HowtoForge - Linux Howtos and Tutorials - Security

Never Forget To Turn Dansguardian Back On After A Cyberspacejaywalk

Fri, 02 Aug 2013 19:13:40 +0200

Never Forget To Turn Dansguardian Back On After A Cyberspacejaywalk

Dansguardian is the leading free keyword blocker on Linux systems and it uses this method known as a weighed keyword score. Now, people who use or administer a web content filter know very well that there are situations when a filter accidentally blocks an acceptable site or even an unreviewed site. The simple solution is often to turn off filtering completely. Then it is of paramount importance that when this unrestricted cyberspacewalk ends, the administrator must turn Dansguardian back on!! But what if they forget?

Setting Up KeePass For Centos 6

Wed, 31 Jul 2013 19:52:48 +0200

Setting Up KeePass For Centos 6

This mini-howto describes how to set up KeePass on Centos 6. It requires building mono from source and installing the "portable" version of KeePass. Finally there are a few tweaks that need to be done so that it can execute properly.

Encrypt Your Data With EncFS (Ubuntu 13.04)

Wed, 24 Jul 2013 20:13:34 +0200

Encrypt Your Data With EncFS (Ubuntu 13.04)

EncFS provides an encrypted filesystem in user-space. It runs without any special permissions and uses the FUSE library and Linux kernel module to provide the filesystem interface. It is a pass-through filesystem, not an encrypted block device, which means it is created on top of an existing filesystem. This tutorial shows how you can use EncFS on Ubuntu 13.04 to encrypt your data.

Encrypt Your Data With EncFS (Debian Wheezy)

Tue, 23 Jul 2013 19:22:27 +0200

Encrypt Your Data With EncFS (Debian Wheezy)

Removing Signatures From Various Packages

Tue, 09 Jul 2013 19:34:42 +0200

Removing Signatures From Various Packages

This tutorial shows you how to remove the Debian signature/version info from packages such as Apache, Postfix or SSH. There are various reasons to remove the signature (and therefore hide that you are using Debian/a specific version). The most important one is about security. When a hacker knows the distro you are using, he can search for well-known security issues and start an attack against them. If he doesn't know the distro in use, chances to not find any security holes are much larger.

Virtual Users And Domains With Postfix, Courier, MySQL And SquirrelMail (Debian Wheezy)

Thu, 04 Jul 2013 17:59:04 +0200

Virtual Users And Domains With Postfix, Courier, MySQL And SquirrelMail (Debian Wheezy)

This document describes how to install a Postfix mail server that is based on virtual users and domains, i.e. users and domains that are in a MySQL database. I'll also demonstrate the installation and configuration of Courier, so that Courier can authenticate against the same MySQL database Postfix uses. The resulting Postfix server is capable of SMTP-AUTH and TLS and quota. Passwords are stored in encrypted form in the database. In addition to that, this tutorial covers the installation of Amavisd, SpamAssassin, ClamAV, and SquirrelMail.

How To Add WiKID Two-Factor Authentication To OpenVPN Community On Ubuntu 13.04

Mon, 24 Jun 2013 17:44:38 +0200

How To Add WiKID Two-Factor Authentication To OpenVPN Community On Ubuntu 13.04

These instructions describe setting up two-factor authentication with WiKID Strong Authentication, which is a commercial/open source two-factor authentication system and OpenVPN, an SSL-encrypted VPN, on an Ubuntu 13.04 Linux server using the Radius Pluggable Authentication Module. First, we will configure PAM to use Radius, then we will configure OpenVPN to use PAM and one-time passwords, then we will create a network client on the WiKID server for OpenVPN. We won't go into specifics about installing these services, rather we will focus on configuring them to all work together.

Secure ISPConfig 3 And Services With GoDaddy Signed Certificate On CentOS

Wed, 29 May 2013 16:44:49 +0200

Secure ISPConfig 3 And Services With GoDaddy Signed Certificate On CentOS

Let's set up a signed certificate from GoDaddy for the ISPConfig control panel, Pure-FTPD, Postfix, Dovecot, phpMyAdmin, and Squirrelmail. Don't forget to replace pluto.example.com with your own FQDN throughout this entire section!

Securing SSH On Ubuntu Precise With WiKID Two-Factor Authentication

Fri, 17 May 2013 12:33:44 +0200

Securing SSH On Ubuntu Precise With WiKID Two-Factor Authentication

SSH offers a highly secure channel for remote administration of servers. However, if you face an audit for regulatory or business requirements, such as Visa/Mastercard PCI, you need to be aware of some potential authentication related short-comings that may cause headaches in an audit. In this document we are going to demonstrate how to combine two-factor authentication from WiKID on Ubuntu. This document will also serve as the basis for additional tutorials because many services on Linux use PAM for authentication.

How To Configure Apache To Use Radius For WiKID Two-Factor Authentication On Ubuntu

Fri, 10 May 2013 18:04:01 +0200

How To Configure Apache To Use Radius For WiKID Two-Factor Authentication On Ubuntu

This document describes how to add WiKID two-factor authentication to Apache 2.x using mod_auth_radius on Ubuntu 12.04 Precise. It is recommended that you consider using mutual https authentication for web applications that are worthy of two-factor authentication. Strong mutual authentication means that the targeted website is authenticated to the user in some cryptographically secure manner, thwarting most man-in-the-middle attacks. The use of cryptography is key. While some sites use an image in an attempt to validate a server, it should be noted that any man-in-the-middle could simply replay such an image.

Setting Up ProFTPd + TLS On Ubuntu 12.10

Wed, 24 Apr 2013 21:12:12 +0200

Setting Up ProFTPd + TLS On Ubuntu 12.10

FTP is a very insecure protocol because all passwords and all data are transferred in clear text. By using TLS, the whole communication can be encrypted, thus making FTP much more secure. This article explains how to set up ProFTPd with TLS on an Ubuntu 12.10 server.

Encrypt Your Data With EncFS (OpenSUSE 12.3)

Fri, 12 Apr 2013 17:36:48 +0200

Encrypt Your Data With EncFS (OpenSUSE 12.3)

How To Run LinOTP On OpenSuSE 12.3 With PostgreSQL

Tue, 09 Apr 2013 18:06:37 +0200

How To Run LinOTP On OpenSuSE 12.3 With PostgreSQL

This tutorial describes the installation of LinOTP on OpenSUSE 12.3 using PostgreSQL as a token database. LinOTP is a two factor authentication solution with One Time Passwords. In the following Howto we are showing how to enable SSH authentication with LinOTP.

Virtual Users And Domains With Postfix, Courier, MySQL And SquirrelMail (CentOS 6.3 x86_64)

Thu, 21 Mar 2013 17:46:09 +0100

Virtual Users And Domains With Postfix, Courier, MySQL And SquirrelMail (CentOS 6.3 x86_64)

This document describes how to install a Postfix mail server that is based on virtual users and domains, i.e. users and domains that are in a MySQL database. I'll also demonstrate the installation and configuration of Courier, so that Courier can authenticate against the same MySQL database Postfix uses. The resulting Postfix server is capable of SMTP-AUTH and TLS and quota. Passwords are stored in encrypted form in the database. In addition to that, this tutorial covers the installation of Amavisd, SpamAssassin and ClamAV so that emails will be scanned for spam and viruses. I will also show how to install SquirrelMail as a webmail interface so that users can read and send emails and change their passwords.

How To Do Mass Enrolling Of Yubikey With LinOTP

Mon, 04 Mar 2013 17:47:15 +0100

How To Do Mass Enrolling Of Yubikey With LinOTP

When it comes to two factor authentication Yubikeys are very in vogue. They are small, they have a very small footprint on your keychain and are easy to handle as they need no driver and authentication is as easy as touching a button. This howto shows, how you can use the open source LinOTP to enroll many Yubikeys to the LinOTP server.