Windows XP has a vast number of configuration dialogs, but some adjustments can be performed only by directly editing the Registry. Frequently, tips involving Registry tweaks include stern warnings to back up the Registry before making any change. The Windows XP Backup applet can back up the Registry along with other elements of the System State, but the resulting data file can occupy hundreds of megabytes. You’re better off saving a system restore point each time you’re about to edit the Registry. Better still, you can use Regedit to back up only the Registry keys that will be changed.

Click on Start | Run and enter Regedit to launch the Registry editor. To back up an individual key you plan to edit, navigate to the key and right-click on it. Choose Export from the menu, and save the key to a REG file. Open the REG file in Notepad and insert a few comment lines that describe the source and purpose of the tweak. (To create a comment line, simply put a semicolon at the start of the line.)

Now go ahead and make all the changes to Registry keys and values specified by the tip you’re applying. Any time you add a new key or value, make a note of it with another comment line in the REG file. When you’re done, save the REG file and close Notepad.

If later you want to undo this Registry tweak, just double-click on the REG file and confirm that you want to add it to the Registry. This will restore any deleted keys or values and will restore the original data for any values whose data was changed. Note that this will not remove new keys or values that were added; that’s why you need to make comments about such changes.

Right-click on the REG file and choose Edit, which will open it in Notepad. Check for comments about keys or values that were added, and if you find any, use Regedit to delete them. You can delete the REG file itself once you’ve completed this process

• 0 Comments

Actions are automatically saved to the Actions Palette folder in the Adobe Photoshop or Adobe ImageReady CS Settings folder. If this file is lost or removed, the actions you created are lost. You can save your actions to a separate actions file so that you can recover them if necessary. You can also load a variety of action sets that are shipped with Photoshop.

Note: The default location of the Adobe Photoshop CS Settings folder varies by operating system. Use your operating system’s Find command to locate this folder.

To save a set of actions:

1. Select a set.
2. Choose Save Actions from the Actions palette menu.
3. Type a name for the set, choose a location, and click Save.

You can save the set anywhere. However, if you place the file in the Presets/Photoshop Actions folder inside the Photoshop program folder, the set will appear at the bottom of the Actions palette menu after you restart the application.

Press Ctrl+Alt (Windows) or Command+Option (Mac OS) when you choose the Save Actions command to save the actions in a text file. You can use this file to review or print the contents of an action. However, you can’t reload the text file back into Photoshop.

To load a set of actions:

Do one of the following:
* Choose Load Actions from the Actions palette menu. Locate and select the action set file, and then click Load. (In Windows, Photoshop action set files have the extension .atn.)
* Select an action set from the bottom of the Actions palette menu.

To restore actions to the default set:

1. Choose Reset Actions from the Actions palette menu.
2. Click OK to replace the current actions in the Actions palette with the default set, or click Append to add the set of default actions to the current actions in the Actions palette.

• 0 Comments

Chkrootkit is a powerful tool to scan your Linux server for trojans. We’ll show you how to install it, scan your server and setup a daily automated scanning job that emails you the report.

Installing CHKROOTKIT

SSH as admin to your server. DO NOT use telnet, it should be disabled anyways.

#Change to root
su -

#Type the following
wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz

# Check the MD5 SUM of the download for security:
ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.md5

md5sum chkrootkit.tar.gz

#Unpack the tarball using the command
tar xvzf chkrootkit.tar.gz

#Change to the directory it created
cd chkrootkit*

#Compile by typing
make sense

#To use chkrootkit, just type the command
./chkrootkit

#Everything it outputs should be ‘not found‘ or ‘not infected‘…

Important Note: If you see ‘Checking `bindshell’… INFECTED (PORTS: 465)’ read on.
I’m running PortSentry/klaxon. What’s wrong with the bindshell test?
If you’re running PortSentry/klaxon or another program that binds itself to unused ports probably chkrootkit will give you a false positive on the bindshell test (ports 114/tcp, 465/tcp, 511/tcp, 1008/tcp, 1524/tcp, 1999/tcp, 3879/tcp, 4369/tcp, 5665/tcp, 10008/tcp, 12321/tcp, 23132/tcp, 27374/tcp, 29364/tcp, 31336/tcp, 31337/tcp, 45454/tcp, 47017/tcp, 47889/tcp, 60001/tcp).

#Now,
cd ..
#Then remove the .gz file
rm chkrootkit.tar.gz

Daily Automated System Scan that emails you a report

While in SSH run the following:
pico /etc/cron.daily/chkrootkit.sh

Insert the following to the new file:
#!/bin/bash
cd /yourinstallpath/chkrootkit-0.42b/
./chkrootkit | mail -s “Daily chkrootkit from Servername” admin@youremail.com

Important:
1. Replace ‘yourinstallpath’ with the actual path to where you unpacked Chkrootkit.
2. Change ‘Servername’ to the server your running so you know where it’s coming from.
3. Change ‘admin@youremail.com’ to your actual email address where the script will mail you.

Now save the file in SSH:
Ctrl+X then type Y

Change the file permissions so we can run it
chmod 755 /etc/cron.daily/chkrootkit.sh

Now if you like you can run a test report manually in SSH to see how it looks.
cd /etc/cron.daily/

./chkrootkit.sh

You’ll now receive a nice email with the report! This will now happen everyday so you don’t have to run it manually.

• 0 Comments

As you should know, on Windows 2003 Server, CDONTS was deprecated and CDOSYS is the new one Microsoft email sender component (read more on Microsoft Website)

However, some ASP scripts will require CDONTS and customers can need CDONTS install.So, to install CDONTS

1) First, install MailEnable or other SMTP server. Make sure it is running.
2) Download and unzip cdonts.dll to C:WindowsSystem32 folder
3) Register the CDONTS.DLL component on your server by clicking start >> run >> type :
regsvr32 c:winntsystem32cdonts.dll >> ENTER

Now CDONTS should being work perfectly.

To know if CDONTS is installed you can use http://www.pensaworks.com/prg_com.asp to view a list of installed components.

Based on: http://www.windows-2003-hosting.co.uk/?pagename=cdontshowto

• 0 Comments

I will be speaking about ModSecurity at ApacheCon Europe in Amsterdam later this year. I hear ApacheCon Europe 2007 (also in Amsterdam) was great so I am looking forward to participating this year. Interestingly, for some reason or another, this will be the first time ModSecurity will be “officially” presented to the Apache crowd, in spite of the fact we’ve been going at it for years. As always, the best part is meeting the people you’ve been communicating with for years.

“Intrusion detection is a well-known network security technique — it introduces monitoring and correlation devices to networks, enabling administrators to monitor events and detect attacks and anomalies in real-time. Web intrusion detection does the same but it works on the HTTP level, making it suitable to deal with security issues in web applications. This session will start with an overview of web intrusion detection and web application firewalls, discussing where they belong in the overall protection strategy. The second part of the talk will discuss ModSecurity and its capabilities. ModSecurity is an open source web application firewall that can be deployed either embedded (in the Apache HTTP server) or as a network gateway (as part of a reverse proxy deployment). Now in its fifth year of development, ModSecurity is mature, robust and flexible. Due to its popularity and wide usage it is now positioned as a de-facto standard in the web intrusion detection space.”

• 0 Comments

A very interesting research paper titled “Apache Prefork MPM Vulnerabilities” was released a few days ago, as you can see in the corresponding Bugtraq post. The paper describes, in detail, the dangers of allowing third-parties to run code under the same account as the Apache web server. This normally happens when dynamic content is produced using Apache modules (e.g. PHP) or when CGI scripts are configured to run without suEXEC. This topic itself is not new. You will find several articles on runtime process infection following this Google search link. I warn about this problem throughout my book and especially in Chapter 6, which is dedicated to those situations when more than one party is using the one Apache installation. However, it is one thing to know that something is possible and another to demonstrate, step by step, how it is done. Another interesting finding resulting from this paper is that it is possible to send a SIGUSR1 signal, as root, to any process on the system instead of just to Apache children processes. This is an issue that will have to be fixed in one of the future versions of Apache.

This problem with running code as the same identity as the web server is well understood (and has been for years) among the advanced Apache users. The solution is to always execute CGI scripts through suEXEC and to never allow third parties access to any of the modules. The real problem is that, as with any other product, there are few people who understand Apache inside out (and they can protect themselves) but there also those who are using the technology but do not have the luxury of learning everything there is about it (and there are many legitimate reasons for that).

The solution is obvious. Apache must be safe out of the box! We should dispense with the idea of running things in the same process. Process isolation facilities (either suEXEC or something else) should be installed and running by default on all installations. We can and should make provisions for those who know what they are doing to shoot themselves in the foot, of course. But the only reason to attempt to run things in the same process is performance and I suspect, in this day and age, virtually all users will be happy with the performance of their web server doing things in a secure manner.

• 0 Comments

Last week I spent some time stress-testing Apache 2.2.3 configured to work as a reverse proxy. I discovered (actually, re-discovered would be more accurate) two issues worth sharing.

1. Memory consumption of an Apache process will steadily increase as the number of processed requests rises. This is very easy to see if you send thousands of requests per second, with each request going to the same process. This has to be either a memory leak or a memory fragmentation issue. To deal with this you need to recycle processes before they become too large (and cause the operating system to start swapping). The MaxRequestsPerChild directive is meant to help with this. By setting its value to something other than zero (which means “unlimited”) you are telling Apache to shut down every process that goes over the limit. No problems there. Except that it’s where the second problem comes in.

2. The MaxRequestsPerChild directive does not work as the name suggests. Apache does not count requests – it counts *connections*. This creates a problem if you have persistent connections enabled in your configuration – you don’t know how many requests will come over a connection. It is probably safe to assume the number will not be large in most cases but you won’t know if someone will try to abuse this problem and force a large number of requests over a single connection (e.g. by using a specially programmed script). To be on the safe side you need to divide your ideal MaxRequestsPerChild value with the MaxKeepAliveRequests value. This will prevent the Apache processes from growing too large. But there’s a side effect – Apache will now recycle its worker processes more often. As your final step you need to make sure there are enough idle processes around (using MinSpareServers) to jump in as soon as an active process goes down. Yo need to have a few of these processes because there is a performance penalty associated with the creation of a new process and because Apache creates new processes at a rate of one every second.

• 0 Comments

My book was translated to Japanese and published by O’Reilly Japan! This is, apparently, old news, as they did it back in 2005, but I only found out about it from the three-montly royalties statement I received in April.

While we are on the subject of writing, I am starting to get the itch again. There are two or three topics I would like to explore further. Topics such as web application firewalls and ModSecurity, web application security, and application security patterns. On the other hand, I have a few compelling reasons against writing another book:

• It takes a lot of time (time better spent building Thinking Stone into a stronger business).

• It’s lonesome (but this can be dealth with by finding someone to co-author the book with me.
• My hands and arms haven’t fully recovered from the first book. (This one is the most compelling reason of all – I barely managed to finish Apache Security in the first place. If you are using keyboard extensively make sure to read about RSI and always keep Workrave active.)

• 0 Comments

It’s been exactly one year since my book, Apache Security, was published. I was very glad to learn Amazon.com are now enabling book authors to talk to their audience. It is unfortunate this feature did not exist at the time – I would have loved the opportunity to point those looking at this page to the book’s web site – http://www.apachesecurity.net.

I have always believed publication is just a first step in the life of a book (a long step in my case, as I spent eight months writing), and that the best stuff comes only after a book has been in use for a year or two. Let’s face it, we (the authors) don’t know nearly as much as our collective readership does. Therefore I invite you, the reader, to send me your feedback and make the second edition of Apache Security much better!

• 0 Comments

I was recently involved with a project where we needed to configure an Apache server that was intended to run multiple web sites/applications. It’s a pretty common assignment. To ensure the setup is secure I decided to start by creating a separate user account for each application. This allowed me to correctly configure file permissions to allow Apache to serve the static files directly. To take care of the dynamic content, I configured suEXEC to execute each application’s scripts under its own account. (In case you are wondering, this particular server is fast enough to run the scripts as CGIs. But if process creation becomes a bottleneck we can always seamlessly switch to FastCGI to avoid the performance penalty. Nothing to worry about, then.)

SuEXEC is a great tool but I’d love it to be capable of jailing (via the chroot system call) the binaries it executes. However, this feature is not present in the stock version. Having been responsible for the internal chroot feature of ModSecurity, I think I have a pretty good idea of why this is the case: unless you know what you’re doing it’s pretty easy to break applications with chroot. And if that happens you are going to ask for help… from those that created the feature, right? Of course! As it turns out, chrooting is notoriously difficult to debug remotely and that’s why the developers would much rather not deal with it.

But, if do you know your way around feel free to use my suexec chroot patch, which I have just added to the Apache Tools project. But, please, don’t write to me if it’s not working as you are expecting :)

• 0 Comments