Archive for January, 2012

UBUNTU COMMAND

Posted: January 13, 2012 in LINUX, Ubuntu Command ref
Tags: ,

##How to view installed packages on ubuntu

 

OR

# dpkg –list

# dpkg –info packageName

# apt-get remove packageName

 

4: Keep Linux Kernel and Software Up to Date

# apt-get update && apt-get upgrade

 

#6.3: Locking User Accounts After Login Failures

To see failed login attempts, enter:

faillog

To unlock an account after login failures, run:

faillog -r -u userName

 

Note you can use passwd command to lock and unlock accounts:

# lock account

passwd -l userName

# unlocak account

passwd -u userName

#6.4: How Do I Verify No Accounts Have Empty Passwords?

 

Type the following command

# awk -F: ‘($2 == “”) {print}’ /etc/shadow

Lock all empty password accounts:

# passwd -l accountName

 

#6.5: Make Sure No Non-Root Accounts Have UID Set To 0

 

Only root account have UID 0 with full permissions to access the system. Type the following command to display all accounts with UID set to 0:

# awk -F: ‘($3 == “0”) {print}’ /etc/passwd

 

Q.How Do I Secure Grub Boot Loader?

#1: Create A Password For Grub

 

Type grub-md5-crypt command to create password in MD5 format:

# grub-md5-cryptOutput:

 

Password:<ENTER-YOUR-PASSWORD>

Retype password:<ENTER-YOUR-PASSWORD>

$1$NYoR71$Sgv6pxQ6LG4GXpfihIJyL0

 

Please note that you need to copy and paste the MD5 password ($1$NYoR71$Sgv6pxQ6LG4GXpfihIJyL0) to your configuration file. Use mouse to copy the same.

#2 Add MD5 Password To Grub Configuration File

 

Under Debian GNU/Linux the Grub configuration file is located at /boot/grub/menu.lst. (Red Hat / Fedora user use /boot/grub/grub.conf file)

# vi /boot/grub/menu.lst

 

Edit file and add a password line as follows:

password –md5 $1$NYoR71$Sgv6pxQ6LG4GXpfihIJyL0

 

To require use of the password for entering single user mode, change the value of the lockalternative variable in the file /boot/grub/menu.lst to true, as shown in the following example.

 

# lockalternative=true

 

 

To disable the reboot action taken by pressing the Ctrl+Alt+Delete key combination, comment out the following line in the file /etc/event.d/control-alt-delete.

 

#exec /sbin/shutdown -r now “Control-Alt-Delete pressed”

 

 

#9.1: Find Listening Network Ports

 

Use the following command to list all open ports and associated programs:

netstat -tulpn

OR

nmap -sT -O localhost

nmap -sT -O server.example.com

 

#15: Disable Unwanted SUID and SGID Binaries

#See all set user id files:

find / -perm +4000

# See all group id files

find / -perm +2000

# Or combine both in a single command

find / \( -perm -4000 -o -perm -2000 \) -print

find / -path -prune -o -type f -perm +6000 -ls

 

#15.1: World-Writable Files

 

Anyone can modify world-writable file resulting into a security issue. Use the following command to find all world writable and sticky bits set files:

find /dir -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print

 

#15.2: Noowner Files

 

Files not owned by any user or group can pose a security problem. Just find them with the following command which do not belong to a valid user and a valid group

find /dir -xdev \( -nouser -o -nogroup \) -print

 

ArpON – Protect yourself from MITM attacks.

ArpON (Arp handler inspectiON) is a portable handler daemon that make ARP secure in order to avoid the Man In The Middle through ARP Spoofing/Poisoning. It detects and blocks also Man In The Middle through ARP Spoofing/Poisoning for DHCP Spoofing, DNS Spoofing, WEB Spoofing, Session Hijacking and SSL/TLS Hijacking & co attacks.

 

This is possible using two kinds of anti ARP Poisoning tecniques: the first is based on SARPI or “Static Arp Inspection” the second on DARPI or “Dynamic Arp Inspection” approach. SARPI and DARPI protects both unidirectional, bidirectional and distributed attacks.

 

Here’s a very quick example of it’s usage, we will use SARPI.

 

arpon -n 10 -g -u 1 -s -i eth0

 

ArpON “Arp handler inspection” version 1.90 (http://arpon.sourceforge.net)

 

[00/02/2011 – 08:32:04 PST] Device: (eth0) MAC: 0:24:21:66:9:5a Inet4: 192.168.1.101 Netmask: 255.255.255.0

 

[00/02/2011 – 08:32:04 PST] Device: (eth0) MAC: 0:24:21:66:9:5a Inet4: 192.168.1.101 Netmask: 255.255.255.0

[00/02/2011 – 08:32:04 PST] SARPI Start…

[00/02/2011 – 08:32:04 PST] SARPI protects these Arp Cache’s entries:

[00/02/2011 – 08:32:04 PST] 1)     192.168.1.1 ->  0:66:78:d6:92:c8

[00/02/2011 – 08:32:04 PST] SARPI Arp Cache refresh timeout: 1 minute.

[00/02/2011 – 08:32:04 PST] SARPI Realtime Protect actived!

 

 

 

-n 10 ~ Sets priority

-g ~ Works in logging mode

-u 1 ~ Sets sarpi timeout to 1 minute

-s ~ Manage arp cache statically

 

You can get ArpON with the apt-get command or visit here

 

 

Multiple network interfaces and ARP flux

 

$sysctl -a | grep net.ipv4.conf.*.arp

A Simple Fix That May Work

 

If all three network interfaces are on different IP networks (such as 10.x.x.x, 172.16.x.x, 192.168.x.x) then executing the following will work:

 

sysctl -w net.ipv4.conf.all.arp_filter=1

 

However, if they are all on the same IP network, which is the case here, then this won’t achieve the desired results.

A More Effective Solution

 

The following can be added to your /etc/sysctl.conf file once you’ve tested it.

 

sysctl -w net.ipv4.conf.all.arp_ignore=1

sysctl -w net.ipv4.conf.all.arp_announce=2

 

 

1/ Clearing ARP cache and table.

You need the “arp -d hostname’ repeatedly to accomplish this.

You could make a script. Is there an easier way ?

 

2/ Clearing the routing table

“route del ROUTEDESCRIPTOR” repeatedly.

 

3/changing the mac of my eth0 card and also changing it back to the original

See “man ethtool”, the -e -E options change the firmware setting. The

“ethtool ethN -s phyad 01:22:33:44:55” will temporarily change (till reboot or re-command).

 

4/ restarting the network and taking it down.

For a fixed config the RedHat “ifup ethN” and “ifdown ethN” will do. But als osee the

“ip” command and the older deprecated (but very common) “ifconfig” command.

 

5/ assigning static IP’s and masks and then restarting the network to make sure it worked

I’d use “ip”, but “ifconfig” is good too.

ip addr add 192.168.0.77/24 dev eth0

ip link set eth0 up

ip link set eth0 down

or

ifconfig eth0 192.168.0.9../24 up

ifconfig eth0 down

 

6/Firewall stuff

“man iptables” stuff. Search google.com/linux for “iptables howto”.

 

7/ ACL’s

/usr/bin/chacl

/usr/bin/getfacl

/usr/bin/setfacl

/usr/bin/chacl

/usr/bin/getfacl

/usr/bin/setfacl

see “man acl” and “man COMMAND” for the above. Totally POSIX AFAIK.

If you don’t have these then “su -; yum -y install acl”, but I think they are in the default distro.

Reply With Quote

 

“ip neighbor flush all” – clears the arp table(s).

2/ “ip route flush all” – clears the entire route table.

 

The lesson is that the “ip” command subsumes nearly all the arp/route/ifconfig command and should be used instead.

The following output is from executing this command on the HN.

 

$sysctl -a | grep net.ipv4.conf.*.arp

$cat /proc/net/arp

 

$ip route ls

Advertisements

This is a linux command line reference for common operations.
Examples marked with • are valid/safe to paste without modification into a terminal, so
you may want to keep a terminal window open while reading this so you can cut & paste.
All these commands have been tested both on Fedora and Ubuntu.
See also more linux commands.

Command Description
apropos whatis Show commands pertinent to string. See also threadsafe
man -t ascii | ps2pdf – > ascii.pdf make a pdf of a manual page
which command Show full path name of command
time command See how long a command takes
time cat Start stopwatch. Ctrl-d to stop. See also sw
dir navigation
cd – Go to previous directory
cd Go to $HOME directory
(cd dir && command) Go to dir, execute command and return to current dir
pushd . Put current dir on stack so you can popd back to it
file searching
alias l=’ls -l –color=auto’ quick dir listing
ls -lrt List files by date. See also newest and find_mm_yyyy
ls /usr/bin | pr -T9 -W$COLUMNS Print in 9 columns to width of terminal
find -name ‘*.[ch]’ | xargs grep -E ‘expr’ Search ‘expr’ in this dir and below. See also findrepo
find -type f -print0 | xargs -r0 grep -F ‘example’ Search all regular files for ‘example’ in this dir and below
find -maxdepth 1 -type f | xargs grep -F ‘example’ Search all regular files for ‘example’ in this dir
find -maxdepth 1 -type d | while read dir; do echo $dir; echo cmd2; done Process each item with multiple commands (in while loop)
find -type f ! -perm -444 Find files not readable by all (useful for web site)
find -type d ! -perm -111 Find dirs not accessible by all (useful for web site)
locate -r ‘file[^/]*\.txt’ Search cached index for names. This re is like glob *file*.txt
look reference Quickly search (sorted) dictionary for prefix
grep –color reference /usr/share/dict/words Highlight occurances of regular expression in dictionary
archives and compression
gpg -c file Encrypt file
gpg file.gpg Decrypt file
tar -c dir/ | bzip2 > dir.tar.bz2 Make compressed archive of dir/
bzip2 -dc dir.tar.bz2 | tar -x Extract archive (use gzip instead of bzip2 for tar.gz files)
tar -c dir/ | gzip | gpg -c | ssh user@remote ‘dd of=dir.tar.gz.gpg’ Make encrypted archive of dir/ on remote machine
find dir/ -name ‘*.txt’ | tar -c –files-from=- | bzip2 > dir_txt.tar.bz2 Make archive of subset of dir/ and below
find dir/ -name ‘*.txt’ | xargs cp -a –target-directory=dir_txt/ –parents Make copy of subset of dir/ and below
( tar -c /dir/to/copy ) | ( cd /where/to/ && tar -x -p ) Copy (with permissions) copy/ dir to /where/to/ dir
( cd /dir/to/copy && tar -c . ) | ( cd /where/to/ && tar -x -p ) Copy (with permissions) contents of copy/ dir to /where/to/
( tar -c /dir/to/copy ) | ssh -C user@remote ‘cd /where/to/ && tar -x -p’ Copy (with permissions) copy/ dir to remote:/where/to/ dir
dd bs=1M if=/dev/sda | gzip | ssh user@remote ‘dd of=sda.gz’ Backup harddisk to remote machine
rsync (Network efficient file copier: Use the –dry-run option for testing)
rsync -P rsync://rsync.server.com/path/to/file file Only get diffs. Do multiple times for troublesome downloads
rsync –bwlimit=1000 fromfile tofile Locally copy with rate limit. It’s like nice for I/O
rsync -az -e ssh –delete ~/public_html/ remote.com:’~/public_html’ Mirror web site (using compression and encryption)
rsync -auz -e ssh remote:/dir/ . && rsync -auz -e ssh . remote:/dir/ Synchronize current directory with remote one
ssh (Secure SHell)
ssh $USER@$HOST command Run command on $HOST as $USER (default command=shell)
ssh -f -Y $USER@$HOSTNAME xeyes Run GUI command on $HOSTNAME as $USER
scp -p -r $USER@$HOST: file dir/ Copy with permissions to $USER’s home directory on $HOST
scp -c arcfour $USER@$LANHOST: bigfile Use faster crypto for local LAN. This might saturate GigE
ssh -g -L 8080:localhost:80 root@$HOST Forward connections to $HOSTNAME:8080 out to $HOST:80
ssh -R 1434:imap:143 root@$HOST Forward connections from $HOST:1434 in to imap:143
ssh-copy-id $USER@$HOST Install public key for $USER@$HOST for password-less log in
wget (multi purpose download tool)
(cd dir/ && wget -nd -pHEKk http://www.pixelbeat.org/cmdline.html) Store local browsable version of a page to the current dir
wget -c http://www.example.com/large.file Continue downloading a partially downloaded file
wget -r -nd -np -l1 -A ‘*.jpg’ http://www.example.com/dir/ Download a set of files to the current directory
wget ftp://remote/file[1-9].iso/ FTP supports globbing directly
wget -q -O- http://www.pixelbeat.org/timeline.html | grep ‘a href’ | head Process output directly
echo ‘wget url’ | at 01:00 Download url at 1AM to current dir
wget –limit-rate=20k url Do a low priority download (limit to 20KB/s in this case)
wget -nv –spider –force-html -i bookmarks.html Check links in a file
wget –mirror http://www.example.com/ Efficiently update a local copy of a site (handy from cron)
networking (Note ifconfig, route, mii-tool, nslookup commands are obsolete)
ethtool eth0 Show status of ethernet interface eth0
ethtool –change eth0 autoneg off speed 100 duplex full Manually set ethernet interface speed
iwconfig eth1 Show status of wireless interface eth1
iwconfig eth1 rate 1Mb/s fixed Manually set wireless interface speed
iwlist scan List wireless networks in range
ip link show List network interfaces
ip link set dev eth0 name wan Rename interface eth0 to wan
ip link set dev eth0 up Bring interface eth0 up (or down)
ip addr show List addresses for interfaces
ip addr add 1.2.3.4/24 brd + dev eth0 Add (or del) ip and mask (255.255.255.0)
ip route show List routing table
ip route add default via 1.2.3.254 Set default gateway to 1.2.3.254
host pixelbeat.org Lookup DNS ip address for name or vice versa
hostname -i Lookup local ip address (equivalent to host `hostname`)
whois pixelbeat.org Lookup whois info for hostname or ip address
netstat -tupl List internet services on a system
netstat -tup List active connections to/from system
windows networking (Note samba is the package that provides all this windows specific networking support)
smbtree Find windows machines. See also findsmb
nmblookup -A 1.2.3.4 Find the windows (netbios) name associated with ip address
smbclient -L windows_box List shares on windows machine or samba server
mount -t smbfs -o fmask=666,guest //windows_box/share /mnt/share Mount a windows share
echo ‘message’ | smbclient -M windows_box Send popup to windows machine (off by default in XP sp2)
text manipulation (Note sed uses stdin and stdout. Newer versions support inplace editing with the -i option)
sed ‘s/string1/string2/g’ Replace string1 with string2
sed ‘s/\(.*\)1/\12/g’ Modify anystring1 to anystring2
sed ‘/ *#/d; /^ *$/d’ Remove comments and blank lines
sed ‘:a; /\\$/N; s/\\\n//; ta’ Concatenate lines with trailing \
sed ‘s/[ \t]*$//’ Remove trailing spaces from lines
sed ‘s/\([`”$\]\)/\\\1/g’ Escape shell metacharacters active within double quotes
seq 10 | sed “s/^/      /; s/ *\(.\{7,\}\)/\1/” Right align numbers
sed -n ‘1000{p;q}’ Print 1000th line
sed -n ‘10,20p;20q Print lines 10 to 20
sed -n ‘s/.*<title>\(.*\)<\/title>.*/\1/ip;T;q Extract title from HTML web page
sed -i 42d ~/.ssh/known_hosts Delete a particular line
sort -t. -k1,1n -k2,2n -k3,3n -k4,4n Sort IPV4 ip addresses
echo ‘Test’ | tr ‘[:lower:]’ ‘[:upper:]’ Case conversion
tr -dc ‘[:print:]’ < /dev/urandom Filter non printable characters
tr -s ‘[:blank:]’ ‘\t’ </proc/diskstats | cut -f4 cut fields separated by blanks
history | wc -l Count lines
set operations (Note you can export LANG=C for speed. Also these assume no duplicate lines within a file)
sort file1 file2 | uniq Union of unsorted files
sort file1 file2 | uniq -d Intersection of unsorted files
sort file1 file1 file2 | uniq -u Difference of unsorted files
sort file1 file2 | uniq -u Symmetric Difference of unsorted files
join -t” -a1 -a2 file1 file2 Union of sorted files
join -t” file1 file2 Intersection of sorted files
join -t” -v2 file1 file2 Difference of sorted files
join -t” -v1 -v2 file1 file2 Symmetric Difference of sorted files
math
echo ‘(1 + sqrt(5))/2’ | bc -l Quick math (Calculate φ). See also bc
seq -f ‘4/%g’ 1 2 99999 | paste -sd-+ | bc -l Calculate π the unix way
echo ‘pad=20; min=64; (100*10^6)/((pad+min)*8)’ | bc More complex (int) e.g. This shows max FastE packet rate
echo ‘pad=20; min=64; print (100E6)/((pad+min)*8)’ | python Python handles scientific notation
echo ‘pad=20; plot [64:1518] (100*10**6)/((pad+x)*8)’ | gnuplot -persist Plot FastE packet rate vs packet size
echo ‘obase=16; ibase=10; 64206’ | bc Base conversion (decimal to hexadecimal)
echo $((0x2dec)) Base conversion (hex to dec) ((shell arithmetic expansion))
units -t ‘100m/9.58s‘ ‘miles/hour’ Unit conversion (metric to imperial)
units -t ‘500GB’ ‘GiB’ Unit conversion (SI to IEC prefixes)
units -t ‘1 googol’ Definition lookup
seq 100 | (tr ‘\n’ +; echo 0) | bc Add a column of numbers. See also add and funcpy
calendar
cal -3 Display a calendar
cal 9 1752 Display a calendar for a particular month year
date -d fri What date is it this friday. See also day
[ $(date -d ’12:00 +1 day’ +%d) = ’01’ ] || exit exit a script unless it’s the last day of the month
date –date=’25 Dec’ +%A What day does xmas fall on, this year
date –date=’@2147483647′ Convert seconds since the epoch (1970-01-01 UTC) to date
TZ=’America/Los_Angeles’ date What time is it on west coast of US (use tzselect to find TZ)
date –date=’TZ=”America/Los_Angeles” 09:00 next Fri’ What’s the local time for 9AM next Friday on west coast US
locales
printf “%’d\n” 1234 Print number with thousands grouping appropriate to locale
BLOCK_SIZE=\’1 ls -l Use locale thousands grouping in ls. See also l
echo “I live in `locale territory`” Extract info from locale database
LANG=en_IE.utf8 locale int_prefix Lookup locale info for specific country. See also ccodes
locale -kc $(locale | sed -n ‘s/\(LC_.\{4,\}\)=.*/\1/p’) | less List fields available in locale database
recode (Obsoletes iconv, dos2unix, unix2dos)
recode -l | less Show available conversions (aliases on each line)
recode windows-1252.. file_to_change.txt Windows “ansi” to local charset (auto does CRLF conversion)
recode utf-8/CRLF.. file_to_change.txt Windows utf8 to local charset
recode iso-8859-15..utf8 file_to_change.txt Latin9 (western europe) to utf8
recode ../b64 < file.txt > file.b64 Base64 encode
recode /qp.. < file.qp > file.txt Quoted printable decode
recode ..HTML < file.txt > file.html Text to HTML
recode -lf windows-1252 | grep euro Lookup table of characters
echo -n 0x80 | recode latin-9/x1..dump Show what a code represents in latin-9 charmap
echo -n 0x20AC | recode ucs-2/x2..latin-9/x Show latin-9 encoding
echo -n 0x20AC | recode ucs-2/x2..utf-8/x Show utf-8 encoding
CDs
gzip < /dev/cdrom > cdrom.iso.gz Save copy of data cdrom
mkisofs -V LABEL -r dir | gzip > cdrom.iso.gz Create cdrom image from contents of dir
mount -o loop cdrom.iso /mnt/dir Mount the cdrom image at /mnt/dir (read only)
cdrecord -v dev=/dev/cdrom blank=fast Clear a CDRW
gzip -dc cdrom.iso.gz | cdrecord -v dev=/dev/cdrom – Burn cdrom image (use dev=ATAPI -scanbus to confirm dev)
cdparanoia -B Rip audio tracks from CD to wav files in current dir
cdrecord -v dev=/dev/cdrom -audio -pad *.wav Make audio CD from all wavs in current dir (see also cdrdao)
oggenc –tracknum=’track’ track.cdda.wav -o ‘track.ogg’ Make ogg file from wav file
disk space (See also FSlint)
ls -lSr Show files by size, biggest last
du -s * | sort -k1,1rn | head Show top disk users in current dir. See also dutop
du -hs /home/* | sort -k1,1h Sort paths by easy to interpret disk usage
df -h Show free space on mounted filesystems
df -i Show free inodes on mounted filesystems
fdisk -l Show disks partitions sizes and types (run as root)
rpm -q -a –qf ‘%10{SIZE}\t%{NAME}\n’ | sort -k1,1n List all packages by installed size (Bytes) on rpm distros
dpkg-query -W -f=’${Installed-Size;10}\t${Package}\n’ | sort -k1,1n List all packages by installed size (KBytes) on deb distros
dd bs=1 seek=2TB if=/dev/null of=ext3.test Create a large test file (taking no space). See also truncate
> file truncate data of file or create an empty file
monitoring/debugging
tail -f /var/log/messages Monitor messages in a log file
strace -c ls >/dev/null Summarise/profile system calls made by command
strace -f -e open ls >/dev/null List system calls made by command
strace -f -e trace=write -e write=1,2 ls >/dev/null Monitor what’s written to stdout and stderr
ltrace -f -e getenv ls >/dev/null List library calls made by command
lsof -p $$ List paths that process id has open
lsof ~ List processes that have specified path open
tcpdump not port 22 Show network traffic except ssh. See also tcpdump_not_me
ps -e -o pid,args –forest List processes in a hierarchy
ps -e -o pcpu,cpu,nice,state,cputime,args –sort pcpu | sed ‘/^ 0.0 /d’ List processes by % cpu usage
ps -e -orss=,args= | sort -b -k1,1n | pr -TW$COLUMNS List processes by mem (KB) usage. See also ps_mem.py
ps -C firefox-bin -L -o pid,tid,pcpu,state List all threads for a particular process
ps -p 1,$$ -o etime= List elapsed wall time for particular process IDs
last reboot Show system reboot history
free -m Show amount of (remaining) RAM (-m displays in MB)
watch -n.1 ‘cat /proc/interrupts’ Watch changeable data continuously
udevadm monitor Monitor udev events to help configure rules
system information (see also sysinfo) (‘#’ means root access is required)
uname -a Show kernel version and system architecture
head -n1 /etc/issue Show name and version of distribution
cat /proc/partitions Show all partitions registered on the system
grep MemTotal /proc/meminfo Show RAM total seen by the system
grep “model name” /proc/cpuinfo Show CPU(s) info
lspci -tv Show PCI info
lsusb -tv Show USB info
mount | column -t List mounted filesystems on the system (and align output)
grep -F capacity: /proc/acpi/battery/BAT0/info Show state of cells in laptop battery
# dmidecode -q | less Display SMBIOS/DMI information
# smartctl -A /dev/sda | grep Power_On_Hours How long has this disk (system) been powered on in total
# hdparm -i /dev/sda Show info about disk sda
# hdparm -tT /dev/sda Do a read speed test on disk sda
# badblocks -s /dev/sda Test for unreadable blocks on disk sda
interactive (see also linux keyboard shortcuts)
readline Line editor used by bash, python, bc, gnuplot, …
screen Virtual terminals with detach capability, …
mc Powerful file manager that can browse rpm, tar, ftp, ssh, …
gnuplot Interactive/scriptable graphing
links Web browser
xdg-open . open a file or url with the registered desktop application
© Jan 7 2008

Some usefull command and bash script

Posted: January 13, 2012 in LINUX
Tags: , , ,

“FOR AEONS HAVE I HAVE ROAMED ON THE INTERNET”

This script and all other things here are collected from internet. There is no where in my creativeness. All thanks going to be those GURUZ who make it available to us..

This is useful to find out if your server is under attack or not. You can also list abusive IP address using this method.
1).###Daily Command for Admin
# netstat -nat | awk ‘{print $6}’ | sort | uniq -c | sort -n

Dig out more information about a specific ip address:
# netstat -nat |grep {IP-address} | awk ‘{print $6}’ | sort | uniq -c | sort -n

Busy server can give out more information:
# netstat -nat |grep 202.54.1.10 | awk ‘{print $6}’ | sort | uniq -c | sort -n

Get List Of All Unique IP Address

To print list of all unique IP address connected to server, enter:
# netstat -nat | awk ‘{ print $5}’ | cut -d: -f1 | sed -e ‘/^$/d’ | uniq
To print total of all unique IP address, enter:
# netstat -nat | awk ‘{ print $5}’ | cut -d: -f1 | sed -e ‘/^$/d’ | uniq | wc -l

Find Out If Box is Under DoS Attack or Not

If you think your Linux box is under attack, print out a list of open connections on your box and sorts them by according to IP address, enter:
# netstat -atun | awk ‘{print $5}’ | cut -d: -f1 | sed -e ‘/^$/d’ |sort | uniq -c | sort -n

A few more tools:

nmap – scan your server for open ports.
lsof – list open files, network connections and much more.
ntop web based tool – ntop is the best tool to see network usage in a way similar to what top command does for processes i.e. it is network traffic monitoring software. You can see network status, protocol wise distribution of traffic for UDP, TCP, DNS, HTTP and other protocols.
Conky – Another good monitoring tool for the X Window System. It is highly configurable and is able to monitor many system variables including the status of the CPU, memory, swap space, disk storage, temperatures, processes, network interfaces, battery power, system messages, e-mail inboxes etc.
GKrellM – It can be used to monitor the status of CPUs, main memory, hard disks, network interfaces, local and remote mailboxes, and many other things.
vnstat – vnStat is a console-based network traffic monitor. It keeps a log of hourly, daily and monthly network traffic for the selected interface(s).
htop – htop is an enhanced version of top, the interactive process viewer, which can display the list of processes in a tree form.
mtr – mtr combines the functionality of the traceroute and ping programs in a single network diagnostic tool.

 

2) ### Script for Hardware information

 

#!/bin/bash

#
# server_info.sh – display server hardware info
#
# 2008 – Mike Golvach – eggi@comcast.net
#
# Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License
#

hwinfo=”/usr/sbin/hwinfo –short”
hostname=`hostname`
separator=”—————————————-”
echo $separator
echo “System Information For $hostname”
echo $separator
echo $separator
echo SERVER – MEMORY
echo $separator
/usr/sbin/hwinfo –bios|egrep ‘OEM id:|Product id:|CPUs|Product:|Serial:|Physical Memory Array:|Max. Size:|Memory Device:|Location:|Size:|Speed:|Location:’|sed -e ‘s/”//g’ -e ‘/^ *Speed: */s/Memory Device:/\n Memory Device:/’ -e ‘s/\(Max. Speed:\)/CPU \1 MHz/’ -e ‘s/\(Current Speed\)/CPU \1 MHz/’
echo $separator
echo SMP
echo $separator
$hwinfo –smp
echo $separator
echo CPU
echo $separator
$hwinfo –cpu
echo $separator
echo CD_ROM
echo $separator
/usr/sbin/hwinfo –cdrom|egrep ’24:|Device File:|Driver:’|awk -F”:” ‘{ if ( $1 ~ /[0-9][0-9]*/ ) print $0; else print ” ” $2}’|sed -e ‘s/^.*[0-9] //’ -e ‘s/ //’ -e ‘s/”//g’
echo $separator
echo DISK
echo $separator
$hwinfo –disk
echo $separator
echo PARTITION
echo $separator
$hwinfo –partition
echo $separator
echo NETWORK
echo $separator
$hwinfo –network
echo $separator
echo NETCARD
echo $separator
$hwinfo –netcard
echo $separator

 

3)####Simple Ping monitor on Linux

 

#!/bin/bash
# Simple SHELL script for Linux and UNIX system monitoring with
# ping command
# ————————————————————————-
# Copyright (c) 2006 nixCraft project <http://www.cyberciti.biz/fb/&gt;
# This script is licensed under GNU GPL version 2.0 or above
# ————————————————————————-
# This script is part of nixCraft shell script collection (NSSC)
# Visit http://bash.cyberciti.biz/ for more information.
# ————————————————————————-
# Setup email ID below
# See URL for more info:
# http://www.cyberciti.biz/tips/simple-linux-and-unix-system-monitoring-with-ping-command-and-scripts.html
# ————————————————————————-

# add ip / hostname separated by white space
HOSTS=”cyberciti.biz theos.in router”

# no ping request
COUNT=1

# email report when
SUBJECT=”Ping failed”
EMAILID=”me@mydomain.com”
for myHost in $HOSTS
do
count=$(ping -c $COUNT $myHost | grep ‘received’ | awk -F’,’ ‘{ print $2 }’ | awk ‘{ print $1 }’)
if [ $count -eq 0 ]; then
# 100% failed
echo “Host : $myHost is down (ping failed) at $(date)” | mail -s “$SUBJECT” $EMAILID
fi
done

 

 

4)##BVegginers Script Show Process or every “N” second

 

#!/bin/bash
# Write a shell script to display the process running on the system for every
# 30 seconds, but only for 3 times.
# ————————————————————————-
# Copyright (c) 2008 nixCraft project <http://www.cyberciti.biz/fb/&gt;
# This script is licensed under GNU GPL version 2.0 or above
# ————————————————————————-
# This script is part of nixCraft shell script collection (NSSC)
# Visit http://bash.cyberciti.biz/ for more information.
# ————————————————————————-
#
# for loop 3 times
for r in 1 2 3
do
#see every process on the system
echo “**************************** x^x^x ****************************”
ps -e
echo “**************************** x^x^x ****************************”
#sleep for 30 seconds
sleep 3
# clean
done