How to: Easy Intrusion Detection System (IDS) setup with EasyIDS

Last day, my boss ask me to install one IDS for our office. He just say "Please install the open source product". After seek on the internet for whole day, I found the EasyIDS. I have tested on my office's PC with details:

Pentium 4 2.8ghz
512MB DDR-RAM
40GB Hard disk
2 Network interface card (10/100baseT)
52X CD-ROM

This is the way I do it:
1. Download from the EasyIDS website http://www.skynet-solutions.net/easyids/

2. The download file is on ISO type which mean you can burn it to CD.

3. After burn on the CD, I just install the software with the CD-ROM boot first. You can setting the CD-ROM boot first in your BIOS setting.

4. I just follow the step by step until finish.

5. After it restart and update the patches, it display tty1 as the default with the black and white screen. You can login as root here.

6. After the EasyIDS properly setup you can go to another PC and open the browser. Type http://youreasyIDS. Its will popup the username and password. The default login is admin and the password is password.

7. After login, you see the interface base on ACID which some people call php-acid. This interface is easy to administrating the EasyIDS. I'm so glad this kind of software have develop by open source community. Thanks.

You can go to EasyIDS website http://www.skynet-solutions.net/easyids/ for more details.

EasyIDS Features:
Base on Centos 4.5
Snort
BASE
ACID
Oinkmaster
ntop

Thanks for EasyIDS team for develop this tools. Keep it up! :-)

Tomboy: The easiest Note-taking Program in Gnome

Relatively new application that has found its way into recent versions of almost all Linux distributions is Tomboy. It is in cross-indexing tool and a quick publisher all rolled into one. Tomboy is also very addictive and easy to use, and does away with the hassle of naming files and remembering the directory paths. It is an evolving application and the latest release is still at version 0.6.

To start:
1. Go to Application --> Accessories --> Tomboy Notes, which lunched Tomboy as an applet on your panel. Once lunched it remains active and you can access your note quickly from the applet icon till you log out or quit the applet.

2. To give automatic lunched Tomboy every time you boot the system; you can use this guide (for gnome):
- right-clicking on an empty space on the panel and selecting the 'Add to Panel' option. Once you have 'Add to Panel' window up, select the Tomboy Notes application and click the 'Add' button to add it in your panel.

Many feature Tomboy can do. For more infomation about Tomboy please visit http://www.gnome.org/projects/tomboy/

How to block root to access ssh to your server (CentOS 5)

1. First open your terminal
2. vi /etc/ssh/sshd_config
3. Find PermitRootLogin yes
4. Change PermitRootLogin no
5. Save and exit
6. Restart your sshd by type /etc/init.d/sshd restart

That's all.

How to give MySql Root Password

As default, Mysql database didn't have any password. For some security reason, you need give the Mysql with a password. This is the way how to give the password to your Mysql database.

1. Go in to Mysql by type mysql

2. Type update user set password=password ('yourpassword') where user='root'; and enter. yourpassword mean enter your own password.

3. Type flush privileges

4. Exit mysql

To test:

1. Go in to Mysql by type mysql -u root -p and enter

2. It promt you to enter the password. Enter you password given before.

3. If you can login with you password, it mean your work is successfully.

Error after install Phpmyadmin

Last day my friend had asked me about the error after install phpmyadmin in his Linux.

The error say
"The configuration file now needs a secret passphrase (blowfish_secret)"

This is the solution:
1. Go to phpmyadmin directory on your linux. Eg: /usr/share/phpmyadmin (in Centos5).

2. File the config.inc.php with your favorite editor eg. vi

3. Find $cfg ['blowfish_secret'] = ' ';

4. Fill in the password or phassphrase, example
$cfg ['blowfish_secret'] = ' 123456';

5. Save and quit the editor. That all

How to: Resetting Mysql root password

Sometimes, you cannot remember the mysql password. After try many time to login, you still cannot login to database. This is the solution.

1. You need to open 2 terminal/shell.

At terminal 1:
2. At terminal 1, stop your mysql deamon if it running: $ /etc/init.d/mysqld stop and enter. The mysql deamon is stop now.
3. Type $ mysqld_safe --skip-grant-tables


Terminal 2:
4. Change root password to new password: mysql> update user set password=password('newpassword') where user='root';
5. Flush mysql privileges: mysql> flush privileges;
6. Exit mysql: mysql> exit
7. Restart mysql: $ /etc/init.d/mysqld start

After finish all process, go to your terminal 1 and press Ctrl-C on your keyboard.

Thats all.

How to: Install Network Monitoring Tool (Nagios+Nagmin+Webmin+Mysql+Apache2+RRDTool+NMAP) on OpenSUSE 10.2

These are step by step how to setup network monitoring tool on OpenSUSE 10.2:

Install MySql, RRDTool, NMAP and Apache2:
1. Open the YaST software management. Select package mysql, mysql-client, mysql-shared, rrdtool, nmap and apache2. (*Accept all dependencies)
2. After install all package run this command mysqladmin -u root password "yourpassword"
3. Start mysql by run this command rcmysql start
4. Make this service automatically start after reboot by type chkconfig mysql on
5. Start apache2 by typing rcapache2 start
6. Make apache2 auto start after reboot by typing chkconfig apache2 on

Install Webmin:
1. Download webmin from webmin.com. I recommend you to download the noarch package for support all machine architecture. Save it, such as at your desktop.
2. Go to your desktop and type rpm -Uvh webmin_name
3. Start webmin by typing /etc/init.d/webmin start
4. Log in to webmin interface by opening your browser and type https://localhost:10000

Install Nagios:
1. Open YaST and select libcrypt, perl-Net-SNMP, fping, postgresql-libs, radiusclient, apache2, gd, and perl-URI.
2. Download nagios package (nagios-2.5-24.i586.rpm, nagios-nrpe-2.5.2-28.i586.rpm , nagios-nsca-2.5-39.i586.rpm , nagios-plugins-1.4.5-5.i586.rpm , nagios-plugins-extras-1.4.5-5.i586.rpm , nagios-plugins-sap-ccms-0.7.3-38.i586.rpm and nagios-www-2.5-24.i586.rpm )
at http://download.opensuse.org/distribution/10.2/repo/oss/suse/i586/.
I recommend use nagios version 2.5 because most stable and many package are supported.
3. Install all these packages by typing rpm -Uvh nagios*.rpm
4. Start nagios by typing rcnagios start
5. Make nagios autostart after reboot by type chkconfig nagios on
6. Check your nagios by typing http://localhost/nagios/ on your browser (firefox etc)

Install Nagmin:
Nagmin is a webmin module. To install:
1. Download nagmin from http://sourceforge.net/project/showfiles.php?group_id=77010
I recommend you to download nagmin-2.1.0.tar.gz . It is because easy to install by a setup script. Other nagmin doesn't have a setup script.
2. Extract the nagmin by typing tar xvzf yournagminname .
3. Go to the nagmin folder and type ./setup to intall. Follow this guide

Database name to use or create : [Enter]
Nagios Root directory : /etc/nagios [Enter]
Nagios ETC directory : /etc/nagios [Enter]
Nagmin root directory : [Enter]
Nagios Configuration File: : [Enter]
CGI Configuration File: : [Enter]
Entries will be displayed for accuracy, select Y to continue.
Script will continue with its process.
Select N to question for viewing the SQL file
Select Y to other question

4. Now acces webmin and install the Nagmin plugin

Configure Nagmin setting:
Configure Nagmin Nagios by clicking Module Config in webmin. Change the configuration to the following value:
Nagios BIN directory /usr/bin
Nagios ETC directory /etc/nagios
Nagios LIBEXEC directory /usr/lib/nagios/plugins

5. Open your terminal and type vi /etc/nagios/cgi.cfg
find use_authentication=1; chage 1 to 0
find default_user_name = user, chage the user by deamon

6. Save and quit.

7. Now install NagMin module for webmin. To install go to Webmin --> Webmin Configuration --> Webmin Modules. Install the nagmin module from the nagmin folder that you extract before. The file name is look like nagmin-2.x.x.wbm

The Error
1. (Error: version issue):
Some error found when your login webmin --> Server --> nagMIN Network Monitoring.

Error message:
The MySQL client program /usr/bin/mysql does not appear to be the correct version. Webmin only supports MySQL versions 3 and above.

The command /usr/bin/mysql -V returned :

/usr/bin/mysql  Ver 14.12 Distrib 5.0.22, for redhat-linux-gnu (i686) using readline 5.0

Suggested fix:
open terminal and type vi /usr/libexec/webmin/nagmin/index.cgi
find "distrib" and add "| 5" after 4 at same line
save and quit the vi.

2. error found when your login webmin --> Server --> nagMIN Network Monitoring --> in column System Databases --> nagios

error message:

"Error - Perl execution failed
Can't use an undefined value as a HASH reference at /path/to/mysql.pm line 113"

Suggested fix:

Location mysql.pm on Suse /usr/lib/perl5/vendor_perl/5.8.8/i586-linux-thread-multi/DBD/mysql.pm

At around line 109 of mysql.pm:

------------------------------------
  # Avoid warnings for undefined values
  $username ||= '';
  $password ||= '';

  # create a 'blank' dbh
  my($this, $privateAttrHash) = (undef, $attrhash);
  $privateAttrHash = { %$privateAttrHash,
'Name' => $dsn,
'user' => $username,
'password' => $password
  };
-------------------------------------

Needs to be changed to

-------------------------------------
 # Avoid warnings for undefined values
  $username ||= '';
  $password ||= '';
  $attrhash ||= {};

  # create a 'blank' dbh
  my($this, $privateAttrHash) = (undef, $attrhash);
  $privateAttrHash = { %$privateAttrHash,
'Name' => $dsn,
'user' => $username,
'password' => $password
  };

Finish.