Fragmented Technical Notes
This post will walk you through the process of showing and updating a MySQL database via terminal.
We’ll use a WordPress installation because it has an established database schema. The principles apply to any database.
Continue reading “How do you show and update a MySQL database in a linux terminal?”SFTP is a file transfer protocol. It wraps the File Transfer Protocol (FTP) inside the Secure Shell (SSH) protocol. This allows the communication to be protected as it moves from one point to another.
PSA: Using FTP is considered an insecure transfer protocol and should be avoided.
This article assumes you are trying to create new SFTP users on your linux machine. In this example we’ll be using Ubuntu 18.04.
To enable SFTP you have to enable it inside your SSH configuration file. It’s often located here: /etc/ssh/sshd_config. Open the file and add the following to the end of the configuration file:
# override default of no subsystems Subsystem sftp /usr/lib/openssh/sftp-server Match group sftp X11Forwarding no AllowTCPForwarding no ForceCommand internal-sftp
Options explained:
| Option | Description |
|---|---|
| Subsystem | An abstraction layer that allows you to invoke remote commands. In this instance, we’re invoking sftp-server. |
| Match | Allows you to limit actions in shell, in this instance we’re limiting the actions to a specific group – sftp. Only those users inside the SFTP group will be able to SFTP into the server. |
| X11Forwarding | This is a special case for remote tunneling. Unfortuantely it can be used maliciously by a bad actor, so it’s recommended your disable unless you know what you’re doing. |
| AllowTCPForwarding | “TCP Forwarding” allows you to encapsulate any other protocol (based on TCP of course) inside an already established SSH connection. There are a lot of reasons for this, but we don’t want to allow SFTP users to use this without appropriate planning. |
| ForceCommand | The remote system can only execute a set of statically defined commands. Specifying a command of internal-sftp will force the use of an in-process SFTP server that requires no support files when used with ChrootDirectory. |
Once you add this to the SSH config file you need to restart OpenSSH:
service ssh restart
Now you need to add new SFTP users, and apply the user to the right group.
useradd -m [newsftpuser] -g sftp
Set the password:
passwd [newsftpuser]
Now you can test your SFTP connection, from a different server:
sftp [newsftpuser]@[serverIPaddress]
Happy SFTP’ing!
Sharing is caring!
There are instances where you want to quickly locate and move specific file types from point A to Point B.
Example:
Move all PHP files from /home/$user/php-files/ to /home/$user/php-mv-files
Easiest way to do this is to use the Find command in terminal.
$ find ./ -name "*.php" ./php-files/file3.php ./php-files/file2.php ./php-files/file1.php
This lists all the PHP files in the /php-files directory.
To move the files, you run the following command:
$ find ./php-files/ -name "*.php" -exec mv {} ./php-mv-files/ \;
This will move all files from ./php-files to ./php-vmv-files. Running the original Find command will get you the following:
$ find ./ -name "*.php" ./php-mv-files/file3.php ./php-mv-files/file2.php ./php-mv-files/file1.php
In this instance, -exec mv {} says, run the MV command on the files selected from the original find, that’s what the {} implies. You then escape, and close the command using \;. This final piece is critical to stopping the command.
Sharing is caring!
Path environmental variables are variables that function like a shortcut for your system. They allow you to define directories where executables are located.
Assume you installed this application picc-9.82.9453-linux.run. Without setting the path you’d have to run this every time in your terminal:
# /usr/hitech/picc/9.82/bin/picc
Instead of:
# picc
Running picc without having to define the path every time is so much easier, and faster. To achieve this experience you have to add the application executable to the Path environmental variable.
The first option is edit your user profile:
$ vim ~/.bash_profile
It will look something like this:
# .bash_profile # Get the aliases and functions if [ -f ~/.bashrc ]; then . ~/.bashrc fi # User specific environment and startup programs PATH=$PATH:$HOME/bin export PATH
You are looking to edit this section:
PATH=$PATH:$HOME/bin
Update the path with new application location (e.g., /usr/hitech/picc/9.82/bin) using the colon (:) as the separator.
PATH="$HOME/bin:$PATH:/usr/hitech/picc/9.82/bin"
Save the file, and try running the command in your terminal.
# picc
Sharing is caring!
Whenever you’re working with linux you’ll find yourself in need of running tasks repeatedly. The easiest way to do this is to set up a recurring job using Cron.
A crontab file contains instructions for the cron(8) daemon in the following simplified manner: “run this command at this time on this
date”. – Cron Man Page
You can edit your cron jobs using crontab, specifically:
# crontab -e
If you have any other cron jobs you’ll see other entries. If not, you’ll be able to create your own entries using your favorite editor (e.g., VIM, Nano, VI, etc…).
The format for a cron entry is as follows:
minute hour day-of-month month day-of-week command
There is a great tutorial available here: https://crontab.guru/every-1-hour
If I want to run a job every hour, this is the entry I’d add to Cron:
0 * * * * cd /root/scripts && ./checkrunningprocess.sh
If you ever want to see what jobs you have running you can run:
crontab -l
and you’d see something like this:
# crontab -l 0 * * * * cd /root/scripts && ./checkrunningprocess.sh
Happy automating!
Sharing is caring!
When you’re working with linux you might have to add a user to different group.
Let’s say that you want to create user John, and you want John to have root abilities. To do this you’re going to want to add the user, John, to the sudoers group.
The sudoers group controls who has Sudo privileges on a machine. Sudo is a command that allows a user to run commands based on another users privileges, in most instances it is configured to run as root. Fun fact, SUDO was established from “superuser do.”
To add user John to the sudoers group you would do something like this:
# usermod -aG sudoers John
The two options used include:
You have to use both options in conjunction with each other. You can find a more detailed list of options here: https://linux.die.net/man/8/usermod
This same model applies to any group and can be used for any user. A great example is Apache on a web server. 🙂
Sharing is caring!
If you are looking for specific content but can’t remember where it’s located on the server, this post is for you. It will show you how to find specific text anywhere in a folder, or server.
We are going to use the GREP command when doing searches in linux.
Continue reading “How do I find all files containing specific text on Linux?”grep searches input files for lines containing a match to a given pattern list. When it finds a match in a line, it copies the line to standard output (by default), or produces whatever other sort of output you have requested with options.
Do you ever find yourself wanting to do advanced searches in Linux? In the last article we shared how to use grep to find specific text. In this article we’ll introduce AWK.
Continue reading “How do you use AWK to perform advanced searches in Linux?”The awk command is a powerful method for processing or analyzing text files—in particular, data files that are organized by lines (rows) and columns. Simple awk commands can be run from the command line. More complex tasks should be written as awk programs (so-called awk scripts) to a file.
If you have ever tried to run the current directory (CD) command inside your shell script you’ll notice it doesn’t work.
Example
#!/bin/bash cd /home/$user/Documents/test-directory
This is because shell scripts run inside a subshell, and each subshell has its own concept of what the “current directory” is. In fact, it’s not that the cd doesn’t execute, it actually does but the minute it exits the subshell you’re back in the original shell and nothing changed.
Continue reading “Why doesn’t CD work in a Shell Script? How can I make CD work in a Shell Script?”If you suffer multiple reinfections and your site is one of many in an account, the odds are high that you’re suffering from cross-site contamination.
Cross-site contamination is when a site is negatively affected by neighboring sites within the same server due to poor isolation on the server or account configuration. This phenomenon is one of the greatest contributors to the VPS/Dedicated/Shared hosting secure or insecure debate.
The greatest contributor to cross-site contamination is what I call soup-kitchen servers. Soup-kitchen servers are those environments riddled with every installation and configuration known to man. It might include 10’s or 100’s of different sites or different platforms (i.e., Drupal, Joomla, WordPress, etc.). The problem isn’t the quantity. They might also include sites in different phases of their lives – development, staging, production.
The biggest culprits of these configurations are agencies, freelance developers, and aspiring hosts.
The concept of functional isolation is not new but can be difficult to employ. It’s the idea that an environment should be used for only one purpose. A classic example might be using a web server as an email server or vice versa. The general rule of thumb is that using an environment for more than one purpose is bad practice. Theoretical and practical application, however, are always two different things.
Most organizations (individuals) wouldn’t dream of having a server per site, and in many ways it’s impractical. So my recommendation is to break it out by three things: technology, function, and stage.
The next thing you want to think about – accounts.
Shared hosts have a bad reputation for poor security, but it’s not entirely accurate. While it’s true there have been challenges in the past, we’re talking circa 2010/2011. These days, the problems with shared hosts, are not the shared host themselves, but the one-to-many relationship website owners have with their accounts and sites.
Example: One account has 100 sites under it.
In these configurations, the attacks we’re seeing are not those that are moving laterally between accounts on the shared host, but rather those that are moving laterally within the same account.
It’s important that when you’re configuring your account to create unique users for each site and ensure that the permissions are such that a user can’t move between users on the same account.
The most frustrating thing for a website owner is when they deploy all the recommended security controls and they continue to get infected. We experience it all the time with customers that have deployed our controls, including our Firewall, and a reinfection happens.
In 9 out of 10 instances, reinfections are occurring because of internal attacks (not external). The challenge with this, however, is that it requires investigation and education.
Seeing the infection on your site doesn’t mean that it’s the site itself being exploited. If you continue to experience multiple reinfections it’s good to look at your entire environment and see if any of the conditions described above might be contributing to the issues.
The biggest contributors we find when running our reinfection investigations include:
If you’re a website owner and wondering if this affects you, open a dialog with your developer or host and ask them what their approach is to handling multiple websites on the same server and account. Ask them if they are managing other sites on your account and how they can provide you assurances that your site is properly isolated from other neighboring sites. If you continue to experience issues the odds are there is a misconfiguration.
The approach I propose here is simple, cost-effective, and the first step into improving your overall security posture. It will pay dividends in helping reduce the risks associated with cross-site contamination, while also helping streamline your maintenance activities.
Functional isolation is as old a concept as Least Privileged or Defense in Depth, but perhaps the least discussed. I would extend that to encourage you to consider not just Functional Isolation, but Account Isolation as well. Combined, both these will dramatically reduce the threat that is cross-site contamination.
A few last thoughts:
If you need help with a hacked site or are struggling with cross-site contamination, we offer professional website malware removal services and will protect and monitor your website.