newly copied file so that we can set up what ever log monitoring you want:
cd /etc/fail2ban/ ; sudo nano jail.local
Changes (so you don't ban your self when testing)....  
ignoreip = 127.0.0.1/8   YOU_IP     Your_ISP_Net NAT_IP
When you are done :
sudo service fail2ban restart
sudo fail2ban-client status
sudo iptables -S

update-rc.d fail2ban defaults

You may also Install mod_security
Modsecurity is available in the Debian/Ubuntu repository:
apt-get install libapache2-modsecurity
Verify if the mod_security module was loaded.
apachectl -M | grep --color security

How To Install and Configure Varnish with Apache on Ubuntu 16.04LTS

About Varnish

Varnish is an HTTP accelerator and a useful tool for speeding up a server, especially during a times when there is high traffic to a site. It works by redirecting visitors to another port or IP on a Webserver. In This case it's Apache running on port 8080 (default is port 80) on the same server!!.
Info : https://varnish-cache.org/faq/index.html

The Setup : (on Ubuntu 16.04 LTS )
sudo apt install varnish  or  sudo apt-get install varnish
 nano /etc/apache2/ports.conf
Change : Listen 127.0.0.1:80 < to > Listen 127.0.0.1:8080
# Save with X -> Next step....
sudo nano /etc/varnish/default.vcl
# Default backend definition. Set this to point to your content server.
backend default {
## #The V4 IP on the Web-server
    .host = "10.0.0.4";
###The port where the Webserver listen.
    .port = "8080";
}
# Save with X -> Next step....
nano /etc/systemd/system/multi-user.target.wants/varnish.service
## Find the 6081 and change it to 80  (near "user=vcache -F -a")
###Like this :
[Unit]
Description=Varnish HTTP accelerator
Documentation=https://www.varnish-cache.org/docs/4.1/ man:varnishd
[Service]
Type=simple
LimitNOFILE=131072
LimitMEMLOCK=82000
ExecStart=/usr/sbin/varnishd -j unix,user=vcache -F -a :80 -T localhost:6082 -f$
ExecReload=/usr/share/varnish/reload-vcl
ProtectSystem=full
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
[Install]
WantedBy=multi-user.target
# Save with X -> Next step....  # Restart httpd service and Varnish...
sudo service varnish restart
systemctl daemon-reload
####TEST########  Note : port 80 and the webserver : 8080
root@WindarPh-China01:/# netstat -tupln
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:29130         0.0.0.0:*               LISTEN      1820/mdsd
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1098/varnishd
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1092/sshd
tcp        0      0 127.0.0.1:6082          0.0.0.0:*               LISTEN      1098/varnishd
tcp6       0      0 :::80                   :::*                    LISTEN      1098/varnishd
tcp6       0      0 :::8080                 :::*                    LISTEN      1497/apache2
udp        0      0 0.0.0.0:68              0.0.0.0:*                           966/dhclient

####TEST########

 curl 127.0.0.1

####TEST########

varnishtop

### Open a browser and try the webserver's IP ;-)

-Errors....  Is the UFW on? Is the ports open? (The firewall)

-Errors....  What do the log in  /var/log/varnish say ??

Thanks for fish

I stopped at DTU (on a leave).

This blog will not be updated until I'm back @DTU. (if ever!)

-Sorry...

iRODS with Ansible

The story behind : My group ask me if I can do a Ansible install for iRODS.

But what is Ansible ? 
Ansible is an open source, powerful automation software for configuring, managing and deploying software applications on the nodes without any downtime just by using SSH. Today, most of the IT Automation tools runs as a agent in remote host, but ansible just need a SSH connection and Python (2.4 or later) to be installed on the remote nodes to perform it’s action.

Prerequisites
Operating System: RHEL/CentOS/Fedora and Ubuntu/Debian/Linux Mint
Jinja2: A modern, fast and easy to use stand-alone template engine for Python.
PyYAML: A YAML parser and emitter for the Python programming language.
parmiko: A native Python SSHv2 channel library.
httplib2: A comprehensive HTTP client library.
sshpass: A non-interactive ssh password authentication.

Source : http://www.tecmint.com/install-and-configure-ansible-automation-tool-in-linux/

My quick install (centOS) :

sudo rpm -iUvh http://dl.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-8.noarch.rpm

yum -y install ansible

####Make the trust###

ssh-keygen -t rsa -b 4096 -C "root@192.168.xxx.147"

ssh-copy-id root@192.168.xxx.148

ssh-copy-id root@192.168.xxx.149

### please note IP is the MAIN note IP###

To do the automate installation we use Ansible from www.ansible.com , Ansible-Tower and some ideas from EUDATs Github.  On a Redhat/Centos 7.x.  

Please note : You can easy re-use the shellscript with Ansible because it only need a ssh-login.

My RPMbuilder and installer: 

https://raw.githubusercontent.com/sunadtudk/irods_2_figshare/master/Irods-install.sh
Update : Our Ansible script is online at : https://github.com/sunadtudk/ansible_irods
Shell script and help : https://github.com/EUDAT-B2STAGE/docker-images

We just change the playbook from : https://github.com/aabdulwahed/iRODS/

So... do a clone and "hack" your own version ;-)

More IRODS :
http://bigdatadk.blogspot.dk/2016/08/update-irods-from-41x-to-42-with-yum.html
http://bigdatadk.blogspot.dk/2016/08/building-irods-419-from-source-on.html

Tnx for Leaked Mirai Source Code Jerry Gamblin!

"Source code of Mirai botnet responsible for Krebs On Security DDoS released online
Now anyone can use the IoT-based botnet for their own destructive purposes."
Source :
http://www.zdnet.com/article/source-code-of-mirai-botnet-responsible-for-krebs-on-security-ddos-released-online/

Some days ago I got a tweet from a friend about the source code to a IoT BotNet.
The source can be found on :   https://github.com/jgamblin/Mirai-Source-Code
Backup : http://pastebin.com/raw/8bgjhYQa

The files real file name (google for links!) :
loader.src.zip 
dlr.src.zip  
mirai.src.zip

     Pix. Source : http://blog.malwaremustdie.org/2016/08/mmd-0056-2016-linuxmirai-just.html

Read the full text :
https://raw.githubusercontent.com/jgamblin/Mirai-Source-Code/master/ForumPost.txt

Configuring CNC
Code: apt-get install mysql-server mysql-client
CNC requires database to work. When you install database, go into it and run following commands:
http://pastebin.com/86d0iL9g

This will create database for you. To add your user,
Code: INSERT INTO users VALUES (NULL, 'anna-senpai', 'myawesomepassword', 0, 0, 0, 0, -1, 1, 30, '');
Now, go into file ./mirai/cnc/main.go
Edit these values
Code:
const DatabaseAddr string   = "127.0.0.1"
const DatabaseUser string   = "root"
const DatabasePass string   = "password"
const DatabaseTable string  = "mirai"

To the information for the mysql server you just installed

Setting Up Cross Compilers
Cross compilers are easy, follow the instructions at this link to set up. You must restart your system or reload .bashrc file for these changes to take effect. http://pastebin.com/1rRCc3aD

Source : http://hackforums.net/showthread.php?tid=5420472

Thx for a nice RedHat Forum

Thx for a really great RedHat Forum In Copenhagen @Docken.

https://www.redhat.com/en/about/events/red-hat-forum-denmark-2016

Lets do it agian nex year ;-) 

                                   
                                              Plz. note  Microsoft.... at Redhat Forum!