Apache .htaccess file configuration in Linux

. There are many ways you can password protect directories under Apache web server. This is important to keep your file privates from both unauthorized users and search engines (when you do not want to get your data indexed). Here you will see the basics of password protecting a directory on your server. You can use any one of the following method:

1. Putting authentication directives in a <Directory> section, in your main server configuration httpd.conf file, is the preferred way to implement this kind of authentication.
2. If you do not have access to Apache httpd.conf file (for example shared hosting) then with the help of file called .htaccess you can create password protect directories. .htaccess file provide a way to make configuration changes on a per-directory basis.

In order to create apache password protected directories you need:

• Password file
• And Directory name which you would like to password protect (/var/www/docs)

Step # 1: Make sure Apache is configured to use .htaccess file

You need to have AllowOverride AuthConfig directive in httpd.conf file in order for these directives to have any effect. Look for DocumentRoot Directory entry. In this example, our DocumentRoot directory is set to /var/www. Therefore, my entry in httpd.conf looks like as follows:

<Directory /var/www>
Options Indexes Includes FollowSymLinks MultiViews
AllowOverride AuthConfig
Order allow,deny
Allow from all
</Directory>

Save the file and restart Apache
If you are using Red Hat /Fedora Linux:

# service httpd restart

If you are using Debian Linux:

# /etc/init.d/apache-perl restart

Step # 2: Create a password file with htpasswd

htpasswd command is used to create and update the flat-files (text file) used to store usernames and password for basic authentication of Apache users. General syntax:
htpasswd -c password-file username

Where,

• -c : Create the password-file. If password-file already exists, it is rewritten and truncated.
• username : The username to create or update in password-file. If username does not exist in this file, an entry is added. If it does exist, the password is changed.

Create directory outside apache document root, so that only Apache can access password file. The password-file should be placed somewhere not accessible from the web. This is so that people cannot download the password file:

# mkdir -p /home/secure/

Add new user called vivek

# htpasswd -c /home/secure/apasswords vivek

Make sure /home/secure/apasswords file is readable by Apache web server. If Apache cannot read your password file, it will not authenticate you. You need to setup a correct permission using chown command. Usually apache use www-data user. Use the following command to find out Apache username. If you are using Debian Linux use pache2.conf, type the following command:
# grep -e '^User' /etc/apache2/apache2.conf

Output:

www-data

Now allow apache user www-data to read our password file:
# chown www-data:www-data /home/secure/apasswords
# chmod 0660 /home/secure/apasswords

If you are using RedHat and Fedora core, type the following commands :
# grep -e '^User' /etc/httpd/conf/httpd.conf

Output:

apache

Now allow apache user apache to read our password file:
# chown apache:apache /home/secure/apasswords
# chmod 0660 /home/secure/apasswords

Now our user vivek is added but you need to configure the Apache web server to request a password and tell the server which users are allowed access. Let us assume you have directory called /var/www/docs and you would like to protect it with a password.

Create a directory /var/www/docs if it does not exist:
# mkdir -p /var/www/docs

Create .htaccess file using text editor:
# cd /var/www/docs
# vi .htaccess

Add following text:

AuthType Basic
AuthName "Restricted Access"
AuthUserFile /home/secure/apasswords
Require user vivek

Save file and exit to shell prompt.

Step # 3: Test your configuration

Fire your browser type url http://yourdomain.com/docs/ or http://localhost/docs/ or http://ip-address/docs

When prompted for username and password please supply username vivek and password. You can add following lines to any file <Diretory> entry in httpd.conf file:

AuthType Basic
AuthName "Restricted Access"
AuthUserFile /home/secure/apasswords
Require user vivek

To change or setup new user use htpasswd command again.

Troubleshooting

If password is not accepted or if you want to troubleshoot authentication related problems, open and see apache access.log/error.log files:

Fedora Core/CentOS/RHEL Linux log file location:
# tail -f /var/log/httpd/access_log
# tail -f /var/log/httpd/error_log
Debian Linux Apache 2 log file location:
# tailf -f /var/log/apache2/access.log
# tailf -f /var/log/apache2/error.log

Increasing Limit of The Maximum Number Of Open Files in Linux

The ulimit command provides control over the resources available to the shell and/or to processes started by it, on systems that allow such control. The maximum number of open file descriptors displayed with following command (login as the root user).

Command To List Number Of Open File Descriptors

Use the following command command to display maximum number of open file descriptors:
cat /proc/sys/fs/file-maxOutput:

75000

75000 files normal user can have open in single login session. To see the hard and soft values, issue the command as follows:
# ulimit -Hn
# ulimit -Sn
To see the hard and soft values for httpd or oracle user, issue the command as follows:
# su - username
In this example, su to oracle user, enter:
# su - oracle
$ ulimit -Hn
$ ulimit -Sn

System-wide File Descriptors (FD) Limits

The number of concurrently open file descriptors throughout the system can be changed via /etc/sysctl.conf file under Linux operating systems.

The Number Of Maximum Files Was Reached, How Do I Fix This Problem?

Many application such as Oracle database or Apache web server needs this range quite higher. So you can increase the maximum number of open files by setting a new value in kernel variable /proc/sys/fs/file-max as follows (login as the root):
# sysctl -w fs.file-max=100000
Above command forces the limit to 100000 files. You need to edit /etc/sysctl.conf file and put following line so that after reboot the setting will remain as it is:
# vi /etc/sysctl.conf
Append a config directive as follows:
fs.file-max = 100000
Save and close the file. Users need to log out and log back in again to changes take effect or just type the following command:
# sysctl -p
Verify your settings with command:
# cat /proc/sys/fs/file-max
OR
# sysctl fs.file-max

User Level FD Limits

The above procedure sets system-wide file descriptors (FD) limits. However, you can limit httpd (or any other users) user to specific limits by editing /etc/security/limits.conf file, enter:
# vi /etc/security/limits.conf
Set httpd user soft and hard limits as follows:
httpd soft nofile 4096
httpd hard nofile 10240
Save and close the file. To see limits, enter:
# su - httpd
$ ulimit -Hn
$ ulimit -Sn

Charting and Graphing Logfiles for Linux Server Admins

Some Linux server admins are comfortable with wading through text logfiles, but why wade when you can create beautiful charts and graphs that highlight trouble spots? Try the excellent CairoPlot for beautiful, informative visual server log.

CairoPlot isn't packaged for most distros, but it's an easy install. The current release is version 1.1 at the CairoPlot Launchpad page. You can download the cairoplot-1.1.tar.gz from there, or check it out with bzr if you prefer. (Once 1.2 is ready the project may move to Sourceforge.)

Extract the tarball:

$ tar xvf cairoplot-1.1.tar.gz

then copy one file, cairoplot-1.1/CairoPlot.py, to the directory where you'll be developing your Python script.

Pie Charts: Who's sending spam?

When playing with plotting, finding a good source of data is always the first step. For this project, let's analyze a Postfix log file, /var/log/mail.info to look at the sources of one class of spam.

A casual glimpse through the file reveals that we're getting a lot of mail delivery attempts where the sender claims an address that doesn't really exist, like this one:

Mar 5 15:05:45 mailserver postfix/smtpd[29764]: NOQUEUE: reject: RCPT from 212.199.94.45.static.012.net.il[212.199.94.45]: 450 4.7.1 <ex02.maccabiworld.org>: Helo command rejected: Host not found; from=<> to= proto=ESMTP helo=

Our postfix server rejects mail like this, because it's usually spam. Properly configured mail servers shouldn't make up bogus addresses -- though a few misconfigured ones do.

But where do these bogus requests come from? Do they come from specific countries? How many from .com or .org versus from specific country domains?

To find out, I'll create a Python dictionary, then use CairoPlot to plot a pie chart. Each key in the dictionary will be a top-level domain, e.g. "com"; the value will be the number of rejected messages seen from that domain.

Parsing the Log File

Filling out the dictionary means parsing /var/log/mail.info. The address each message really came from shows up in the RCPT from; get it using Python's re module. Since this is an article about CairoPlot, not Python regular expressions, just take my word for the code that follows.

#! /usr/bin/env python

import CairoPlot, re

MAIL_INFO = "/var/log/mail.info"

# Dictionary to store the results as (domain : number of rejects)
rejected = {}

# Parse mail.info to find all the 'NOQUEUE: reject' lines and
# figure out what top-level domains (TLDs) they're coming from.
f = open(MAIL_INFO)
for line in f :
    if line.find('status=sent') > 0 :
        pass
    elif line.find('NOQUEUE: reject') > 0 :
        # An attempt we rejected. Look for a pattern like
        # RCPT from foo.example.com[nnn.nnn.nnn.nnn]
        rcpt = re.search("RCPT from ([^[]*)\[([0-9\.]+)\]", line)
        if not rcpt :
            continue
        # Now rcpt.group(1) is the reverse-DNS hostname (if any)
        # from the log file, rcpt.group(2) is the IP address.
        if rcpt.group(1) and rcpt.group(1) != 'unknown' :
            hostname = rcpt.group(1)
        else :
            hostname = None

        # Find the part after the last "."
        tld = "Unknown"   # default there's no "." in the hostname
        if hostname :
            dot = hostname.rfind(".")
            if dot >= 0 :
                tld = hostname[dot+1:]
        if tld in rejected :
            # We've seen this TLD before; add 1.
            rejected[tld] += 1
        else :
            # First time we've seen this TLD.
            rejected[tld] = 1
f.close()

At the end of this, rejected is a dictionary suitable for passing to CairoPlot, like this:

{'ru': 3, 'ch': 1, 'ma': 2, 'rs': 2, 'it': 4, 'hu': 1, 'cz': 1, 'ar': 2, 'il': 35, 'br': 16, 'es': 1, 'co': 2, 'net': 4, 'com': 24, 'pl': 7, 'at': 2}

Generating a Pie Chart

How do you generate a pie chart from a dictionary? It only takes one line:

CairoPlot.pie_plot("piechart", rejected, 500, 500, None, True, False, None)

CairoPlot will produce a graphics file named pie.svg (Figure 1).

figure 1

The arguments are:

pie_plot(name,
         data,
         width, height,
         background=None,
         gradient=False, shadow=False,
         colors=None)

name is the filename: if you include an extension such as .jpg, CairoPlot will use that format instead of SVG format, in case you need a graphic that even IE users can view on a website.

data, of course, is the dictionary of values.

width and height are the desired size of the plot. Notice that CairoPlot leaves quite a bit of extra space around the outside of the pie, so plan accordingly.

background lets you specify a background color as a tuple of red, green and blue, so background=(0, 1, 0) would give a solid green background. You can also pass a Cairo gradient here. gradientspecifies whether the pie slices themselves should show a gradient, which makes the plot prettier.shadow lets you add a drop shadow on the whole piechart, and you can pass an array of custom colors-- again, tuples or gradients -- if you don't like the default colors. The colors list must have exactly the same number of entries as the data dictionary.

A minor problem with the chart in Figure 1: it turns out most hosts with invalid HELO addresses aren't resolvable at all, and the rest of the chart gets all squinched into a tiny piece of pie. What happens if you toss out all those unknowns? You can do that by adding one else clause after the if hostname:

if hostname :
            dot = hostname.rfind(".")
            if dot >= 0 :
                ext = hostname[dot+1:]
        else :
            continue

Run that, and the piechart looks like Figure 2. Quite interesting! I had no idea, before writing this example, that I got so much spam from Israel and Brazil compared to other countries. Sometimes a picture really is worth a thousand words.

figure 2

Bar Charts

CairoPlot makes pretty bar charts, too. Unfortunately, CairoPlot's various methods aren't consistent about their input, and bar_plot wants a list, not a dictionary.

No problem! Just convert that dictionary to two lists -- one for the labels, one for the data -- and callbar_plot (Figure 3):

h_labels = [ k for k in rejected.keys() ]
rejlist = [ rejected[k] for k in rejected.keys() ]
CairoPlot.bar_plot ('bars', rejlist, 500, 400,
                    border=5, three_dimension=True,
                    h_labels=h_labels)

figure 3

Again, you can pass a list of colors if you want custom colors, and there are a few other options available, like background, grid, rounded_corners, h_bounds and v_bounds, and of course v_labels as well as h_labels.

Of course, CairoPlot can do other types of graphs as well. There's some documentation here, or you can use the interactive Python interpreter and type

import CairoPlot
help(CairoPlot.pie_plot)

Eventually CairoPlot may move to Sourceforge and have a more organized website. But in the meantime, if you experiment a bit, you'll find it's one of the best packages around for making pretty, colorful graphs.

Akkana Peck is a longtime Linux programmer, and the author of Beginning GIMP: From Novice to Professional.

• 
• 
• 

Easy Redirection of sudo Output

If you're using Sudo, you've probably already discovered that the increased privileges apply only to the first command typed and don't extend to any input or output redirection. For example:


sudo iptables -L > /etc/iptables

will give you a 'Permission denied' error because the shell interprets the first command (with sudo), then pipes it into the second command (without sudo).

One solution to this is to jump straight into the root user shell with su. However, this ignores all the many very good reasons to use sudo in the first place (including logging, ticketing and a lower risk of accidentally doing something foolish because you've left a root shell lying around).

A better solution is to use sudo to run bash. Just typing

sudo bash

isn't great, as this would put you in much the same position as just using su. However, if you use the -c option, you can execute a single command and then return to your original shell:

sudo bash -c 'iptables -L > /etc/iptables'

Another option uses echo and a second pipe:

echo 'iptables -L > /etc/iptables' | sudo bash

This method really comes into its own if you're building up a particularly complicated command, as it allows you to confirm what you're doing in advance. Type

echo 'iptables -L > /etc/iptables'

and you'll see the command you're about to run echoed to your screen. This makes sure there aren't any unexpected escapes or similar in there. Then, recall the previous command with the up arrow, and add | sudo bash(or | sudo sh, if you prefer) to the end.

Helpfully, these are all fairly easy to edit from the previous line, for those all-too-common occasions when you forget about the redirection issue until the error reminds you.

More Deep Discovery on your Linux Server With /proc

/proc isn't just for getting information out of the system and into convenient text form. You can also use it to put information into the system, and thereby change it. The sys/ directory, which is where kernel variable information is kept, is where most of the things you might want to alter live. Changes made here will take effect immediately; no need to reboot

Networking changes

/proc/sys/net/ipv4/ contains a bunch of networking values to try playing around with.

/proc/sys/net/ipv4/tcp_keepalive_time sets how long (in seconds) it takes the TCP keepalive routines to send the first keepalive probe. A keepalive message simply detects whether the other side of the connection is still there; if not, it drops the connection. However, the default is 7200 seconds (2 hours), which is probably after your session would have timed out itself. If you want something quicker than that, you can change this value to send a keepalive sooner (and thus drop the session sooner if the other side has gone away). Setting it to 120 seconds would start sending keepalives after two minutes.

echo 120 > /proc/sys/net/ipv4/tcp_keepalive_time

After the first probe, the default time between keepalives is 75 seconds. To change this, you can alter/proc/sys/net/ipv4/tcp_keepalive_intvl. (Bear in mind that shortening the interval will increase network traffic, although keepalives are small packets, so not by much.)

Another useful value is /proc/sys/net/ipv4/tcp_keepalive_probes, which defines how many dropped keepalives it takes before the connection is marked inactive. By default, this value is 9, which may be worth increasing if you have a flaky network (or if your network is temporarily flaky):

 
echo 15 > /proc/sys/net/ipv4/tcp_keepalive_probes

When changing settings via /proc, you should use echo, as shown above, rather than a text editor. If you open the file in a text editor, the kernel value might conceivably change while you're editing it. Bear in mind that these files don't "really" exist, but are just a pretend file getting values into and out of the kernel. To avoid this problem, use echo to edit files, and cat (piped through less if necessary) to look at files.

Another useful file, /proc/sys/net/ipv4/ip_forward, allows you to enable IP forwarding. Most people don't need IP forwarding, but in some networking situations, such as setting up a VPN and/or dial-in server, it can be useful. (Be careful, as unlimited IP forwarding is a security risk!) Change the value to 1 to enable, or 0 to disable:

echo 1 > /proc/sys/net/ipv4/ip_forward

Here are a few more interesting variables to experiment with:

• Changing /proc/sys/fs/file-max will change the number of filehandles that are available – this will get rid of error messages stating the maximum number of open files has been reached, and no more files can be opened. The default is 4096, but you can use any number. (It's probably best to change this only if you actually run into this limit.)
You can do the same thing for inodes with /proc/sys/fs/inode-max. However, the total number of inodes available overall on the system can't be changed in this way.
• /proc/sys/kernel/ctrl-alt-del allows you to set the response to the Ctrl+Alt+Del key combination. 1 will set this to be a graceful shutdown (like typing shutdown -h now; 0 will be an immediate shutdown (like turning the power off). 1 is probably a safer value (after all, if you really have to do an immediate non-clean shutdown you can always physically turn the power off).
• You can use /proc/sys/kernel/hostname to configure your network hostname -- be careful doing this if you have DHCP as you might create a conflict.
• If experiencing load problems on an NFS server, you can increase the server memory queue limits by changing the value in the rmem_default, rmem_max, wmem_default, and wmem_maxfiles in /proc/sys/net/core/. Try 262144 (256K) as a starting point. I've found this very useful with NFS servers in the past.

If you poke around in /proc/sys/, there's plenty of other files you can play around with. Basically, if a file has the write attribute set, then you can change it – but do course be aware that you could potentially screw up your system by doing this! The good news is that changes made in this way will only last until the next boot; to make changes permanent, use sysctl and /etc/sysctl.confinstead. Type sysctl -a | less to look at a list of parameters. Working directly with the/proc/sys/ settings is a useful way to experiment before making permanent changes with sysctl or other tools.

More information

As with the process directories, there's a lot of information in /proc/ and I haven't covered all of it here. Spend some time having a poke through /proc with the man page to find out what else is there and what you might be able to change. Unfortunately the proc documentation can be a bit lacking in some cases. If the man page is unhelpful, try the docs in /usr/src/linux/Documentation/ (you may need to install kernel source packages), or at kernel.org. Alternatively, go take a look through /procand then Google for whatever file or directory names you find.

How to install ntop on RedhatLinux/Centos

ntop is a network and traffic analyzer that provides a wealth of information on various networking hosts and protocols. ntop is primarily accessed via a built-in web interface.
Following instructions are tested on 32/64 bit versions only:
a) RHEL Linux 5.x
b) CentOS Linux 5.x

Download latest ntop

Visit ntop project to grab latest version. You can use wget to grab the same, enter:
# cd /opt
# wget http://freshmeat.net/redir/ntop/7279/url_tgz/ntop-3.3.6.tar.gz
Untar tar ball, enter:
# tar -zxvf ntop-3.3.6.tar.gz

Configure and Compile ntop under RHEL

You must have RRDTool installed. You also need to install libpcap, enter:
# yum install libpcap-devel libpcap
Type the following commands to compile and install ntop:
# cd ntop
# ./autogen.sh
Just type make to compile ntop:
# make
Just type make install to install ntop:
# make install
# make install-data-as

Create ntop user

Type the following command to run ntop as ntop user, enter:
# useradd -M -s /sbin/nologin -r ntop

Setup directory permissions

Next, you need to setup directory permissions, enter:
# chown ntop:root /usr/local/var/ntop/
# chown ntop:ntop /usr/local/share/ntop/

Setup ntop user admin password

Type the following command to set ntop admin password, enter:
# ntop -A
Sample output:

Mon Jul 28 03:38:34 2008  NOTE: Interface merge enabled by default
Mon Jul 28 03:38:34 2008  Initializing gdbm databases
ntop startup - waiting for user response!
Please enter the password for the admin user:
Please enter the password again:
Mon Jul 28 03:38:42 2008  Admin user password has been set

Start ntop

Type the following command to start ntop:
# /usr/local/bin/ntop -d -L -u ntop -P /usr/local/var/ntop --skip-version-check --use-syslog=daemon
Sample output:

Mon Jul 28 03:42:19 2008  NOTE: Interface merge enabled by default
Mon Jul 28 03:42:19 2008  Initializing gdbm databases

If you have multiple interface (eth0, eth1 and so on), start ntop as follows:
# /usr/local/bin/ntop -i "eth0,eth1" -d -L -u ntop -P /usr/local/var/ntop --skip-version-check --use-syslog=daemon
Where,

• -i "eth0,eth1" : Specifies the network interface or interfaces to be used by ntop for network monitoring. Here you are monitoring eth0 and eth1.
• -d : Run ntop as a daemon.
• -L : Send all log messages to the system log (/var/log/messages) instead of screen.
• -u ntop : Start ntop as ntop user
• -P /usr/local/var/ntop : Specify where ntop stores database files. You may need to backup database as part of your disaster recovery program.
• --skip-version-check : By default, ntop accesses a remote file to periodically check if the most current version is running. This option disables that check.
• --use-syslog=daemon : Use syslog daemon.

How do I view ntop stats?

By default ntop listen on 3000 port. You can view ntop stats by visiting following url:
http://localhost:3000/
OR
http://server-ip:3000/

(Fig.01: ntop Global TCP/UDP Protocol Distribution Graphs [click to enlarge])

(Fig.02: Network Load Statistics (click to enlarge])

Open port 3000 using iptables

Open /etc/sysconfig/iptables file, enter:
# vi /etc/sysconfig/iptables
Append following code before final REJECT line:
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 3000 -j ACCEPT
Save and close the file. Restart firewall:
# service iptables restart

How do I view ntop stats without opening port 3000?

Setup simple tunnel using ssh, enter the following on your local UNIX / Linux desktop system:
$ ssh -L 3000:localhost:3000 -N -f user@server.yourcorp.com
Now open browser and type the following command:
http://localhost:3000/

How do I start ntop on boot?

Open /etc/rc.local file, enter:
# vi /etc/rc.local
Append the following line:
/usr/local/bin/ntop -i "eth0,eth1" -d -L -u ntop -P /usr/local/var/ntop --skip-version-check --use-syslog=daemon
Save and close the file.

How do I stop ntop?

Use web interface to shutdown ntop, or use normal kill / killall command:
# killall ntop

Hacking Facebook

Hacking Facebook Coming Soon Stay Tuned                                      Hacking Facebook Coming Soon Stay Tuned

Hacking Facebook Coming Soon Stay Tuned                                      Hacking Facebook Coming Soon Stay Tuned

Hacking Facebook Coming Soon Stay Tuned                                      Hacking Facebook Coming Soon Stay Tuned

Hacking Facebook Coming Soon Stay Tuned                                      Hacking Facebook Coming Soon Stay Tuned

Hacking Facebook Coming Soon Stay Tuned                                      Hacking Facebook Coming Soon Stay Tuned

Hacking Facebook Coming Soon Stay Tuned                                      Hacking Facebook Coming Soon Stay Tuned

Hacking Facebook Coming Soon Stay Tuned                                      Hacking Facebook Coming Soon Stay Tuned

Hacking Facebook Coming Soon Stay Tuned                                      Hacking Facebook Coming Soon Stay Tuned

Hacking Facebook Coming Soon Stay Tuned                                      Hacking Facebook Coming Soon Stay Tuned

Hacking Facebook Coming Soon Stay Tuned                                      Hacking Facebook Coming Soon Stay Tuned