뚜기의 S 톨이

구분 

 내용

 시간동기화 방식

 Time-based One-Time Password (TOTP)

 - 일정시간에 따라 지속적으로 암호값이 변함 (기본 30초)

 - 시간동기화 방식 알고리즘으로 HMAC-SHA1은 HOTP와 같은 방법으로 암호 생성

 - 비밀키와 현재 유닉스 시간을 결합하여 암호 생성 (HOTP(K, TC))

 이벤트 방식

 HMAC-based One-Time Password (HOTP)
 (Hash Message Authentication Code)

 - 이벤트가 발생 시 암호값 생성

 - 이벤트 기반 알고리즘으로 HMAC-SHA1를 이용하여 암호 생성

 - 비밀키와 카운터 값을 결합하여 암호 생성 (HOTP(K, C))

 # yum -y install git pam-devel autoconf automake libtool gcc 

 # git clone https://github.com/google/google-authenticator-libpam

 # cd google-authenticator-libpam/

 # ./bootstrap.sh

 # ./configure --libdir=/lib64  <-- 64비트일 경우 추가

 # make && make install

 # vi /etc/pam.d/sshd

 # vi /etc/ssh/sshd_config

 # google-authenticator 

Do you want authentication tokens to be time-based (y/n) y
Warning: pasting the following URL into your browser exposes the OTP secret to Google:
https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/root@localhost%3Fsecret%3D5VNTBITJHEH2GGSVOLTFZMDAKA%26issuer%3Dlocalhost
Failed to use libqrencode to show QR code visually for scanning.
Consider typing the OTP secret into your app manually.
Your new secret key is: 5VNTBITJHEH2GGSVOLTFZMDAKA
Your verification code is 024646
Your emergency scratch codes are:
  60700042
  28183432
  27147472
  84160543
  62329722

Do you want me to update your "/root/.google_authenticator" file? (y/n) y

Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y

By default, a new token is generated every 30 seconds by the mobile app.
In order to compensate for possible time-skew between the client and the server,
we allow an extra token before and after the current time. This allows for a
time skew of up to 30 seconds between authentication server and client. If you
experience problems with poor time synchronization, you can increase the window
from its default size of 3 permitted codes (one previous code, the current
code, the next code) to 17 permitted codes (the 8 previous codes, the current
code, and the 8 next codes). This will permit for a time skew of up to 4 minutes
between client and server.
Do you want to do so? (y/n) y

If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting? (y/n) y

function cmdlog
{
f_ip=`who am i | awk '{print $5}'`
cmd=`history | tail -1`
if [ "$cmd" != "$cmd_old" ]; then
  logger -p local1.notice "[1] From_IP=$f_ip, PWD=$PWD, Command=$cmd"
fi
  cmd_old=$cmd
}
trap cmdlog DEBUG

# logger hahaha

# tail -1 /var/log/message

Jul 26 16:37:13 Host root: hahaha

# logger -p local1.notice logging test

# tail -1 /var/log/message

Jul 26 17:00:46 Host root: logging test

  설치

  # yum -y install gcc gcc-c++

 # wget http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el5.rf.i386.rpm
 # rpm -Uvh rpmforge-release-0.5.2-2.el5.rf.i386.rpm
 # yum -y install rrdtool-devel

 # wget http://fping.org/dist/fping-3.4.tar.gz
 # tar zxvf fping-3.4.tar.gz
 # cd fping-3.4
 # ./configure
 # make;make install

 # yum -y  install pcre-devel
 # yum -y  install openssl-devel
 # yum -y  install openldap-devel
 # yum -y install httpd

 # useradd xymon
 # passwd xymon

 # wget http://iweb.dl.sourceforge.net/project/xymon/Xymon/4.3.10/xymon-4.3.10.tar.gz
 # tar zxvf xymon-4.3.10.tar.gz
 # cd xymon-4.3.10
 # ./configure.server (설정 시 하기 내용 참고)
 # make; make install

 # chmod go+rx /home/xymon

Configuration script for Xymon

This script asks a few questions and builds a Makefile to compile Xymon

Checking your make-utility
Checking pre-requisites for building Xymon

Checking for fping ...
Xymon has a built-in ping utility (xymonping)
However, it is not yet fully stable and therefore it
may be best to use the external fping utility instead.
I found fping in /usr/local/sbin/fping
Do you want to use it [Y/n] ?
y
Checking to see if '/usr/local/sbin/fping 127.0.0.1' works ...
127.0.0.1 is alive
OK, will use '/usr/local/sbin/fping' for ping tests
NOTE: If you are using an suid-root wrapper, make sure the 'xymond'
      user is also allowed to run fping without having to enter passwords.
      For 'sudo', add something like this to your 'sudoers' file:
      xymon ALL=(ALL) NOPASSWD: /usr/local/sbin/fping



Checking for PCRE ...
Compiling with PCRE library works OK
Linking with PCRE library works OK


Checking for RRDtool ...
Not RRDtool 1.0.x, checking for 1.2.x
Compiling with RRDtool works OK
Linking with RRDtool works OK


Checking for OpenSSL ...
Compiling with SSL library works OK
Linking with SSL library works OK
Checking if your SSL library has SSLv2 enabled
Will support SSLv2 when testing SSL-enabled network services

Xymon can use the OpenSSL library to test SSL-enabled services
like https-encrypted websites, POP3S, IMAPS, NNTPS and TELNETS.
If you have the OpenSSL library installed, I recommend that you enable this.

Do you want to be able to test SSL-enabled services (y) ?
y



Checking for LDAP ...
Compiling with LDAP works OK
LBER library not needed
Linking with LDAP works OK

Xymon can use your OpenLDAP LDAP client library to test LDAP servers.

Do you want to be able to test LDAP servers (y) ?
y

Checking for clock_gettime() requiring librt ...
clock_gettime() requires librt


Checking for Large File Support ...
Large File Support OK


Setting up for a Xymon server

What userid will be running Xymon [xymon] ? [enter]

Found passwd entry for user xymon:x:500:500::/home/xymon:/bin/bash

Where do you want the Xymon installation [/home/xymon] ? [enter]

OK, will configure to use /home/xymon as the Xymon toplevel directory

What URL will you use for the Xymon webpages [/xymon] ? [enter]

Where to put the Xymon CGI scripts [/home/xymon/cgi-bin] ? [enter]
(Note: This is the filesystem directory - we will get to the URL shortly)

What is the URL for the Xymon CGI directory [/xymon-cgi] ? [enter]
(Note: This is the URL - NOT the filesystem directory)

********************** SECURITY NOTICE ****************************
If your Xymon server is accessible by outsiders, then you should
restrict access to the CGI scripts that handle enable/disable of
hosts, and acknowledging of alerts. The easiest way to do this is
to put these in a separate CGI directory and require a password to
access them.
Even if your Xymon server is on a secured, internal network, you
may want to have some operations (like disabling a host) be password-
protected - that lets you see who disabled or acknowledged an alert.

Where to put the Xymon Administration CGI scripts [/home/xymon/cgi-secure] ? [enter]
(Note: This is the filesystem directory - we will get to the URL shortly)



What is the URL for the Xymon Administration CGI directory [/xymon-seccgi] ? [enter]
(Note: This is the URL - NOT the filesystem directory)



** Note that you may need to modify your webserver configuration.
** After installing, see /home/xymon/server/etc/xymon-apache.conf for an example configuration.


To generate Xymon availability reports, your webserver
must have write-access to a directory below the Xymon
top-level directory. I can set this up if you tell me
what group-ID your webserver runs with. This is typically
'nobody' or 'apache' or 'www-data'

What group-ID does your webserver use [nobody] ?
apache


Where to put the Xymon logfiles [/var/log/xymon] ? [enter]


What is the name of this host [localhost.localdomain] ? [enter]


What is the IP-address of this host [127.0.0.1] ? [enter]

** NOTE: Using 127.0.0.1 (loopback), but it is probably not what you want **

Where should I install the Xymon man-pages (/usr/local/man) ? [enter]





Using Linux Makefile settings



Created Makefile with the necessary information to build Xymon
Some defaults are used, so do look at the Makefile before continuing.

Configuration complete - now run make (GNU make) to build the tools

 # vi /etc/httpd/conf/httpd.conf
 DocumentRoot /home/xymon/server/www 로 변경

 # ln -s /home/xymon/server/etc/xymon-apache.conf xymon-apache.conf

 # htpasswd -c /home/xymon/server/etc/xymonpasswd admin

 # /etc/init.d/httpd start

 # cd /etc/init.d
 # wget http://iam8up.com/xymon-initd/xymon
 # chmod 755 xymon
 # ln -s /etc/init.d/xymon /etc/rc3.d/S70xymon
 # /etc/init.d/xymon start

 # vi /home/xymon/server/etc/xymonserver.cfg -> 상단의 이름 변경

 # vi /home/xymon/server/etc/hosts.cfg -> 클라이언트 등록

 :: Windows

BBWin_0.13.msi

 :: Linux (xymon 설치 파일에 클라이언트가 있습니다.)

 # wget http://iweb.dl.sourceforge.net/project/xymon/Xymon/4.3.10/xymon-4.3.10.tar.gz

- 메모장
- Netcat (NC)

- SMTP 서버

@echo off

title C:\Windows\system32\cmd.exe

※ title을 넣은 이유는 cmd창이 실행되었을 경우를 대비하여 눈속임을 하기 위함입니다.

rem Create mail contents 
echo helo naver.com>> "%userprofile%\alert.txt"
echo mail from:^<Mail@Address^>>> "%userprofile%\alert.txt"
echo rcpt to:^<Mail@Address^>>> "%userprofile%\alert.txt"
echo data>> "%userprofile%\alert.txt"
echo Subject:【-ALERT-】 Server LOGIN detected - [ %COMPUTERNAME% ]>> "%userprofile%\alert.txt"
echo Login by [ %USERNAME% ] on [ %Date% %TIME% ] to Server [ %COMPUTERNAME% ]>> "%userprofile%\alert.txt"
echo .>> "%userprofile%\alert.txt"

※ 위 부분이 메일 내용을 만드는 부분입니다. 일반 SMTP 명령어를 사용하여 메일을 보내도록 하기 위해

내용을 텍스트로 저장합니다. 여기서 중요한 점은 끝에 공백이 들어가면 오류가 나기 때문에 조심하셔야 합니다.

rem Connect smtp server and execute the script file
pushd \\ShareServer\share\nc
nc -w 2 -i 1 SMTP-Server 25 < "%userprofile%\alert.txt" > "%userprofile%\results.txt"
popd

※ 메일 발송 정보를 가지고 NC를 이용하여 SMTP 서버에 접속하여 메일을 보내는 부분입니다.

내용 중에 PUSHD/POPD 라는 명령어가 있는데 cmd를 통한 네트워크 드라이브를 잡아주는 역할을 합니다.

윈도우 cmd에서 UNC경로 사용하기 PUSHD/POPD

rem Delete create files
del /Q "%userprofile%\alert.txt"
del /Q "%userprofile%\results.txt"

※ 흔적을 없애기 위해 생성된 파일을 삭제합니다.