De-Luxer

Saturday, July 4, 2009

The easiest way to setup the most unsecure sendmail service in linux

Yes, the easiest way, and yes, the most unsecure, i mean it.

I hope this blog will help you. This is what I've found after 2 days of reading and frustration of trying to set up sendmail server/client for whole day.

And trust me, never setup sendmail on Friday... @@

--- Setup Sendmail ---

-- Server --
#vi /etc/mail/sendmail.mc
= Replace 192.168.168.1 with your mail server's IP.

DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')dnl
DAEMON_OPTIONS(`Port=smtp,Addr=192.168.168.1, Name=MTA')dnl

## and...
= find "relay_based_on_MX" and comment or replace it with "loose_relay_check"

dnl #FEATURE(`relay_based_on_MX')dnl
FEATURE('loose_relay_check')dnl

# then..
echo "Connect:192.168.2 RELAY" >> /etc/mail/access

-- Client --
# find following line in sendmail.mc and change it.
[root@bb ~]# grep mail000 /etc/mail/sendmail.mc
define(`SMART_HOST', `mail0001.test')dnl

-- MAKE SURE --

= check if sendmail is listening to port 25
netstat -ant | grep LISTEN | grep 25

= check local or the service connect by telneting the port
telnet mail0001 25

= check sendmail status
service sendmail status

--- Links ---
-- Howto --
http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch21_:_Configuring_Linux_Mail_Servers

-- Masquerading --
http://www.brandonhutchinson.com/Sendmail_masquerading.html

-- Mail Relay --
http://www.sendmail.org/m4/anti_spam.html

PS:
Here is the story be hide this post. Has any one found that the documentation of sendmail is a mess?? I always found it overwhelm, all the tutorial gives you some options that you may not even understand. That's why, I think it's good to setup the most basic one and then build stuffs on top of it. Making a service work is more important than any thing after all. Well... the worst thing about the way I setup is someone may use you mail server to send spam.... well... u lose some resources cos people may use it to send spam but, you can setup other options once you make sure every thing is working.

20090723
When I read this page again, I found that the reason why I could send it, it`s because I have already accept all my internal network. After doing more configuring with sendmail, I realize it wasn`t a fully open relay. I now have SSL configured with sendmail and dovecot. I may post the tutorial later, once I`m sure that`s really working and it`s the simplest way to do.

Tuesday, June 30, 2009

Laziest way to set SSH without password

I've been crazily busy lately, finally got a chance to check our fabulous CDOT planet again. Saw a few nice posts from LUX classmates. As the king of blog in LUX class, of course I have to post something, I'm gonna beat Kezong!! hehe... (see below for Kezhong's blog)

Yesterday I just did public key authentication too. You can actually do the following to minimize all the work. All you have to do is copy and paste following and type your password twice. :-)

===== Commands =====
##### Step: 1 #####
ssh-keygen -t rsa -N "" -f ~/.ssh/id_rsa
Key=`cat ~/.ssh/id_rsa.pub `
ssh -f -q nestor@bossanesta.ath.cx "echo $Key >> .ssh/authorized_keys"

##### Step: 2 #####
ssh -f -q nestor@bossanesta.ath.cx chmod 600 .ssh/authorized_keys

===== Verify =====
# if dosen't work, you can always use verbose/debug mode to see the ssh process..

ssh -vv bossanesta.ath.cx

# if still dosen't work and you're sure your file and permission is right, you may want to check the server sshd config file and make sure Public Key authentication is enabled. It's enabled by default anyway. Also you may need to create and change the ~/.ssh folder permission by yourself, if you have never ssh "from" the server/target.

##### IF SOMETHING GOES WRONG #####
Just follow the official guide step by step.. :-)

=== LINK ===
OpenSSH Public Key Authentication

A professional article about Public Key Authentication from very profession LUX student

Wednesday, June 3, 2009

Weekend; Toronto Island; Unplug day..

I've been quite busy for work and things that I want to learn in this field. Last week was very busy. So, last weekend, I decided not to do any thing about computer.. well.. i did tried. I went to Toronto Island for photography. I found that's the best way to be away of computer and get some real fresh away. :-)

I did about 300, 400 photos in there, went there around 5pm and start shooting once I was on a boat. I was surprised that view was so good from Toronto Island. Too bad there were a bit of fogs. I should go there one more time when humility was low. Any way, hope you enjoy the photos. Save them as your wallpaper if you want. :-)

hackers; spider; IDS; spam

In last few days, I've been getting a lot of possible attack warning from my IDS. Before, i always get some local port scan, brut force attack. Yesterday, I found one form Hong Kong.. i was like.. how could that be?

Then, I found the reason. 1,2 days ago.. I login to a photography site and post some of my photos, and I updated my profile and put my domain name on it. That site is from HK.. so.. I guess that explain why I got more attacker from HK.

Nes: 20090603:2030
I totally forgot to mention about "spider". I believe after posting that photo site (dcfever.com) I got attack from HK. I believe somehow some hacker use spider program to search every one's profile and see if there is a site. I believe that's how they got my site. I'm putting myself in a hacker's situation, I would do this. Why waste the time to surf every one's profile and see if there is any possible site to attack?:-)

I've been thinking to do something interesting to my possible attacker. I was thinking to hack them back.. but. hehe... i'm not a good hacker and i dun wanna get in big trouble. So, I've been thinking to telnet their mail port (25) and use snmp protocol to send them an email and tell them that there is 'someone' trying to hack other people's network. (hey, if someone trying to login my ssh with root or ssh more than 5 and it's not me, i'm sure that's not accident!!) That would be fun.. but I think i'll have to mangle my IP too. Just send that mail command, i wouldn't care if i got receive back.

Unfortunately, my Rogers broadband block port 25.. sigh.. I've been thinking to switch an other ISP.. found one for $45 with a static IP and all port open!! That seems to be a good choice tho.

Monday, May 18, 2009

My IDS has some Interesting reports.. got attacks from a security blog server

In the LUC course, we wrote an IDS program in perl. After setting up my own server, I put my IDS there and add on some simple features. When ever there is an possible attack, no matter if it's brute force, port scan, I will block the source IP and also port scan back with "nmap -A -PN", then output the result in my apache directory. It's been running for a while. And my IDs has collected quite a lot of interesting reports.

As far as I know, the source IP can be a hacked machine or from a network. Althought I may not able to track down the attacker, but I would like to see where it's from. One of the source has an entry mentioned about an site called "http://echelon.pl/", it blog talk about IT security or.. IPSec... I'm thinking how could it end up attacking my server? haha...

Tne entry:

106/tcp open pop3pw Poppassd 1.8.5 (http://echelon.pl/pubs/poppassd.html)

Anywya, if you're interested, you can see all the nmap result here.. And have some mercy.. don't hack my server.. ;-)

http://bossanesta.ath.cx/NesIds/nmap/

Sunday, May 3, 2009

FREE Photogrphier for Open Source and Seneca!!

Dessert Flower, love the contrast

Just bought a new lens, Nikkor 50mm F1.4. It's super amazing!!! It's not expensive tho, I bought a used one for $320, a new one is around $350. It's actually a mid-priced lens. cos the top one should be 50mm F1.2 or 80mm F1.4. But.. u know what? this is amazing!! When I first saw the photos, i was like.. OMG.. are those really my photos? hahaha..

I would love to dedicate my hobby to all every one involved in open source and Seneca. Let me know if I could help you. And I'll try my best!

PS: look at my tittle, geez.. i should be in media instead of computing. Maybe I've read too much gossip magazine, hahaha..