Rahul Krishnan R

How can I turn off Microsoft elemetry?

2024-06-05T17:29:00.000-07:00

Step 1. Disable schedule for Windows Compatibility Telemetry.

WCT is a service which contains technical data on how the device and its related software are working. To disable it:

Stop and disable the “Connected User Experiences and Telemetry” Windows service
Click Start, type Task Scheduler, and then press Enter.
On the Task Scheduler window, go to this path: Task Scheduler Library\Microsoft\Windows\Application Experience.
On the Application Experience folder, look for Microsoft Compatibility Appraiser.
Right-click on it, select Disable, and then confirm to complete the process.

Step.2. Disable Microsoft's Diagnostic Tracking.

Next, please run the following command in an elevated cmd (*).

This will remove tracking services:

sc delete DiagTrack

sc delete dmwappushservice

Add a registry key titled "AllowTelemetry" and sets the key to 0, to disable the telemetry:

reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection /v AllowTelemetry /t REG_DWORD /d 0 /f

(*) Note, to run elevated cmd:

Press Windows key and type cmd. This should find the Command line program. Note that searching by "cmd" works in any language version of Windows.

There should be an option to Run as administrator. Use it.

Webmin: A web-based Linux management tool

2022-08-31T21:04:00.003-07:00

Installing Webmin in Redhat 7

If you're a purist, you can download the tarball from webmin.com, but doing so doesn't give you that much extra control over options. You can choose where to place a few files, but save yourself the effort on RHEL, CentOS, and Fedora by installing the RPM:

$ wget https://www.webmin.com/download/rpm/webmin-current.rpm

$ sudo rpm -Uvh webmin-1.XXX-x.noarch.rpm

If your system doesn't have Perl, then you'll have to satisfy that dependency before installing Webmin. You might also have to install the Encode::Detect and Net::SSLeay Perl modules before installing Webmin:

$ sudo yum install perl-Encode-Detect -y

$ sudo yum install perl-Net-SSLeay -y

Once installed, the installation script directs you to your new Webmin instance at http://<servername>:10000. Log in with your system's root password.

You can change the port, username, and password on the Webmin Configuration option (discussed later). Please do make these changes to the username and password.

Navigating Webmin

Webmin, by default, starts you out with the so-called "Authentic" theme, with the navigation frame on the left side of the page:

I much prefer the "Old Webmin Theme," but switching to it breaks the current version, which is 1.920 as of this writing.

Webmin not only provides system administrators with an abundant list of management tools, but it also comes with its own internal configuration and management options:

Selecting one of these links opens a number of editable options. For example, below I selected the Webmin Configuration option. As you can see, there are several Webmin behavioral and configuration options available:

Rather than showing screenshots of every selection from Webmin, I'll let you discover them on your own, but there is one worth taking a closer look at for this overview: Others. Believe it or not, this group of applets is one that I spend a lot of time in. Below, I've selected File Manager from the list to illustrate the depth and richness of these utilities. The volunteer developers have done an excellent job in creating tools that are useful to busy system administrators:

Other notable applets on the Others page are Command Shell, Perl Modules, System and Server Status, Text Login, and Upload and Download. The Command Shell option appears as a root login prompt in the upper left of your screen when selected, containing an interactive shell and not a single command at a time service.

With Perl Modules, you can install Perl modules from CPAN from multiple sources: CPAN itself, local files, URLs, and uploaded files. You can also see a list of your currently installed modules, and optionally install a list of suggested modules with a single click.

The System and Server page provides you with a snapshot of the current status of installed services. There is a drop-down from which you can select a new service to monitor on this screen.

Text Login is a valuable option that provides you with an interactive console terminal login screen. You must have Python installed for this feature to function properly. Also, you might have to create a symbolic link from python to your python executable because the configuration looks for python rather than python2. This is what I did:

$ sudo ln -s /usr/bin/python2 /usr/bin/python

This command satisfies the dependency for the applet.

Finally, the Upload and Download page is valuable for remote uploading and downloading files without access to a secure FTP (SFTP) or secure copy (SCP) client.

NOTE: If you use Webmin with a Linux server that can be accessed from the internet, please protect this powerful resource by enabling SSL on the Webmin Configuration page, and also enabling multi-factor authentication if possible.

Source: https://www.redhat.com/sysadmin/webmin

Source: https://www.redhat.com/sysadmin/favorite-linux-sysadmin-tools

Ubuntu: Extend your default LVM space

2022-03-17T16:37:00.003-07:00

Linux LVM Briefly Explained

If you followed the default settings in the Ubuntu installation, then the storage for your Linux OS is probably using the Logical Volume Manager (LVM). LVM is an abstraction framework which exists between your physical (or virtual) disks and your Linux file system (which is likely ext4). It is used to group separate block devices (partitions) together into Volume Groups (VGs), and then chop those VGs up into logical block devices, or Logical Volumes (LVs). LV’s are the abstracted block devices upon which your usable file system resides.

Below is good visualization of how LVM works. In this example, we have 5 different disks, each with a single partition mapped to Physical Volumes (PVs), all being grouped into a single Volume Group (VG). The Volume Group is chopped up into two different Logical Volumes (LVs) and each LV is being used for a filesystem.

Using a similar visualization, the below diagram shows how the Ubuntu installer (using all default options) divided up my 100GB disk.

Ubuntu Installer Default Settings

When installing Ubuntu, it has you approve a storage layout in a couple different screens (shown below). By default this storage layout will have a couple small boot partitions, and a third partition, which will be used by your LVM to create your root filesystem. You should be able to see the consistency between the screens below and the diagram above.

Use Your Default Free Space

As you can see above: the Ubuntu installer (by default) left almost half of my disk space unusable by the root file system! I’ve looked around to find an explanation on why these are the default settings, but can’t find anything. Before extending your underlying hypervisor disk or storage volume, you may want to see if you have free space available and ready to be used to extend your existing file system. If you used the Ubuntu defaults during installation, then there is a good chance you have this free space.

Start by checking your root filesystem free space with df -h. As you can see I am only using 14% of my ~49GB volume, but we’ll pretend I’m close to 100% and need to make that 49GB volume larger.

To check for existing free space on your Volume Group (where it is left by the installer default settings), run the command vgdisplay and check for free space. Here you can see I have 49.25GB of free space ready to be used. If you don’t have any free space, move on to the next section to use some free space from an extended physical (or virtual) disk.

To use up that free space on your Volume Group (VG) for your root Logical Volume (LV), first run the lvdisplay command and check the Logical Volume size, then run lvextend -l +100%FREE /dev/ubuntu-vg/ubuntu-lv to extend the LV to the maximum size usable, then run lvdisplay one more time to make sure it changed.

At this point you have increased the size of the block volume where your root filesystem resides, but you still need to extend the filesystem on top of it. First, run df -h to verify your (almost full) root file system, then run resize2fs /dev/mapper/ubuntu--vg-ubuntu--lv to extend your filesystem, and run df -h one more time to make sure you’re successful.

And that’s it. You just allocated the free space left behind by the Ubuntu installer to your root filesystem. If this is still not enough space, continue on to the next section to allocate more space by extending an underlying disk.

Use Space from Extended Physical (or Virtual) Disk

First you need to increase the size of the disk being presented to the Linux OS. This is most likely done by expanding the virtual disk in KVM/VMWare/Hyper-V or by adjusting your RAID controller / storage system to increase the volume size. You can often do this while Linux is running; without shutting down or restarting. I’ve extended my 100GB disk to 200GB for my example machine.

Once that is done, you may need to get Linux to rescan the disk for the new free space. Check for free space by running cfdisk and see if there is free space listed, use “q” to exit once you’re done.

If you don’t see free space listed, then initiate a rescan of /dev/sda with echo 1>/sys/class/block/sda/device/rescan. Once done, rerun cfdisk and you should see the free space listed.

Select your /dev/sda3 partition from the list and then select “Resize” from the bottom menu. Hit ENTER and it will prompt you to confirm the new size. Hit ENTER again and you will now see the /dev/sda3 partition with a new larger size.

Select “Write” from the bottom menu, type yes to confirm, and hit ENTER. Then use “q” to exit the program.

Now that the LVM partition backing the /dev/sda3 Physical Volume (PV) has been extended, we need to extend the PV itself. Run pvresize /dev/sda3 to do this and then use pvdisplay to check the new size.

As you can see above, my PV has been increased from 98.5GB to 198.5GB. Now let’s check the Volume Group (VG) free space with vgdisplay.

We can see above that the VG has 100GB of free space. Now let’s check the size of our upstream Logical Volume (LV) using lvdisplay, extend the LV to use up all the VG’s free space with lvextend -l +100%FREE /dev/ubuntu-vg/ubuntu-lv, and then check the LV one more time with lvdisplay to make sure it has been extended.

At this point, the block volume underpinning our root filesystem has been extended, but the filesystem itself has not been resized to fit that new volume. To do this, run df -h to check the current size of the file system, then run resize2fs /dev/mapper/ubuntu--vg-ubuntu--lv to resize it, and df -h one more time to check the new file system available space.

And there you go. You’ve now taken an expanded physical (or virtual) disk and moved that free space all the way up through the LVM abstraction layers to be used by your (critically full) root file system.

Source: https://packetpushers.net/ubuntu-extend-your-default-lvm-space/#:~:text=To%20use%20up%20that%20free,to%20make%20sure%20it%20changed.

How to Reset Forgotten Ubuntu Password in 2 Minutes

2022-03-16T19:05:00.005-07:00

Step 1: Boot into recovery mode

Switch the computer on. Go to the grub menu. Generally, it appears automatically – if not, then hold down the shift key or press Esc key until the boot menu appears.

If you’re using Oracle VirtualBox or VMware, you have to hold down the shift key when the logo of Oracle or VMware appears.

In the grub menu, select the “Advanced Options for Ubuntu”:

This is grub screen

In here, you’ll see the option to go to recovery mode:

It will bring you to a black screen with several lines of output being displayed in a flash. Wait for a few seconds here.

Step 2: Drop to root shell prompt

Now you’ll be presented with different options for recovery mode. Here you need to choose “Root – Drop to root shell prompt“. Just press the enter key to select this option. Like in the picture below:

You’ll see that when you select the root shell prompt option, an option to enter commands appears at the bottom. This is your root shell prompt and this is where you’ll use the commands to reset the password.

Step 3: Remount the root with write access

You need to have write access to the root partition. By default, it has read-only access.

Use the command below to remount it with write access:

mount -rw -o remount /

Step 4: Reset username or password

Here, you’ll be given root access. Use the following command to list all the users available:

ls /home

Based on this command, choose the “username” for which you want to reset or (say) hack the password. Now, use the following command to reset the password for the selected “username“:

passwd username

It prompts for a new password. Enter the new password twice:

Enter new UNIX password:

Retype new UNIX password:

Voilà! There you go. You have just successfully reset the password. Now exit the root shell prompt:

exit

When you exit, you’ll be back at the recovery mode menu. Select the normal boot option here.

There will be a warning about graphics mode compatibility. Don’t worry. A complete reboot will fix any issues with this.

You should now be able to log in with the new password.

Source: https://itsfoss.com/how-to-hack-ubuntu-password/

How to get full PC memory specs (speed, size, type, part number, form factor) on Windows 10

2022-02-07T21:37:00.000-08:00

wmic memorychip list full

wmic memorychip get devicelocator, manufacturer, partnumber, serialnumber, capacity, speed, memorytype, formfactor

wmic memorychip get devicelocator, manufacturer

wmic memorychip get devicelocator, partnumber

wmic memorychip get devicelocator, serialnumber

Quick tip: In the command, you can also replace "devicelocator" with "banklabel" to list the serial number showing the bank's physical label where the memory is located on the motherboard. For example, wmic memorychip get banklabel, serialnumber

wmic memorychip get devicelocator, capacity

Quick tip: The capacity information is displayed in bytes, but you can divide the number by 1,073,741,824 (1 gigabyte in bytes) to convert the data into gigabytes

systeminfo | findstr /C:"Total Physical Memory"

wmic memorychip get devicelocator, speed

wmic memorychip get devicelocator, memorytype

Memory types the command can identify:

0: Unknown.

1: Other.

2: DRAM.

3: Synchronous DRAM.

4: Cache DRAM.

5: EDO.

6: EDRAM.

7: VRAM.

8: SRAM.

9: RAM.

10: ROM.

11: Flash.

12: EEPROM.

13: FEPROM.

14: EPROM.

15: CDRAM.

16: 3DRAM.

17: SDRAM.

18: SGRAM.

19: RDRAM.

20: DDR.

21: DDR2.

22: DDR2 FB-DIMM.

24: DDR3.

25: FBD2.

26: DDR4.

wmic memorychip get devicelocator, formfactor

0: Unknown.

1: Other.

2: SIP.

3: DIP.

4: ZIP.

5: SOJ

6: Proprietary.

7: SIMM.

8: DIMM.

9: TSOP.

10: PGA.

11: RIMM.

12: SODIMM.

13: SRIMM.

14: SMD.

15: SSMP.

16: QFP.

17: TQFP.

18: SOIC.

19: LCC.

20: PLCC.

21: BGA.

22: FPBGA.

23: LGA.

24: FB-DIMM

Source: https://www.windowscentral.com/how-get-full-memory-specs-speed-size-type-part-number-form-factor-windows-10

How to upgrade Debian 9 Stretch to Linux Debian 10 Buster

2021-12-22T17:48:00.006-08:00

Introduction

Debian is a popular version, or fork, of the Linux operating system.

The most recently released version is Debian 10, codenamed Buster. The previous version Debian 9 Stretch is officially supported until June 2022. The newer version offers a longer support period and new features, so it is highly recommended to upgrade if running Debian 9.

This tutorial will walk you through how to upgrade from Debian 9 (Stretch) to Debian 10 (Buster).

Prerequisites

A system running Debian 9
A Debian user account with sudo privileges
Access to a command line/terminal window (Ctrl–Alt–F2)
A recent snapshot (backup) of the system

Upgrade to Debian Version 10 Buster

Make sure to back up your system and data prior to upgrading. That way, if anything breaks during the upgrade, you can easily restore your system configuration.

Step 1: Update Package Manager and Repositories

By default, Debian 9 refers to the repositories designated for Stretch.

1. First, create a backup copy of the /etc/apt/sources.list file:

sudo cp /etc/apt/sources.list /etc/apt/sources.list.bak

2. Then, open the file for editing (we are using GNU nano for text editing):

sudo nano /etc/apt/sources.list

3. Change all the references in this file from Stretch to Buster. The entries should appear as follows:

deb http://deb.debian.org/debian debian buster main

deb http://deb.debian.org/debian buster-updates main

deb http://deb.debian.org/debian buster/updates main

4. Save the file using the keyboard combination Ctrl+O and Exit by pressing Ctrl+X.

You can also check for FTP download mirrors to replace the web address .

Step 2: Upgrade from Debian 9 to Debian 10

1. Update the local package lists:

sudo apt-get update

2. Next, run updates on the software packages to prepare for the operating system upgrade:

sudo apt-get upgrade

3. Finally, run the distribution upgrade:

sudo apt-get dist-upgrade

4. Once the process completes, reboot the system to boot into Debian 10 Buster:

sudo reboot

Step 3: Verify Debian 10 Update

You can use the hostnamectl command to display the OS version with the command:

hostnamectl

The Operating System field should display Debian GNU/Linux 10 (buster).

The output should appear as:

PRETTY_NAME="Debian GNU/Linux 10 (buster)"
NAME="Debian GNU/Linux"
VERSION_ID="10"
VERSION="10 (buster)"
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

(Optional) Step 4: Remove Outdated Packages

After the upgrade to Debian 10, your system might have outdated packages and dependencies which are no longer necessary.

To remove outdated packages, run the --purge autoremove command:

sudo apt --purge autoremove

Conclusion

By following the directions above, you should have successfully upgraded from Debian 9 to Debian 10.

Source: https://phoenixnap.com/kb/how-to-upgrade-debian-9-stretch-to-debian-10-buster

HOW TO USE NMAP TO SCAN ANY PORT [UDP/TCP] [2021]

2021-12-09T17:03:00.001-08:00

We can use several NMAP command flags to scan specific TCP and UDP ports, as seen in Table 1.1 below.

Description	NMAP Command Flag
Scan all ports	*-p “”**
Scan top ports	–top-ports [number]
Scan specific ports	-p [port]
Scan ports by name	-p [name]
Scan ports by protocol	-p U:[UDP ports],T:[TCP ports]
Perform a fast scan	-F
Perform a sequential port scan	-r

Table 1.1: [NMAP Scan Any Port]: Flags summary

Let’s discuss each NMAP flag in the above table, their syntax, and use case.

Scan All Ports With NMAP

FLAG: -p “*”
Command syntax: nmap -p “*” [Target]
Description: Perform NMAP scan for all 65,535 TCP/UDP ports. This command do does not mandate elevated privileges.

The NMAP Scan All Ports flag will produce a scan for all 65,535 TCP and UDP ports on a target machine and output a list of open ports as well as the services running on a specific port [Figure 1.1].

Figure 1.1: [NMAP Scan Any Port]: Scan All Ports example.

Make sure your wildcard [*] statement is enclosed in quotes (“”); otherwise, NMAP will throw a syntax error, as seen in Figure 1.2 below.

Figure 1.2: [NMAP Scan Any Port]: Use of wrong wildcard quotes.

Scan Top Ports With NMAP

Flag: –top-ports [Number]
Command Syntax: nmap –top-ports [Number] [Target]
Description: Perform an NMAP scan by specifying the number of top-ranked ports to scan.

The NMAP Scan Top Ports flag allows us to define the number of top-ranked ports to scan. For example, let’s assume we want to scan the top commonly used 50 ports.

The NMAP command for scanning the top commonly used ports is shown below with the output in Figure 1.3.

nmap – top-ports 10000 172.16.121.134

NOTE: Remember to replace the IP address in my example with your target IP address.

Figure 1.3: [NMAP Scan Any Port]: Scan top 50 most commonly used ports.

Let’s perform another scan, this time for the top 10000 commonly used ports on a target machine using the NMAP command below and the output shown in Figure 1.4

nmap – top-ports 10000 172.16.121.134

Figure 1.4: [NMAP Scan Any Port]: Scan the top 10000 top ports.

NOTE: Top commonly used ports e.g., 10000, do not refer to the range of ports starting with, e.g., 1 to 10000.

Scan Specific Ports With NMAP

Flag: -p
Command Syntax: nmap -p [Port] [Target]
Description: Perform an NMAP scan for a specified port or range of ports.

The Scan Specific Port(s) flag instructs NMAP to perform a scan on a single port or multiple ports [separated by a comma and no spaces] on a specified target. Check out the list of the most commonly hacked ports for your reference.

Let’s practice this method by instructing NMAP to scan a single port, e.g., port 80, using the following command with the output shown in Figure 1.5.

nmap -p 80 172.16.121.134

Figure 1.5: [NMAP Scan Any Port]: Scan port 80.

Next, let’s instruct NMAP to scan multiple or a range of ports, e.g., 25, 53, 80-500 using the command below with the output seen in Figure 1.6.

nmap -p 25,53,80-500 172.16.121.134

Figure 1.6: [NMAP Scan Any Port]: Scan port 80.

Scan Ports By Name With NMAP

Flag: -p
Command Syntax: nmap -p [Port name(s)] [Target]
Description: Perform an NMAP scan for a specified port or ports.

The NMAP Scan Ports By Name uses the same -p flag as used in the previous method. Here we will instruct NMAP to scan based on the port name [http,ftp,smtp] and not a number.

NOTE: When scanning multiple ports by name, make sure you separate the name with a comma and no spaces.

The port name must match the exact name as specified in the nmap-service file.

On Windows, you can find the nmap-service file in the c:\Program Files\Nmap\ folder. On Linux/UNIX, the nmap-service file is generally located in /usr/share/nmap folder [Kali Linux 2021].

Alternatively, you can access the list of NMAP port names included in the nmap-service file HERE.

Let’s instruct NMAP to scan the FTP [21] and HTTP [80] ports on a target using the following command and the output shown in Figure 1.7.

nmap -p ftp,http 172.16.121.134

Figure 1.7: [NMAP Scan Any Port]: Scan FTP and HTTP ports using the port name.

This NMAP command flag also supports wildcard. Let’s filter all the FTP ports using the command below with the output shown in Figure 1.8.

nmap -p ftp* 172.16.121.134

Figure 1.8: [NMAP Scan Any Port]: Scan FTP and HTTP ports using the port name wildcard.

Scan Ports By Protocol With NMAP

Flag: -p
Additional Flags: U:[UDP Ports],T:[TCP Ports]
Command Syntax: nmap -p U:[UDP Ports],T:[TCP Ports] [Target]
Description: Search for a specific protocol and port combination.

As in previous examples, the Scan Ports By Protocol method uses the -p option followed by T: [for TCP ports] and U: [for UDP ports] flags. Simply said, we will instruct NMAP to scan for a specific TCP and UDP port on a target machine in a single command line.

Let’s execute a scan using this method for UDP port 53 [DNS] and TCP port 25 [SMTP], as shown in Figure 1.9 below. Pay attention to the NMAP WARNING message highlight in yellow.

Figure 1.9: [NMAP Scan Any Port]: Scan ports by protocol.

By default, NMAP scans only the TCP ports. We need to instruct NMAP to check the UDP ports as well. To do that, we need to enforce our command with the additional -sU and -sT flags.

So let’s run the command again, this time including the additional flags as shown below with the output in Figure: 1.10.

nmap -sU -sT -p U:53,T:25 172.16.121.134

Figure 1.10: [NMAP Scan Any Port]: Scan ports by protocol.

Voilà! Both TCP port 25 and UDP port 53 were successfully scanned on the target machine.

Fast Scan Flag With NMAP

FLAG: -F
Command Syntax: nmap -F [Target]
Description: Perform a fast scan of only 100 most commonly used ports. Do not mandate elevated privileges.

As explained in the previous sections, NMAP will scan by default only the commonly used 1000 ports.

The NMAP Fast Scan Flag will reduce the number of ports scanned from 1000 to 100 [commonly used ports] and drastically improve the time per scan while still providing us valuable information on the open ports in numerical order [Figure 1.11].

Figure 1.11: [NMAP Scan Any Port]: Fast Scan Flag.

But wait! There’s a catch.

Each time NMAP shows an output will automatically sort the final result. We can use the additional flag -v [verbose mode] and see the sequential port scan in real-time [Figure 1.12].

Figure 1.12: [NMAP Scan Any Port]: Example of a sequential port scan in verbose mode.

That’s it. By now, you should know how to use NMAP to scan any TCP and UDP port(s) on a target computer.

Source: https://nudesystems.com/how-to-use-nmap-to-scan-any-port-udp-tcp-2021/

Querying SQL Server Agent Job History Data

2021-06-22T21:16:00.001-07:00

Problem

Often times we are tasked with having to programmatically come with a list of durations per SQL Server Agent Job to trend the run times and order the results by date. Unfortunately Microsoft has not made that very easy in the way the data is stored in the system tables in the MSDB database. In this tip I will explain how to use the system tables to get the data into the correct format for dates and job durations.

Solution

SQL Server stores job information in the MSDB system tables. The table that stores historical job executions is msdb.dbo.sysjobhistory and the date/time information as well as the duration of the job execution is stored a little different than what you will see in most system tables. Let's dive into the tables to learn how to perform the calculations.

MSDB.dbo.sysjobhistory Table - run_date and run_time Columns

In the msdb.dbo.sysjobhistory table, the date (run_date column) and time (run_time column) are stored as two different columns and the columns are an INT data type as seen in the screenshot below.

If you were to query the sysjobhistory (joined to sysjobs of course) this is what the raw data would look like. Note run_date appears to be in YYYYMMDD format but the time is a little trickier. It is in format HHMMSS and not always 6 numbers long as you can see in this example the times are 3:30 AM represented by 33000 in the run_time column.

The result set in the picture above was generated by running the following T-SQL script:

select 
 j.name as 'JobName',
 run_date,
 run_time
From msdb.dbo.sysjobs j 
INNER JOIN msdb.dbo.sysjobhistory h 
 ON j.job_id = h.job_id 
where j.enabled = 1  --Only Enabled Jobs
order by JobName, run_date, run_time desc

This can be very confusing when trying to analyze these results and more importantly trying to order results by date and time, which as a common practice for DBA's. There are many ways to get the date/time into a true DATETIME format and I have seen some very creative scripts over the years. Starting in SQL Server 2005 there is an system scalar function located in MSDB that will convert this for you. I say it is undocumented as I could not find a BOL article for it. The function name is MSDB.dbo.agent_datetime(run_date, run_time) and will return a nicely formatted DATETIME column that is much easier to use programmatically. Below is the same query as the first one above with just an additional column that is a call to this function.

select 
 j.name as 'JobName',
 run_date,
 run_time,
 msdb.dbo.agent_datetime(run_date, run_time) as 'RunDateTime'
From msdb.dbo.sysjobs j 
INNER JOIN msdb.dbo.sysjobhistory h 
 ON j.job_id = h.job_id 
where j.enabled = 1  --Only Enabled Jobs
order by JobName, RunDateTime desc

Below are the results that this query produces and the nicely formatted DATETIME column at the end. This makes sorting easy as well as date range queries against your SQL Agent Jobs.

How to monitor backup and restore progress in SQL Server

2021-06-08T17:06:00.004-07:00

Below script can give us a summary of current backups and restores which are happening on the server:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
`SELECT` `r.session_id` `AS` `[Session_Id]`
    `,r.command` `AS` `[command]`
    `,CONVERT(NUMERIC(6, 2), r.percent_complete)` `AS` `[% Complete]`
    `,GETDATE()` `AS` `[Current` `Time]`
    `,CONVERT(VARCHAR(20), DATEADD(ms, r.estimated_completion_time, GetDate()), 20)` `AS` `[Estimated Completion` `Time]`
    `,CONVERT(NUMERIC(32, 2), r.total_elapsed_time / 1000.0 / 60.0)` `AS` `[Elapsed` `Min]`
    `,CONVERT(NUMERIC(32, 2), r.estimated_completion_time / 1000.0 / 60.0)` `AS` `[Estimated` `Min]`
    `,CONVERT(NUMERIC(32, 2), r.estimated_completion_time / 1000.0 / 60.0 / 60.0)` `AS` `[Estimated Hours]`
    `,CONVERT(VARCHAR(1000), (`
            `SELECT` `SUBSTRING(TEXT, r.statement_start_offset / 2,` `CASE`
                        `WHEN` `r.statement_end_offset = - 1`
                            `THEN` `1000`
                        `ELSE` `(r.statement_end_offset - r.statement_start_offset) / 2`
                        `END)` `'Statement text'`
            `FROM` `sys.dm_exec_sql_text(sql_handle)`
            `))`
`FROM` `sys.dm_exec_requests r`
`WHERE` `command` `like` `'RESTORE%'`
`or` `command` `like` `'BACKUP%'`

Source:

https://blog.sqlauthority.com/2017/03/12/get-status-running-backup-restore-sql-server-interview-question-week-113/

How to get a backup SQL database history

2021-06-08T17:02:00.004-07:00

How to get a backup SQL database history

This article will review how to get information on your backup SQL database history, including the metadata in MSDB that can be queried, as well as value-added tools and features to group, sort, report, and export this critical information

It is essential for each organization to define the backup policy in its environment. Such policies help to recover the database with minimum loss of the data and minimum downtime. SQL Server maintains a backup history in the system database msdb. We might be taking different kinds of backups to the main minimum restoration time. In the case of any disaster, we must know exactly how to get the data from this internal table and prepare the restoration plan accordingly. In this article, we will understand the way to retrieve the database backup history to meet these critical business requirements.

Below are tables in the msdb database for the database backups.

Backupfile

This table contains the row for each data or log file of the database for which we executed the backup SQL database. In the following image, we can see essential columns of this table:

SELECT [filegroup_name]
      ,[backed_up_page_count]
      ,[file_type]
      ,[file_size]
      ,[logical_name]
      ,[physical_name]
  ,State
      ,[state_desc]
      ,[backup_size]
  ,[differential_base_lsn]
 FROM [msdb].[dbo].[backupfile]

filegroup_name: It shows the filegroup name of the data or log file. We do not have any filegroup for the log file therefore; this column can contain NULL value.

backed_up_page_count: It shows the page count backed up.

file_type: We can get the file type using this field. It can have following values.

D: SQL Server data file
L: SQL Server log file
F: Full-text catalog
S: Memory optimised file

Logical_name: Logical name of the database file.

Physical_name: backup physical location.

State: It gives the state information of particular file. We can have following values for this.

0 = ONLINE
1 = RESTORING
2 = RECOVERING
3 = RECOVERY PENDING
4 = SUSPECT
6 = OFFLINE
7 = DEFUNCT
8 = DROPPED

backup_size: It gives the backup SQL database size in bytes.

differential_base_lsn: SQL Server takes a differential backup for the extents having LSN greater than differential_base_lsn.

backupmediafamily

In this table, we get the information about the logical and physical backup SQL database file name along with the device type in which backup was taken:

select logical_device_name ,physical_device_name,device_type from backupmediafamily

In the above screenshot, we can have the following device types:

2 = Disk
5 = Tape
7 = Virtual device
9 = Azure Storage
105 = A permanent backup SQL database device

Backupset

In this table, we can get information about the successful backup for each database:

select name,user_name,first_lsn,last_lsn,database_backup_lsn,backup_start_date,backup_finish_date,
  type,database_name,server_name,machine_name from backupset

Name: backup SQL database set description
User_name: We can get a user who executed this backup from this column
Fist_lsn,last_lsn and database_backup_lsn: We get the backup LSN information from this column. It can help us to identify the backups after a particular LSN or preparing a restoration plan for a database
Backup_start_date and backup_finish_date: It gives the backup start and ends time
Server_name: It shows the instance name of the server
Machine_name: we can get the name of the machine from which we took the backup
Type: We can get the backup type using this column value. Here we have the following values
D: Full database backup.
L: log backup
I: Differential database backup

We need to join these multiple tables to get the relevant backup information. For example, we can get the backup history from yesterday using the below query:

SELECT 
CONVERT(CHAR(100), SERVERPROPERTY('Servername')) AS Server, 
msdb.dbo.backupset.database_name, 
msdb.dbo.backupset.backup_start_date, 
msdb.dbo.backupset.backup_finish_date, 
CASE msdb..backupset.type 
WHEN 'D' THEN 'Database' 
WHEN 'L' THEN 'Log' 
When 'I' THEN 'Differential database'
END AS backup_type, 
msdb.dbo.backupset.backup_size, 
msdb.dbo.backupmediafamily.physical_device_name, 
msdb.dbo.backupset.name AS backupset_name
FROM msdb.dbo.backupmediafamily 
INNER JOIN msdb.dbo.backupset ON msdb.dbo.backupmediafamily.media_set_id = msdb.dbo.backupset.media_set_id 
WHERE (CONVERT(datetime, msdb.dbo.backupset.backup_start_date, 102) >= GETDATE()-1 ) 
ORDER BY 
msdb.dbo.backupset.backup_finish_date desc

We might want to get a list of the most recent full backup of all the databases:

SELECT  
   CONVERT(CHAR(100), SERVERPROPERTY('Servername')) AS Server, 
   msdb.dbo.backupset.database_name,  
   MAX(msdb.dbo.backupset.backup_finish_date) AS last_db_backup_date 
FROM   msdb.dbo.backupmediafamily  
   INNER JOIN msdb.dbo.backupset ON msdb.dbo.backupmediafamily.media_set_id = msdb.dbo.backupset.media_set_id  
WHERE  msdb..backupset.type = 'D' 
GROUP BY 
   msdb.dbo.backupset.database_name

It is also equally important to identify if there are any databases for which we are not taking any backups. We can run the below query to get a list of such databases:

SELECT      
      S.NAME AS database_name,  
      'Nobackups' AS [Backup Age (Hours)]  
FROM 
   master.dbo.sysdatabases S LEFT JOIN msdb.dbo.backupset B
       ON S.name  = B.database_name 
WHERE B.database_name IS NULL AND S.name <> 'tempdb'
ORDER BY  
   B.database_name

In my test instance, you can see many databases having no database backups:

It does become difficult to get the backup information each time based on the requirement. We need to write the code and get the data accordingly. We might be having different kinds of environments having different database needs, and if we have a large database environment, it becomes difficult to get this data. We might report backup failures or backup reports to the management. In such a case, we need a central place from which we can get any backup information for any database in the instance.

In SQL Server, you can do it using the central management server with the combination of SSIS, SSRS tools however it requires a good level of knowledge of the development of the information using these code but again if requirement changes, we need to make changes at all places to reflect the change.

Source:

https://solutioncenter.apexsql.com/how-to-get-a-backup-sql-database-history/

Active Directory User Password Age command: Using Net User command to Display User Expiration Date

2020-05-31T17:21:00.003-07:00

Using Net User command to Display User Expiration Date

This first method uses the net user command that is built into windows. This command is used to add, remove and make changes to user and computer accounts.

To determine when the password will expire for a single account open the command prompt and type the following command:

Net user USERNAME /domain

In the below screenshot is an example for the user mfoster.

In addition to displaying the password expires date it also provides other useful information such as password last set, when the password can be changed, if the account is active and so on.

(Solved) error: Something went wrong and your search couldn't be completed it looks like theres a problem with your network connection Outlook 2016 - Exchange 2016

2020-05-13T17:30:00.002-07:00

This will stop the error, but Outlook will no longer perform any online searches:

HKEY_CURRENT_USER\software\microsoft\office\16.0\outlook\search
DWORD DisableServerAssistedSearch 1

Disable WSUS on Windows 10 by Registry Modification

2020-01-22T00:02:00.002-08:00

Disable WSUS on Windows 10 by Registry Modification

This method is simple and easy. As an end-user, you can perform on your computer.

Note: This is just a temporary solution. If you connect back the computer to the company network, the WSUS group policy will be applied automatically and revert the changes we are going to do below. The ideal permanent solution is to move your computer to the different OU where WSUS policy not applied, which can be done by the network/Windows update administrator only. So, as a computer user, we have only below option to disable WSUS on Windows 10.

To make Windows update/component to download from Microsoft online Windows update servers via the direct Internet, we can do these steps.

1) Open Registry editor (Type regedit in Search), and access following location.

HKLM/Software/Policies/Microsoft/Windows/WindowsUpdate/AU/

2) Change the value from 1 to 0 in UseWUServer key. 1 is to use WSUS server and 0 for not.

3) Once you have changed the above key from 1 to 0, close the registry editor and restart Windows update service. Even if you are okay, restart the computer to take effect.

Now connect the computer to direct Internet and try Windows update or any other component installation from the Microsoft Update website. It should work fine this time.

You may need to check some more guides here about Windows update issues.

How to enable Remote Administration feature in Windows

2020-01-22T00:01:00.000-08:00

To enable the Remote Administration feature manually, follow the steps given below:

Click start>Run
Enter gpedit.msc
Click OK
Double-click Computer Configuration>Administrative Templates>Network>Network Connections>Windows Firewall
Double-click Domain Profile>Windows Firewall: Allow remote administration exception
Select Enabled
Click Apply
Click OK

Links to refer deployment of several applications on SCCM

2020-01-15T19:32:00.002-08:00

Deployment of 7-zip, Notepad++, Google Chrome, Adobe Flash Player and upgrade superseded applications.

https://www.youtube.com/watch?v=G4iyyq_UlDA&t=554s

Deployment of 7-Zip with more troubleshooting.

https://www.youtube.com/watch?v=57YB_w-5iBc

Deployment of SSMS

https://www.prajwaldesai.com/deploy-sql-server-management-studio-using-sccm/

Deployment of Adobe Acrobat Reader DC

https://www.andersrodland.com/deploy-acrobat-reader-dc-with-sccm/

Deployment of Snagit 12

https://www.prajwaldesai.com/deploy-snagit-using-sccm/

How to let websites and IPs bypass the VPN using static routing

2019-08-08T17:23:00.005-07:00

There are several reasons for letting certain IPs or websites bypass the VPN connection, so they are used with your real IP and connection instead.

For example:

if a certain website is blocking access to foreign IPs, so you can only access it with your real IP
if websites and services forbid the use of VPN, so your account won't get restricted or suspended
if you cannot access a local machine in your network while the VPN is connected (e.g. server, other computer or network device of any kind)

Manual setup via route.exe

On windows, to create static routing rules to let IPs bypass the VPN, you need to use the integrated tool "route.exe" of Windows.
You can find it in the folder C:\Windows\System32 - but it's executable from any place.

To use it, open a command prompt. Run "cmd.exe" or navigate to "All Programs/Accessories/Command Prompt" in the start menu.

Run "route" to get the instructions for how to use this tool. How to use it for our purpose (IPs bypassing the VPN) is quickly explained:

First you need to find your gateway IP address. This is usually the IP of your router/DSL-Modem, so the device your computer gets the internet from.
If you're not sure which IP that is, please run "route print".
You'll see that certain IPs are using a gateway address that belongs into your local network. In this case, 192.168.88.2 is our gateway IP address, the IP of the router
Keep that gateway IP address in mind. Now we need to get the IP of the website you want to bypass the VPN. For testing, we can use http://ipaddress.com
As you might know, this website shows your current IP and location. When disconnected from the VPN, go there and you'll see your real IP and location.
To get the IP of that website, you can simply ping it by running "ping ipadress.com". It returns the IP address, which is: 80.237.246.185
Alternatively use websites like http://www.hcidata.info/host2ip.htm for this purpose
Now we create a routing rule for this website, by running "route add 80.237.246.185 192.168.88.2" (syntax: route add destinationIP gatewayIP)
When that is done, connect to the VPN and visit http://ipaddress.com again. You'll notice that it still shows your real IP and location, instead the VPN IP and location.
That means the routing rule is working and the website is bypassing the VPN.

Note: This rules are only temporary, that means they disappear upon next reboot.
To make them permanent, use the switch "-p", so e.g. "route -p add 80.237.246.185 192.168.88.2"

Source: https://en.wikiversity.org/wiki/Computer_Networks/Route/Modify

33 Tools to Monitor Linux Performance

2019-06-13T17:49:00.000-07:00

1. Top – Linux Process Monitoring

Linux Top command is a performance monitoring program which is used frequently by many system administrators to monitor Linux performance and it is available under many Linux/Unix like operating systems. The top command used to dipslay all the running and active real-time processes in ordered list and updates it regularly. It display CPU usage, Memory usage, Swap Memory, Cache Size, Buffer Size, Process PID, User, Commands and much more. It also shows high memory and cpu utilization of a running processess. The top command is much userful for system administrator to monitor and take correct action when required. Let’s see top command in action.

# top

Top Command Example

For more examples of Top command read : 12 TOP Command Examples in Linux

2. VmStat – Virtual Memory Statistics

Linux VmStat command used to display statistics of virtual memory, kernerl threads, disks, system processes, I/O blocks, interrupts, CPU activity and much more. By default vmstat command is not available under Linux systems you need to install a package called sysstat that includes a vmstat program. The common usage of command format is.

# vmstat

procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu-----
 r  b   swpd   free  inact active   si   so    bi    bo   in   cs us sy id wa st
 1  0      0 810420  97380  70628    0    0   115     4   89   79  1  6 90  3  0

For more Vmstat examples read : 6 Vmstat Command Examples in Linux

3. Lsof – List Open Files

Lsof command used in many Linux/Unix like system that is used to display list of all the open files and the processes. The open files included are disk files, network sockets, pipes, devices and processes. One of the main reason for using this command is when a disk cannot be unmounted and displays the error that files are being used or opened. With this commmand you can easily identify which files are in use. The most common format for this command is.

# lsof

COMMAND     PID      USER   FD      TYPE     DEVICE     SIZE       NODE NAME
init          1      root  cwd       DIR      104,2     4096          2 /
init          1      root  rtd       DIR      104,2     4096          2 /
init          1      root  txt       REG      104,2    38652   17710339 /sbin/init
init          1      root  mem       REG      104,2   129900     196453 /lib/ld-2.5.so
init          1      root  mem       REG      104,2  1693812     196454 /lib/libc-2.5.so
init          1      root  mem       REG      104,2    20668     196479 /lib/libdl-2.5.so
init          1      root  mem       REG      104,2   245376     196419 /lib/libsepol.so.1
init          1      root  mem       REG      104,2    93508     196431 /lib/libselinux.so.1
init          1      root   10u     FIFO       0,17                 953 /dev/initctl

More lsof command usage and examples : 10 lsof Command Examples in Linux

4. Tcpdump – Network Packet Analyzer

Tcpdump one of the most widely used command-line network packet analyzer or packets sniffer program that is used capture or filter TCP/IP packets that received or transferred on a specific interface over a network. It also provides a option to save captured packages in a file for later analysis. tcpdump is almost available in all major Linux distributions.

# tcpdump -i eth0

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
22:08:59.617628 IP tecmint.com.ssh > 115.113.134.3.static-mumbai.vsnl.net.in.28472: P 2532133365:2532133481(116) ack 3561562349 win 9648
22:09:07.653466 IP tecmint.com.ssh > 115.113.134.3.static-mumbai.vsnl.net.in.28472: P 116:232(116) ack 1 win 9648
22:08:59.617916 IP 115.113.134.3.static-mumbai.vsnl.net.in.28472 > tecmint.com.ssh: . ack 116 win 64347

For more tcpdump usage read : 12 Tcpdump Command Examples in Linux

5. Netstat – Network Statistics

Netstat is a command line tool for monitoring incoming and outgoing network packets statistics as well as interface statistics. It is very useful tool for every system administrator to monitor network performance and troubleshoot network related problems.

# netstat -a | more

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State
tcp        0      0 *:mysql                     *:*                         LISTEN
tcp        0      0 *:sunrpc                    *:*                         LISTEN
tcp        0      0 *:realm-rusd                *:*                         LISTEN
tcp        0      0 *:ftp                       *:*                         LISTEN
tcp        0      0 localhost.localdomain:ipp   *:*                         LISTEN
tcp        0      0 localhost.localdomain:smtp  *:*                         LISTEN
tcp        0      0 localhost.localdomain:smtp  localhost.localdomain:42709 TIME_WAIT
tcp        0      0 localhost.localdomain:smtp  localhost.localdomain:42710 TIME_WAIT
tcp        0      0 *:http                      *:*                         LISTEN
tcp        0      0 *:ssh                       *:*                         LISTEN
tcp        0      0 *:https                     *:*                         LISTEN

More Netstat examples : 20 Netstat Command Examples in Linux.

6. Htop – Linux Process Monitoring

Htop is a much advanced interactive and real time Linux process monitoring tool. This is much similar to Linux top command but it has some rich features like user friendly interface to manage process, shortcut keys, vertical and horizontal view of the processes and much more. Htop is a third party tool and doesn’t included in Linux systems, you need to install it using YUM package manager tool. For more information on installation read our article below.

# htop

Htop Command Example Screenshot

For Htop installation read : Install Htop (Linux Process Monitoring) in Linux

7. Iotop – Monitor Linux Disk I/O

Iotop is also much similar to top command and Htop program, but it has accounting function to monitor and display real time Disk I/O and processes. This tool is much useful for finding the exact process and high used disk read/writes of the processes.

# iotop

Iotop Command Example Screenshot

For Ioptop installation and usage read : Install Iotop in Linux

8. Iostat – Input/Output Statistics

IoStat is simple tool that will collect and show system input and output storage device statistics. This tool is often used to trace storage device performance issues including devices, local disks, remote disks such as NFS.

# iostat

Linux 2.6.18-238.9.1.el5 (tecmint.com)         09/13/2012

avg-cpu:  %user   %nice %system %iowait  %steal   %idle
           2.60    3.65    1.04    4.29    0.00   88.42

Device:            tps   Blk_read/s   Blk_wrtn/s   Blk_read   Blk_wrtn
cciss/c0d0       17.79       545.80       256.52  855159769  401914750
cciss/c0d0p1      0.00         0.00         0.00       5459       3518
cciss/c0d0p2     16.45       533.97       245.18  836631746  384153384
cciss/c0d0p3      0.63         5.58         3.97    8737650    6215544
cciss/c0d0p4      0.00         0.00         0.00          8          0
cciss/c0d0p5      0.63         3.79         5.03    5936778    7882528
cciss/c0d0p6      0.08         2.46         2.34    3847771    3659776

For more Iostat usage and examples visit : 6 Iostat Command Examples in Linux

9. IPTraf – Real Time IP LAN Monitoring

IPTraf is an open source console-based real time network (IP LAN) monitoring utility for Linux. It collects a variety of information such as IP traffic monitor that passes over the network, including TCP flag information, ICMP details, TCP/UDP traffic breakdowns, TCP connection packet and byne counts. It also gathers information of general and detaled interface statistics of TCP, UDP, IP, ICMP, non-IP, IP checksum errors, interface activity etc.

IP Traffic Monitor

For more information and usage of IPTraf tool, please visit : IPTraf Network Monitoring Tool

10. Psacct or Acct – Monitor User Activity

psacct or acct tools are very useful for monitoring each users activity on the system. Both daemons runs in the background and keeps a close watch on the overall activity of each user on the system and also what resources are being consumed by them.

These tools are very useful for system administrators to track each users activity like what they are doing, what commands they issued, how much resources are used by them, how long they are active on the system etc.

For installation and example usage of commands read the article on Monitor User Activity with psacct or acct

11. Monit – Linux Process and Services Monitoring

Monit is a free open source and web based process supervision utility that automatically monitors and managers system processes, programs, files, directories, permissions, checksums and filesystems.

It monitors services like Apache, MySQL, Mail, FTP, ProFTP, Nginx, SSH and so on. The system status can be viewed from the command line or using it own web interface.

Monit Linux Process Monitoring

12. NetHogs – Monitor Per Process Network Bandwidth

NetHogs is an open source nice small program (similar to Linux top command) that keeps a tab on each process network activity on your system. It also keeps a track of real time network traffic bandwidth used by each program or application.

NetHogs Linux Bandwidth Monitoring

13. iftop – Network Bandwidth Monitoring

iftop is another terminal-based free open source system monitoring utility that displays a frequently updated list of network bandwidth utilization (source and destination hosts) that passing through the network interface on your system. iftop is considered for network usage, what ‘top‘ does for CPU usage. iftop is a ‘top‘ family tool that monitor a selected interface and displays a current bandwidth usage between two hosts.

iftop – Network Bandwidth Monitoring

14. Monitorix – System and Network Monitoring

Monitorix is a free lightweight utility that is designed to run and monitor system and network resources as many as possible in Linux/Unix servers. It has a built in HTTP web server that regularly collects system and network information and display them in graphs. It Monitors system load average and usage, memory allocation, disk driver health, system services, network ports, mail statistics (Sendmail, Postfix, Dovecot, etc), MySQL statistics and many more. It designed to monitor overall system performance and helps in detecting failures, bottlenecks, abnormal activities etc.

Monitorix Monitoring

15. Arpwatch – Ethernet Activity Monitor

Arpwatch is a kind of program that is designed to monitor Address Resolution (MAC and IP address changes) of Ethernet network traffic on a Linux network. It continuously keeps watch on Ethernet traffic and produces a log of IP and MAC address pair changes along with a timestamps on a network. It also has a feature to send an email alerts to administrator, when a pairing added or changes. It is very useful in detecting ARP spoofing on a network.

16. Suricata – Network Security Monitoring

Suricata is an high performance open source Network Security and Intrusion Detection and Prevention Monitoring System for Linux, FreeBSD and Windows.It was designed and owned by a non-profit foundation OISF(Open Information Security Foundation).

17. VnStat PHP – Monitoring Network Bandwidth

VnStat PHP a web based frontend application for most popular networking tool called “vnstat“. VnStat PHPmonitors a network traffic usage in nicely graphical mode. It displays a total IN and OUT network traffic usage in hourly, daily, monthly and full summary report.

18. Nagios – Network/Server Monitoring

Nagios is an leading open source powerful monitoring system that enables network/system administrators to identify and resolve server related problems before they affect major business processes. With the Nagios system, administrators can able to monitor remote Linux, Windows, Switches, Routers and Printers on a single window. It shows critical warnings and indicates if something went wrong in your network/server which indirectly helps you to begin remediation processes before they occur.

19. Nmon: Monitor Linux Performance

Nmon (stands for Nigel’s performance Monitor) tool, which is used to monitor all Linux resources such as CPU, Memory, Disk Usage, Network, Top processes, NFS, Kernel and much more. This tool comes in two modes: Online Mode and Capture Mode.

The Online Mode, is used for real-time monitoring and Capture Mode, is used to store the output in CSV format for later processing.

Nmon Monitoring

20. Collectl: All-in-One Performance Monitoring Tool

Collectl is a yet another powerful and feature rich command line based utility, that can be used to gather information about Linux system resources such as CPU usage, memory, network, inodes, processes, nfs, tcp, sockets and much more.

Collectl Monitoring

21. Glances – Real Time System Monitoring

Glances is a monitoring tool built to present as much information as possible in any terminal size, it automatically takes the terminal window size it runs on, in other words, it’s a responsive monitoring tool.

Glances

Features

Licensed under LGPL and written in Python.

Cross-platform, it works on Windows, Mac, BSD and Linux.

Available in most Linux official repositories.

A It gives a lot of information about your system.

Built using curses.

Read More: Install Glances on RHEL/CentOS/Fedora and Ubuntu/Debian

22. Sarg – Squid Bandwidth Monitoring

Sarg (Squid Analysis Report Generator) is a free & open-source tool which act as a monitoring tool for your Squid proxy server, it creates reports about your Squid proxy server users, IP addresses, the sites they visit beside some other information.

Sarg Monitors Squid Logs

Features of Sarg

Licensed under GPL 2 and available in many languages.

Works under Linux & FreeBSD.

Generates report in HTML format.

Very easy to install & use.

Read More: Install Sarg “Squid Bandwidth Monitoring” Tool in Linux

23. Apache Status Monitoring

Apache Module mod_status is an Apache server module that allows you to monitor the workers status of the Apache server. It generates a report in an easy to read HTML format. It shows you the status of all the workers, how much CPU each one using, and what requests are currently handled and number of working and not working workers.

Apache Status Monitoring

Read More: Apache Web Server Load and Page Statistics Monitoring

24. Monit – Linux Process and Services Monitoring

Monit is a nice program that monitors your Linux & Unix server, it can monitor everything you have on your server, from the main server (Apache, Nginx..) to files permissions, files hashes and web services. Plus a lot of things.

Monit: Linux Process Monitoring

Features of Monit

Free & open-source, released under AGPL and written in C.

It can be started from the command line interface or via its special web interface.

Very effective in monitoring all the software on your system and services.

A nice web interface with beautiful charts for CPU and RAM usage.

Monit can automatically take actions in emergency situations.

A lot more..

Read More: Install Monit Tool in RHEL/CentOS/Fedora and Ubuntu/Debian

25. Sysstat – All-in-One System Performance Monitoring

Another monitoring tool for your Linux system. Sysstat is not a real command in fact, it’s just the name of the project, Sysstat in fact is a package that includes many performance monitoring tools like iostat, sadf, pidstat beside many other tools which shows you many statistics about your Linux OS.

Sysstat: Linux Statistics Monitoring

Features of Sysstat

Available in many Linux distributions repositories by default.

Ability to create statistics about RAM, CPU, SWAP usage. Beside the ability to monitor Linux kernel activity, NFS server, Sockets, TTY and filesystems.

Ability to monitor input & output statistics for devices, tasks.. etc.

Ability to output reports about network interfaces and devices, with support for IPv6.

Sysstat can show you the power statistics (usage, devices, the fans speed.. etc) as well.

Many other features..

Read More: Install Sysstat in Linux and 20 Useful Commands of Sysstat

26. Icinga – Next Generation Server Monitoring

Unlike the other tools, Icinga is a network monitoring program, it shows you many options and information about your network connections, devices and processes, it’s a very good choice for those who are looking for a good tool to monitor their networking stuffs.

Icinga Monitoring Tool

Features of Icinga

Icinga is also free and open-source.

Very functional in monitoring everything you may have in networking.

Support for MySQL and PostgreSQL is included.

Real-time monitoring with A nice web interface.

Very expendable with modules and extensions.

Icinga supports applying services and actions to hosts.

A lot more to discover..

Read More: Install Icinga in RHEL/CentOS 7/6

27. Observium – Network Management and Monitoring

Observium is also a network monitoring tool, it was designed to help you manage your network of servers easily, there are 2 versions from it; Community Edition which is free & open-source and Commercial version which costs £150/year.

Observium: Linux Network Monitoring

Features of Observium

Written in PHP with MySQL database support.

Has a nice web interface to output information and data.

Ability to manage and monitor hundreds of hosts worldwide.

The community version from it is licensed under QPL license.

Works on Windows, Linux, FreeBSD and more.

Read More: Observium – Network Management and Monitoring Tool for RHEL/CentOS

28. Web VMStat – System Statistics Monitoring

Web VMStat is a very simple web application programmer, that provides a real time system information usage, from CPU to RAM, Swap and input/output information in html format.

Web VMStat Tool for Linux

Read More: Web VMStat: A Real Time System Statistics Tool for Linux

29. PHP Server Monitoring

Unlike the other tools on this list, PHP Server Monitoring is a web script written in PHP that helps you to manage you websites and hosts easily, it supports MySQL database and is released under GPL 3 or later.

PHP Server Monitor

Features

A nice web interface.

Ability to send notifications to you via Email & SMS.

Ability to view the most important information about CPU and RAM.

A very modern logging system to log connection errors and emails that are sent.

Support for cronjob services to help you monitor your servers and websites automatically.

Read More: Install PHP Server Monitoring Tool in Arch Linux

30. Linux Dash – Linux Server Performance Monitoring

From its name, “Linux Dash” is a web dashboard that shows you the most important information about your Linux systems such as RAM, CPU, file-system, running processes, users, bandwidth usage in real time, it has a nice GUI and it’s free & open-source.

Linux Dash Tool

Read More: Install Linux Dash (Linux Performance Monitoring) Tool in Linux

31. Cacti – Network and System Monitoring

Cacti is nothing more than a free & open-source web interface for RRDtool, it is used often to monitor the bandwidth using SNMP (Simple Network Management Protocol), it can be used also to monitor CPU usage.

Cacti Network Monitoring

Features of Cacti

Free & open-source, released under GPL license.

Written in PHP with PL/SQL.

A cross-platform tool, it works on Windows and Linux.

User management; you may create different users accounts for Cacti.

Read More: Install Cacti Network and System Monitoring Tool in Linux

32. Munin – Network Monitoring

Munin is also a web interface GUI for RRDtool, it was written in Perl and licensed under GPL, Munin is a good tool to monitor systems, networks, applications and services. It works on all Unix-like operating systems and has a nice plugin system; there are 500 different plugin available to monitor anything you want on your machine. A notifications system is available to send messages to the administrator when there’s an error or when the error is resolved.

Munin Network Monitoring

Read More: Install Munin Network Monitoring Tool in Linux

33. Wireshark – Network Protocol Analyzer

Also, unlike all the other tools on our list, Wireshark is an analyzer desktop program which is used to analyze network packets and to monitor network connections. It’s written in C with the GTK+ library and released under the GPL license.

Wireshark Network Analyzer

Features

Cross-platform: it works on Linux, BSD , Mac OS X and Windows.

Command line support: there’s a command line based version from Wireshark to analyze data.

Ability to capture VoIP calls, USB traffic, network data easily to analyze it.

Available in most Linux distributions repositories.

Set up public-key authentication using SSH on a Linux or macOS computer

2019-06-11T21:24:00.000-07:00

To set up public-key authentication using SSH on a Linux or macOS computer:

Log into the computer you'll use to access the remote host, and then use command-line SSH to generate a key pair using the RSA algorithm.
To generate RSA keys, on the command line, enter:
```
ssh-keygen -t rsa
```
You will be prompted to supply a filename (for saving the key pair) and a password (for protecting your private key):
- Filename: To accept the default filename (and location) for your key pair, press Enter or Returnwithout entering a filename.
  Alternatively, you can enter a filename (for example, my_ssh_key) at the prompt, and then press Enteror Return. However, many remote hosts are configured to accept private keys with the default filename and path (~/.ssh/id_rsa for RSA keys) by default. Consequently, to authenticate with a private key that has a different filename, or one that is not stored in the default location, you must explicitly invoke it either on the SSH command line or in an SSH client configuration file (~/.ssh/config); see below for instructions.
- Password: Enter a password that contains at least five characters, and then press Enter or Return. If you press Enter or Return without entering a password, your private key will be generated without password-protection.
  
  Important:
  
  If you don't password-protect your private key, anyone with access to your computer conceivably can SSH (without being prompted for a password) to your account on any remote system that has the corresponding public key.
Your private key will be generated using the default filename (for example, id_rsa) or the filename you specified (for example, my_ssh_key), and stored on your computer in a .ssh directory off your home directory (for example, ~/.ssh/id_rsa or ~/.ssh/my_ssh_key).

The corresponding public key will be generated using the same filename (but with a .pub extension added) and stored in the same location (for example, ~/.ssh/id_rsa.pub or ~/.ssh/my_ssh_key.pub).
Use SFTP or SCP to copy the public key file (for example, ~/.ssh/id_rsa.pub) to your account on the remote system (for example, darvader@deathstar.empire.gov); for example, using command-line SCP:
```
scp ~/.ssh/id_rsa.pub darvader@deathstar.empire.gov:
```
You'll be prompted for your account password. Your public key will be copied to your home directory (and saved with the same filename) on the remote system.
Log into the remote system using your account username and password.

Note:

If the remote system is not configured to support password-based authentication, you will need to ask system administrators to add your public key to the ~/.ssh/authorized_keys file in your account (if your account doesn't have ~/.ssh/authorized_keys file, system administrators can create one for you). Once your public key is added to your ~/.ssh/authorized_keys file on the remote system, the setup process is complete, and you should now be able to SSH to your account from the computer that has your private key.
If your account on the remote system doesn't already contain a ~/.ssh/authorized_keys file, create one; on the command line, enter the following commands:
```
mkdir -p ~/.ssh
touch ~/.ssh/authorized_keys
```
Note:

If your account on the remote system already has a ~/.ssh/authorized_keys file, executing these commands will not damage the existing directory or file.
On the remote system, add the contents of your public key file (for example, ~/id_rsa.pub) to a new line in your ~/.ssh/authorized_keys file; on the command line, enter:
```
cat ~/id_rsa.pub >> ~/.ssh/authorized_keys
```
You may want to check the contents of ~/.ssh/authorized_keys to make sure your public key was added properly; on the command line, enter:
```
more ~/.ssh/authorized_keys
```
You may now safely delete the public key file (for example, ~/id_rsa.pub) from your account on the remote system; on the command line, enter:
```
rm ~/id_rsa.pub
```
Alternatively, if you prefer to keep a copy of your public key on the remote system, move it to your .sshdirectory; on the command line, enter:
```
mv ~/id_rsa.pub ~/.ssh/
```
Optionally, repeat steps 3-7 to add your public key to other remote systems that you want to access from the computer that has your private key using SSH public-key authentication.
You now should be able to SSH to your account on the remote system (for example, username@host2.somewhere.edu) from the computer (for example, host1) that has your private key (for example, ~/.ssh/id_rsa):
- If your private key is password-protected, the remote system will prompt you for the password or passphrase (your private key password/passphrase is not transmitted to the remote system):
```
[username@host1 ~]$ ssh username@host2.somewhere.edu
Enter passphrase for key '/username/Host1/.ssh/id_rsa':
Last login: Mon Oct 20 09:23:17 2014 from host1.somewhere_else.edu
```
- If your private key is not password-protected, the remote system will place you on the command line in your home directory without prompting you for a password or passphrase:
```
[username@host1 ~]$ ssh username@host2.somewhere.edu
Last login: Mon Oct 20 09:23:17 2014 from host1.somewhere_else.edu
```
If the private key you're using does not have the default name, or is not stored in the default path (not ~/.ssh/id_rsa), you must explicitly invoke it in one of two ways:

On the SSH command line: Add the -i flag and the path to your private key.
For example, to invoke the private key host2_key, stored in the ~/.ssh/old_keys directory, when connecting to your account on a remote host (for example, username@host2.somewhere.edu), enter:
```
ssh -i ~/.ssh/old_keys/host2_key username@host2.somewhere.edu
```
In an SSH client configuration file: SSH gets configuration data from the following sources (in this order):
1. From command-line options
2. From the user's client configuration file (~/.ssh/config), if it exists
3. From the system-wide client configuration file (/etc/ssh/ssh_config)
The SSH client configuration file is a text file containing keywords and arguments. To specify which private key should be used for connections to a particular remote host, use a text editor to create a ~/.ssh/config that includes the Host and IdentityFile keywords.

For example, for connections to host2.somewhere.edu, to make SSH automatically invoke the private key host2_key, stored in the ~/.ssh/old_keys directory, create a ~/.ssh/config file with these lines included:
```
Host host2.somewhere.edu
IdentityFile ~/.ssh/old_keys/host2_key
```
Once you save the file, SSH will use the specified private key for future connections to that host.

You can add multiple Host and IdentityFile directives to specify a different private key for each host listed; for example:
```
Host host2.somewhere.edu
IdentityFile ~/.ssh/old_keys/host2_key

Host host4.somewhere.edu
IdentityFile ~/.ssh/old_keys/host4_key

Host host6.somewhere.edu
IdentityFile ~/.ssh/old_keys/host6_key
```
Alternatively, you can use a single asterisk ( * ) to provide global defaults for all hosts (specify one private key for several hosts); for example:
```
Host *.somewhere.edu
IdentityFile ~/.ssh/old_keys/all_hosts_key
```
For more about the SSH client configuration file, see the OpenSSH SSH client configuration file on the web or from the command line (man ssh_config).

Source: https://kb.iu.edu/d/aews

List sudo or super users in Linux

2019-06-04T21:53:00.000-07:00

Let us first list all users in the system. To do so, run:

$ awk -F':' '{ print $1}' /etc/passwd

Sample output from my Ubuntu system:

root

daemon

bin

sys

sync

games

man

mail

news

uucp

proxy

www-data

backup

list

irc

gnats

nobody

systemd-timesync

systemd-network

systemd-resolve

systemd-bus-proxy

syslog

_apt

lxd

messagebus

uuidd

dnsmasq

sshd

senthil

kumar

ostechnix

You can also use the following command to list all users:

$ compgen -u

Among all users, let us only find the sudo or super users in our Linux system.

$ grep '^sudo:.*$' /etc/group | cut -d: -f4

sk,ostechnix

Also, you can use “getent” command instead of “grep” to get the same result.

$ getent group sudo | cut -d: -f4

sk,ostechnix

As you see in the above output, “sk” and “ostechnix” are the sudo users in my system.

In the above examples, we listed all sudo users. You might want to know whether a certain user has sudo privilege or not.

To do so, run:

$ sudo -l -U sk

Sample output:

Matching Defaults entries for sk on ubuntuserver:

env_reset, mail_badpass,

secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User sk may run the following commands on ubuntuserver:

(ALL : ALL) ALL

As you see, the user named “sk” can perform all commands. So, he is in the sudo group. Let us check another user.

$ sudo -l -U senthil

Sample output:

User senthil is not allowed to run sudo on ubuntuserver.

Oops! The user “senthil” is not allowed to run sudo, so he is just a normal user.

We can also find if an user has sudo access by running the following command:

$ sudo -nv

If you get nothing as output, the user still has sudo access.

If you see an output like below, then the user doesn’t has sudo access.

$ sudo -nv

Sorry, user senthil may not run sudo on ubuntuserver.

Top 20 OpenSSH Server Best Security Practices

2019-06-04T20:28:00.001-07:00

OpenSSH defaults

TCP port – 22
OpenSSH server config file – sshd_config (located in /etc/ssh/)

1. Use SSH public key based login

OpenSSH server supports various authentication. It is recommended that you use public key based authentication. First, create the key pair using following ssh-keygen command on your local desktop/laptop:

DSA and RSA 1024 bit or lower ssh keys are considered weak. Avoid them. RSA keys are chosen over ECDSA keys when backward compatibility is a concern with ssh clients. All ssh keys are either ED25519 or RSA. Do not use any other type.

$ ssh-keygen -t key_type -b bits -C "comment"
$ ssh-keygen -t ed25519 -C "Login to production cluster at xyz corp"
$ ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa_aws_$(date +%Y-%m-%d) -C "AWS key for abc corp clients"

Next, install the public key using ssh-copy-id command:

$ ssh-copy-id -i /path/to/public-key-file user@host
$ ssh-copy-id user@remote-server-ip-or-dns-name
$ ssh-copy-id vivek@rhel7-aws-server

When promoted supply user password. Verify that ssh key based login working for you:
$ ssh vivek@rhel7-aws-server

For more info on ssh public key auth see:

2. Disable root user login

Before we disable root user login, make sure regular user can log in as root. For example, allow vivek user to login as root using the sudo command.

How to add vivek user to sudo group on a Debian/Ubuntu

Allow members of group sudo to execute any command. Add user vivek to sudo group:
$ sudo adduser vivek sudo
Verify group membership with id command
$ id vivek

How to add vivek user to sudo group on a CentOS/RHEL server

Allows people in group wheel to run all commands on a CentOS/RHEL and Fedora Linux server. Use the usermod command to add the user named vivek to the wheel group:

$ sudo usermod -aG wheel vivek
$ id vivek

Test sudo access and disable root login for ssh

Test it and make sure user vivek can log in as root or run the command as root:

$ sudo -i
$ sudo /etc/init.d/sshd status
$ sudo systemctl status httpd

Once confirmed disable root login by adding the following line to sshd_config:

PermitRootLogin no
ChallengeResponseAuthentication no
PasswordAuthentication no
UsePAM no

See “How to disable ssh password login on Linux to increase security” for more info.

3. Disable password based login

All password-based logins must be disabled. Only public key based logins are allowed. Add the following in your sshd_config file:

AuthenticationMethods publickey
PubkeyAuthentication yes

Older version of SSHD on CentOS 6.x/RHEL 6.x user should use the following setting:
PubkeyAuthentication yes

4. Limit Users’ ssh access

By default, all systems user can login via SSH using their password or public key. Sometimes you create UNIX / Linux user account for FTP or email purpose. However, those users can log in to the system using ssh. They will have full access to system tools including compilers and scripting languages such as Perl, Python which can open network ports and do many other fancy things. Only allow root, vivek and jerry user to use the system via SSH, add the following to sshd_config:
AllowUsers vivek jerry
Alternatively, you can allow all users to login via SSH but deny only a few users, with the following line in sshd_config:
DenyUsers root saroj anjali foo
You can also configure Linux PAM allows or deny login via the sshd server. You can allow list of group name to access or deny access to the ssh.

5. Disable Empty Passwords

You need to explicitly disallow remote login from accounts with empty passwords, update sshd_config with the following line:
PermitEmptyPasswords no

6. Use strong passwords and passphrase for ssh users/keys

It cannot be stressed enough how important it is to use strong user passwords and passphrase for your keys. Brute force attack works because user goes to dictionary based passwords. You can force users to avoid passwords against a dictionary attack and use john the ripper tool to find out existing weak passwords. Here is a sample random password generator (put in your ~/.bashrc):

genpasswd() {
 local l=$1
        [ "$l" == "" ] && l=20
       tr -dc A-Za-z0-9_ < /dev/urandom | head -c ${l} | xargs
}

Run it:
genpasswd 16
Output:

uw8CnDVMwC6vOKgW

7. Firewall SSH TCP port # 22

You need to firewall ssh TCP port # 22 by updating iptables/ufw/firewall-cmd or pf firewall configurations. Usually, OpenSSH server must only accept connections from your LAN or other remote WAN sites only.

Netfilter (Iptables) Configuration

Update /etc/sysconfig/iptables (Redhat and friends specific file) to accept connectiononly from 192.168.1.0/24 and 202.54.1.5/29, enter:

-A RH-Firewall-1-INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -s 202.54.1.5/29 -m state --state NEW -p tcp --dport 22 -j ACCEPT

If you’ve dual stacked sshd with IPv6, edit /etc/sysconfig/ip6tables (Redhat and friends specific file), enter:

 -A RH-Firewall-1-INPUT -s ipv6network::/ipv6mask -m tcp -p tcp --dport 22 -j ACCEPT

Replace ipv6network::/ipv6mask with actual IPv6 ranges.

UFW for Debian/Ubuntu Linux

UFW is an acronym for uncomplicated firewall. It is used for managing a Linux firewalland aims to provide an easy to use interface for the user. Use the following command to accept port 22 from 202.54.1.5/29 only:
$ sudo ufw allow from 202.54.1.5/29 to any port 22
Read “Linux: 25 Iptables Netfilter Firewall Examples For New SysAdmins” for more info.

*BSD PF Firewall Configuration

If you are using PF firewall update /etc/pf.conf as follows:

pass in on $ext_if inet proto tcp from {192.168.1.0/24, 202.54.1.5/29} to $ssh_server_ip port ssh flags S/SA synproxy state

8. Change SSH Port and limit IP binding

By default, SSH listens to all available interfaces and IP address on the system. Limit ssh port binding and change ssh port (many brutes forcing scripts only try to connect to TCP port # 22). To bind to 192.168.1.5 and 202.54.1.5 IPs and port 300, add or correct the following line in sshd_config:

Port 300
ListenAddress 192.168.1.5
ListenAddress 202.54.1.5

A better approach to use proactive approaches scripts such as fail2ban or denyhosts when you want to accept connection from dynamic WAN IP address.

9. Use TCP wrappers (optional)

TCP Wrapper is a host-based Networking ACL system, used to filter network access to the Internet. OpenSSH does support TCP wrappers. Just update your /etc/hosts.allow file as follows to allow SSH only from 192.168.1.2 and 172.16.23.12 IP address:

sshd : 192.168.1.2 172.16.23.12

See this FAQ about setting and using TCP wrappers under Linux / Mac OS X and UNIX like operating systems.

10. Thwart SSH crackers/brute force attacks

Brute force is a method of defeating a cryptographic scheme by trying a large number of possibilities (combination of users and passwords) using a single or distributed computer network. To prevents brute force attacks against SSH, use the following software:

DenyHosts is a Python based security tool for SSH servers. It is intended to prevent brute force attacks on SSH servers by monitoring invalid login attempts in the authentication log and blocking the originating IP addresses.
Explains how to setup DenyHosts under RHEL / Fedora and CentOS Linux.
Fail2ban is a similar program that prevents brute force attacks against SSH.
sshguard protect hosts from brute force attacks against ssh and other services using pf.
security/sshblock block abusive SSH login attempts.
IPQ BDB filter May be considered as a fail2ban lite.

11. Rate-limit incoming traffic at TCP port # 22 (optional)

Both netfilter and pf provides rate-limit option to perform simple throttling on incoming connections on port # 22.

Iptables Example

The following example will drop incoming connections which make more than 5 connection attempts upon port 22 within 60 seconds:

#!/bin/bash
inet_if=eth1
ssh_port=22
$IPT -I INPUT -p tcp --dport ${ssh_port} -i ${inet_if} -m state --state NEW -m recent  --set
$IPT -I INPUT -p tcp --dport ${ssh_port} -i ${inet_if} -m state --state NEW -m recent  --update --seconds 60 --hitcount 5 -j DROP

Call above script from your iptables scripts. Another config option:

$IPT -A INPUT  -i ${inet_if} -p tcp --dport ${ssh_port} -m state --state NEW -m limit --limit 3/min --limit-burst 3 -j ACCEPT
$IPT -A INPUT  -i ${inet_if} -p tcp --dport ${ssh_port} -m state --state ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -o ${inet_if} -p tcp --sport ${ssh_port} -m state --state ESTABLISHED -j ACCEPT
# another one line example
# $IPT -A INPUT -i ${inet_if} -m state --state NEW,ESTABLISHED,RELATED -p tcp --dport 22 -m limit --limit 5/minute --limit-burst 5-j ACCEPT

See iptables man page for more details.

*BSD PF Example

The following will limits the maximum number of connections per source to 20 and rate limit the number of connections to 15 in a 5 second span. If anyone breaks our rules add them to our abusive_ips table and block them for making any further connections. Finally, flush keyword kills all states created by the matching rule which originate from the host which exceeds these limits.

sshd_server_ip="202.54.1.5"
table <abusive_ips> persist
block in quick from <abusive_ips>
pass in on $ext_if proto tcp to $sshd_server_ip port ssh flags S/SA keep state (max-src-conn 20, max-src-conn-rate 15/5, overload <abusive_ips> flush)

12. Use port knocking (optional)

Port knocking is a method of externally opening ports on a firewall by generating a connection attempt on a set of prespecified closed ports. Once a correct sequence of connection attempts is received, the firewall rules are dynamically modified to allow the host which sent the connection attempts to connect to the specific port(s). A sample port Knocking example for ssh using iptables:

$IPT -N stage1
$IPT -A stage1 -m recent --remove --name knock
$IPT -A stage1 -p tcp --dport 3456 -m recent --set --name knock2
 
$IPT -N stage2
$IPT -A stage2 -m recent --remove --name knock2
$IPT -A stage2 -p tcp --dport 2345 -m recent --set --name heaven
 
$IPT -N door
$IPT -A door -m recent --rcheck --seconds 5 --name knock2 -j stage2
$IPT -A door -m recent --rcheck --seconds 5 --name knock -j stage1
$IPT -A door -p tcp --dport 1234 -m recent --set --name knock
 
$IPT -A INPUT -m --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -p tcp --dport 22 -m recent --rcheck --seconds 5 --name heaven -j ACCEPT
$IPT -A INPUT -p tcp --syn -j door

For more info see:

Debian / Ubuntu: Set Port Knocking With Knockd and Iptables

13. Configure idle log out timeout interval

A user can log in to the server via ssh, and you can set an idle timeout interval to avoid unattended ssh session. Open sshd_config and make sure following values are configured:

ClientAliveInterval 300
ClientAliveCountMax 0

You are setting an idle timeout interval in seconds (300 secs == 5 minutes). After this interval has passed, the idle user will be automatically kicked out (read as logged out). See how to automatically log BASH / TCSH / SSH users out after a period of inactivity for more details.

14. Enable a warning banner for ssh users

Set a warning banner by updating sshd_config with the following line:
Banner /etc/issue
15. Disable .rhosts files (verification)

Don’t read the user’s ~/.rhosts and ~/.shosts files. Update sshd_config with the following settings:
IgnoreRhosts yes
SSH can emulate the behavior of the obsolete rsh command, just disable insecure access via RSH.

16. Disable host-based authentication (verification)

To disable host-based authentication, update sshd_config with the following option:
HostbasedAuthentication no

17. Patch OpenSSH and operating systems

It is recommended that you use tools such as yum, apt-get, freebsd-update and others to keep systems up to date with the latest security patches:

18. Chroot OpenSSH (Lock down users to their home directories)

By default users are allowed to browse the server directories such as /etc/, /bin and so on. You can protect ssh, using os based chroot or use special tools such as rssh. With the release of OpenSSH 4.8p1 or 4.9p1, you no longer have to rely on third-party hacks such as rssh or complicated chroot(1) setups to lock users to their home directories. See this blog post about new ChrootDirectory directive to lock down users to their home directories.

19. Disable OpenSSH server on client computer

Workstations and laptop can work without OpenSSH server. If you do not provide the remote login and file transfer capabilities of SSH, disable and remove the SSHD server. CentOS / RHEL users can disable and remove openssh-server with the yum command:
$ sudo yum erase openssh-server
Debian / Ubuntu Linux user can disable and remove the same with the apt command/apt-get command:
$ sudo apt-get remove openssh-server
You may need to update your iptables script to remove ssh exception rule. Under CentOS / RHEL / Fedora edit the files /etc/sysconfig/iptables and /etc/sysconfig/ip6tables. Once done restart iptables service:

# service iptables restart
# service ip6tables restart

20. Bonus tips from Mozilla

You can grab list of cipher and alog supported by your OpenSSH server using the following commands:

$ ssh -Q cipher
$ ssh -Q cipher-auth
$ ssh -Q mac
$ ssh -Q kex
$ ssh -Q key

How do I test sshd_config file and restart/reload my SSH server?

To check the validity of the configuration file and sanity of the keys for any errors before restarting sshd, run:
$ sudo sshd -t
Extended test mode:
$ sudo sshd -T
Finally restart sshd on a Linux or Unix like systems as per your distro version:

$ sudo systemctl start ssh ## Debian/Ubunt Linux##
$ sudo systemctl restart sshd.service ## CentOS/RHEL/Fedora Linux##
$ doas /etc/rc.d/sshd restart ## OpenBSD##
$ sudo service sshd restart ## FreeBSD##

Source: https://www.cyberciti.biz/tips/linux-unix-bsd-openssh-server-best-practices.html

Ubuntu Linux: Start / Stop / Restart / Reload OpenSSH Server

2019-06-04T20:26:00.001-07:00

Start / Stop / Restart / Reload OpenSSH Server on Ubuntu

Latest version of Ubuntu such as Ubuntu Linux 16.04 LTS or 18.04 LTS and others use the systemctl command to control ssh server on Ubuntu. Older version use the service command. To find out your Ubuntu Linux version, type:

lsb_release -a
cat /etc/*release*

Sample outputs:

No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 17.10
Release: 17.10
Codename: artful

Ubuntu Linux: Start OpenSSH Server

Type the following command:
`$ sudo /etc/init.d/ssh start`
OR
`$ sudo service ssh start`
OR for systemd based Ubuntu Linux 16.04 LTS or above server:
`$ sudo systemctl start ssh`

Ubuntu Linux: Stop OpenSSH server

Type the following command:
`$ sudo /etc/init.d/ssh stop`
OR
`$ sudo service ssh stop`
OR for systemd based Ubuntu Linux 16.04 LTS or above server:
`$ sudo systemctl stop ssh`

Ubuntu Linux: Restart OpenSSH server

Type the following command:
`$ sudo /etc/init.d/ssh restart`
OR
`$ sudo service ssh restart`
OR for systemd based Ubuntu Linux 16.04 LTS or above server:
`$ sudo systemctl restart ssh`

systemctl command in action on Ubuntu Linux desktop

Ubuntu Linux: See status of OpenSSH server

Type the following command:
`$ sudo /etc/init.d/ssh status`
OR
`$ sudo service ssh status`
OR for systemd based Ubuntu Linux 16.04 LTS or above server:
`$ sudo systemctl status ssh`

Controlling sshd using upstart based commands (this syntax is no longer works with the latest version of Ubuntu)

Since the script /etc/init.d/ssh has been converted to an Upstart based job, try the following commands to start / stop / restart the OpenSSH server:

Stop/Start/Restart the OpenSSH using the following commands

The syntax is:

sudo stop ssh
sudo start ssh 
sudo restart ssh
sudo status ssh

Sample outputs:

source :

https://www.cyberciti.biz/faq/howto-start-stop-ssh-server/

OpenSSH security and hardening

2019-06-04T20:23:00.000-07:00

OpenSSH security

OpenSSH is under development by the security fanatics from the OpenBSD project. Every new piece of functionality is created with care, especially when it comes to security. Although there were some vulnerabilities, OpenSSH is fairly secure by default. There are still some steps left that can be improved. During research for the security auditing tool Lynis, we looked also at the available OpenSSH settings. Besides the tests that are now in Lynis, this article is one of the other results of that research.

What will be covered?

We will be covering both the server and client configuration. The configuration syntax and settings are based on OpenSSH 7.x. The examples should be working for most Linux distributions like CentOS, Debian, Ubuntu, and RHEL. You can expect this to be also the case for FreeBSD, OpenBSD, and other systems that use OpenSSH. When in doubt, consult your man page. If you discovered an error or exception, let it know via the comments. Your feedback is welcome.

After reading this article, you will know:

Where the client settings and server settings are stored
How to see the active and default settings
How to test your configuration settings
Make an informed decision on how to secure SSH
Which tools can help audit SSH and apply best practices

SSH basics

SSH has two parts: the server daemon (sshd) that runs on a system and the client (ssh) used to connect to the server. Typically administration is done by using an SSH client from a workstation. If you are on Windows, then often you will be using something like Putty.

When it comes to the security of the SSH configuration, it is the server part that is the most interesting. For example, is that the server can decide if normal password based logins are allowed or denied. Even if the client has a preference, it is the server to make the final call. The server configuration file is located at /etc/ssh/sshd_config.

The client configuration settings can be found in /etc/ssh/ssh_config (system wide) or ~/.ssh/config (per user). Settings can also be specified during the connection by providing a command-line option.

Before we start making changes, let’s start with some tips to do it right.

Deployment tips

Do (not) use best practices

The web is full of blogs and guides that state they are using so-called best practices. A best practice is an effective and good approach and typically agreed on by the experts and by consensus. Unfortunately, many of the blogs and articles are simple copies from other blogs and without the extensive research. So I strongly suggest to look up some background of the blog and author first.

If you see just configuration settings without a good explanation, be careful with applying such changes. Some are outdated or simply not relevant. What is the purpose of setting some value when it is already the default or even removed? So whatever you do, apply critical thinking and don’t make assumptions. So use best practices, but always test your changes.

Check the status of SSH

Is this the first time you will change your SSH configuration? Check the status of the SSH daemon and see if the related service is started on boot. When using a distribution with systemd, make sure the daemon is running and enabled.

systemctl status ssh.service

Note: on some Linux distributions the service is named sshd.service.

The output should contain the enabled value.

Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset: enabled)

To see if SSH is running, look at the next line.

Active: active (running) since Mon 2018-06-04 17:18:33 CEST; 1 months 2 days ago

Use the SSH configuration test

If you make changes to your SSH configuration, it makes sense to restart the service. I strongly recommend to always check your configuration (sshd_config) first. This can be done by using the test mode flag. This additional step ensures the syntax and options are correct before you end up with a nonfunctioning service.

sshd -t

This command should not return any text or errors. Here is an example when something does not look good:

Make sure to test your settings first.

Making changes to a remote system

Are you connected to the system with SSH and making changes to its configuration? Instead of restarting, consider sending a reload command to the running SSH daemon. This decreases the chance that you lose your connection and can’t reconnect.

For systems using systemd, use systemctl to reload the SSH service.

systemctl reload ssh.service

The alternative is to manually send a SIGHUP to the SSH daemon. Do not to send this to any of the child processes, or you will be disconnected.

kill -HUP 1234

Another option is to temporarily run another SSH process on another port, without becoming a daemon process. Specify the full path and use -D together with the -p for the port number. Then ensure that you can access the temporary connection, especially if you are using a firewall with traffic filtering.

/usr/sbin/sshd -D -p 2222

Use CTRL + C to stop the process after you are done.

Deploy in small steps

While it makes sense to do a full deployment of your new SSH configuration to all systems, you might want to be careful. One example is that some older SSH clients can’t use the newer key types. So have a look at the oldest Linux distributions that are used to get an idea on compatibility issues.

Show active SSH connections

Before applying changes or restarting the daemon, check for any active SSH connections. This can be done with the ss tool.

ss -n -o state established '( dport = :22 or sport = :22 )'

Any established TCP connection will be displayed. By using both dport and sport, we can confirm what connections are active in both directions.

Securing the SSH server configuration

Preparations

Before we start making changes to our configuration, let’s make a backup.

cp /etc/ssh/sshd_config /root/sshd_config

After that is done, it is good to know that each OpenSSH version has its own defaults. New features may have been added, older settings may have disappeared. To know if a specific setting is set, don’t rely on the configuration file. Instead, call the SSH daemon with the extended test mode flag -T to show all details.

sshd -T

The output may look something like this:

Show active and default settings of the OpenSSH daemon

Note: configuration settings and values are displayed with lowercase characters.

SSH security settings

Use of X11Forwarding

The display server on the client might have a higher exposure to be attacked with X11 traffic forwarded. If forwarding of X11 traffic is not needed, disable it:

X11Forwarding no

Why disabling X11Forwarding matters: the X11 protocol was never built with security in mind. As it opens up channel back to the client, the server could send malicious commands back to the client. To protect clients, disable X11Forwarding when it is not needed.

Disable rhosts

While not common anymore, rhosts was a weak method to authenticate systems. It defines a way to trust another system simply by its IP address. By default, the use of rhosts is already disabled. Make sure to check if it really is.

IgnoreRhosts yes

DNS hostname checking

By default, the SSH server can check if the client connecting maps back to the same combination of hostname and IP address. Use the option UseDNS to perform this basic check as an additional safeguard.

UseDNS yes

Note: this option may not work properly in all situations. It could result in an additional delay, as the daemon is waiting for a timeout during the initial connection. Only use this when you are sure your internal DNS is properly configured.

Disable empty passwords

Accounts should be protected and users should be accountable. For this reason, the usage of empty passwords should not be allowed. This can be disabled with the PermitEmptyPasswords option, which is the default.

PermitEmptyPasswords no

If you see this option enabled, then check which user accounts have no password set.

Maximum authentication attempts

To protect against brute-force attacks on the password of a user, limit the number of attempts. This can be done with the MaxAuthTries setting.

MaxAuthTries 3

Also enable monitoring for authentication failures, which starts at the half the number of maximum attempts. Use these authentication failures together with your SIEM solution, or forward them to your security administrator.

The SSH server can be configured to be used together with PAM or pluggable authentication modules. By using a set of rules, part of the authentication stack, the number of failed logins can be used to block a particular user. Another option is to define a period to lock the account when this number of attempts has been reached. This way the server can defend better against brute-force attempts to crack a user account and its password.

When limiting the maximum authentication attempts, be aware that public key authentication (see below) can also eat up your number of attempts. If you want to enforce the SSH client (or SCP) to use password-based authentication, use the related options on the command line.

ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no username@system

Public key authentication

Instead of using a normal password-based login, a better way is using public key authentication. Keys are considered much safer and less prone to brute-force attacks. Disable PasswordAuthentication to force users using keys.

PubkeyAuthentication yes
PasswordAuthentication no

Refer to the article Using SSH keys instead of passwords, to set up key-based authentication.

Disable root login

It is best practice not to log in as the root user. Use a normal user account to initiate your connection instead, together with sudo. Direct root logins may result in bad accountability of the actions performed by this user account.

PermitRootLogin no

Newer versions of OpenSSH also support the value without-password. This value refers to methods like public key authentication. If your installation comes with this value, there is no reason to change it.

Set SSH protocol

If you are running an older system, version 1 of the SSH protocol might still be available. This version has weaknesses and should no longer be used. Since version 7.0 of OpenSSH, protocol 1 is automatically disabled during compile time. If your version is older than that, enforce the protocol version:

Protocol 2

Usage of AllowUsers and DenyUsers

When not all users should have access to the system, limit the number of people who can actually log in. One way is to create a group (e.g. sshusers) and add people to this group. Next set the AllowGroups option to define that only these users can log in.

Other possibilities include to only allow a few users with the AllowUsers, or specifically deny users and groups with the DenyUsers, or DenyGroups. Whitelisting access, using the ‘default deny’ principle, is usually better. So when possible, use the AllowUsers or AllowGroups option.

Good to know: SSH applies the following order to determine if one can log in: DenyUsers, AllowUsers, DenyGroups, finally AllowGroups.

Use HashKnownHosts

Each time the SSH client connects to a server, it will store a related signature (a key) of the server. This information is stored in a file with the name known_hosts. The known_hosts file itself is available in the .ssh subdirectory of the related user (on the client). In the case the signature of the server changes, SSH will protect the user by notifying about this chance. This option is useful but also has a risk. Previously it was common to store the hostname related to the specific host key. This made it easy for worms and other malicious scripts to use this information and spread to other systems, once they had a single system compromised. To counter this, the HashKnownHosts will hash each host, so it’s not readable anymore. While being unreadable for the human eye, it still allows SSH to check for the next time you connect to the same system, as the results in the same hash.

Example output:

|1|XV5CFMH8LLIQPq7PxdBhGX7I9PA=|VKNLdODsQlJ/j4cvTZncqs9vgh0= ecdsa-sha2-nistp256 AAAAE2VjZHNhLX….dJ/RzzZLH8Hs0UgroC0=

Restrict allowable commands

OpenSSH allows restricting the commands that a user can run via the command option. This is placed in the authorized_keys file, together with the allowable command and other options.

command="ps",no-agent-forwarding,no-port-forwarding,no-x11-forwarding, TYPE_OF_KEY KEY COMMENT

In the example above, replace the TYPE_OF_KEY, KEY, and COMMENT fields. The values that are to be used are similar to when using public key authentication.

Additional restrictions

Configure your firewall

Besides adjusting the SSH configuration, consider also limiting access by using traffic filtering. A local firewall like iptables or nftables can be used to restrict access to only allowed systems. Restrict access by only allowing those IP addresses that are trusted.

Use a jump server

Bigger environments typically restrict access by using a jump server or jump host. You may be familiar with them with other names like stepping stone server or bastion host. They are then the only systems within the network that are configured to allow access to other systems. That means if you want to do system administration, you always connect first to the jump server. From there you will be connecting with the target system. A great combination with the previous tip to limit access with firewalling.

OpenSSH client security settings

As there are many SSH clients available, it would be impossible to cover them all in this article. Instead, we will have a look at the OpenSSH client tool.

Client configuration

The OpenSSH client has three ways to be configured. They are processed in order and checked for every available configuration setting. The first match wins.

Options provided via the command-line
Configuration file in the home directory (~/.ssh/config)
Configuration file for all users (/etc/ssh/ssh_config)

Let’s say there is a setting named A. A is configured system-wide (option 3) with the value of ‘True’. User michael has it configured (option 2) being ‘False’. In that case, the latter would win. The reason is that it is considered before the system-wide configuration.

See the default and active client settings

Remember the trick to see the settings for the server (sshd -T)? The client has a similar one, although with a different character.

ssh -G abc

The ‘abc’ in this example is just a random hostname. Ok, it is not really that random. You can use anything you want, including a real hostname. The client can use Host and Match blocks to customize the configuration to a group of systems or an individual system. As the host ‘abc’ does not exist, that means the default settings will be parsed.

SSH settings for a single system

Let’s say we have a system with the name secureserver. Instead of running on port 22, it accepts SSH connections on port 2222. Instead of using -p on the command line each time, we can add a Host block to our configuration file. So if you want to do this for your user, create the config file in your home directory, below the .ssh directory (so /home/username/.ssh/config).

Next step is creating a block and define the related settings that you want to use.

Host secureserver
    Hostname hostname.example.org
    User mynickname
    Port 2222
    MACs hmac-sha2-512
    KexAlgorithms curve25519-sha256@libssh.org

Indenting with spaces is not required. I would still advice to do it, so you see which settings belong to what host definition.

One question remains: What settings should you use in your client configuration file?

I suggest applying changes that make your daily work easier. So if you prefer security, set strong defaults. If a particular host is using a different SSH port, creating a Host block and overrule it that way. Regarding KexAlgorithms, use the newer algorithms that are available. This strongly depends on OpenSSH version on the other systems. If you have fairly new OpenSSH versions on the server, then the curve25519 is a good option. It is a high-speed elliptic-curve that is considered secure (at this moment).

Tools for SSH security

While it is good to manually harden a system, software and the related configurations can change over time. For that reason, it is helpful to perform a regular security scan.

Lynis

This open source security tool is an allrounder when it comes to testing the security of your Linux system. From the bootloader to your web server, it will check as much as it can. It is free to use and written in shell script. Lynis runs on the system itself, so it can look both in the configuration files and the actually loaded configuration. It includes several tests focused on OpenSSH and its configuration, including security-related settings. Findings or possible improvements are displayed on the screen, so you can directly get into action and start hardening your system.

Download the tool via GitHub or from the website. Never used the tool before, then use the Get Started guide.

ssh-audit

Although slightly outdated, the ssh-audit tool is a great one to have in your toolbox. Instead of testing on the host itself, it can connect to an SSH server via the network. It performs its testing on the selected target and looks at the responses it receives. Based on these responses it can learn about the system and the SSH server. It even knows about particular vulnerabilities and can warn you about them. Download the tool via GitHub and give it a spin.

See the Linux Security Expert category SSH configuration scanners for other alternatives.

Source: https://linux-audit.com/audit-and-harden-your-ssh-configuration/

How to change root password in Ubuntu

2019-06-03T22:53:00.002-07:00

The procedure to change the root user password on Ubuntu Linux:

Type the following command to become root user and issue passwd:
sudo -i
passwd
OR set a password for root user in a single go:
sudo passwd root
Test it your root password by typing the following command:
su -

How to disable your root account on Ubuntu

One can disable the root account by typing the following command:
$ sudo passwd -dl root
OR
$ sudo passwd --delete --lock root
Sample session from the above commands:

Understanding passwd command option

-d OR --delete : Delete a user’s password (make it empty for root user). This is a quick way to disable a password for an account. It will set the named account passwordless.
-l OR --lock: Lock the password of the named account such as root. This option disables a password by changing it to a value which matches no possible encrypted value (it adds a ‘!’ at the beginning of the password)
root : Lock and disble root account i.e. re-disabling your root account

A note about root password on an Ubuntu server/desktop

Enabling the root account by setting the password is not needed. Almost everything you need to do as SuperUser (root) of an Ubuntu server can be done using sudo command. For example, restart apache server:
$ sudo systemctl restart apache2
You can add additional user to sudo by typing the following command:
$ sudo adduser {userNameHere} sudo
For example, add a user named tom to sudo:
$ sudo adduser tom sudo
You can in as another user say logging as tom from jerry account:
{jerry@nixcraft}$ sudo -i -u tom
When prompted enter jerry’s password i.e. the password being asked for is your own, not tom’s. For more info see “How to create a new sudo user on Ubuntu Linux server” and RootSudo.

Source: https://www.cyberciti.biz/faq/change-root-password-ubuntu-linux/

Steps to Create a New Sudo User

2019-06-03T22:50:00.001-07:00

1. Log in to your server as the root user.

· ssh root@server_ip_address

2. Use the adduser command to add a new user to your system.

Be sure to replace username with the user that you want to create.

· adduser username

· Set and confirm the new user's password at the prompt. A strong password is highly recommended!

Set password prompts:

Enter new UNIX password:

Retype new UNIX password:

passwd: password updated successfully

· Follow the prompts to set the new user's information. It is fine to accept the defaults to leave all of this information blank.

User information prompts:

Changing the user information for username

Enter the new value, or press ENTER for the default

    Full Name []:

    Room Number []:

    Work Phone []:

    Home Phone []:

    Other []:

Is the information correct? [Y/n]

3. Use the usermod command to add the user to the sudo group.

· usermod -aG sudo username

By default, on Ubuntu, members of the sudo group have sudo privileges.

4. Test sudo access on new user account

· Use the su command to switch to the new user account.

· su - username

· As the new user, verify that you can use sudo by prepending "sudo" to the command that you want to run with superuser privileges.

· sudo command_to_run

· For example, you can list the contents of the /root directory, which is normally only accessible to the root user.

· sudo ls -la /root

· The first time you use sudo in a session, you will be prompted for the password of the user account. Enter the password to proceed.

Output:

[sudo] password for username:

If your user is in the proper group and you entered the password correctly, the command that you issued with sudo should run with root privileges.

Source : https://www.digitalocean.com/community/tutorials/how-to-create-a-sudo-user-on-ubuntu-quickstart

How To Set Up SSH Keys on Ubuntu

2019-06-03T22:39:00.000-07:00

Introduction

SSH, or secure shell, is an encrypted protocol used to administer and communicate with servers. When working with an Ubuntu server, chances are you will spend most of your time in a terminal session connected to your server through SSH.

In this guide, we'll focus on setting up SSH keys for a vanilla Ubuntu 16.04 installation. SSH keys provide an easy, secure way of logging into your server and are recommended for all users.

Step 1 — Create the RSA Key Pair

The first step is to create a key pair on the client machine (usually your computer):

· ssh-keygen

By default ssh-keygen will create a 2048-bit RSA key pair, which is secure enough for most use cases (you may optionally pass in the -b 4096 flag to create a larger 4096-bit key).

After entering the command, you should see the following output:

Output

Generating public/private rsa key pair.

Enter file in which to save the key (/your_home/.ssh/id_rsa):

Press ENTER to save the key pair into the .ssh/ subdirectory in your home directory, or specify an alternate path.

If you had previously generated an SSH key pair, you may see the following prompt:

Output

/home/your_home/.ssh/id_rsa already exists.

Overwrite (y/n)?

If you choose to overwrite the key on disk, you will not be able to authenticate using the previous key anymore. Be very careful when selecting yes, as this is a destructive process that cannot be reversed.

You should then see the following prompt:

Output

Enter passphrase (empty for no passphrase):

Here you optionally may enter a secure passphrase, which is highly recommended. A passphrase adds an additional layer of security to prevent unauthorized users from logging in. To learn more about security, consult our tutorial on How To Configure SSH Key-Based Authentication on a Linux Server.

You should then see the following output:

Output

Your identification has been saved in /your_home/.ssh/id_rsa.

Your public key has been saved in /your_home/.ssh/id_rsa.pub.

The key fingerprint is:

a9:49:2e:2a:5e:33:3e:a9:de:4e:77:11:58:b6:90:26 username@remote_host

The key's randomart image is:

+--[ RSA 2048]----+

| ..o |

| E o= . |

| o. o |

| .. |

| ..S |

| o o. |

| =o.+. |

|. =++.. |

|o=++. |

+-----------------+

You now have a public and private key that you can use to authenticate. The next step is to place the public key on your server so that you can use SSH-key-based authentication to log in.

Step 2 — Copy the Public Key to Ubuntu Server

The quickest way to copy your public key to the Ubuntu host is to use a utility called ssh-copy-id. Due to its simplicity, this method is highly recommended if available. If you do not have ssh-copy-id available to you on your client machine, you may use one of the two alternate methods provided in this section (copying via password-based SSH, or manually copying the key).

Copying Public Key Using ssh-copy-id

The ssh-copy-id tool is included by default in many operating systems, so you may have it available on your local system. For this method to work, you must already have password-based SSH access to your server.

To use the utility, you simply need to specify the remote host that you would like to connect to and the user account that you have password SSH access to. This is the account to which your public SSH key will be copied.

The syntax is:

· ssh-copy-id username@remote_host

You may see the following message:

Output

The authenticity of host '203.0.113.1 (203.0.113.1)' can't be established.

ECDSA key fingerprint is fd:fd:d4:f9:77:fe:73:84:e1:55:00:ad:d6:6d:22:fe.

Are you sure you want to continue connecting (yes/no)? yes

This means that your local computer does not recognize the remote host. This will happen the first time you connect to a new host. Type "yes" and press ENTER to continue.

Next, the utility will scan your local account for the id_rsa.pub key that we created earlier. When it finds the key, it will prompt you for the password of the remote user's account:

Output

/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed

/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys

username@203.0.113.1's password:

Type in the password (your typing will not be displayed for security purposes) and press ENTER. The utility will connect to the account on the remote host using the password you provided. It will then copy the contents of your ~/.ssh/id_rsa.pub key into a file in the remote account's home ~/.ssh directory called authorized_keys.

You should see the following output:

Output

Number of key(s) added: 1

Now try logging into the machine, with: "ssh 'username@203.0.113.1'"

and check to make sure that only the key(s) you wanted were added.

At this point, your id_rsa.pub key has been uploaded to the remote account. You can continue on to Step 3.

Copying Public Key Using SSH

If you do not have ssh-copy-id available, but you have password-based SSH access to an account on your server, you can upload your keys using a conventional SSH method.

We can do this by using the cat command to read the contents of the public SSH key on our local computer and piping that through an SSH connection to the remote server.

On the other side, we can make sure that the ~/.ssh directory exists and has the correct permissions under the account we’re using.

We can then output the content we piped over into a file called authorized_keys within this directory. We’ll use the >> redirect symbol to append the content instead of overwriting it. This will let us add keys without destroying previously added keys.

The full command looks like this:

· cat ~/.ssh/id_rsa.pub | ssh username@remote_host "mkdir -p ~/.ssh && touch ~/.ssh/authorized_keys && chmod -R go= ~/.ssh && cat >> ~/.ssh/authorized_keys"

You may see the following message:

Output

The authenticity of host '203.0.113.1 (203.0.113.1)' can't be established.

ECDSA key fingerprint is fd:fd:d4:f9:77:fe:73:84:e1:55:00:ad:d6:6d:22:fe.

Are you sure you want to continue connecting (yes/no)? yes

This means that your local computer does not recognize the remote host. This will happen the first time you connect to a new host. Type "yes" and press ENTER to continue.

Afterwards, you should be prompted to enter the remote user account password:

Output

username@203.0.113.1's password:

After entering your password, the content of your id_rsa.pub key will be copied to the end of the authorized_keys file of the remote user's account. Continue on to Step 3 if this was successful.

Copying Public Key Manually

If you do not have password-based SSH access to your server available, you will have to complete the above process manually.

We will manually append the content of your id_rsa.pub file to the ~/.ssh/authorized_keys file on your remote machine.

To display the content of your id_rsa.pub key, type this into your local computer:

· cat ~/.ssh/id_rsa.pub

You will see the key's content, which should look something like this:

Output

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCqql6MzstZYh1TmWWv11q5O3pISj2ZFl9HgH1JLknLLx44+tXfJ7mIrKNxOOwxIxvcBF8PXSYvobFYEZjGIVCEAjrUzLiIxbyCoxVyle7Q+bqgZ8SeeM8wzytsY+dVGcBxF6N4JS+zVk5eMcV385gG3Y6ON3EG112n6d+SMXY0OEBIcO6x+PnUSGHrSgpBgX7Ks1r7xqFa7heJLLt2wWwkARptX7udSq05paBhcpB0pHtA1Rfz3K2B+ZVIpSDfki9UVKzT8JUmwW6NNzSgxUfQHGwnW7kj4jp4AT0VZk3ADw497M2G/12N0PPB5CnhHf7ovgy6nL1ikrygTKRFmNZISvAcywB9GVqNAVE+ZHDSCuURNsAInVzgYo9xgJDW8wUw2o8U77+xiFxgI5QSZX3Iq7YLMgeksaO4rBJEa54k8m5wEiEE1nUhLuJ0X/vh2xPff6SQ1BL/zkOhvJCACK6Vb15mDOeCSq54Cr7kvS46itMosi/uS66+PujOO+xt/2FWYepz6ZlN70bRly57Q06J+ZJoc9FfBCbCyYH7U/ASsmY095ywPsBo1XQ9PqhnN1/YOorJ068foQDNVpm146mUpILVxmq41Cj55YKHEazXGsdBIbXWhcrRf4G2fJLRcGUr9q8/lERo9oxRm5JFX6TCmj6kmiFqv+Ow9gI0x8GvaQ== demo@test

Access your remote host using whichever method you have available.

Once you have access to your account on the remote server, you should make sure the ~/.sshdirectory exists. This command will create the directory if necessary, or do nothing if it already exists:

· mkdir -p ~/.ssh

Now, you can create or modify the authorized_keys file within this directory. You can add the contents of your id_rsa.pub file to the end of the authorized_keys file, creating it if necessary, using this command:

· echo public_key_string >> ~/.ssh/authorized_keys

In the above command, substitute the public_key_string with the output from the cat ~/.ssh/id_rsa.pub command that you executed on your local system. It should start with ssh-rsa AAAA....

Finally, we’ll ensure that the ~/.ssh directory and authorized_keys file have the appropriate permissions set:

· chmod -R go= ~/.ssh

This recursively removes all “group” and “other” permissions for the ~/.ssh/ directory.

If you’re using the root account to set up keys for a user account, it’s also important that the ~/.ssh directory belongs to the user and not to root:

· chown -R sammy:sammy ~/.ssh

In this tutorial our user is named sammy but you should substitute the appropriate username into the above command.

We can now attempt passwordless authentication with our Ubuntu server.

Step 3 — Authenticate to Ubuntu Server Using SSH Keys

If you have successfully completed one of the procedures above, you should be able to log into the remote host without the remote account's password.

The basic process is the same:

· ssh username@remote_host

If this is your first time connecting to this host (if you used the last method above), you may see something like this:

Output

The authenticity of host '203.0.113.1 (203.0.113.1)' can't be established.

ECDSA key fingerprint is fd:fd:d4:f9:77:fe:73:84:e1:55:00:ad:d6:6d:22:fe.

Are you sure you want to continue connecting (yes/no)? yes

This means that your local computer does not recognize the remote host. Type "yes" and then press ENTER to continue.

If you did not supply a passphrase for your private key, you will be logged in immediately. If you supplied a passphrase for the private key when you created the key, you will be prompted to enter it now (note that your keystrokes will not display in the terminal session for security). After authenticating, a new shell session should open for you with the configured account on the Ubuntu server.

If key-based authentication was successful, continue on to learn how to further secure your system by disabling password authentication.

Step 4 — Disable Password Authentication on your Server

If you were able to log into your account using SSH without a password, you have successfully configured SSH-key-based authentication to your account. However, your password-based authentication mechanism is still active, meaning that your server is still exposed to brute-force attacks.

Before completing the steps in this section, make sure that you either have SSH-key-based authentication configured for the root account on this server, or preferably, that you have SSH-key-based authentication configured for a non-root account on this server with sudo privileges. This step will lock down password-based logins, so ensuring that you will still be able to get administrative access is crucial.

Once you've confirmed that your remote account has administrative privileges, log into your remote server with SSH keys, either as root or with an account with sudo privileges. Then, open up the SSH daemon's configuration file:

· sudo nano /etc/ssh/sshd_config

Inside the file, search for a directive called PasswordAuthentication. This may be commented out. Uncomment the line and set the value to "no". This will disable your ability to log in via SSH using account passwords:

/etc/ssh/sshd_config

...

PasswordAuthentication no

...

Save and close the file when you are finished by pressing CTRL + X, then Y to confirm saving the file, and finally ENTER to exit nano. To actually implement these changes, we need to restart the sshd service:

· sudo systemctl restart ssh

As a precaution, open up a new terminal window and test that the SSH service is functioning correctly before closing this session:

· ssh username@remote_host

Once you have verified your SSH service, you can safely close all current server sessions.

The SSH daemon on your Ubuntu server now only responds to SSH keys. Password-based authentication has successfully been disabled.

Source: https://www.digitalocean.com/community/tutorials/how-to-set-up-ssh-keys-on-ubuntu-1604#step-1-—-create-the-rsa-key-pair

Rahul Krishnan R

How can I turn off Microsoft elemetry?

Webmin: A web-based Linux management tool

Installing Webmin in Redhat 7

Navigating Webmin

Ubuntu: Extend your default LVM space

Linux LVM Briefly Explained

Ubuntu Installer Default Settings

Use Your Default Free Space

Use Space from Extended Physical (or Virtual) Disk

How to Reset Forgotten Ubuntu Password in 2 Minutes

Step 1: Boot into recovery mode

Step 2: Drop to root shell prompt

Step 3: Remount the root with write access

Step 4: Reset username or password

How to get full PC memory specs (speed, size, type, part number, form factor) on Windows 10

How to upgrade Debian 9 Stretch to Linux Debian 10 Buster

Upgrade to Debian Version 10 Buster

Step 1: Update Package Manager and Repositories

Step 2: Upgrade from Debian 9 to Debian 10

Step 3: Verify Debian 10 Update

(Optional) Step 4: Remove Outdated Packages

HOW TO USE NMAP TO SCAN ANY PORT [UDP/TCP] [2021]

Scan All Ports With NMAP

Scan Top Ports With NMAP

Scan Specific Ports With NMAP

Scan Ports By Name With NMAP

Scan Ports By Protocol With NMAP

Fast Scan Flag With NMAP

Querying SQL Server Agent Job History Data

Problem

Solution

MSDB.dbo.sysjobhistory Table - run_date and run_time Columns

How to monitor backup and restore progress in SQL Server

How to get a backup SQL database history

Backupfile

backupmediafamily

Backupset

Active Directory User Password Age command: Using Net User command to Display User Expiration Date

Using Net User command to Display User Expiration Date

(Solved) error: Something went wrong and your search couldn't be completed it looks like theres a problem with your network connection Outlook 2016 - Exchange 2016

Disable WSUS on Windows 10 by Registry Modification

Disable WSUS on Windows 10 by Registry Modification

How to enable Remote Administration feature in Windows

Links to refer deployment of several applications on SCCM

How to let websites and IPs bypass the VPN using static routing

There are several reasons for letting certain IPs or websites bypass the VPN connection, so they are used with your real IP and connection instead.

Manual setup via route.exe

33 Tools to Monitor Linux Performance

1. Top – Linux Process Monitoring

2. VmStat – Virtual Memory Statistics

3. Lsof – List Open Files

4. Tcpdump – Network Packet Analyzer

5. Netstat – Network Statistics

6. Htop – Linux Process Monitoring

7. Iotop – Monitor Linux Disk I/O

8. Iostat – Input/Output Statistics

9. IPTraf – Real Time IP LAN Monitoring

10. Psacct or Acct – Monitor User Activity

11. Monit – Linux Process and Services Monitoring

12. NetHogs – Monitor Per Process Network Bandwidth

13. iftop – Network Bandwidth Monitoring

14. Monitorix – System and Network Monitoring

15. Arpwatch – Ethernet Activity Monitor

16. Suricata – Network Security Monitoring

17. VnStat PHP – Monitoring Network Bandwidth

18. Nagios – Network/Server Monitoring

19. Nmon: Monitor Linux Performance

20. Collectl: All-in-One Performance Monitoring Tool

21. Glances – Real Time System Monitoring

Glances is a monitoring tool built to present as much information as possible in any terminal size, it automatically takes the terminal window size it runs on, in other words, it’s a responsive monitoring tool. Glances

Features

Licensed under LGPL and written in Python. Cross-platform, it works on Windows, Mac, BSD and Linux. Available in most Linux official repositories. A It gives a lot of information about your system. Built using curses. Read More: Install Glances on RHEL/CentOS/Fedora and Ubuntu/Debian

22. Sarg – Squid Bandwidth Monitoring

Sarg (Squid Analysis Report Generator) is a free & open-source tool which act as a monitoring tool for your Squid proxy server, it creates reports about your Squid proxy server users, IP addresses, the sites they visit beside some other information. Sarg Monitors Squid Logs

Features of Sarg

Licensed under GPL 2 and available in many languages. Works under Linux & FreeBSD. Generates report in HTML format. Very easy to install & use. Read More: Install Sarg “Squid Bandwidth Monitoring” Tool in Linux

23. Apache Status Monitoring

24. Monit – Linux Process and Services Monitoring

Monit is a nice program that monitors your Linux & Unix server, it can monitor everything you have on your server, from the main server (Apache, Nginx..) to files permissions, files hashes and web services. Plus a lot of things. Monit: Linux Process Monitoring

Glances is a monitoring tool built to present as much information as possible in any terminal size, it automatically takes the terminal window size it runs on, in other words, it’s a responsive monitoring tool.

Glances

Licensed under LGPL and written in Python.

Cross-platform, it works on Windows, Mac, BSD and Linux.

Available in most Linux official repositories.

A It gives a lot of information about your system.

Built using curses.

Read More: Install Glances on RHEL/CentOS/Fedora and Ubuntu/Debian

Sarg (Squid Analysis Report Generator) is a free & open-source tool which act as a monitoring tool for your Squid proxy server, it creates reports about your Squid proxy server users, IP addresses, the sites they visit beside some other information.

Sarg Monitors Squid Logs

Licensed under GPL 2 and available in many languages.

Works under Linux & FreeBSD.

Generates report in HTML format.

Very easy to install & use.

Read More: Install Sarg “Squid Bandwidth Monitoring” Tool in Linux

Monit is a nice program that monitors your Linux & Unix server, it can monitor everything you have on your server, from the main server (Apache, Nginx..) to files permissions, files hashes and web services. Plus a lot of things.

Monit: Linux Process Monitoring

Unlike the other tools, Icinga is a network monitoring program, it shows you many options and information about your network connections, devices and processes, it’s a very good choice for those who are looking for a good tool to monitor their networking stuffs.

Icinga Monitoring Tool

Observium is also a network monitoring tool, it was designed to help you manage your network of servers easily, there are 2 versions from it; Community Edition which is free & open-source and Commercial version which costs £150/year.

Observium: Linux Network Monitoring

Web VMStat is a very simple web application programmer, that provides a real time system information usage, from CPU to RAM, Swap and input/output information in html format.

Web VMStat Tool for Linux

Read More: Web VMStat: A Real Time System Statistics Tool for Linux

Unlike the other tools on this list, PHP Server Monitoring is a web script written in PHP that helps you to manage you websites and hosts easily, it supports MySQL database and is released under GPL 3 or later.

PHP Server Monitor

Cacti is nothing more than a free & open-source web interface for RRDtool, it is used often to monitor the bandwidth using SNMP (Simple Network Management Protocol), it can be used also to monitor CPU usage.

Cacti Network Monitoring

Free & open-source, released under GPL license.

Written in PHP with PL/SQL.

A cross-platform tool, it works on Windows and Linux.

User management; you may create different users accounts for Cacti.

Read More: Install Cacti Network and System Monitoring Tool in Linux

Also, unlike all the other tools on our list, Wireshark is an analyzer desktop program which is used to analyze network packets and to monitor network connections. It’s written in C with the GTK+ library and released under the GPL license.

Wireshark Network Analyzer

Cross-platform: it works on Linux, BSD , Mac OS X and Windows.

Command line support: there’s a command line based version from Wireshark to analyze data.

Ability to capture VoIP calls, USB traffic, network data easily to analyze it.

Available in most Linux distributions repositories.