SpeakBit

Linux : How to list files according to their modification time ?

2014-10-08T04:57:00.000-07:00

For descending order

# ls -t

for ascending order

#ls -rt

Squid 2.7 Installation from source on Centos 6

2012-03-30T01:08:00.001-07:00

Steps :

This squid installation is done on Centos6

1. Frist you need to install Development tools
#yum groupinstall "Development Tools"
2. Get the “squid 2.7 ” source. decompress it.
#wget http://www.squid-cache.org/Versions/v2/2.7/squid-2.7.STABLE9.tar.gz
#tar -xzvf squid-2.7.STABLE9.tar.gz
3. change directory to squid -2.7

root@xyz squid-2.7.STABLE9]#
check configure options by
#./configure -help
4. Select your configuration
like
./configure --enable-gnuregex --enable-carp --with-pthreads --enable-heap-replacement --enable-icmp --enable-delay-pools --enable-useragent-log --enable-htcp --with-openssl --enable-linux-netfilter --disable-internal-dns --enable-auth=digest,ntlm,basic --enable-auth-baisc=PAM,NCSA,LDAP --enable-auth-basic=none --enable-basic-auth-helpers=PAM,NCSA,LDAP --enable-external-acl-helpers=unix_group,ldap_group --with-filedescriptors=8192 --enable-removal-policies=lru,heap
5.Make it.

#make
Installation
for installation you need to have root privileges .
# su

# make Install
if you get it without errors congratulate yourself.
and proceed to next step .
Your default installation directory is
#/usr/local/squid/
6.post-Installation
After compiling and installing squid, you should create the cache_dir, give it the rights permissions for the squid user/group and then run:

#/usr/sbin/squid -z

to initialize the cache_dir and create the necessary subdirs

If everything works as expected then try to start squid normally

Code:

#/usr/sbin/squid

7. Debug.

If you get any errors start squid in debug mode to get the errors on screen:

Code:

#/usr/sbin/squid -N -d 5

ERROR 407: Proxy Authentication Required ?

2012-03-30T01:06:00.002-07:00

If your Linux machine is behind a proxy server then to access the internet, proxy configuration will be required. The 'http_proxy' and 'ftp_proxy' environment variables hold the information about proxy server. Just hit the these commands-

#export http_proxy=http://proxy-server-ip:port

#export ftp_proxy=http://proxy-server-ip:port

If proxy server needs authentication then include username and password as follows-

#export http_proxy=http://user:password@proxy-server-ip:port

#export ftp_proxy=http://user:password@proxy-server-ip:port

These settings are remains vails for single session once you reboot the system they will get erased tomake them permenant add them in ~/.bashrc file.

# How to reset forgotten password in Linux

2011-12-20T04:03:00.000-08:00

This is quick trick to reset forgotten root password .

Reboot the system.

Interrupt the boot at the GRUB stage(by pressing any key ) and boot to runlevel 1 i.e. Single usermode . For this select the kernel you want to boot, then use "e" or "a" to edit it .

In edit give space and then append "single". Hit Enter or "b" for boot. The system will boot in single user mode, then use "passwd" to reset password/s. e.g. #passwd root Other user passwords can be reset,

CentOS-6 Note: Due to an upstream SELinux bug the root password cannot be reset on a fresh install of CentOS-6 without an additional step. Booting with "selinux=0" appended to the grub kernel line are work-arounds.

Ebtables and Netfilter

2011-08-08T02:24:00.001-07:00

Ebtables and Netfilter

Introduction:

The ebtables program is a filtering tool for a Linux-based bridging firewall. It enables transparent filtering of network traffic passing through a Linux bridge. The filtering possibilities are limited to link layer filtering and some basic filtering on higher network layers. Advanced logging, MAC DNAT/SNAT and brouter facilities are also included.

The ebtables tool can be combined with the other Linux filtering tools (iptables, ip6tables and arptables) to make a bridging firewall that is also capable of filtering these higher network layers. This is enabled through the bridge-netfilter architecture which is a part of the standard Linux kernel.

Ebtables only work on bridged interface.

Q.How to bridge two interfaces ?

brctl is the tool for interface bridging.

#brctl addbr br0            // add bridge br0

#ifconfig eth0 0.0.0.0 // reomove eth0’s IP

#ifconfig eth1 0.0.0.0 // reomove eth1’s IP

#brctl addif br0 eth1 // add eth1 to bro

#brctl addif br0 eth0 // add eth0 to bro

#brctl show     //see bridge br0 configuration

#brctl stp br0 on   // stp(spinning tree protocol) on

#ifconfig br0 192.168.0.254 up // bridge up

you can ping the bridge now.

Q.What can we do with ebtables and netfilter ?

Ethernet protocol filtering.

MAC address filtering.

Simple IP header filtering.

ARP header filtering.

802.1Q VLAN filtering.

In/Out interface filtering (logical and physical device).

MAC address nat.

Logging.

Frame counters.

Ability to add, delete and insert rules; flush chains; zero counters.

Brouter facility.

Ability to atomically load a complete table, containing the rules you made, into the kernel. See the man page and the examples section.

Support for user defined chains.

Support for marking frames and matching marked frames

Basic Examples :

1) Drop/Allow everything

ebtables -P FORWARD DROP/ACCEPT

-P for policy
-A for append rule in chain

It will drop/allow all traffic going through bridge
you can flush out all ebtable rule by using

ebtables -F

HOW Configure a Bridging Ebtables Firewall ?

2) Basic filter on IP

FORWARD chain policy must be ACCEPT
#ebtables -P FORWARD ACCEPT
#ebtables -I FORWARD -p Ipv4 --ip-src 192.168.0.2 -j ACCEPT // Allow 192.168.0.2
#ebtables -I FORWARD -p Ipv4 --ip-src 192.168.0.3 -j ACCEPT // Allow 192.168.0.3
#ebtables -A FORWARD -p Ipv4 --ip-src 192.168.0.0/24 -j DROP //Drop all 192.162.0.0/24

-I insert rule on top of all
-A appends rule at the end

Remember DROP “ rule” must be at the end

You can check rule's order by ,

#ebtables -L

To delete any specific rule

ebtables -D FORWARD 4 // delete rule no 4 from FORWARD chain

3)How to filtert ports and protocols ?
problem . suppose we want to allow http and icmp traffic on two IP’s namely. 192.168.0.2 and 192.168.0.3 . the rules will look like this.

#ebtables -P FORWARD DROP // Change the forward policy to drop all

# ebtables -A FORWARD -p 0x806 -j ACCEPT // Allow arp traffic

# ebtables -A FORWARD -p 0x800 --ip-dst 192.168.0.2 --ip-proto tcp --ip-sport 80 -j ACCEPT // allow packets having 192.168.0.2 as destination

# ebtables -A FORWARD -p 0x800 --ip-src 192.168.0.2 --ip-proto tcp --ip-dport 80 -j ACCEPT // allow packets having 192.168.0.2 as source

# ebtables -A FORWARD -p 0x800 --ip-dst 192.168.0.3 --ip-proto tcp --ip-sport 80 -j ACCEPT
// allow packets having 192.168.0.3 as destination

# ebtables -A FORWARD -p 0x800 --ip-src 192.168.0.3 --ip-proto tcp --ip-dport 80 -j ACCEPT // allow packets having 192.168.0.3 as source

# ebtables -A FORWARD -p 0x800 --ip-src 192.168.0.2 --ip-proto icmp -j ACCEPT // allow ping
# ebtables -A FORWARD -p 0x800 --ip-src 192.168.0.3 --ip-proto icmp -j ACCEPT // allow ping

Now to allow DNS requests ,suppose 192.168.0.1 is our name server .we allow dns to 192.168.0.2 only.

# ebtables -A FORWARD -p 0x800 --ip-src 192.168.0.2 --ip-dst 192.168.0.1 --ip-proto udp --ip-dport 53 -j ACCEPT
# ebtables -A FORWARD -p 0x800 --ip-src 192.168.0.2 --ip-dst 192.168.0.1 --ip-proto udp --ip-sport 53 -j ACCEPT

Protocol hex descriptions

protocol value      Description
0x800            IP
0x806                       ARP

Have fun!