Non Nerd Friendly
Category: Linux
When you are creating a global security policy on a SRX its important to remember to move the default Deny All rule to the bottom of the list see below for the example
insert security policies global policy DENY-ALL after policy Allow-SSH-From-TestServer1-To-TestServer2 commit check commit
A Quick guide on how I build my workstation environment using Debian Linux. Firstly I always use minimal installation the reason for this is to make the installation of Debian as small as possible and add applications and packages as I need them.
apt-get update -y && apt-get upgrade -y
apt-get install -y open-vm-tools
apt-get install -y ssh
apt-get install -y <code>apt-get install xserver-xorg xinit<strong> </strong></code>
apt-get install -y cinnamon <code>lightdm </code>
apt-get install -y gnome-terminal
apt-get install -y libreoffice
wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb dpkg -i google-chrome-stable_current_amd64.deb
add-apt-repository ppa:me-davidsansome/clementine apt-get update apt-get install clementine
VMware is now recommending that you use Open-VM-Tools instead of the traditional VMware tool Linux agent. Below is the script to perform the installation from your terminal session
# Perform Debian VM update apt-get update -y && apt-get upgrade -y # Install Open VM Tools apt-get install -y open-vm-tools
I manage from time to time servers that are sat in a pretty restricted DMZ and when I need to download and install packages I tend to have to download them on another machine first and then perform the installation on the hosts that need the packages. So below is a small snippet that I use to download the package and all of its dependencies ready to transferred to the server that they will be installed on
aptitude clean aptitude --download-only install <your_package_here> cp /var/cache/apt/archives/*.deb <your_directory_here>
A quick and easy guide on how to implement VRRP between two servers using the KeepAlived daemon
apt-get install -y keepalived
nano /etc/keepalived/keepalived.conf
global_defs {
# Email Alert Configuration
notification_email {
# Email To Address
admin@example.com
}
# Email From Address
notification_email_from noreply@example.com
# SMTP Server Address / IP
smtp_server 127.0.0.1
# SMTP Timeout Configuration
smtp_connect_timeout 60
router_id Example-Router-01
}
vrrp_sync_group VG1 {
group {
Example_Inst
}
}
vrrp_instance Example_Inst {
# State = Master or Backup
state MASTER
# Interface ID for VRRP to run on
interface eth0
# VRRP Router ID
virtual_router_id 10
# Highest Priority Wins
priority 250
# VRRP Advert Intaval 1 Second
advert_int 1
# Basic Inter Router VRRP Authentication
authentication {
auth_type PASS
auth_pass ChangeMeTestPassword123456789
}
# VRRP Virtual IP Address Config
virtual_ipaddress {
192.168.1.2/24 dev eth0
}
}
Once config file has been built save the file
service keepalived start
service keepalived status
apt-get install -y keepalived
nano /etc/keepalived/keepalived.conf
global_defs {
notification_email {
admin@example.com
}
notification_email_from noreply@example.com
smtp_server 127.0.0.1
smtp_connect_timeout 60
router_id Example-Router-02
}
vrrp_sync_group VG1 {
group {
Example_Inst
}
}
vrrp_instance Example_Inst {
# State = Master or Backup
state BACKUP
# Interface ID for VRRP to run on
interface eth0
# VRRP Router ID
virtual_router_id 10
# Highest Priority Wins
priority 150
# VRRP Advert Intaval 1 Second
advert_int 1
# Basic Inter Router VRRP Authentication
authentication {
auth_type PASS
auth_pass ChangeMeTestPassword123456789
}
# VRRP Virtual IP Address Config
virtual_ipaddress {
192.168.1.2/24 dev eth0
}
}
Once config file has been built save the file
service keepalived start
service keepalived status
Perform a ping to the VRRP VIP
ping 192.168.1.2
On the master server check IP address list to see whether the VIP is active on the master host
ip addr list
A simple guide on how to perform an implementation of Fail2Ban on Debian Jessie for SSH.
Download and Install Fail2Ban
sudo apt-get install -y fail2ban
Create a local config file
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Open new local config file in nano text editor
nano /etc/fail2ban/jail.local
Configure Default Ignore IP and ban time
[DEFAULT] ignoreip = 127.0.0.1 bantime = 3600 findtime = 600 maxretry = 3
Enable SSHD jail
[sshd] enabled = true
Restart the Fail2Ban Service
service fail2ban stop service fail2ban start # Or Run the following service fail2ban restart # Check service status service fail2ban status
Check IPtables new rules implemented by Fail2Ban
iptables -L
