Linux Blog

Secure Proxy to Surf the Web Anonymously on Linux - Anon-Proxy

Anon-Proxy contains the JAP client which acts as a local proxy between your browser and the insecure Internet. All requests for web pages are handled by JAP and are encrypted several times. The encrypted messages are sent through a chain of intermediate servers (named Mixes) to the final destination on the Internet.

Multiple layers of encryption protect all messages. A Mix collects messages in a batch, totally changes their appearance (removes one layer of encryption) and forwards them all at the same time, but in a different order. An adversary may observe all communication links, however he cannot determine a relation between incoming and outgoing packets. A surfer remains anonymous within the group of all users of the service.

Demonstrably, the Anon-Proxy protects your privacy as long as the Mix works correctly. Each message passes through several Mixes and the entire chain of Mixes has to be corrupt to successfully observe the user's activities. The chaining effectively prevents single Mixes from observing. This is the meaning of strong anonymity: Even the anonymity service itself cannot spy on its users.

Block Brute-Force Attempts on Ubuntu Linux - Fail2Ban

Fail2ban operates by blocking selected IP addresses that may belong to hosts that are trying to breach the system's security. It determines the hosts to be blocked by monitoring log files (e.g. /var/log/pwdfail, /var/log/auth.log, etc.) and bans any host IP that makes too many login attempts or performs any other unwanted action within a time frame defined by the administrator.

Fail2ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured. However, an unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, as well as reducing the likelihood of a successful dictionary attack.

Fail2ban can perform multiple actions whenever an abusive IP is detected: update Netfilter/iptables firewall rules, or alternatively TCP Wrapper's hosts.deny table, to reject an abuser's IP address; email notifications; or any user-defined action that can be carried out by a Python script. The standard configuration ships with filters for Apache, Lighttpd, sshd, vsftpd, qmail, Postfix and Courier Mail Server.

Hardening Ubuntu Linux using Bastille Linux

The Bastille Hardening program "locks down" an operating system, proactively configuring the system for increased security and decreasing its susceptibility to compromise. Bastille can also assess a system's current state of hardening, granular reporting on each of the security settings with which it works.

Bastille currently supports the Red Hat (Fedora Core, Enterprise, and Numbered/Classic), SUSE, Debian, Gentoo, and Mandrake distributions, along with HP-UX. Bastille's focuses on letting the system's user/administrator choose exactly how to harden the operating system. In its default hardening mode, it interactively asks the user questions, explains the topics of those questions, and builds a policy based on the user's answers. It then applies the policy to the system. In its assessment mode, it builds a report intended to teach the user about available security settings as well as inform the user as to which settings have been tightened.

How to Change the Network MAC Address on Ubuntu Linux - macchanger

A Media Access Control address (MAC address) is a unique identifier assigned to network interfaces for communications on the physical network segment. MAC addresses are used for numerous network technologies. Logically, MAC addresses are used in the Media Access Control protocol sub-layer of the OSI reference model.

MAC addresses are most often assigned by the manufacturer of a network interface card (NIC) and are stored in its hardware, the card's read-only memory, or some other firmware mechanism. If assigned by the manufacturer, a MAC address usually encodes the manufacturer's registered identification number and may be referred to as the burned-in address. It may also be known as an Ethernet hardware address (EHA), hardware address or physical address. A network node may have multiple NICs and will then have one unique MAC address per NIC.

MACChanger is a GNU/Linux utility for viewing/manipulating the MAC addresses of network interfaces. It can set specific, random, vendor-based (with a 6600+ vendor list), and device-type-based MACs.

A Fast Web Server Log Analyzer - Visitors

Visitors is a very fast web log analyzer for Linux, Windows, and other Unix-like operating systems. It takes as input a web server log file, and outputs statistics in form of different reports. The design principles are very different compared to other software of the same type:

* Designed to be executed by the command line, output html and text reports. The text report can be used in pipe to less to check web stats from ssh.
* Support for real time statistics with the Visitors Stream Mode.
* To specify the log format is not needed at all. Works out of box with apache and most other web servers with a standard log format.
* It's a portable C program, can be compiled on many different systems.
* The produced html report doesn't contain images or external CSS, is self-contained, you can send it by email to users.
* Visitors is free software (and of course, freeware), under the terms of the GPL license.

Visitors Reports information
Visitors reports contain a number of useful information and statistics:
* Requested pages.
* Requested images.
* Referrers by hits and age.
* Unique visitors in each day.
* Page views per visit.
* Pages accessed by the Google crawler (and the date of google's last access on every page).
* Percentage of visits originated from Google searches for every day.
* User's navigation patterns (web trails).
* Key phrases used in Google searches.
* User agents.
* Weekdays and Hours distributions of accesses.
* Weekdays/Hours combined bidimentional map.
* Month/Year combined bidimentional map.
* Visual path analysis with Graphviz.
* Operating systems, browsers and domains popularity.
* 404 errors.