Category Archives: Open Source

Install + Konfigurasi PowerDNS (dengan menggunakan MariaDB) dan PowerAdmin di CentOS 7

PowerDNS adalah DNS yang dikonfigurasi dengan berbagai backend seperti menggunakan relasional database, file zona seperti BIND atau algoritma load balancing / failover. Untuk installasi dan konfigurasinya akan kita bahas di halaman ini :

[1] Install dan Enable EPEL repository

# yum install epel-release -y

[2] Install MariaDB

yum install mariadb mariadb-server -y

# Start dan enable service mariadb
systemctl enable mariadb.service
Created symlink from /etc/systemd/system/multi-user.target.wants/mariadb.service to /usr/lib/systemd/system/mariadb.service.

systemctl start mariadb


# Setup MariaDB

# mysql_secure_installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
 SERVERS IN PRODUCTION USE! PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user. If you've just installed MariaDB, and
you haven't set the root password yet, the password will be blank,
so you should just press enter here.

Enter current password for root (enter for none): 
OK, successfully used password, moving on...

Setting the root password ensures that nobody can log into the MariaDB
root user without the proper authorisation.

Set root password? [Y/n] y
New password: 
Re-enter new password: 
Password updated successfully!
Reloading privilege tables..
 ... Success!


By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them. This is intended only for testing, and to make the installation
go a bit smoother. You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] y
 ... Success!

Normally, root should only be allowed to connect from 'localhost'. This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] y
 ... Success!

By default, MariaDB comes with a database named 'test' that anyone can
access. This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] y
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] y
 ... Success!

Cleaning up...

All done! If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

[3] Install PowerDNS

# yum install pdns pdns-backend-mysql -y

[4] Koneksikan ke Mysql dan buat database dengan menggunakan nama powerdns

# mysql -u root -p
Enter password: 
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 10
Server version: 5.5.56-MariaDB MariaDB Server

Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> create database powerdns;
Query OK, 1 row affected (0.00 sec)

Buat user database untuk powerdns

MariaDB [(none)]> GRANT ALL ON powerdns.* TO 'powerdns'@'YourIPServerPowerDNS' IDENTIFIED BY 'PasswordUser';
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> FLUSH PRIVILEGES;
Query OK, 0 rows affected (0.00 sec)

Buat tabel database PowerDNS

MariaDB [(none)]> use powerdns;
Database changed
MariaDB [powerdns]> CREATE TABLE domains (id INT auto_increment,name VARCHAR(255) NOT NULL,master VARCHAR(128) DEFAULT NULL,last_check INT DEFAULT NULL,type VARCHAR(6) NOT NULL,notified_serial INT DEFAULT NULL,account VARCHAR(40) DEFAULT NULL,primary key (id));
Query OK, 0 rows affected (0.01 sec)

MariaDB [powerdns]> CREATE UNIQUE INDEX name_index ON domains(name);
Query OK, 0 rows affected (0.01 sec)
Records: 0 Duplicates: 0 Warnings: 0

MariaDB [powerdns]> CREATE TABLE records (id INT auto_increment,domain_id INT DEFAULT NULL,name VARCHAR(255) DEFAULT NULL,type VARCHAR(6) DEFAULT NULL,content VARCHAR(255) DEFAULT NULL,ttl INT DEFAULT NULL,prio INT DEFAULT NULL,change_date INT DEFAULT NULL,primary key(id));
Query OK, 0 rows affected (0.00 sec)

MariaDB [powerdns]> CREATE INDEX rec_name_index ON records(name);
Query OK, 0 rows affected (0.01 sec)
Records: 0 Duplicates: 0 Warnings: 0

MariaDB [powerdns]> CREATE INDEX nametype_index ON records(name,type);
Query OK, 0 rows affected (0.00 sec)
Records: 0 Duplicates: 0 Warnings: 0

MariaDB [powerdns]> CREATE INDEX domain_id ON records(domain_id);
Query OK, 0 rows affected (0.00 sec)
Records: 0 Duplicates: 0 Warnings: 0

MariaDB [powerdns]> CREATE TABLE supermasters ( ip varchar(25) NOT NULL, nameserver VARCHAR(255) NOT NULL, account VARCHAR(40) DEFAULT NULL);
Query OK, 0 rows affected (0.01 sec)

MariaDB [powerdns]> quit; 
Bye

[5] Open file konfigurasi powerDNS

# vi /etc/pdns/pdns.conf

Tambahkan di baris paling bawah

Enable launch=gmysql

gmysql-host=localhost
gmysql-user=powerdns
gmysql-password="YourPassword"
gmysql-dbname=powerdns

Start dan Enable service PowerDNS

# systemctl start pdns
# systemctl enable pdns
Created symlink from /etc/systemd/system/multi-user.target.wants/pdns.service to /usr/lib/systemd/system/pdns.service.

[6] Install dependency packages sebelum melakukan installasi PowerAdmin

# yum install httpd php php-devel php-gd php-imap php-ldap php-mysql php-odbc php-pear php-xml php-xmlrpc php-mbstring php-mcrypt php-mhash gettext -y
# yum install php-pear-DB php-pear-MDB2-Driver-mysql -y

Start dan Enable Service httpd

# systemctl start httpd
# systemctl enable httpd
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.

[7] Download packet PowerAdmin
Masuk ke direktor, lalu lakukan download packet menggunakan wget

# pwd
/var/www/html

wget https://sourceforge.net/projects/poweradmin/files/poweradmin-2.1.7.tgz

Lakukan extract

# tar xvf poweradmin-2.1.7.tgz

Restart httpd service
# systemctl restart httpd

[8] Open WebBrowser dengan alamat IP Server PowerDNS http://YourIP/poweradmin-2.1.7/install/

Catatan untuk Hostname diisi dengan IPServerPowerDNS

OK, Selanjutnya mengatur akses terbatas ke admin dengan mengeksekusi kode yang diberikan oleh poweradmin di terminal.

# mysql -u root -p
Enter password: 
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 10
Server version: 5.5.56-MariaDB MariaDB Server

Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> GRANT SELECT, INSERT, UPDATE, DELETE ON powerdns.* TO 'poweradmin'@'IP_Server' IDENTIFIED BY 'PasswordUser';
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> quit
Bye

cd /var/www/html/poweradmin-2.1.7/inc
mv config-me.inc.php config.inc.php
vi config.inc.php

// Database settings
$db_host = 'YourIP_DBServer';
$db_port = '3306';
$db_user = 'YourUserDB';
$db_pass = 'YourPassword';
$db_name = 'powerdns';
$db_type = 'mysql';
$session_key = 'MasukanSessionKeyYangSudahDiGenearateDiWebBrowser';
$dns_hostmaster = 'YourDNSHostMaster';
$dns_ns1 = 'ns1.localhost.com';
$dns_ns2 = 'ns2.localhost.com';

Ok, Konfigurasi Poweradmin selesai

Jalankan perintah berikut untuk mensupport URL yang digunakan oleh provider DNS dynamic lainnya.

Enable mod_rewrite di Konfigurasi Apache.

# /var/www/html/poweradmin-2.1.7 
# cp install/htaccess.dist .htaccess

Remove “install” folder.

# rm -rf /var/www/html/poweradmin-2.1.7/install/

[9] Sekarang coba buka web browser URL http://YourIPServer/poweradmin-2.1.7/

[-] Menambahkan Master Zones

Ok sekarang check List Zones

[-] Untuk delete DNS Master Zone, Pilih List Zone dan klik icon trash

[10] Untuk reser Password Admin bisa klik ke “Change Password” karena pada saat pertama kali selesai Konfigurasi Admin password kosong login tidak menggunakan password.

OK, Silahkan mencoba..

Cheers – AnditoYugoWicaksono

Advertisements

Lynis ( Security Audit Tool )

[1] Install lynis

# yum --enablerepo=epel -y install lynis

[2] Penggunanan lynis ( Command )

# lynis

[ Lynis 2.5.5 ]

################################################################################
 Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
 welcome to redistribute it under the terms of the GNU General Public License.
 See the LICENSE file for details about using this software.

2007-2017, CISOfy - https://cisofy.com/lynis/
 Enterprise support available (compliance, plugins, interface and tools)
################################################################################


[+] Initializing program
------------------------------------


 Usage: lynis command [options]


 Command:

audit
 audit system : Perform local security scan
 audit system remote <host> : Remote security scan
 audit dockerfile <file> : Analyze Dockerfile

show
 show : Show all commands
 show version : Show Lynis version
 show help : Show help

update
 update info : Show update details


 Options:

--no-log : Don't create a log file
 --pentest : Non-privileged scan (useful for pentest)
 --profile <profile> : Scan the system with the given profile file
 --quick (-Q) : Quick mode, don't wait for user input

Layout options
 --no-colors : Don't use colors in output
 --quiet (-q) : No output
 --reverse-colors : Optimize color display for light backgrounds

Misc options
 --debug : Debug logging to screen
 --view-manpage (--man) : View man page
 --verbose : Show more details on screen
 --version (-V) : Display version number and quit

Enterprise options
 --plugin-dir "<path>" : Define path of available plugins
 --upload : Upload data to central node

More options available. Run '/usr/bin/lynis show options', or use the man page.

No command provided. Exiting..
# lynis audit system

[ Lynis 2.5.5 ]

################################################################################
 Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
 welcome to redistribute it under the terms of the GNU General Public License.
 See the LICENSE file for details about using this software.

2007-2017, CISOfy - https://cisofy.com/lynis/
 Enterprise support available (compliance, plugins, interface and tools)
################################################################################


================================================================================

Lynis security scan details:

Hardening index : 66 [############# ]
 Tests performed : 218
 Plugins enabled : 0

Components:
 - Firewall [V]
 - Malware scanner [X]

Lynis Modules:
 - Compliance Status [?]
 - Security Audit [V]
 - Vulnerability Scan [V]

Files:
 - Test and debug information : /var/log/lynis.log
 - Report data : /var/log/lynis-report.dat

================================================================================

Lynis 2.5.5

Auditing, system hardening, and compliance for UNIX-based systems
 (Linux, macOS, BSD, and others)

2007-2017, CISOfy - https://cisofy.com/lynis/
 Enterprise support available (compliance, plugins, interface and tools)

================================================================================

[TIP]: Enhance Lynis audits by adding your settings to custom.prf (see /etc/lynis/default.prf for all settings)

[3] Report hasil scanning disimpan di /var/log/lynis-report.dat. Cari file dengan kata kunci “warning” atau “suggestion”, maka akan menunjukkan pengaturan yang direkomendasi seperti di bawah ini.

# grep -E "^warning|^suggestion" /var/log/lynis-report.dat 
suggestion[]=AUTH-9286|Configure minimum password age in /etc/login.defs|-|-|
suggestion[]=AUTH-9286|Configure maximum password age in /etc/login.defs|-|-|
suggestion[]=AUTH-9328|Default umask in /etc/profile or /etc/profile.d/custom.sh could be more strict (e.g. 027)|-|-|
suggestion[]=FILE-6310|To decrease the impact of a full /tmp file system, place /tmp on a separated partition|-|-|
suggestion[]=FILE-6310|To decrease the impact of a full /var file system, place /var on a separated partition|-|-|
suggestion[]=STRG-1840|Disable drivers like USB storage when not used, to prevent unauthorized storage or data theft|-|-|
suggestion[]=STRG-1846|Disable drivers like firewire storage when not used, to prevent unauthorized storage or data theft|-|-|
suggestion[]=NAME-4028|Check DNS configuration for the dns domain name|-|-|
suggestion[]=NAME-4404|Add the IP name and FQDN to /etc/hosts for proper name resolving|-|-|
suggestion[]=PKGS-7384|Install package 'yum-utils' for better consistency checking of the package database|-|-|

Cheers – AnditoYugoWicaksono

Octopussy Log Management

[1] Install Octopussy ( requirements )

yum install -y httpd perl mod_perl mod_ssl nscd rsyslog sudo
yum install -y gcc make cpan epel-release mariadb-server
yum install -y rrdtool htmldoc

[2] Install perl module yang di butuhkan

Install menggunakan Yum

yum install -y perl-Cache-Cache perl-Crypt-PasswdMD5 perl-Date-Manip
yum install -y perl-DBD-MySQL perl-DBI
yum install -y perl-JSON perl-Linux-Inotify2 perl-List-MoreUtils perl-Locale-Maketext-Lexicon perl-Locale-Maketext-Simple perl-Mail-Sender
yum install -y perl-LDAP perl-Net-SCP perl-Net-Telnet perl-Net-XMPP perl-Proc-PID-File perl-Proc-ProcessTable
yum install -y perl-Readonly-XS perl-Regexp-Assemble perl-Sys-CPU perl-Unix-Syslog perl-Term-ProgressBar perl-URI perl-version perl-XML-Simple

cpan Apache::ASP App::Info DateTime::Format::Strptime LWP Net::FTP Time::Piece

Menggunakan CPAN

cpan Apache::ASP App::Info App::Info::HTTPD Cache::Cache Crypt::PasswdMD5
cpan SBECK/Date-Manip-5.56.tar.gz
cpan DateTime::Format::Strptime DBD::mysql DBI File::Slurp
cpan JSON Linux::Inotify2 List::MoreUtils Locale::Maketext::Lexicon Locale::Maketext::Simple 
cpan LWP Mail::Sender Net::FTP Net::LDAP Net::SCP Net::Telnet Net::XMPP
cpan Proc::PID::File Proc::ProcessTable Readonly Regexp::Assemble Sys::CPU Term::ProgressBar Time::Piece
cpan Unix::Syslog URI version XML::Simple

Setting CPAN

Would you like to configure as much as possible automatically? [yes] yes

Would you like me to automatically choose some CPAN mirror
sites for you? (This means connecting to the Internet) [yes] no

Would you like to pick from the CPAN mirror list? [yes] yes
Found a cached mirror list as of Thu Sep 7 21:10:03 2017

Shall I use the cached mirror list? [yes] yes

You should select more than one (just in case the first isn't available).

(1) Africa
(2) Asia
(3) Europe
(4) North America
(5) Oceania
(6) South America
Select your continent (or several nearby continents) [] 2
(1) Bangladesh
(2) China
(3) India
(4) Indonesia
(5) Iran
(6) Japan
(7) Kazakhstan
(8) Philippines
(9) Qatar
(10) Republic of Korea
(11) Singapore
(12) Taiwan
(13) Turkey
(14) United Arab Emirates
(15) Viet Nam
Select your country (or several nearby countries) [] 4
Select your country (or several nearby countries) [] 4
(1) http://cpan.pesat.net.id/
(2) http://kambing.ui.ac.id/cpan/
(3) http://kartolo.sby.datautama.net.id/CPAN/
(4) http://mirror.poliwangi.ac.id/CPAN/
Select as many URLs as you like (by number),
put them on one line, separated by blanks, hyphenated ranges allowed
 e.g. '1 4 5' or '7 1-4 8' [] 1
Now you can enter your own CPAN URLs by hand. A local CPAN mirror can be
listed using a 'file:' URL like 'file:///path/to/cpan/'

Enter another URL or ENTER to quit: [] 
New urllist
 http://cpan.pesat.net.id/

Autoconfiguration complete.

commit: wrote '/root/.cpan/CPAN/MyConfig.pm'

You can re-run configuration any time with 'o conf init' in the CPAN shell
Terminal does not support AddHistory.

cpan shell -- CPAN exploration and modules installation (v1.9800)
Enter 'h' for help.

cpan[1]>
cpan[4]> install Apache::ASP
Trying with
 /usr/bin/wget -O "/root/.cpan/sources/modules/03modlist.data.gz.tmp23966"
to get
 http://cpan.pesat.net.id/modules/03modlist.data.gz
--2017-09-15 07:24:41-- http://cpan.pesat.net.id/modules/03modlist.data.gz
Connecting to "IP_PROXY":"Port"... connected.
Proxy request sent, awaiting response... 200 OK
Length: 248 [application/x-gzip]
Saving to: ‘/root/.cpan/sources/modules/03modlist.data.gz.tmp23966’

100%[============================================================================================================>] 248 --.-K/s in 0s

2017-09-15 07:24:41 (28,5 MB/s) - ‘/root/.cpan/sources/modules/03modlist.data.gz.tmp23966’ saved [248/248]

Reading '/root/.cpan/sources/modules/03modlist.data.gz'
DONE
Writing /root/.cpan/Metadata
Apache::ASP is up to date (2.62).

 

set http_proxy=http://xxx.xxx.xxx.x:zzzz (xxx = proxy dan yyyy = port)
set http_proxy_user=username (login username)
set http_proxy_pass=password (login password)

Atau bisa menggunakan manual download package di

[3] Install Octopussy, download disini

tar zxvf octopussy-1.0.16.tar.gz
cd Octopussy-1.0.16/
cd LINUX/
chmod 775 *
./INSTALL.sh

[4] Setting IPTABLES di system

-A INPUT -m state --state NEW -m tcp -p tcp --dport 8888 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 514 -j ACCEPT
-A INPUT -m udp -p udp --dport 514 -j ACCEPT

systemctl restart iptables

[5] Disable syslog and enable rsyslog and octopussy at boot time:

chkconfig --del syslog
chkconfig --add octopussy
chkconfig --add rsyslog
chkconfig --level 2345 octopussy on
chkconfig --level 2345 rsyslog on

[6] Ubah Rsyslog default konfigurasi ( /etc/sysconfig/rsyslog):

SYSLOGD_OPTIONS="-c 3"

[7] Tambahkan  server name di /etc/rsyslog.d/octopussy.conf:

:hostname, !isequal, "your_server_name" ~

Restart rsyslog:

systemctl restart rsyslog

Disable SELinux

Edit /etc/sysconfig/selinux:

SELINUX=disabled

 

Cheers – Andito Yugo Wicaksono

 

 

Operative Framework

Operative Framework adalah open-source berbasis Python dan sangat powerful yang dapat digunakan untuk menemukan informasi domain yang terdaftar dengan alamat email yang sama, serta banyak fungsi investigasi lainnya. Tool reconnaissance ini memberi informasi tentang target dengan memeriksa relasi di domain yang mereka miliki.

[1] Installing the Operative Framework

git clone https://github.com/graniet/operative-framework.git
cd operative-framework
pip install -r requirements.txt
python operative.py

Jika paket pip belum terinstall bisa melakukan installasi python-pip

# sudo apt install python-pip
atau menggunakan git clone
git clone https://github.com/pypa/pip.git

[2] Jalankan operative.py

$ python operative.py
__ _ 
 ____ ____ ___ _________ _/ /_(_) _____ 
 / __ \/ __ \/ _ \/ ___/ __ `/ __/ / | / / _ \
/ /_/ / /_/ / __/ / / /_/ / /_/ /| |/ / __/
\____/ .___/\___/_/ \__,_/\__/_/ |___/\___/ 
 /_/ Version: 2.0 BETA | Twitter: @graniet75
 If you don't know how run it use :help

$ operative > modules 
 * viadeo_search Viadeo employee search module
 * email_to_domain Get domain with email
 * reverse_ipdomain Reverse ip domain check (Yougetsignal)
 * vhost_IPchecker Reverse IP domain check (BING)
 * https_gathering SSL/TLS information gathering (sslyze)
 * subdomain_search Search subdomain with google dork
 * getform_data Get all form parameters (BETA)
 * defaultPassword Search default password from manufactor
 * domain_search Search enterprise domain name
 * header_retrieval No module description found
 * file_common Read/Search common file
 * waf_gathering WAF information gathering : need wafw00f
 * cms_gathering Check if CMS is used (wordpress,joomla,magento)
 * get_websiteurl Extract url on website domain
 * metatag_look get meta name,content
 * search_db Forensics module for SQL database
 * website_archive Search archive of website domain (archive.org)
 * linkedin_search Linkedin employee search module
 * sample_module Module sample
 * whois_domain Whois information for domain
 * tools_suggester Check website & show possible tools for CMS exploitation
 * generate_email Generate email with employee list
$ operative >

example : how to use

$ operative > use whois_domain
Loading : core/modules/whois_domain.py
$ operative (core/modules/whois_domain) > show options
- website(is_required):No value
$ operative (core/modules/whois_domain) > set website=zotma.com 
$ operative (core/modules/whois_domain) > run

 

 

 

 

 

 

 

FoxyProxy

What is FoxyProxy ?

FoxyProxy sells reliable, fast, secure VPN and proxy servers in 68+ different countries with 5 ways to connect. Our free proxy and VPN management tools set industry standards as far back as 2006, with our award-winning Firefox addons used by millions.

[1] Untuk installasinya bisa langsung add-on melalui web browser mozilla firefox

[2] Setelah selesai terinstall lalu buka FoxyProxy, buat proxy baru sebagai contoh akan memakai localhost

– Select mode untuk mengaktifkan proxy

Cheers – Andito Yugo Wicaksono

 

 

 

 

 

Install Nessus di Ubuntu 16.04

[1] Download Packet Nessus di link ini

[2] Lakukan install pakcet Nessus-6.10.9-ubuntu1110_amd64.deb

sudo dpkg -i Nessus-6.10.9-ubuntu1110_amd64.deb 
[sudo] password for space: 
Selecting previously unselected package nessus.
(Reading database ... 299222 files and directories currently installed.)
Preparing to unpack Nessus-6.10.9-ubuntu1110_amd64.deb ...
Unpacking nessus (6.10.9) ...
Setting up nessus (6.10.9) ...
Unpacking Nessus Core Components...
nessusd (Nessus) 6.10.9 [build M20097] for Linux
Copyright (C) 1998 - 2016 Tenable Network Security, Inc

Processing the Nessus plugins...
[##################################################]

All plugins loaded (1sec)

- You can start Nessus by typing /etc/init.d/nessusd start
 - Then go to https://localhost:8834/ to configure your scanner

Processing triggers for systemd (229-4ubuntu17) ...
Processing triggers for ureadahead (0.100.0-19) ...
ureadahead will be reprofiled on next reboot

[3] Lakukan start service dan buka halaman web dengan url https://localhost:8834/

Lakukan registrasi nessus terlebih dahulu supaya mendapatkan Activation Code, setelah selesai Register lalu masukkan Code ke Activation Code.

[4] Setelah selesai lalu lakukan login dengan menggunakan username dan password

Cheers – Andito Yugo Wicaksono