Security
Yandex recomendations
# Turn on execshield
kernel.exec-shield=1
kernel.randomize_va_space=1
# Enable IP spoofing protection
net.ipv4.conf.all.rp_filter=1
# Disable IP source routing
net.ipv4.conf.all.accept_source_route=0
# Ignoring broadcasts request
net.ipv4.icmp_echo_ignore_broadcasts=1
net.ipv4.icmp_ignore_bogus_error_messages=1
# Make sure spoofed packets get logged
net.ipv4.conf.all.log_martians = 1
/etc/security/limits.conf, /etc/security/
* soft nproc 65535
* hard nproc 65535
* soft nofile 65535
* hard nofile 65535
Search files with secrets
find . -type f -exec grep -i -I -E "password|secret\w?" {} /dev/null \;
Search user with empy password
awk -F: '($2 == "") {print}' /etc/shadow
Search users with uid=0
awk -F: '($3 == "0") {print}' /etc/passwd
Search SUID and SGID
find / -perm /4000 -or -perm /2000 -print 2> /dev/null
Search world writable files and dirs
find / -xdev -type f \( -perm -0002 -a ! -perm -1000 \) -print
find / -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print
Search files without owner
find / -xdev -type f \( -nouser -o -nogroup \) -print
Show mounts
cat /proc/mounts
Search crontab
cat /etc/crontab
Search changed files of user
find . -type f -atime -7 -printf “%AY%Am%Ad%AH%AM%AS %h/%s/%f\n” -user <username>|sort -n
find . -type f -mtime -7 -printf “%TY%Tm%Td%TH%TM%TS %h — %s — %f\n” -user <username>|sort -n
find . -type f -ctime -7 -printf “%CY%Cm%Cd%CH%CM%CS %h — %s — %f\n” -user <username>|sort –n
Search for accesses to executable files
find . -type f -perm /111 -user thole -atime -7 -printf “%AY%Am%Ad%AH%AM%AS %h — %s — %f\n” -user <username>| sort -n
Show ports and connections
ss -tupn
ss -tupnl
Verify packages
dpkg --verify
rpm -Va
dnf check
Get processes
ps auxeww
Take sum sha1
echo -n "actual_password_here" | sha1sum | tr [:lower:] [:upper:]
Take sum like shadow
python3 -c "import crypt; print(crypt.crypt('actual_password_here', '\$6\$random_salt\$'))"
View
fail2ban-client status
fail2ban-client status asterisk-udp
Unban
fail2ban-client set asterisk-udp unbanip ip_address
View
iptables -n -L -v --line-numbers
Import key
gpg --keyserver keys.gnupg.net --recv-keys key
Generate key pair
gpg --full-gen-key
Show private keys
gpg --list-secret-keys --keyid-format LONG <email>
Export public key
gpg --armor --export <key_id>
Get key
keyring get <service name> <username>
Get key
secret-tool lookup <attribute> <value>