Add comments to IPTables firewall rules
Instead of just documenting the IPTables configuration file eg: /etc/sysconfig/iptables with comments (#’s) you can also input comments as part of the ruleset itself. So when you perform iptables -L -v -n you get the following output:
root@server070:[~]: iptables -L -v -n Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 64M 4727M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 5 474 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 202K 27M ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 16 880 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 137M 38G ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:514 /* Syslog traffic */ 28 1664 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:514 /* Syslog traffic */ 41067 2050K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:9997 /* Universal Forwarder traffic */ 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8089 /* Splunk SSL traffic */ 47 2564 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8000 /* Splunk web interface */ 14135 1313K LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 5/min burst 5 LOG flags 0 level 7 prefix `iptables denied: ' 218K 21M REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
All that you need to do use the following example in your configuration file:
root@server070:[~]: cat /etc/sysconfig/iptables *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A INPUT -p udp -m udp --dport 514 -m comment --comment "Syslog traffic" -j ACCEPT -A INPUT -p tcp -m tcp --dport 514 -m comment --comment "Syslog traffic" -j ACCEPT -A INPUT -p tcp -m tcp --dport 9997 -m comment --comment "Universal Forwarder traffic" -j ACCEPT -A INPUT -p tcp -m tcp --dport 8089 -m comment --comment "Splunk SSL traffic" -j ACCEPT -A INPUT -p tcp -m tcp --dport 8000 -m comment --comment "Splunk web interface" -j ACCEPT -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT
Happy commenting!
How to block malicious VBA documents and spreadsheets with spam assassin or amavisd
Monitoring our net streams for SMTP traffic, I have a particular Splunk alert configured to alert when a spam campaign in underway. It’s quite interesting to see what tricks spammers try and how long some campaigns last.
Something that has caught my attention is the increased use of unsolicited “invoice” and “order” emails which get sent with .doc documents attached. Reviewing the documents nearly all of them contain malicious VB scripting usually set to auto run, which downloads and tries to execute binaries.
Now I have created a number of spam assassin rules to block these types of emails (invoices with .doc files attached) but it’s a cat and mouse game, and you can’t be too generic as you may block legitimate email. What I can block ruthlessly is documents and spreadsheets which contain autorun VB scripting.
Here is how to do it:
Create the following file on your amavisd server at the location “/usr/local/bin/detectvba.pl”
#!/usr/bin/perl -w
# technion@lolware.net
# Detects vba macros containing blacklisted strings.
# https://github.com/technion/maia_mailguard/blob/master/scripts/detectvba.pl
# Mods by www.cammckenzie.com
#
# Suggested amavisd/maiad.conf config:
# ['Detect-VBA',
# '/usr/local/bin/detectvba.pl', "{}",
# [0], qr/INFECTED/, qr/\bINFECTED (.+)\b/m ],
#
use strict;
my $sigtool = '/usr/bin/sigtool'; #Clamav sigtool path
if ($#ARGV != 0) {
print "Please supply directory to scan\n";
exit 0;
}
#Sanity check directory
my $dir = $ARGV[0];
if ($dir !~ /^[a-z0-9A-Z\/-]+$/) {
print "Invalid directory passed\n";
exit 0;
}
opendir DIR, $dir or die "Cannot open dir $dir: $!";
my @files = readdir DIR;
foreach my $file (@files) {
next if $file =~ /^\.$/;
next if $file =~ /^\.\.$/;
my $scan = `$sigtool --vba="$dir/$file"`;
if ($scan =~ /autoopen/i ) {
print "Scanning $file: INFECTED VBA\n";
exit 1;
} else {
print "Scanning $file: OK\n";
}
}
closedir DIR;
exit 0;
Then in amavisd.conf (/etc/amavisd/amavisd.conf on CentOS) modify the section “@av_scanners” and insert as a primary scanner the following stanza:
['Detect-VBA',
'/usr/loca/bin/detectvba.pl', "{}",
[0], qr/INFECTED/, qr/\bINFECTED (.+)\b/m ],
Then after that just restart your amavisd service and you should see, it finds Detect-VBA as a primary scanner, test it by sending yourself a malicious macro document lol.
Download the raw howto here, so that special characters are intact as FlatPress has a habit of removing them….https://www.cammcken … assin-or-amavisd.txt
How to mount dd images under Linux
For a raw filesystem try:
fdisk -l harddrive.img mount -o ro,loop,offset=xxxxxxxxx harddrive.img /mnt/loop
or for filesystems with volume groups etc try:
losetup /dev/loop0 disk.img kpartx -a /dev/loop0
Then to mount the first partition:
mount /dev/mapper/loop0p1 /mnt
Or to activate the volume group then mount the logical volume:
vgscan vgchange -ay vg mount /dev/vg/lv /mnt
Hope that helps.
How to measure IOPS with linux
So many times I need to measure the amount of IOPS on a Linux disk/storage system. While there are many tools for the jobs they just don’t seem to give you a ‘number’. For example Splunk indexers require 1200+ IOPS according to hardware recommendation guides but how do you find out if your any where close to that number? Use ‘bonnie++’, ‘iozone’ or perhaps ‘fio’? Well use any of those tools will create the type of read / write sequence you would like to replicate - but where the damn magic number???
Easiest two ways are:
Method #1:
run iozone -a (or bonnie++) in one screen then in another session / terminal use nmon, pressing D (capital D) to get disk stats and get the number from the Xfers column. This is your magic number (or IOPS reading)
┌nmon─14i─────────────────────Hostname=reddragon─────Refresh= 2secs ───19:51.57─ │ Disk I/O ──/proc/diskstats────mostly in KB/s─────Warning:contains duplicates─ │DiskName Busy Read Write Xfers Size Peak% Peak-RW InFlight │sda 99% 699.9 14.0KB/s 178.0 4.0KB 493% 3658.8KB/s 1 │sda1 0% 0.0 0.0KB/s 0.0 0.0KB 0% 0.0KB/s 0 │sda2 99% 699.9 14.0KB/s 178.0 4.0KB 493% 3658.8KB/s 1 │dm-0 0% 0.0 0.0KB/s 0.0 0.0KB 0% 0.0KB/s 0 │dm-1 99% 699.9 14.0KB/s 178.5 4.0KB 494% 3658.8KB/s 1 │dm-2 0% 0.0 0.0KB/s 0.0 0.0KB 76% 2553.5KB/s 0 │Totals Read-MB/s=2.1 Writes-MB/s=0.0 Transfers/sec=534.4
In the above example I’m getting about 178 IOPS for my disk ’sda’
Method #2:
run fio with the correct workload (google how to use fio) and while it’s running it will actually tell you the IOPS.
[root@reddragon ~]# fio random-read-test.fio random-read: (g=0): rw=randread, bs=4K-4K/4K-4K/4K-4K, ioengine=sync, iodepth=1 fio-2.0.13 Starting 1 process Jobs: 1 (f=1): [r] [85.1% done] [736K/0K/0K /s] [184 /0 /0 iops] [eta 00m:28s]
In this example I am getting 184 IOPS. Also if you wait until fio finishes it run - you can the IOPS reading from there. Eg.
random-read: (g=0): rw=randread, bs=4K-4K/4K-4K/4K-4K, ioengine=sync, iodepth=1 fio-2.0.13 Starting 1 process Jobs: 1 (f=1): [r] [98.9% done] [2224K/0K/0K /s] [556 /0 /0 iops] [eta 00m:02s] random-read: (groupid=0, jobs=1): err= 0: pid=7239: Tue Feb 25 16:49:16 2014 read : io=131072KB, bw=747406 B/s, iops=182 , runt=179578msec clat (usec): min=107 , max=117530 , avg=5473.62, stdev=4112.08 lat (usec): min=107 , max=117531 , avg=5473.93, stdev=4112.08 clat percentiles (usec): | 1.00th=[ 245], 5.00th=[ 302], 10.00th=[ 370], 20.00th=[ 2480], <SNIP>
As you can see: iops=182 - pretty consistent with the other results!
Stop puppet spamming /var/log/messages
Hate Spam? Hate Puppet Spam in var/log/messages more? Quick buy now!
# Edit /etc/puppet/puppet.conf # In the [agent] section add: syslogfacility = local6 # Edit: vi /etc/rsyslog.conf # Do a quick to see if local6 is being used somewhere else first... # Add a line: local6.* /var/log/puppet/puppet.log # Add setup the permissions and file touch /var/log/puppet/puppet.log chown puppet:puppet /var/log/puppet/puppet.log chmod 640 /var/log/puppet/puppet.log service rsyslog reload
And your done!