Rootop 服务器运维与web架构

2014-03-19
发表者 Venus
暂无评论

搭建Linux+Jexus+MariaDB+ASP.NET(LJMA环境)

系统环境:centos6.5_x64

LJMA 是Linux+Jexus+MariaDB+ASP.NET的简写,其实就是把Jexus, MariaDB以及ASP.NET安装在Linux系统上,组成一个环境来运行ASP.NET的应用。Jexus是Linux下的基于Mono编写的WEB服务软件,而MariaDB是比较小型的数据库软件,ASP.NET是由微软在.NET Framework框架中所提供,开发Web应用程序的类库,通过Mono我们可以让他在Linux下运行。

Jexus相比其它Linux系统的WEB服务器的优势
一、Jexus直接支持跨平台的ASP.NET网站和PHP网站,中间无需第三方插件。
二、Jexus在静态文件处理方面同样拥有非常优秀的性能。
三、Jexus专们针对应用服务器的需求进行了优化,具有超强的稳定性和不间断运行能力,其稳健度,绝不亚于其它任何WEB服务器。
四、Jexus拥有最基础而关键的入侵检测能力,这是所有其它WEB服务器所不具备的。

Mono是一个由Novell公司(由Ximian发起,并由Miguel de lcaza领导的,一个致力于开创.NET在Linux上使用的开源工程。它包含了一个C#语言的编译器, 一个CLR的运行时,和一组类库,并实现了 ADO NET和ASP NET。能够使得开发人员在Linux用C#开发程序。)主持的项目.该项目的目标是创建一系列符合标准ECMA (Ecma-334和Ecma-335)的.Net 工具, 包括C #编译器和共同语言(CL 即 Common Language)执行平台(Platform).与微软的.Net不同, Mono项目不仅可以运行于Windows系统内,还可以运行于Linux, FreeBSD, Unix, Mac OS X和Solaris。

[root@centos-6.5-x64 ~]#yum -y install gcc gcc-c++ bison pkgconfig glib2-devel gettext make libpng-devel libjpeg-devel libtiff-devel libexif-devel giflib-devel libX11-devel freetype-devel fontconfig-devel cairo-devel

Mono需要的GDI+兼容API的库Libgdiplus 支持System.Drawing

[root@centos-6.5-x64 ~]#wget -c http://download.mono-project.com/sources/libgdiplus/libgdiplus-2.10.tar.bz2
[root@centos-6.5-x64 ~]#tar jxvf libgdiplus-2.10.tar.bz2
[root@centos-6.5-x64 libgdiplus-2.10]#./configure --prefix=/usr
[root@centos-6.5-x64 libgdiplus-2.10]#make && make install

下载mono,安装:

[root@centos-6.5-x64 ~]#wget -c http://download.mono-project.com/sources/mono/mono-3.2.3.tar.bz2
[root@centos-6.5-x64 ~]#tar jxvf mono-3.2.3.tar.bz2
[root@centos-6.5-x64 ~]#cd mono-3.2.3
[root@centos-6.5-x64 mono-3.2.3]#./configure --prefix=/usr/local/mono
[root@centos-6.5-x64 mono-3.2.3]#make && make install

测试安装:
[root@centos-6.5-x64 mono-3.2.3]#/usr/local/mono/bin/mono -V
Mono JIT compiler version 3.2.3 (tarball 2014年 03月 20日 星期四 05:25:29 CST)
Copyright (C) 2002-2012 Novell, Inc, Xamarin Inc and Contributors. www.mono-project.com
TLS: __thread
SIGSEGV: altstack
Notifications: epoll
Architecture: amd64
Disabled: none
Misc: softdebug
LLVM: supported, not enabled.
GC: sgen

[root@centos-6.5-x64 ~]#ldconfig

测试mono:

[root@centos-6.5-x64 ~]#echo 'class X { static void Main () { System.Console.Write("My first mono app worked!\n");} }' > example.cs
[root@centos-6.5-x64 ~]#/usr/local/mono/bin/mcs example.cs
[root@centos-6.5-x64 ~]#ll
总用量 82008
-rw-r--r-- 1 root root 88 3月 19 22:28 example.cs
-rwxr-xr-x 1 root root 3072 3月 19 22:28 example.exe
drwxr-xr-x 3 root root 4096 8月 3 2013 jexus-5.4.3
-rw-r--r-- 1 root root 179047 8月 6 2013 jexus-5.4.3.tar.gz
-rw-r--r-- 1 root root 1962898 2月 15 2011 libgdiplus-2.10.tar.bz2
drwxr-xr-x 19 1000 users 4096 3月 20 2014 mono-3.2.3
-rw-r--r-- 1 root root 81810387 3月 20 2014 mono-3.2.3.tar.bz2
[root@centos-6.5-x64 ~]#/usr/local/mono/bin/mono example.exe
My first mono app worked!

Jexus Web Server for nux 是一款基于.NET兼容环境,运行于Linux/unix操作系统之上,以支持ASP.NET为核心功能的高性能WEB服务器,用于替换Apache+mod_mono、Nginx+FastCgi 方案运行ASP.NET。Jexus不但具有跨平台ASP.NET服务器这样的标志性特征,同时还拥有内核级的安全监控、入侵检测、URL重写、无文件路由等一系列重要功能和专有特性。

从5.3.1版本开始,Jexus的安装过程简化了,内置了两个新的脚本,它们分别是“install”和“upgrade”,对应原来的“安装”和“升级”,将Jexus的安装过程自动化了。jexus本身的安装和升级方式并没有发生更多的变化,因此对于已经习惯于5.3.1之前版本的使用方式的用户仍然可以采用之前的安装方式。

[root@centos-6.5-x64 ~]#wget -c http://linuxdot.net/down/jexus-5.4.3.tar.gz
[root@centos-6.5-x64 ~]#tar zxvf jexus-5.4.3.tar.gz
[root@centos-6.5-x64 ~]#cd jexus-5.4.3
[root@centos-6.5-x64 jexus-5.4.3]#ll
总用量 28
drwxr-xr-x 5 root root 4096 8月 6 2013 data
-rwxr-xr-x 1 root root 611 8月 3 2013 install
-rw-r--r-- 1 root root 16111 8月 5 2013 readme.cn.txt
-rwxr-xr-x 1 root root 758 8月 3 2013 upgrade
[root@centos-6.5-x64 jexus-5.4.3]#sh install
Installed /usr/jexus/jxAspx.dll into the gac (/usr/local/mono/lib/mono/gac)
Installed /usr/jexus/jxHost.dll into the gac (/usr/local/mono/lib/mono/gac)
OK, Jexus web server has been installed to '/usr/jexus'.

执行install脚本时,jexus默认是安装到/usr/jexus/中,如果想安装到其他目录,可以在执行该脚本时增加一个目录的参数(如 sh install /usr/local/jexus)。对于升级就是执行upgrade脚本。

启动jexus:
[root@centos-6.5-x64 ~]#/usr/jexus/jws start
Start … OK
[root@centos-6.5-x64 ~]#lsof -i:80
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
mono 1093 root 4u IPv4 113800 0t0 TCP *:http (LISTEN)
mono 1100 root 9u IPv4 113800 0t0 TCP *:http (LISTEN)
[root@centos-6.5-x64 ~]#echo “/usr/jexus/jws start” >> /etc/rc.local 加入开机自启动
通过浏览器打开:http://192.168.1.102/info 即可看到欢迎页面。至此.net环境完成。至于mariadb过程就不做列出了。

jexus主配置文件:
[root@centos-6.5-x64 ~]#vi /usr/jexus/siteconf/default
port=80 //指定端口
root=/ /var/www/default //根目录
hosts=* #OR your.com,*.your.com //绑定域名
indexs=index.aspx //定义默认页

关于mariadb安装参考 https://www.rootop.org/pages/2343.html

ps:
在/etc/my.cnf 中的[mysqld]后添加添加lower_case_table_names=1,重启MYSQL服务,这时已设置不区分表名的大小写;

lower_case_table_names = 0

其中 0:区分大小写,1:不区分大小写

2014-03-19
发表者 Venus
暂无评论

配置mysql支持多个实例

[root@localhost ~]# vi /etc/my.cnf 添加:

[mysqld_multi]
mysqld = /usr/bin/mysqld_safe
mysqladmin = /usr/bin/mysqladmin

[mysqld2]
socket = /tmp/mysql.sock2
port = 3307
pid-file = /tmp/localhost.pid2
datadir = /mnt/data/mysqld2
[root@localhost ~]# mkdir -p /mnt/data/mysqld2
[root@localhost ~]# chown mysql:mysql /mnt/data/mysqld2

[root@localhost ~]# mysql_install_db --datadir /mnt/data/mysqld2 --user=mysql

启动实例:
[root@localhost ~]# mysqld_multi start 2

[root@localhost ~]# lsof -i:3306
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
mysqld 27794 mysql 10u IPv4 42678 0t0 TCP *:mysql (LISTEN)
[root@localhost ~]# lsof -i:3307
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
mysqld 27928 mysql 10u IPv4 42930 0t0 TCP *:opsession-prxy (LISTEN)
登陆第二个实例:
[root@localhost ~]# mysql -uroot -h127.0.0.1 -P3307 -p 通过-P指定端口号

2014-03-18
发表者 Venus
暂无评论

使用medusa暴力破解ssh密码

在kali中有个软件叫medusa,可以用来破解linux账户密码。
参数:
Medusa [-h host|-H file] [-u username|-U file] [-p password|-P file] [-C file] -M module

例如现在破解root密码。字典可以从网上找或者自己写。这里只做介绍。
创建一个密码文件,每一个密码占用一行: cat p.txt
123
123456
password
redhat

medusa -h 192.168.1.11 -u root -P p.txt -M ssh

也可以定义用户文件 -U ,-M 破解ssh服务。

破解成功的话,会提示发现账户并提示破解成功。

源码编译安装:

下载:
http://www.foofus.net/jmk/tools/medusa-2.1.1.tar.gz

因为破解ssh密码需要ssh模块,libssh2是一个C函数库,用来实现SSH2协议。
http://www.libssh2.org/

安装libssh2:
[root@localhost libssh2-1.2.6]# ./configure && make && make install
安装medusa:
[root@localhost medusa-2.1.1]# ./configure && make && make install

查看支持的模块:
[root@localhost ~]# medusa -d
···

Available modules in “/usr/local/lib/medusa/modules” :
+ cvs.mod : Brute force module for CVS sessions : version 2.0
+ ftp.mod : Brute force module for FTP/FTPS sessions : version 2.1
+ http.mod : Brute force module for HTTP : version 2.0
+ imap.mod : Brute force module for IMAP sessions : version 2.0
+ mssql.mod : Brute force module for M$-SQL sessions : version 2.0
+ mysql.mod : Brute force module for MySQL sessions : version 2.0
+ nntp.mod : Brute force module for NNTP sessions : version 2.0
+ pcanywhere.mod : Brute force module for PcAnywhere sessions : version 2.0
+ pop3.mod : Brute force module for POP3 sessions : version 2.0
+ rexec.mod : Brute force module for REXEC sessions : version 2.0
+ rlogin.mod : Brute force module for RLOGIN sessions : version 2.0
+ rsh.mod : Brute force module for RSH sessions : version 2.0
+ smbnt.mod : Brute force module for SMB (LM/NTLM/LMv2/NTLMv2) sessions : version 2.0
+ smtp-vrfy.mod : Brute force module for enumerating accounts via SMTP VRFY : version 2.0
+ smtp.mod : Brute force module for SMTP Authentication with TLS : version 2.0
+ snmp.mod : Brute force module for SNMP Community Strings : version 2.1
+ ssh.mod : Brute force module for SSH v2 sessions : version 2.0
+ telnet.mod : Brute force module for telnet sessions : version 2.0
+ vmauthd.mod : Brute force module for the VMware Authentication Daemon : version 2.0
+ vnc.mod : Brute force module for VNC sessions : version 2.1
+ web-form.mod : Brute force module for web forms : version 2.1
+ wrapper.mod : Generic Wrapper Module : version 2.0

可直接输入medusa查看支持的参数:

[root@localhost ~]# medusa -H host.txt -u root -P password.txt -M ssh
Medusa v2.1.1 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks <jmk@foofus.net>

ACCOUNT CHECK: [ssh] Host: 192.168.5.12 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: 123 (1 of 3 complete)
ACCOUNT CHECK: [ssh] Host: 192.168.5.12 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: 321 (2 of 3 complete)
ACCOUNT CHECK: [ssh] Host: 192.168.5.12 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: 123123 (3 of 3 complete)
ACCOUNT FOUND: [ssh] Host: 192.168.5.12 User: root Password: 123123 [SUCCESS]

-H 主机表 -h 直接指定主机 -U 用户名表 -u 直接指定用户名 -P 密码表 -M 协议

2014-03-15
发表者 Venus
暂无评论

apache 限制目录访问

比如说登陆nagios或者是其它监控软件等,都会提示输入用户名密码,才能登陆,其实就是在apache中限制目录访问权限。
通过用户名和密码的方式进行验证。

比如我这里将/var/www/html/a目录进行限制:
1、修改httpd.conf配置文件,添加:

<Directory “/var/www/html/a”>
AllowOverride AuthConfig
</Directory>

2、创建密码文件,添加用户venus:

[root@centos-6.5-x64 ~]#htpasswd -c /var/www/html/a/.htpasswd venus
New password:
Re-type new password:
Adding password for user venus

-c 代表创建,没有.htpasswd文件时才需要-c参数,-D 删除,可以man一下htpasswd

3、创建.htaccess文件

[root@centos-6.5-x64 ~]#cat /var/www/html/a/.htaccess

AuthName “please input your username ang password!”
AuthType Basic
AuthUserFile /var/www/html/a/.htpasswd
Require valid-user

AuthName 提示信息
AuthType 目前只实现了Basic和Digest(不常用)
这两个模块通常至少需要和一个认证支持模块(如mod_authn_file)和一个授权支持模块(如mod_authz_user)一起使用。
AuthUserFile 认证文件路径
Require 所有有效用户

重启apache测试。
访问http://192.168.1.102/a 弹出输入用户名密码即可。

附:

通过ip限制访问:https://www.rootop.org/pages/963.html

2014-03-12
发表者 Venus
暂无评论

ERROR: The number of NVTs in the OpenVAS Manager database is too low.

安装完openvas,登陆web界面时候报错:
Login failed: OMP Service is down.

从官网 http://www.openvas.org/setup-and-start.html 找到检查openvas状态的脚本,下载执行。官方描述如下:

The OpenVAS developers provide a handy tool called openvas-check-setup to check the state of your OpenVAS installation. To use this tool simply follow these three steps:

Download the latest version of openvas-check-setup.
Ensure that the script is executable:
chmod +x openvas-check-setup
Execute the script:
./openvas-check-setup
for current stable release or
./openvas-check-setup [ –v4 | –v5 | –v6 | … ]
for other respective OpenVAS releases.
openvas-check-setup will now analyze the state of your OpenVAS installation and propose fixes should it detect any errors or misconfigurations. It will also check if all required OpenVAS services are running and listening on the correct ports.

In case the hints did not help you to get a working OpenVAS installation, please report the problem to us and we will update/fix openvas-check-setup: OpenVAS Users Mailing List.

If you want to install the OpenVAS services on a server and you do not need clients like OpenVAS CLI or GSD in your installation you can skip the checks for these modules by starting openvas-check-setup with the –server parameter instead:

./openvas-check-setup [–server]

[root@centos-6.5-x64 ~]# wget -c https://svn.wald.intevation.org/svn/openvas/trunk/tools/openvas-check-setup --no-check-certificate
[root@centos-6.5-x64 ~]# ./openvas-check-setup --server

openvas-check-setup 2.2.3
Test completeness and readiness of OpenVAS-6
(add ‘–v4’, ‘–v5’ or ‘–v7’
if you want to check for another OpenVAS version)

Please report us any non-detected problems and
help us to improve this check routine:
http://lists.wald.intevation.org/mailman/listinfo/openvas-discuss

Send us the log-file (/tmp/openvas-check-setup.log) to help analyze the problem.

Step 1: Checking OpenVAS Scanner …
OK: OpenVAS Scanner is present in version 3.4.1.
OK: OpenVAS Scanner CA Certificate is present as /var/lib/openvas/CA/cacert.pem.
OK: NVT collection in /var/lib/openvas/plugins contains 34309 NVTs.
WARNING: Signature checking of NVTs is not enabled in OpenVAS Scanner.
SUGGEST: Enable signature checking (see http://www.openvas.org/trusted-nvts.html).
OK: The NVT cache in /var/cache/openvas contains 34309 files for 34309 NVTs.
Step 2: Checking OpenVAS Manager …
OK: OpenVAS Manager is present in version 4.0.5.
OK: OpenVAS Manager client certificate is present as /var/lib/openvas/CA/clientcert.pem.
OK: OpenVAS Manager database found in /var/lib/openvas/mgr/tasks.db.
OK: Access rights for the OpenVAS Manager database are correct.
OK: sqlite3 found, extended checks of the OpenVAS Manager installation enabled.
OK: OpenVAS Manager database is at revision 74.
OK: OpenVAS Manager expects database at revision 74.
OK: Database schema is up to date.
ERROR: The number of NVTs in the OpenVAS Manager database is too low.
FIX: Make sure OpenVAS Scanner is running with an up-to-date NVT collection and run ‘openvasmd –rebuild’.

ERROR: Your OpenVAS-6 installation is not yet complete!

解决方法,依次执行下面命令:

[root@centos-6.5-x64 ~]# openvassd
[root@centos-6.5-x64 ~]# mkdir -p /usr/local/var/lib/openvas/mgr
[root@centos-6.5-x64 ~]# touch /usr/local/var/lib/openvas/mgr/tasks.db
[root@centos-6.5-x64 ~]# openvasmd --backup
[root@centos-6.5-x64 ~]# openvasmd --rebuild
[root@centos-6.5-x64 ~]# openvasad -c 'add_user' -u openvasadmin -r Admin
[root@centos-6.5-x64 ~]# openvasmd -p 9390 -a 127.0.0.1
[root@centos-6.5-x64 ~]# openvasad -a 127.0.0.1 -p 9393
[root@centos-6.5-x64 ~]# gsad --http-only --listen=127.0.0.1 -p 9392

老外的资料:http://pentestit.de/openvas-auf-backtrack-5-r1-installieren/