EvilZone

May i come with a quick suggestion, if you are to do anything with torrents for movie titles the much much better choice is to use the YTS API. YTS delivers all the new and cool stuff, all full HD, and everything has subtitles.

YTS > Kickass :3

API For reference:
https://yts.re/api

I might be joining in as well, if you can fit Factionwars timezone, it fits mine as well. I'l be hanging around on irc again anyway

huh, not much of a tutorial just read the manual for grsec lol. Same thing...

You go do that then? Nothing stopping you from doing that. Everything can be achived with learning and reading documentations, so why do we have tutorials?

Thanks for the quick answer, I didn't know there were security measures against such scans, always thought nmap was 100% certain to succeed with certain scans.
Tell me when you've tested NULL scans

I really need to update this guide, gonna do it later.

No need for me to start up portscan with CSF when we use PSAD in the guide. But as it seems, you CSF also blocks NULL packets.

When not using CSF, just PSAD, we can add this to iptables to fix

$IPT  -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "NULL Packets"
$IPT  -A INPUT -i ${PUB_IF} -p tcp --tcp-flags ALL NONE -j DROP # NULL packets


I know it-s not finished, but just to be sure, this won't in any way protect you from FIN,XMAS, NUL scans or so am I right?
After all, when you receive such requests you are forced to send a RST packet.
Just to clarify, there might be an option for it, although I don't think there is.

I know about XMAS and FIN, and CSF will in most times catch those. An XMAS packet (SYN,ACK,RST, FIN,URG,PSH) Should never be on a network anyway and csf automaticly drops those.

When it comes to NUL i don't know (those are the packets without flags right?) That i haven't tested yet, and it's a good question, i will come back after i tested it and add it to the guide if needed.

How about adding mod_security2 and fail2ban for server self support...
I prefer put those 2 in every server... 
And sometimes with shorewall for an easy "coffe"mix... 

Fail2ban isn't needed since LFD (that is built into csf) has just the same features and is also intergrated into the firewall, makes it alot easier to follow with logs and automaticly ban rules in the firewall.

Mod_security is on the "todo" list.

And why need 2 firewalls? That's like shooting yourself in the foot with a shotgun

   
Adding a tutorial from one of the ChaseNET admins, with his permission ofcourse


--------

Copyright (c) 2010 Declan Williams.
    Permission is granted to copy, distribute and/or modify this document
    under the terms of the GNU Free Documentation License, Version 1.2
    or any later version published by the Free Software Foundation;
    with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.
    A copy of the license is included here http://www.gnu.org/licenses/fdl-1.3.html

Custom Kernel+Grsec+PaX HOWTO

First, draw up hardware lists to make sure you build in all the required support into the kernel.
I recommend disabling LKM to help prevent kernel level rootkits.
I also recommend putting PaX on the highest settings, and enabling the features to stop writing to /proc/kmsg and other areas nasties abuse.
Also, use a hardened toolchain throughout installation of applications on your machine,Though you will have to compile your applications.
 Recommendations: Gentoo Hardened Project.
 
 Recommended Grsecurity settings:
 
Security Options ->
   Grsecurity ->
      Security Level (High)
Address Space Protection
[*] Deny writing to /dev/kmem, /dev/mem, and /dev/port //kmem can be used to insert rootkits
[*] Disable Privileged I/O //Enable if you use X11 etc, disable for servers.
[*] Removed addresses from /proc/<pid>/[smaps|maps|stat] //Speaks for itself
[*] Deter exploit bruteforcing //You definitely want this one
[*] Hide kernel symbols //Again, no reason for legit to see this
      Role Based Access Control ->
[ ] Disable RBAC System //This is fantastic, do NOT disable it,use it
[*] Hide kernel processes //No legit reason to see these in production.
        (3) Maximum tries before password lockout
          (3600) Time to wait after max password tries, in seconds //That's an hour, pick as appropriate
Filesystem Protections
[*] Proc restrictions //Proc has lots of useful info, to attackers too.
[*] Restrict /proc to user only //Makes sure the user can only see their own processes, and hids network info(like binded ports(can use to identify daemons to exploit))
[*] Allow special group //Certain GID that can see it all, choose wisely
[*] Additional Restrictions //Adds more restrictions, prevents users from seeing slabinfo and devinfo
[*] Linking Restrictions //Prevents /tmp race condition 'sploits, stops users from following symlinks from other users in world-write+t dirs, useful stuff
[*] FIFO Restrictions //Similar to above except FIFO pipes now, again nice to stop
[*] Runtime Read-only Mount Protection //Adds sysctl option to prevent new rw mounts, remounting rw, write on block devs, CHOOSE IF THIS APPLIES TO YOU
[*] Chroot Jail Restrictions //You want ALL of these, hardens your chroots by defeating common bypass methods completely.
...
      Kernel Auditing ->
          [*] Log execs within chroot //Just in case they're doing the naughty.
[*] Ptrace logging //Shouldn't be done on a production system, useful to attackers, you want to know this
          [*] /proc/<pid>/ipaddr support //Tells you the IP the process was executed by, again useful to know
[*] Denied RWX MMAP/MPROT logging //Tells you if something tripped PAX_MPROTECT
Executable Protections
[*] Enforce RLIMIT_NPROC on execs //If the user is limited, it'll be checked also during execve(), usually it's just fork()
[*] DMESG Restrictions //Stops non-super reading the last 4kb of messages in the kernel buffer.
[*] Deter ptrace-based process snooping //Monitoring tools that use ptrace will be mitigated if they try to do it to an already running process
[*] Trusted Path Execution(TPE) //Good stuff, can stop users running stuff in their own directories etc depending on the following selections
[ ] Partially restrict all non-root //Doesn't usually apply, check first if you prefer that option.
[*] Invert GID option //Now it applies to everyone except given GID, choose wisely
      Network Protections ->
[*] Larger entropy pools //Makes things more random and therefore decreases predictability(very important in network security)
[*] TCP/UDP blackhole and LAST_ACK DoS prevention //Prevents resets and destination-unreachable being sent back to unbinded ports.
          [*] Socket restrictions ->
            [*] Deny any sockets to group ->
               [no-net GID] GID to deny all sockets for

Recommended PaX settings:
 
Security options ->
   PaX ->
      Non-executable pages ->
         [ ] Emulate trampolines //can break shit, but also poses a risk if enabled.
         [*] Disallow ELF text relocations
      Miscellaneous hardening features ->
         [*] Sanitize all freed memory //Erases pages when not used, stops sensitive info remaining in memory long enough to be stolen

From there, you will also want to remove the /dev/kmem device in character devices, remove any functionality and drivers you do not need, then go into kernel hacking and remove all debugging options available.
 
 
 Make sure you have kernel.org's public key:
 
% gpg --keyserver wwwkeys.pgp.net --recv-keys 0x517D0F0E
% wget http://www.grsecurity.net/spender-gpg-key.asc
% gpg --import spender-gpg-key.asc
 Download latest release(bz2+bz2.sign files):
 
% lynx http://www.kernel.org/pub/linux/kernel/v2.6/
% gpg --verify linux-2.6.*.bz2.sign linux-2.6.*.bz2
% tar xvjpf ./linux-2.6.*
 Move the folder:
 
% sudo mv -R ./linux-2.6.*/ /usr/src/
 Create new Symlink:
 
% sudo ln -s /usr/src/linux-2.6.<version here>/ /usr/src/linux
 Get the grsec patch and sign for your kernel:
 
% lynx http://grsecurity.net/download.php
 Verify the patch:
 
% gpg --verify ./grsecurity*.patch.sig ./grsecurity*.patch
 Move the patch:
 
% sudo mv ./grsecurity*.patch /usr/src/linux
 Change dir:
 
% cd /usr/src/linux
 Patch the kernel:
 
% patch -p1<./grsecurity*.patch
 Escalate privs:
 
% sudo -i

You're going to want to harden your flags for this.
$ export CFLAGS="-O2 -pipe -fomit-frame-pointer -DFORTIFY_SOURCE_2 -fstack-protector -fPIE -fPIC"
$ export CXXFLAGS="Â${CFLAGS}"
$ export LDFLAGS="-z relro -pie"
 Make the config file:
 Ncurses:
 
$ make menuconfig
 GTK:
 
$ make gconfig
 QT:
 
$ make xconfig
 After doing so, and saving, make the kernel:
 
$ make
 If using lkm, then make the modules:
 
$ make modules_install
 Then install the kernel:
 
$ make install
 Modify your GRUB configuration as required:
 
$ vi /boot/grub/menu.lst
 Reboot
 
$ reboot
 If all is well, download gradm and the .sig, else repeat the steps previously shown from menuconfig onwards.
 
% lynx http://grsecurity.net/test.php
% gpg --verify ./gradm*.gz.sig ./gradm*.gz
% tar xvf ./gradm*.gz
 Then we make it:
 
% cd ./gradm2
% make
% sudo make install
 Then download paxutils:
 
% wget http://mirror.bytemark.co.uk/gentoo/distfiles/pax-utils-0.2.tar.bz2
% tar xvjpf ./pax-utils*.bz2
% cd ./pax-utils*/
% make
% sudo make install
 Then we cleanup
 
% cd ../
% rm -rf ./gradm2/
% rm -rf ./pax-utils*/
% rm -rf ./linux-2.6*/
% rm ./grsec*
% rm ./gradm*
% rm ./linux-2.6.*
% rm ./pax-utils*.bz2
% cd /usr/src/linux
% sudo make clean
% cd
From here it's recommended to make sure all your userland is compiled with the hardened flags and stripped of all debugging information etc,
and that you set up RBAC using the links below.

To check for any badly compilec processes(no RELRO, stack canary etc), then check out this brilliant script http://tk-blog.blogspot.com/2009/02/checksec.html
 
 All done, for further resources in regards to PAX, GRSecurity etc, checkout the gentoo hardened project:
 http://www.gentoo.org/proj/en/hardened/pax-quickstart.xml
 http://www.gentoo.org/proj/en/hardened/grsecurity.xml
 
 Hope this has been somewhat useful, la revedere.
 Canis.
-------

Here's one of my tutorials on linux security. It's not FULLY finished yet, and will get edited. But most of it is there already Have fun.

I wanted to post a few tips on how you can easily secure your network on a debian based distro,

All written by us and is a part of tutorials i post on chasenet, please don't copy this without asking!

In this tutorial we will be using CSF/LFD (IPtable integrated firewalls), PSAD for anti portscans and DDoS-Deflate for protection against (D)DoS attacks, for more security on your server. We will also be using a webinterface on some places instead of console to make things easier for beginners as well, for this i choosed webmin, as it is intergrated into everything you can do on a linux system.


Before we start we would need to install apache/php and mysql on your server as well, not going to much into that you can read about how to easily do that on a debian based system HERE:
http://www.howtoforge.com/ubuntu_debian_lamp_server
Please also try to use an updated debian system so we don't have any crash on dependencies.
In some cases you might want to get the build-essential package as well
apt-get install build-essentialYou will also have to get syslog-ng for logging.
apt-get install syslog-ng

First step:
Installing webmin,

We start of with our web interface for easy management and set up of the firewall etc:
wget http://prdownloads.sourceforge.net/webadmin/webmin_1.500_all.deb
Installing webmin with:
dpkg -i webmin_1.500_all.deb
If you get an error saying you don't have all the dependencies just run:
apt-get -f install
So after this has installed itself you can easily access your webinterface by going to this address:
http://localhost:10000
If this now display a login page you have done it right.

Now we can start the fun part of setting up the firewall

Step two:
Installing and configuring CSF firewall

Downloading CSF:
wget http://configserver.com/free/csf.tgz
Untar the package:
tar xvzf csf.tgz
Switch to the csf directory
cd csf
And just run the install script:
sh install.sh
If this completed without errors we can now load csf into webmin.

Loading the module:
Log into your webmin interface and go to Webmin > Webmin Configuration > Webmin Modules.
On local file you fill in the path to the webmin module installed by csf,
/etc/csf/csfwebmin.tgzAnd press Install Module.

If this goes well you will now see "ConfigServer Security & Firewall" Under the SYSTEM tab in webmin.


Step three:
Configuring ConfigServer Security & Firewall

Go to the ConfigServer Security & Firewall tab in webmin and press "Firewall Configuration"
For this tutorial we will just fill out the easiest part of the configuration but feel free to explore more of the big potentials of CSF.

Change these areas of the config,

Stop running CSF in testmode:
TESTING=1 to TESTING=0
Set the open ports (here we will just fill in what we need at the moment)
TCP_IN=21,22,80,10000 21 for ftp, 22 for ssh, 80 for the www and 10000 for webmin (the last one here is very important to remember)
TCP_OUT=21,22,80,10000
Changing ICMP requests (optional) This will disable ping requests and answers. I personaly like to set this to off, so no specific ping attacks can be made with special packets.
ICMP_IN=0ICMP_OUT=0
Protection against synflood (for webservers etc)
SYNFLOOD=1
Protection against portfloods
PORTFLOOD=1
That should be all, scroll down to the end and press CHANGE to save all the changes you have made to the config.

The usage of CSF will be explained in another tutorial later on, but the interface is very easy to understand. "View iptable logs" To see what csf have banned and why, "View LFD logs" to see what it has picked up as suspicious processes, who has logged in through ssh and if any portscans have been detected.


Step four:
Installing PSAD

As mentioned before, you would need to have syslog-ng installed before running psad properly, with this done, let's start!

Download and install psad:
apt-get install psad
Setup syslog-ng to log things from PSAD (You don't need to use nano if you like other editing tools better.
nano /etc/syslog-ng/syslog-ng.conf
Search for the "# pipes" Section and add this to the list:
destination psadpipe { pipe("/var/lib/psad/psadfifo"); };
Search for the "# filters" section of the config and add this line
filter f_kerninfo { facility(kern); };
And all the way on the bottom of the config, add these lines:
log {
        source(s_all);
        filter(f_kerninfo);
        destination(psadpipe);
};

Restart syslog-ng:
/etc/init.d/syslog-ng restart
Now we have the logging in place, and we can start configure psad:
nano /etc/psad/psad.conf
The most important parts will be these, fill them in with your own information:
Your email address
EMAIL_ADDRESSESYour Hostname (like http://localhost)
HOSTNAMESet home_net to not used:
HOME_NET                NOT_USED;  ### only one interface on boxIf you want to set ports to ignore on scans you can do it like this (optional):
IGNORE_PORTS                tcp/88, udp/3000;For IDS and iptable support:
ENABLE_AUTO_IDS             Y;
IPTABLES_BLOCK_METHOD       Y;

Now save and close the config.
Restart PSAD:
/etc/init.d/psad restart
Now all we need is to add two iptable rules so psad can use iptable logging, done with these two commands:
iptables -A INPUT -j LOG
iptables -A FORWARD -j LOG

That was all for PSAD, it should now be up and running and scan reports can be made using this command:
psad -S

Step five:
Anti-DDoS
Setting up DDoS-Deflate is easier than you think, with just a few commands and changes,
Downloading and installing DDoS-Deflate:
wget http://www.inetbase.com/scripts/ddos/install.sh
chmod 0700 install.sh
./install.sh

To configure ddos deflate you will need to do a few small changes:
Open up the script in your favourite editor,
nano /usr/local/ddos/ddos.shScroll down to add_to_cron() and you will find 2x of these lines
service crond restartChange it to:
service cron restartSave and close the script and open up the ddos.conf:
nano /usr/local/ddos/ddos.confHere you can change how ddos should react in different situations and you can put your own config on these lines,

How often the script is going to run (minutes):
FREQ=1Number of connections a user will need to have at the same time before he get's banned by the script:
NO_OF_CONNECTIONS=30Set this to 0 to use IPtables since we don't use APF:
APF_BAN=0Kill connections or not:
KILL=1If you want emails of the banned IP's then set your email inside the "":
EMAIL_TO=""
Now save and close the config and run this command to add the script to crontab so it runs every minute:
/usr/local/ddos/ddos.sh --cron
A few extra things you might want to add to your linux servers for extra functionality against (D)DoS attacks:
Enable SYN_Cookies:
sysctl -w net.ipv4.tcp_syncookies=1Increase the Connection backlog, allowing more connections
sysctl -w net.ipv4.tcp_max_syn_backlog=2048
If you want to make it permanent just add them to the sysctl config in the /etc/sysctl dir so it will stay like that even after reboots.


And that's everything you need to set up a bit more security on your linux box, even if it's at home or on your server. Feel free to read around on the different documentation (provided by a google search) and implement more secure solutions and take use of all the other nice features these tools have.

If you have any questions please PM me or post here.

Not finished implemented in the guide yet:
PHPIDS
Mod_security
Gresecurity and PAX - Added

Mostly Dubstep, or Heavy Metal, depends on the mood i guess