Software

Automate Linux Tasks with Tools

Let’s take a look at two tools that can make life easier for the Linux admins by automating his day to day tasks.

Puppet

Puppet is an open-source tool designed to make automation and reporting much easier for system administrators. It is basically a configuration management software that helps in configuring and maintaining your servers and other systems in your network. Generally, Server administrators spend a lot of time doing the same task again and again daily. They always wanted to automate these tasks, so as to get more time to work on other projects or learn new concepts and scripting languages. Tasks can be automated by writing scripts, but in companies with a larger network, scripts don’t come in handy. This is where Puppet comes to the rescue as with the help of Puppet one can:

Let’s you define unique configuration setting for every host on the network
Monitor the network continuously for any alterations
Helps in creating and managing users effectively
Helps you to manage every open-source tool’s configuration settings

Ansible

Ansible is an open-source configuration management and IT enterprise automation software from Red Hat and it comes with a simple programming language enabling system administrators to effectively handle the automation and configuration process easily and effectively. Ansible consists of a controlling machine and the nodes being controlled by the controlling machine. The nodes are controlled over SSH. One of the main features of Ansible is that agents are not deployed to the nodes, but only communication is done through SSH. A low learning curve, consistency, high reliability and security are other features that make Ansible stand ahead of the competition. The only limitation of Ansible is that provisioning of bare metal and a virtual machine is not possible.

Nagios

Nagios, now known as the Nagios Core and it is an open-source automation and monitoring tool to manage all systems in your infrastructure. It also offers to alert services to alert the system administrators when it smells something fishy in your network. With the help of SNMP with Nagios, the system admins may also control and manage printers, routers and switches. Nagios allows us to create an event handler that can restart the faulty application and its services automatically whenever application and its services go down.

September 15, 2024 by Brian Software 0

What is Data Leak Detection Software?

Photo by Daan Mooij on Unsplash

Data leak detection software identifies an organization’s data leaks – the accidental public exposure of sensitive data due to software misconfigurations and poor network security. Data leaks quickly become data breaches when cybercriminals identify and exploit this exposed data.

The following scenario demonstrates the progression of a cyberattack facilitated by a data leak attack vector:

Stage 1: An e-commerce company operates its website using the unsecured HTTP protocol, exposing customer transaction details.

Stage 2: A hacker identifies this vulnerability and undertakes a man-in-the-middle attack, intercepting customer contact details, credit card numbers, and other personal data.

Stage 3: The hacker posts this data for sale on a dark web forum.

If the e-commerce company was aware of this exposure, they could have patched it immediately, potentially avoiding a serious data breach. Data leak detection software fills this knowledge gap by proactively identifying vulnerabilities that lead to data breaches. Organizations can then prioritize their remediation workflows based on the severity of these threats.

March 29, 2023 by Brian Software 0

Top 2 Free Open Port Check Tools

Photo by Compare Fibre on Unsplash

The open ports in your hardware could be critical points of vulnerability if the services exposed to them are misconfigured or unpatched. Unfortunately, many organizations are exposing their sensitive resources through such malicious connections, heightening the risk of ransomware attacks, supply chain attacks, and data breaches. Fortunately, free tools can detect all of the open ports in your ecosystem to assess the level of criticality of each exposure.

In this post, we discuss the two best free open port scanners you can start using today to check for open ports in your ecosystem.

What is Open Port Scanning?

Port scanning is the process of analyzing the security of all ports in a network. It involves identifying open ports and sending data packets to select ports on a host to identify any vulnerabilities in received data. Network reconnaissance should be completed regularly to identify and remediate vulnerabilities before cyber attackers discover them. Unfortunately, cybercriminals also use port scanners to garnish vulnerability intelligence about a potential victim before launching a cyberattack.

Because many of these tools are freely accessible, you must assume that cybercriminals are using them to study your open ports. So they cannot be the only security controls protecting your network. This is why network administrators should only use free open port scanners to determine the level of network visibility available to potential cyber attackers. In addition, all free port scanners should be supported with additional security solutions for maximum security. TCP Port scanners can also help penetration testers determine which specific ports accept data to protect them from compromise.

List of Common Network Port Numbers

Every port in a network transports a specific type of network traffic. Each of these ports is assigned a particular number to be easily differentiated.

There are two types of network ports:

TCP – Transmission Control Protocol

UDP – User Diagram Protocol.

What’s the difference between UDP and TCP?

The TCP uses a handshake protocol. TCP also checks each data packet for errors. UDP doesn’t include verification, error checking, or any handshakes. Because of the different processes, TCP is a slower protocol than UDP.

Port numbers range from 0 – 65,535, forming a total of 65,536 ports. These ports are either TCP, UDP, or a combination of both. Because of this extensive range, port numbers are ranked by relevance to shorten the list of network options.

Ports 0-1023 are primarily designed for internet connections.Ports 1024-49151 are ‘registered ports’ designated for exclusive use by registered software corporations and applications. Ports 49152-65,536 are private ports that can be used by anyone.

Tools

1. Nmap

Nmap (short for Network Mapper) is one of the most popular free, open-source port scanning tools. It offers many different port scanning techniques, including TCP half-open scans.

Key features:

Multiple port scanning techniques.

Identifies all open ports on targeted servers.

Operating system detection.

Discovers network services

Scans remote ports

TCP SYN Scanning

UDP and TCP port scanning.

Can scan comprehensive networks housing tens of thousands of network devices. Supports Mac, Linux, Windows Solaris, OpenBSD, Free BSD, and more.

2. Wireshark

Wireshark is a free network sniffing tool used to detect malicious activity in network traffic. This tool can also be used to detect open ports.

Key features:

Reveals request and reply streams in each port.

Malicious network discovery.

Troubleshoots high bandwidth usage.

Offers multiple data packet filters.

Allows users to follow and monitor data streams of interest.

December 29, 2022 by Brian Software 0

Lightweight Directory Access Protocol (LDAP) injection

Photo by Markus Spiske on Unsplash

LDAP is a protocol that lets applications talk with directory services servers that store user IDs, passwords, and computer accounts. When applications accept user input and execute it, attackers can exploit the LDAP server by sending malicious requests.

Some examples of LDAP coding issues include:

Excess access privileged assigned to LDAP accounts
Lack of output regulation
Inability to perform dynamic checks
Lack of static source code analysis

March 20, 2022 by Brian Software 0

How to Improve MySQL Security: Top 10 Ways

Photo by Campaign Creators on Unsplash

In the pantheon of open source heavyweights, few technologies are as ubiquitous as the MySQL RDBMS. Integral to popular software packages like WordPress and server stacks like LAMP, MySQL is the foundational data platform for most websites and cloud services on the internet today. Unfortunately, its popularity translates to more commonly known attack vectors and security exploits — the following are 11 ways to shore up MySQL security and protect your data more effectively.

10 Ways to Improve MySQL Security

1. Drop the Test Database

The test database installed by the MySQL Server package as part of the mysql_install_db process can be fully accessed by all users by default, making it a common target for attackers. It should therefore be removed during post-installation hardening.

2. Remove All Anonymous Accounts

MySQL, by default, creates several anonymous users that essentially serve no purpose after installation. These accounts should therefore be removed, as their presence on the system gives attackers an entry point in the database.

3. Obfuscate the Root Account

Changing the MySQL root user account to a hard-to-guess name adds another layer of security, as attackers must determine the new account name before attempting to brute force the password values.

4. Disable Remote Logins

If local applications only use the MySQL database, remote access to the server should be disabled. This is done by opening up the /etc/my.cnf file and adding a skip-networking entry under the [mysqld] section. Configuring MySQL to stop listening on all TCP/IP ports, including 127.0.0.1, will effectively restrict database access to local, MySQL socket-based communications.

5. Change Default Port Mappings

MySQL, by default, runs on port 3306. This should be changed after installation to obfuscate what critical services are running on which ports, as attackers will initially attempt to exploit default values.

6. Remove and Disable the MySQL History File

Like the Test database, the MySQL history file located at ~/.mysql_history is created by default during installation. This file should be deleted, as it contains historical details regarding installation and configuration steps performed. This could potentially result in the accidental exposure of passwords for critical database users. A weak link for the .mysql_history file to the null device should be created to stop logging into the file.

7. Do Not Run MySQL With Root Level Privileges

MySQL should be run under a specific, newly-created user account with the necessary permissions to run the service instead of directly as the root user. This adds some auditing and logging benefits while preventing attackers from gaining access by hijacking the root user account.

8. Alter Which Hosts Have Access to MySQL

If set up as a standalone server (i.e., application and web servers query the database from another server), the MySQL instance should be configured only to allow access to permitted hosts. This can be accomplished by making the appropriate changes in the hosts. deny and hosts.allow files.

9. Limit or Disable SHOW DATABASES

Again, stripping remote attackers of their information gathering capabilities is critical to a secure security posture. For this reason, the SHOW DATABASES command should be limited or removed entirely by adding skip-show-database to the [mysqld] section of the MySQL configuration file at /etc/my.cnf.

10. Disable the Use of LOAD DATA LOCAL INFILE Command

The LOAD DATA LOCAL INFILE command allows users to read local files and even access other files on the operating system, which could be exploited by attackers using methods such as SQL injection. The command should therefore be disabled by inserting set-variable=local-infile=0 to the [mysqld] section of my.cnf.

February 28, 2022 by Brian Software 0