Batangas Open Source Society -- Tech Blogs

The end is near for Ituloy angsulong

2007-02-17T19:24:00.001+08:00

the end is near for the ituloy angsulong ... its been a fun experience for us, although we dont know anything about SEO.. we do experiment SEO thing on our personal blogs... who will win??? watch out for the final night of ituloy angsulong on Feb 23.

Running Internet Explorer on Fedora Core 6 Linux

2006-12-17T20:08:00.000+08:00

Why would i need an Internet Explorer when there is Firefox?? nah, JobsDB does'nt run on Firefox... so i have to install IE on Linux....

Installing SnortAlog with Snort Log Intrusion Detection System Rotation

2006-12-12T18:30:00.000+08:00

Installing SnortAlog with Snort Log Rotation

This document will show you how to generate Snort Report Logs weekly in a pdf file and automatic Snort Log rotation after you generate your weekly snort log.

1. Download the latest SnortAlog at http://jeremy.chartier.free.fr/snortalog/downloads/snortalog/

#wget http://jeremy.chartier.free.fr/snortalog/downloads/snortalog/snortalog_v2.4.0.tgz

#tar –xvzf snortalog_v2.4.0.tgz

2. Download and install the Requirements of SnortAlog found at

http://jeremy.chartier.free.fr/snortalog/download.html

3. This is an edited script that I found on the mailing list of Snort. My promiscuous Ethernet card is eth1

snort_log_rotation

# Logfile rotation script for snort writen by jameso@elwood.net.

# This script is pretty basic. We start out by setting some vars.

# Its job is tho rotate the days logfiles, e-mail you with what

# it logged, keep one weeks worth of uncompressed logs, and also

# keep compressed tgz files of all the logs. It is made to be run

# at midnight everynight. This script expects you to have a base

# dir that you keep all of your logs, rule sets etc in. You can

# see what sub dirs it expects from looking at the var settings

# below.

# Things to note in this script is that we run this script at 12

# every night, so we want to set the dirdate var the day the script

# runs minus a day so we label the files with the correct day. We

# Then create a dir for the days logs, move the log files into

# todays dir. As soon as that is done restart snort so we don't miss

# anything. Then delete any logs that are uncompressed and over a

# week old. Then compress out todays logs and archive them away, and

# end up by mailling out the logs to you.

# Define where you have the base of your snort install

#snortbase=/usr/snort

snortbase=/var/log/snort

# Define other vars

# logdir - Where the logs are kept

# oldlogs - Where you want the archived .tgz logs kept

# weeklogs - This is where you want to keep a weeks worth of log files uncompressed

# dirdate - Todays Date in Month - Day - Year format

# olddirdate - Todays date in the same format as dirdate, minus a week

logdir=$snortbase

oldlogs=$snortbase/oldlogs

weeklogs=$snortbase/weeklogs

# When I first wrote this script, I only ran it on BSD systems. That was a

# mistake, as BSD systems have a date command that apperently lets you walk the

# date back pretty easily. Well, some systems don't have this feature, so I had

# to change the way that dates are done in here. I left in the old way, because

# it is cleaner, and I added in a new way that should be portable. If anyone

# has any problems, just let me know and I will try to fix it.

# You have to change the system var to either bsd or other. Set it to bsd if

# your system supports the "-v" flag. If you are not sure, set it to other.

system=other

if [ $system = bsd ]

then

dirdate=`date -v -1d "+%m-%d-%y"`

olddirdate=`date -v -8d "+%m-%d-%y"`

else [ $system = other ]

month=`date "+%m"`

yesterday=`expr \`date "+%d"\` - 1`

eightday=`expr \`date "+%d"\` - 8`

year=`date "+%y"`

dirdate=$month-$yesterday-$year

olddirdate=$month-$eightday-$year

# Create the Dir for todays logs.

if [ ! -d $weeklogs/$dirdate ]

then

mkdir $weeklogs/$dirdate

# Move the log files into todays log dir. This is done with

# a for loop right now, because I am afriad that if alot is

# logged there may be to many items to move with a "mv *"

# type command. There may a better way to do this, but I don't

# know it yet.

for logitem in `ls $logdir` ; do

mv /var/log/snort/$logitem $weeklogs/$dirdate

done

# Kill and restart snort now that the log files are moved.

#kill `cat /var/run/snort_fxp0.pid`

pid=`ps -ef | grep 'snort -i eth1' | grep -v grep | awk '{print $2}'`

kill -9 $pid

# Restart snort in the correct way for you

#/usr/local/bin/snort -i fxp0 -d -D -h homeiprange/28 -l /usr/snort/log \

#-c /usr/snort/etc/08292k.rules > /dev/null 2>&1

/usr/local/bin/snort -i eth1 -c /etc/snort/snort.conf -D > /dev/null 2>&1

# Delete any uncompressed log files that over a week old.

if [ -d $weeklogs/$olddirdate ]

then

rm -r $weeklogs/$olddirdate

# Compress and save the log files to save for as long as you want.

# This is done in a sub-shell because we change dirs, and I don't want

# to do that within the shell that the script runs in.

cd $weeklogs; tar zcvf $oldlogs/$dirdate.tgz $dirdate > /dev/null 2>&1

# Mail out the log files for today.

#cat $weeklogs/$dirdate/snort.alert | mail -s "Snort logs" you@domain.com

#cat $weeklogs/$dirdate/snort_portscan.log |

# mail -s "Snort portscan logs" you@do

#main.com

snortalog_rotation

month=`date "+%m"`

yesterday=`expr \`date "+%d"\` - 1`

eightday=`expr \`date "+%d"\` - 8`

year=`date "+%y"`

dirdate=$month-$yesterday-$year

./snortalog.pl -file /var/log/snort/alert -r -report -o $dirdate.pdf

./snort_log_rotation

snort_log_rotation and snortalog_rotation script was saved and given an execute permission inside the folder of snortalog. You can play with the other options that has comment on the script.

#./snortalog_rotation << style=""> then it will restart Snort and recreate Snortlog file at /var/log/snort/. Add this on your weekly cronjobs

Linux Professional Institute (LPI) exam prep

2006-12-11T19:50:00.000+08:00

A series of tutorials to help you learn Linux fundamentals and prepare for system administrator certification can be found here. Enjoy!

New Google???

2006-12-04T09:35:00.000+08:00

Try it at http://www.searchmash.com/

List of Spamassassin Rules and RBLs

2006-11-27T16:56:00.000+08:00

On a Redhat Enterprise Linux or CentOS system, you can install the rules at /etc/mail/spamassassin/

#cd /etc/mail/spamassassin
#wget http://www.timj.co.uk/linux/bogus-virus-warnings.cf
#wget http://mywebpages.comcast.net/mkettler/sa/antidrug.cf
#wget http://www.emtinc.net/includes/backhair.cf
#wget http://www.timj.co.uk/linux/bogus-virus-warnings.cf
#wget http://www.emtinc.net/includes/chickenpox.cf
#wget http://www.sa-blacklist.stearns.org/sa-blacklist/sa-blacklist.current.uri.cf
#wget http://www.sa-blacklist.stearns.org/sa-blacklist/random.current.cf
#wget http://www.rulesemporium.com/rules/99_FVGT_Tripwire.cf
#wget http://www.nospamtoday.com/download/mime_validate.cf
#wget http://bl.csma.biz/csma.cf
#wget http://www.ahbl.org/docs/mailservers/spamassassin.txt

To restart spamassassin

#/etc/init.d/spamassassin restart
#service spamassassin restart ( in RHEL or CentOS Enterprise Linux system)

SpamAssassin Rules Emporium
http://www.rulesemporium.com/

Testing your Rules

#spamassassin --lint -D

This command will check if there are errors on your Spamassassin rules

Real Time Block List (RBL)

relays.ordb.org
bl.spamcannibal.org
list.dsbl.org
bl.spamcop.net
dnsbl.njabl.org
cbl.abuseat.org
opm.blitzed.org
sbl.spamhaus.org

List updated: Nov 28, 2006

Endian Update

2006-11-27T14:59:00.000+08:00

I monitored the behaviour of my Endian installation. It seems that Dansguardian utilizes most of the CPU resources.

root@kalasag:~ # w
14:52:34 up 6 days, 22:32, 2 users, load average: 0.03, 0.14, 0.16

More info at my QrooniX blog.

Updating Snort Rules

2006-11-25T22:54:00.000+08:00

One of the effective tool for updating Snort Rules is by using Activeworx IDS Policy Manager.

You can use both Snort Oinkmaster Rules and Bleeding Edge Snort Rules

Endian Firewall Usage

2006-11-21T16:02:00.000+08:00

I have deployed Endian Firewall within our corporate network. I'm already recieving a lot of complaints regarding it's very strict default rules. My boss is happy about it. My only beef against this is the flaky local authentication support.

Endian Firewall Uptime

2006-11-20T14:35:00.000+08:00

14:18:28 up 43 days, 16:43, 1 user, load average: 0.26, 0.20, 0.14

So far my Endian Firewall deployment performs very well. Anyways, there still lots of problems on the squid authentication as experienced by Qroon.

SFTP -- Secure File Transfer Protocol

2006-11-08T12:03:00.000+08:00

'Sftp' is a secure version of the File Transfer Protocol (ftp). It uses FTP commands to transfer files securely between accounts, whether the accounts are on the same machine or on different machines, including your home computer, if it is properly configured.

Popoy:~# sftp user@popoy.com

Some standard commands for command line SFTP include:

`cd`	Change the directory on the remote computer
`chmod`	Change the permissions of files on the remote computer
`chown`	Change the owner of files on the remote computer
`dir` (or `ls`)	List the files in the current directory on the remote computer
`exit` (or `quit`)	Close the connection to the remote computer and exit SFTP
`get`	Copy a file from the remote computer to the local computer
`help` (or `?`)	Get help on the use of SFTP commands
`lcd`	Change the directory on the local computer
`lls`	See a list of the files in the current directory on the local computer
`lmkdir`	Create a directory on the local computer
`ln` (or `symlink`)	Create a symbolic link for a file on the remote computer
`lpwd`	Show the current directory (present working directory) on the local computer
`lumask`	Change the local umask value
`mkdir`	Create a directory on the remote computer
`put`	Copy a file from the local computer to the remote computer
`pwd`	Show the current directory (present working directory) on the remote computer
`rename`	Rename a file on the remote host
`rm`	Delete files from the remote computer
`rmdir`	Remove a directory on the remote host (the directory usually has to be empty)
`version`	Display the SFTP version
`!`	In Unix, exit to the shell prompt, where you can enter commands. Enter `exit` to get back to SFTP. If you follow `!` with a command (e.g., `!pwd`), SFTP will execute the command without dropping you to the Unix prompt.

PostgreSQL commands to Remember

2006-11-03T16:46:00.000+08:00

Inserting Query
psql -U postgresqluser databasename -f file

Backup the PostgreSQL database
pg_dump databasename > databasebackup.bak

DOS vs. Linux Commands To Remember

2006-11-03T08:53:00.000+08:00

Command's Purpose	MS-DOS	Linux	Basic Linux Example
Copies files	`copy`	`cp`	`cp thisfile.txt /home/thisdirectory`
Moves files	`move`	`mv`	`mv thisfile.txt /home/thisdirectory`
Lists files	`dir`	`ls`	`ls`
Clears screen	`cls`	`clear`	`clear`
Closes prompt window	`exit`	`exit`	`exit`
Displays or sets date	`date`	`date`	`date`
Deletes files	`del`	`rm`	`rm thisfile.txt`
"Echoes" output on the screen	`echo`	`echo`	`echo this message`
Edits files with simple text editor	`edit`	`pico`	`pico thisfile.txt`
Compares the contents of files	`fc`	`diff`	`diff file1 file2`
Finds a string of text in a file	`find`	`grep`	`grep this word or phrase` `thisfile.txt`
Formats a diskette	`format a:` (if diskette is in `A:`)	`mke2fs`	`/sbin/mke2fs /dev/fd0` (`/dev/fd0` is the Linux equivalent of `A:`)
Displays command help	`command /?`	`man`	`man command`
Creates a directory	`mkdir`	`mkdir`	`mkdir directory`
View a file	`more`	`less`	`less thisfile.txt`
Renames a file	`ren`	`mv`	`mv thisfile.txt thatfile.txt`
Displays your location in the file system	`chdir`	`pwd`	`pwd`
Changes directories with a specified path (absolute path)	`cd pathname`	`cd pathname`	`cd /directory/directory`
Changes directories with a relative path	`cd ..`	`cd ..`	`cd ..`
Displays the time	`time`	`date`	`date`
Shows amount of RAM and use	`mem`	`free`	`free`

source : Redhat Docs

Batangas Open Source Society Hibernation Mode??

2006-10-27T16:11:00.000+08:00

Is BOSS dead??? No folks, we are just in hibernation mode. The organization doesn't have any projects for the open source movement in the Batangas area. But we are thinking of rebooting the old website or just make a new website for BOSS
Qroon is so horny with his LDAP and Fedora Core 6 ...

Fedora Core 6 Released in Mirrors

2006-10-23T10:01:00.000+08:00

Check this out:

ftp://ftp.mirror.tw/pub/fedora/linux/core/6/i386/iso

Nice Fedora Core Blog | Fundamentals of Network Security on Meralco Foundation Inc. Technological Institute

2006-10-17T19:18:00.000+08:00

I stumbled upon this cool site about Fedora Core. Nice slippers and tshirt!!!

-----------------

Off Topic:
Meralco Foundation Inc. Technological Institute is offering Fundamentals of Network Security of the Cisco Networking Academy Program. For more info visit their website.

Linux Command to Remember # 2

2006-10-11T22:23:00.000+08:00

Problem:

[root@popoy new]# rm -rf *
-bash: /bin/rm: Argument list too long

Solution:

[root@popoy new]# ls | xargs rm
[root@popoy new]# ll
total 0

Preventing Spams Using Endian Firewall

2006-09-28T22:00:00.000+08:00

One of the main problems of administering mail servers are filtering SPAMS. There are lot of tools and methods that administrator are using nowadays just to filter those VIAGRAs mails.
These were Endian Firewall comes in handy. The process takes up just 2 hours of testing and tweaking. I've installed it on an IBM Netfinity with 1GB of Memory, 17GB of raid 1 SCSI drives.

Since it is based on IPCOP, i dont have the hard time on the firewall's configuration.

Just enter your domains and your mailserver. Dont forget to allow Endian Firewall to relay on your mailserver.

It uses RBLs and Greylisting on its spam protection. I've also added rules on Rulesemporium for greater results.

Sample Logs:

postfix/smtpd[5932]: NOQUEUE: reject: RCPT from ckt97.neoplus.adsl.tpnet.pl[83.31.95.97]: 554 Service unavailable; Client host [83.31.95.97] blocked using dul.dnsbl.sorbs.net; Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml?83.31.95.97; from= to= proto=ESMTP helo=

postfix/smtpd[6290]: NOQUEUE: reject: RCPT from unknown[60.51.116.234]: 450 : Recipient address rejected: Greylisted for 30 seconds (see http://isg.ee.ethz.ch/tools/postgrey/help/domain.com.html); from= to= proto=ESMTP helo=<[60.51.116.234]>

Technorati Tags:
firewall, email spams, spammer, linux email server, linux

Linux Command to Remember # 1

2006-09-26T22:28:00.000+08:00

To know users that dont check emails or has a huge mailbox

[root@popoy new]#$ sudo du --si directory |less

To dump the result on a file

$sudo du --si directory > /home/popoy/domainname_mailbox.txt

Thats all folks!!!

ProxyPass

2006-09-04T15:38:00.000+08:00

For Apache ProxyPass module:

ProxyPass /somedirectory/ http://local.ip/somedirectory/
ProxyPassReverse /somedirectory/ http://local.ip/somedirectory/

Fedora Core 6 advances printing

2006-08-18T13:33:00.000+08:00

The release of Fedora™ Core 6 will see several improvements in the way printing is configured and used. The print spooler itself has had a major upgrade; the printing administration tool has been re-written; and the dialog you see when printing a document has been dramatically improved.

See the full article here.

Parsing Qmail Logs

2006-08-17T10:42:00.000+08:00

Yesterday I was tasked to submit some logs of outgoing mails. The time stamp on qmail logs, located at /var/log/qmail/ (on my set-up) is in UNIX-time format. After searching around to produce a "human-readable format", I executed this simple command:

cat /var/log/qmail/send/\@4000000044e17dfd1c6a4cb4.s | tai64nlocal > somefile.txt

That's it for now.

Qmail Greylisting

2006-08-14T11:58:00.000+08:00

I'm confirming the success of Qmail Greylisting on Qmail-Toaster set-up. Thanks to Jond3rd and Penoy for helping me out!

UPDATE:

Below are snippets of mail logs, spammers are very persistent.

Aug 13 04:04:10 mail greylist[26487]: IP 201.4.121.158 back too soon - temp error again
Aug 13 04:04:13 mail greylist[26488]: IP 196.217.46.237 new - temp error for adsl196-237-46-217-196.adsl196-10.iam.net.ma
Aug 13 04:04:23 mail greylist[26489]: IP 71.247.1.238 new - temp error for pool-71-247-1-238.nycmny.east.verizon.net
Aug 13 04:04:28 mail greylist[26440]: IP 190.40.102.91 new - temp error for 190.40.102.91
Aug 13 04:04:40 mail greylist[26490]: IP 66.215.99.125 new - temp error for 66-215-99-125.dhcp.malb.ca.charter.com
Aug 13 04:04:41 mail greylist[26491]: IP 84.2.185.43 new - temp error for dsl5402B92B.pool.t-online.hu
Aug 13 04:04:46 mail greylist[26492]: IP 84.2.185.43 back too soon - temp error again
Aug 13 04:04:57 mail greylist[26493]: IP 196.217.46.237 back too soon - temp error again
Aug 13 04:05:39 mail greylist[26533]: IP 87.245.133.8 is listed in RBL sbl-xbl.spamhaus.org: nat.zhukovsky.net
Aug 13 04:05:41 mail greylist[26533]: IP 87.245.133.8 new - temp error for nat.zhukovsky.net
Aug 13 04:05:59 mail greylist[26535]: IP 71.246.74.122 new - temp error for pool-71-246-74-122.bltmmd.east.verizon.net
Aug 13 04:06:06 mail greylist[26534]: IP 89.230.5.235 new - temp error for host-89-230-5-235.konstantynow.mm.pl
Aug 13 04:06:17 mail greylist[26537]: IP 72.64.107.70 new - temp error for pool-72-64-107-70.dllstx.fios.verizon.net
Aug 13 04:06:17 mail greylist[26538]: IP 72.64.107.70 back too soon - temp error again
Aug 13 04:06:23 mail greylist[26540]: IP 72.64.107.70 back too soon - temp error again
Aug 14 13:13:35 mail greylist[1456]: IP 66.190.202.236 new - temp error for 66.190.202.236
Aug 14 13:13:36 mail greylist[1463]: IP 222.120.157.156 new - temp error for 222.120.157.156
Aug 14 13:13:53 mail greylist[1494]: IP 71.110.7.214 new - temp error for pool-71-110-7-214.lsanca.dsl-w.verizon.net
Aug 14 13:13:55 mail greylist[1495]: IP 218.81.175.167 back too soon - temp error again
Aug 14 13:14:37 mail greylist[1514]: IP: 61.219.78.54 invalid HELO greeting string: localhost. Disconnecting.
Aug 14 13:14:38 mail greylist[1519]: IP 62.117.33.205 new - temp error for 62.117.33.205

Horny With Sun Ultra

2006-08-14T11:44:00.000+08:00

For the past few days, I'm justifying to my boss the purchase of this machine. And in addition to that, Penoy is also gunning to buy this machine for personal use!

Healthy Competition???

2006-08-03T13:14:00.000+08:00

no more yawning... only straightforward marketing strategy...

Oracle Delivers Better Business Value than SAP—Today

System Administrator Appreciation Day

2006-07-28T20:03:00.000+08:00

Friday, July 28th, 2006, is the 7th annual System Administrator Appreciation Day.

Configure Spamassassin on Qmailrocks

2006-07-26T09:12:00.000+08:00

A good info on how to tweak your spam filtering rules in Spamassassin.. works also on QVCS..haven't tried on Qmailtoaster.

Configure Spamassassin on Qmailrocks

Open Source Symposium 2006

2006-07-25T15:28:00.000+08:00

From an email that i received.

Experience the Power of Open Source Architecture
Feeling helpless and trapped with your existing proprietary platform and applications?
Held ransom by costly software upgrades?
Open source innovation is not a fad. It is here to stay. Enterprises around the world have migrated to Linux because they used to be as frustrated as you. Things happen for a reason. Especially good things. Isn’t it time you make them happen?

Philippines, Manila
Date:September 12

Time:9.00am - 5.30pm
Venue:Makati Shangri-la Manila Rizal A, Level 2 Ayala Avenue corner Makati Avenue, Makati City 1200, Philippines
Fee: USD99

SPAM Phrases # 1

2006-07-11T12:40:00.000+08:00

This are some of the SPAM Phrases not detected by Spamassassin

*10k scholarship*
*Affordable top brand*
*RE: Big choice*
*re: Big choice*
*RE: Creditt*
*Fwd: Creditt*
*Extensive news*
*3400 Kilkenny Pl*
*MortReview*
*Low prices for all watches*
*SystemSoap*
*Crredit*
*Creedit*
*Creditt*
*Crediit*
*ch3ap*
*b4d*
*Analysis.Mort*
*AffordablE mEdicinE*
*888*
*777*
*3ff3ctiv3*
*You’re guaranteed of a fun*
*Hey Buddy*
*Brand New Every*
*Brand New It's*
*Superman Has Done It Again*
*Equity Report*
*A payout rate of over*
*Roller Cassino*
*cheap pills*
*ch3ap pills*
*MB.is*
*Re: Its true Confirmation*
*New Black and Beautiful*

Retro Mode

2006-07-06T22:15:00.000+08:00

My friend borrowed my laptop for a project. These past few days, I'm using an old box. Fedora Core 4 is running nice on Pentium III 450 MHz and 320 MB RAM. Of course I have to use a light window manager, this time it's my old favorite WindowMaker. WM is readily available on FC4's yum repository.

I'm also in the process of looking for lighter apps. Dillo web browser is fine for reading some news and blogs. But I'm still using FireFox for blogging and Gmail purposes. For other email services, I'm using Sylpheed-Claws. I'm also looking into using XChat for IM purposes via BitlBee. As always, I use XMMS (Classic WinAmp-like app) for audio playing. As for office application (though I rarely use it), I use Abiword and Gnumeric.

Dare to Hack your IPOD

2006-07-05T10:07:00.000+08:00

Hack your IPOD... Install Linux.... Full info on iPodLinux Project

Some Network Monitoring Tools

2006-07-02T02:03:00.000+08:00

The following are some of the tools that we use in monitoring our systems/networks. Most of them are already available on your distro's repositories (e.g. yum, apt, YaST).

That's it for now. There are other tools around, perhaps the other posters here can add more.

Qmailtoaster

2006-07-01T01:47:00.000+08:00

I've been fiddling around with this guide. Except for some minor glitches (MySQL script), it seems to be a solid system. More posts coming up after I finished and tested my x86_64 installation.

Updated URLFilter

2006-06-30T11:56:00.000+08:00

last night i've updated my urlfilter on squid proxy server blacklist using univ-tlse.fr updated blacklist. need to check the logs to see if it works...

2006-06-29T20:21:00.000+08:00

SPAMASSASSIN BlackList

Here are some of the blacklist that i used on my spamassassin

relays.ordb.org
bl.spamcannibal.org
list.dsbl.org
bl.spamcop.net
dnsbl.njabl.org
cbl.abuseat.org
opm.blitzed.org
sbl.spamhaus.org

I also add cf files from Rulesemporium and McFadden

Batangas Open Source Society

2006-06-29T20:01:00.000+08:00

Our former website is under indefinite state of hibernation. Members of Batangas Open Source Society and other technology enthusiasts will be posting I.T. related articles here. In addition, we will also be adding tips, mini how-to's and small tutorials here.