Setting up Centos 7 Apache 2.4 with Azure AD Authentication

https://jo.bgplus.com/blog/setting-up-centos-7-apache-24-with-azure-ad-authentication

MacOS Sierra SSH issue solved

Just upgraded to OSX Sierra and my ssh totally broke. The fix is easy. As a super user or with sudo apply that below at the end of file /etc/ssh/ssh_config:

KexAlgorithms +diffie-hellman-group1-sha1
HostKeyAlgorithms +ssh-dss

Crontab jobs for all US federal holidays

Ever wonder how to run crontab jobs for all US federal holidays? Below is how:

1 0 1 1 * /bin/echo “New Year’s Day”
1 0 15,16,17,18,19,20,21 1 1 /bin/echo “Martin Luther King’s Day”
1 0 15,16,17,18,19,20,21 2 1 /bin/echo “President’s Day”
1 0 25,26,27,28,29,30,31 5 1 /bin/echo “Memorial Day”
1 0 4 7 * /bin/echo “Independance Day”
1 0 1,2,3,4,5,6,7 9 1 /bin/echo “Labor Day”
1 0 8,9,10,11,12,13,14 10 1 /bin/echo “Columbus Day”
1 0 11 11 * /bin/echo “Veterans Day”
1 0 22,23,24,25,26,27,28 11 4 /bin/echo “Thanksgiving”
1 0 25 12 * /bin/echo “Christmas”

Snorby: Debug the mailing feature and creating cron job

Do not run the following commands unless you really need to:

cd /path/to/snorby

bundle exec rails c production
Snorby::Jobs::SensorCacheJob.new(true).perform
Snorby::Jobs::DailyCacheJob.new(true).perform (this command is invalid for version 2.6.2)

I tried a few things. From the shell of my CentOS 6.4 everything works fine but can’t make it automatically to send me reports, so I didn’t bother to go ahead with the source but just added that simple file (named snorby_report.cron) in /etc/cron.daily:

#!/bin/sh
cd /path/to/snorby
RAILS_ENV=production /usr/bin/rails r ‘Snorby::Jobs::SensorCacheJob.new(true).perform’

Installing Snort on CentOS 6.4

My guide is simple. Just the commands you need to run. Please, read before copy and paste. It requires clean minimal installation of CentOS 6.4 and Internet connectivity:

yum install wget
wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
wget http://rpms.famillecollet.com/enterprise/remi-release-6.rpm
rpm -Uvh remi-release-6.rpm epel-release-6-8.noarch.rpm

vi /etc/yum.repo.d/remi.repo

        [remi]
        enabled=1

        [remi-php55]
        enabled=1

yum install autoconf automake bison flex gcc glibc libdnet libdnet-devel libpcap libpcap-devel make mlocate pcre-devel rpm-build zlib zlib zlib-devel

wget snort and daq source rpms from snort.org

rpmbuild –rebuild daq-2.0.1-1.src.rpm
yum localinstall rpmbuild/RPMS/x86_64/daq-2.0.1-1.x86_64.rpm
rpmbuild –rebuild snort-2.9.5.5-1.src.rpm
yum localinstall rpmbuild/RPMS/x86_64/snort-2.9.5.5-1.x86_64.rpm

yum install mysql-server
chkconfig –add mysqld
chkconfig mysqld on
service mysqld start
mysql_secure_installation

checking for all runnung barnyard2 proceesses

I am running “snort” with two sensors. Occasionally one of my “barnyard2” processes is dying and if I am not checking the processes on the shell, there is no way I’ll know that. So I wrote a single line perl script and put it in a cron job to be run every five minutes. If there are not two barnyard2 processes running, I’m getting an e-mail. Is that simple.

 

if(`ps -aef |grep barnyard2 |grep -v grep |wc -l`!=2) {`mail -s BY2DOWN me\@email.edu</dev/null`;};

 

Of course, the whole procedure could be automated, I mean if the script detects the issue, could restart my init.d script controlling barnyard2 (in my case it controls snortd and barnyard2 at the same time) but wth will I do that… Just login and start the process is enough in my case.

So, just decided to share. Put #!/bin/perl on the top of the line above, make it chmod +x or 755, the cron should be */5 * * * * /full/path/by2.check, or something like that. That line should be enough for beginners if any.

Snorby No time_zone specified in snorby_config.yml; detected time_zone:

When I installed Snorby 2.6.2 and I started it, everything looked good and worked but I was getting that warning below, all the time:

 

No time_zone specified in snorby_config.yml; detected time_zone: America/Los_Angeles

Regardless of the fact I already put it in the config file: snorby_config.yml

  # If timezone_search is undefined or false, searching based on time will
  # use UTC times (historical behavior). If timezone_search is true
  # searching will use local time.
  timezone_search: true
  # uncomment to set time zone to time zone of box from /usr/share/zoneinfo, e.g. “America/Cancun”
  time_zone: ‘America/Los_Angeles’

 

So how did I fix it? Pretty simple actually but took me a lot of digging. Edit application.rd which is in the config directory, that way:

## time_zone = CONFIG[:time_zone] # set your local time zone here. use rake time:zones:local to choose a value, or use UTC.
    time_zone = “America/Los_Angeles”

 

That’s it. Search for the string “Central Time”. It is right after it. Line 77

Changing back to IPTables in Fedora 18

By default Fedora 18 has changed to using firewalld to maintain the host firewall.  While this may be a good thing some times we need the old ways to allow us to catch up.  Especially when we haven’t the time to migrate complicated rules.  Thankfully Fedora has not removed IPTables.  The following set of commands should disable Firewalld and enable IPTables for those of us needing the breathing space to catch up.

systemctl disable firewalld.service
systemctl stop firewalld.service
systemctl enable iptables.service
systemctl enable ip6tables.service
systemctl start iptables.service
systemctl start ip6tables.service

Of course if you are like me and like to install minimal systems you may need to run this command first.

yum -y install iptables-services iptables-utils

 

Source: http://www.chesterproductions.net.nz/blogs/it/sysadmin/changing-back-to-iptables-in-fedora-18/616/

The definitive guide of connecting Apache via LDAP SSL to ActiveDirectory + Subversion

Being taken though hell I of configuring the damn authentication mechanism.
I needed to integrate Apache with ActiveDirectory via LDAP SSL. The manual SUCKS! It does not say anything useful, except for the syntax of the directives.
This article was the most definitive of configuring the integration. But lacks the information about how to make the SSL work correctly.

Here’s the kicker, it is as simple as the following several elements(this is in the top of /etc/apache2/sites-available/default):

# Make sure ve don’t care about the server’s certificate, because we don’t
LDAPVerifyServerCert off
LDAPTrustedMode SSL
# The server’s client cert information: the cert and the matching private key
LDAPTrustedGlobalCert CERT_BASE64 /etc/apache2/sites-available/cert1.pem
LDAPTrustedGlobalCert KEY_BASE64 /etc/apache2/sites-available/key1.pem

These go into the ROOT. Do not try to put them in the Location, nor Directory, nor VirtualHost.

And the main change to enable the SSL transport:
AuthLDAPURL “ldaps://adserver.example:636/DC=adserver,DC=example?sAMAccountName?sub?(objectClass=*)” SSL

These are the steps:

1. Create the client Key and Certificate

The cert1.pem and key1.pem are created like described here:

openssl genrsa 1024 > key1.pem
openssl req -new -x509 -nodes -sha1 -days 365 -key key1.pem > cert1.pem

For an additional configuration reduction bonus you can have it in one single file:
cat cert1.pem key1.pem > pcert.pem
LDAPTrustedGlobalCert CERT_BASE64 /etc/apache2/sites-available/pcert.pem

2. Enable the correct modules on Apache HTTP Server 2.2.

On my Ubuntu system the module enabling is done like this:

sudo a2enmod alias

sudo a2enmod auth_basic

sudo a2enmod authnz_ldap

sudo a2enmod authz_default

sudo a2enmod authz_user

sudo a2enmod dav

sudo a2enmod dav_svn

sudo a2enmod ldap

Or uncomment these elements in the httpd.conf:
LoadModule actions_module modules/mod_actions.so
LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule authn_default_module modules/mod_authn_default.so
LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule ldap_module modules/mod_ldap.so

And the modules that are prescribed by the Subversion.

3. The access restrictions and Subversion

The short info for configuring the access restrictions.
This will allow people in the users in SVN Writers to commit and SVN Readers will be able to checkout and connect.

<Location>
# This enables Subversion
DAV svn
# Location of the Subversion repository
SVNPath /home/ldaptest/

# How we are going to get authenticated
AuthBasicProvider ldap
AuthType Basic
AuthzLDAPAuthoritative on
AuthName “My Subversion server”
#The URL of the ActiveDirectory server
AuthLDAPURL “ldaps://adserver.example:636/DC=adserver,DC=example?sAMAccountName?sub?(objectClass=*)” SSL
# Credentials for the Apache HTTP to connect to the A/D to issue queries
AuthLDAPBindDN “subversion@adserver.example”
AuthLDAPBindPassword 555

# Limit all write operations to users within SVN Writers group
<LimitExcept>
require ldap-group CN=SVN Writers,CN=Users,DC=adserver,DC=example
</LimitExcept>
# Limit logon and reading to only users in SVN Readers group
require ldap-group CN=SVN Readers,CN=Users,DC=adserver,DC=example
</Location>

4. Add the following to the default site on Apache HTTP

The file is /etc/apache2/sites-available/default
Right at the TOP.

# Make sure ve don’t care about the server’s certificate, because we don’t
LDAPVerifyServerCert off
LDAPTrustedMode SSL
# The server’s client cert information: the cert and the matching private key
LDAPTrustedGlobalCert CERT_BASE64 /etc/apache2/sites-available/cert1.pem
LDAPTrustedGlobalCert KEY_BASE64 /etc/apache2/sites-available/key1.pem

Posted 10th June 2009 by Alexander Panzhin