Export and Import All Databases

คำสั่งสำหรับส่งออกฐานข้อมูลทั้งหมด
mysqldump -u ชื่อผู้ใช้ -pรหัสผ่าน --all-databases > ชื่อ Path ที่เก็บ/กำหนดชื่อฐานข้อมูลที่ต้องการเก็บ.sql

คำสั่งสำหรับนำเข้าฐานข้อมูลทั้งหมด
mysql -u root -p < ชื่อฐานข้อมูล.sql

บันทึกการติดตั้ง FreeBSD 11

ต้องการติดตั้ง Moodle เวอร์ชั่นใหม่ เพื่อใช้เป็นแหล่งเรียนรู้สำหรับนักศึกษา ปัญหาที่ตามมาก็คือต้องปรับปรุง Server ให้ OS ทันสมัยขึ้น ลงมือเลยแล้วกัน รออะไรละ

เริ่มต้น

1. ทำการ Backup ข้อมูลทั้งหมดเพื่อที่จะย้ายข้อมูลระบบทั้งหมดไปไว้ที่ Server ตัวที่ 1 (เรียบร้อย)

2. ดาวน์โหลด FreeBSD 11(ล่าสุด ณ ขณะนี้)

3. ติดตั้งเลย 

    - ครั้งที่ 1 ไม่ผ่าน(อ่านๆๆๆๆๆๆๆๆๆๆ)

    - ครั้งที่ 2 ไม่ผ่าน(อ่านๆๆๆๆๆๆๆๆๆๆ)

    - ครั้งที่ 3 ไม่ผ่าน(เป็นอะไรวะ บูตไม่ได้)

    - ครั้งที่ 4 ไม่ผ่าน(ปวดหัวสุดๆ)

    - ครั้งที่ 5 ไม่ผ่านอีก(ล้มเลิกความตั้งใจ กลับไปใช้ 8.4 ดีกว่า)

    - ครั้งที่ 6 (8.4 ล้าสมัย update ports ไม่ได้  (-_-) )

    - ครั้งที่ 7 กลับมาใช้ FreeBSD 11 เหมือนเดิม ค้นหาข้อมูล

                   - ลองเลือก partition เป็น BSD ผ่าน GPT ไม่ผ่าน รู้ไต๋แล้ว

                   - การติดตั้งเป็นไปด้วยดี แต่..php ไม่ทำงาน อะไรวะ ไม่รู้แก้ไขงัย ติดตั้งใหม่ก็ได้

    - ครั้งที่ 8-10 ติดตั้งใหม่เหมือนเดิมๆๆๆๆๆๆๆๆๆๆ ก็ไม่ได้ เวลาน้อย ทำไม่ได้ต่อเนื่อง ลืม...ทำต่อไป

      

Reset Mysql Password

ติดตั้ง Mysql แล้วพบว่า เขาตั้งรหัสผ่านเข้า root เก็บไว้ในไฟล์ /root/.mysql_secret อ้าว แล้วจะเปลี่ยนรหัสยังงัย ตาลายหน้า Google พักใหญ่ สรุปได้ว่าต้องทำอย่างนี้ เอ้า ลงมือสิ รออะไร

หยุด service ของ mysql ด้วยคำสั่ง :

/usr/local/etc/rc.d/mysql-server stop

จากนั้นพิมพ์

mysqld_safe --skip-grant-tables &

แล้วพิมพ์

mysql -u root -p         กด Enter

พิมพฺ์เลย เปลี่ยนรหัสใหม่ซะ

UPDATE mysql.user SET authentication_string = PASSWORD('ใส่รหัสใหม่ตรงนี้')  WHERE User = 'root';

ตบท้ายด้วย

FLUSH PRIVILEGES;

เสร็จเรียบร้อย
 สั่ง start mysql ใหม่
/usr/local/etc/rc.d/mysql-server start

เสร็จเรียบร้อย โอเคนะครับ นะครับ

บันทึกติดตั้ง FreeBSD 11 + FAMP

1. ติดตั้ง FreeBSD 11 จากแผ่น เลือก Partition เป็น BSD
2. หลังจากติดตั้งเสร็จ ทำการ update
    freebsd-update fetch && freebsd-update install
3. รอจนเสร็จ ทำการ update ports
    portsnap fetch
    portsnap extract
4. ติดตั้ง ฐานข้อมูล mysql
5. ติดตั้ง Apache
6. ติดตั้ง phpxx
5  ติดตั้ง mod_phpxx
7. ติดตั้ง phpMyAdmin

    ไปที่ห้อง      /usr/local/www/apache24/data.
    ดาวน์โหลด
    fetch  https://files.phpmyadmin.net/phpMyAdmin/4.7.0/phpMyAdmin-4.7.0-all-languages.tar.gz

     tar -zxvf phpMyAdmin-4.1.6-english.tar.gz
     mv phpMyAdmin-4.1.6-english.tar.gz phpmyadmin
     cd phpmyadmin
     cp config.sample.inc.php config.inc.php
     Now edit your php.ini and add:


     vi /usr/local/etc/php.ini

add:

extension=session.so
extension=json.so
extension=mysqli.so
extension=mbstring.so

Restart apache:

 /usr/local/etc/rc.d/apache24 restart
  check phpMyAdmin is working or not using the following URL.

 http://ip/phpmyadmin

Guide On How To Install Denyhosts On FreeBSD

A step by step guide on how to install Denyhosts on FreeBSD

Installing denyhosts on FreeBSD is very simple and straight forward. Denyhosts can help you thwart SSH server attacks also known as dictionary based attacks and brute force attacks. It’s also capable of blocking other services as well.

Now before we start a word of advice. Don’t let yourself be lured into a false state of security here by thinking denyhosts is a good way to secure your server. It’s not. It’s a pretty neat program that can help you that’s all. It’s not intended as a replacement for a real Firewall. If you really want to secure your server place it behind a Firewall. That said let’s start installing denyhosts.

Right as mentioned this is quite simple. We will install denyhosts from ports.

When the option screen pops up [Screenshot] accept the default settings by hitting "Tab" and then "OK"

Depending on what you’ve already installed you may not receive all questions. Don’t worry something probably installed that component for you. Below are the default questions you normally get and the action you need to take.

gettext		[Screenshot]		Accept the default settings. Just hit "Tab" and press "OK"
libiconv		[Screenshot]		Accept the default settings. Just hit "Tab" and press "OK"

As Root

cd /usr/ports/security/denyhosts
make install clean

Next add the following 2 lines to your rc.conf file.

As Root

syslogd_flags="-c"
denyhosts_enable="YES"

Denyhosts normally logs to a file called "hosts.deniedssh" residing in /etc. This file is not being created when installing denyhosts. So we will need to do that ourselves.

As Root

touch /etc/hosts.deniedssh

Normal behavior is to block ssh and other login attempts monitored by denyhosts from the "hosts.allow" located in /etc.

As Root

vi /etc/hosts.allow

Find the following line at the top.

ALL : ALL : allow

And add the following above that line.

Add the following as root

sshd : /etc/hosts.deniedssh : deny

You hosts.allow should now look something like this.

Result

sshd : /etc/hosts.deniedssh : deny

ALL : ALL : allow

Right almost there.

All that’s left is to configure threshold values and what services should be blocked. The configuration file for denyhosts is called "denyhosts.conf" and is normally located in /usr/local/etc/. Now there’s a lot of things you can adjust and I recommend reading the FAQ on the denyhosts official homesite. Never the less here’s a couple adjustments just to get you started.

As root

vi /usr/local/etc/denyhosts.conf

Let’s edit what services we want to block when repeated login attempts occur.

Find the following lines.

###################################################
#
# BLOCK_SERVICE: the service name that should be blocked in HOSTS_DENY
#
# man 5 hosts_access for details
#
# eg. sshd: 127.0.0.1 # will block sshd logins from 127.0.0.1
#
# To block all services for the offending host:
# BLOCK_SERVICE = ALL
# To block only sshd:
# BLOCK_SERVICE = sshd
# To only record the offending host and nothing else if using
# an auxilary file to list the hosts. Refer to:
# http://denyhosts.sourceforge.net/faq.html#aux
#BLOCK_SERVICE =
#
###################################################

Now you have a few options here. Remember to remove the "#" In front of the Service you want to use.

BLOCK_SERVICE = All "Not Recomended"
BLOCK_SERVICE = sshd "Recommended"

It is also possible to block more than one service using a line like below in this example ssh and ftp is being blocked. In theory it’s possible to block everything that you can parse through a TCP Wrapper.

To Block SSH And FTP use the following line.

BLOCK_SERVICE = sshd,ftpd

Next we want to set the threshold on when to apply the above action.

You need to modify the following lines to suit your needs or just stick with the default settings.

DENY_THRESHOLD_INVALID
DENY_THRESHOLD_VALID
DENY_THRESHOLD_ROOT
DENY_THRESHOLD_RESTRICTED

In order not to log yourself out which is a real pain in the backside especially when your server is located like 100 miles away. You should add at least 1 IP address which you use and that should never be locked out.

As root

touch /usr/local/share/denyhosts/data/allowed-hosts

Now just add the IP address or IP addresses that will never be blocked to the allowed-hosts file you just created. One IP Address pr. line.

Once your are done all that’s left is to start or restart Denyhosts.

Starting Denyhosts

sh /usr/local/etc/rc.d/denyhosts start

Restarting Denyhosts

sh /usr/local/etc/rc.d/denyhosts restart

Now all of the above is just to get you started with a working Denyhosts installation. There’s a lot more you can configure but I suggest visiting the official Denyhosts site for a more information on how to configure Denyhosts.

Official Denyhosts Site

ขอบคุณแหล่งข้อมูลที่มาครับ
http://www.xfiles.dk/guide-on-how-to-install-denyhosts-on-freebsd/

ถอดรหัส Harddisk เมื่อลืมรหัสผ่าน

วันวันเจอแต่เคสซ่อมปัญหาคอมพิวเตอร์แปลกๆ กว่าจะได้เล่นเอาซะกินพาราเซตามอลไปหลายเม็ด วันนี้ก็อีกหนึ่งปัญหาใหญ่ที่ต้องหาทางแก้ไข Bios และ HDD ขนาด 640 GB ติดรหัสผ่าน ถอดออกจาก Notebook Acer 4560G จึงเริ่มปฏิบัติการ

     1. ถอดถ่าน Bios ของ Notebook ออกเพื่อเคลียร์  CMOS ไม่ผ่าน วันที่ใน CMOS เคลียร์ แต่ไม่เคลียร์รหัส(ต้องเหนื่อยยาวแล้ว)

     2. สืบค้นข้อมูลอยู่พักใหญ่ ได้ไฟล์ clnpwd.exe (ขอบคุณข้อมูลจาก http://akidadammdyusup.blogspot.com/2013/12/laptop-acer-bios-password-cleaner.html) ทำการเคลียร์ไบออส แล้วผ่าน เข้าสู่การตั้งค่า Bios ได้ ผ่านปัญหาที่ 1 ได้แล้ว....เฮ้อๆๆ

     3. เข้าเมนูเพื่อแก้ไขรหัส HDD เพราะทุกครั้งเขาจะถามรหัส HDD ก่อนเริ่มระบบปฏิบัติการ พอจะเปลี่ยน เงิบเลยครับ เขาถามรหัสเดิม (ใครจะไปรู้ล่ะ) ไม่งั้นเคลียร์รหัสไม่ได้ งานนี้เมื่อยอีกแล้ว

     4. หาข้อมูลอยู่หลายวัน ทั้งไทยทั้งเทศ ลองแล้วลองเล่า วิธีไหนที่เคยถูกแนะนำก็ไม่ได้ ถอด HDD เอาไปต่อเครื่องอื่น ก็ไม่อ่าน ถามรหัสอย่างเดียว(ปวดตับมาก) ท้อมาก คงไม่สามารถถอดได้หรอก (ไอ้เรามันครูสอนภาษาอังกฤษไม่ใช่คอมพิวเตอร์ด้วย) แต่ไม่ละความพยายาม หาต่อไปจนกระทั่ง.......ผ่างๆๆๆๆๆ http://pcmediks.blogspot.com/2010/11/how-to-remove-hdd-user-password-in-acer.html ได้ข้อมูลน่าสนใจ ต้องลอง ตาม URL เลยนะครับ ดาวน์โหลดไฟล์มา HDD_PW.exe  แล้วดำเนินการตามขั้นตอน เหลือเชื่อ รหัสผ่านเคลียร์ เข้าถึงข้อมูลใน HDD ได้ สามารถใช้งานได้ตามปกติ

       ทุกอย่างเป็นไปได้ ผมว่าในความยาก ก็ยังสามารถทำได้ ถ้าเราเพียร หวังว่าคงเป็นประโยชน์สำหรับผู้ที่มีปัญหาเช่นเดียวกันกับผมนะครับ

update ports

portsnap fetch extract update

เมื่อ php มัน save file ตลอดเวลาที่เปิด

ตอนติดตั้ง php5 ลืมเลือกให้ทำงานกับ Apache แก้ไขโดยติดตั้ง mod_php5 เพิ่ม

cd /usr/ports/www/mod_php5 
make install clean 

อ่านเพิ่มเติม

สคริปต์ตัดคำ มันยอดเยี่ยมมาก

สคริปต์ตัดคำ มันยอดเยี่ยมมาก

if(strlen($rs[gtopic])>50)
{
// จำกัดความยาวของกระทู้ที่ 35 ตัวอักษร
$rs[gtopic] = iconv_substr($rs[gtopic],0,48, "UTF-8")."..";
    }
แสดงผล UTF-8 ได้เป๊ะ

ขอบคุณเจ้าของความรู้
http://www.code-father.com/%E0%B9%81%E0%B8%81%E0%B9%89%E0%B8%9B%E0%B8%B1%E0%B8%8D%E0%B8%AB%E0%B8%B2%E0%B8%81%E0%B8%B2%E0%B8%A3%E0%B9%83%E0%B8%8A%E0%B9%89%E0%B8%87%E0%B8%B2%E0%B8%99%E0%B8%9F%E0%B8%B1%E0%B8%87%E0%B8%81%E0%B9%8C%E0%B8%8A%E0%B8%B1%E0%B9%88%E0%B8%99-substr-%E0%B9%83%E0%B8%99-php-%E0%B8%95%E0%B8%B1%E0%B8%94%E0%B8%82%E0%B9%89%E0%B8%AD%E0%B8%84%E0%B8%A7%E0%B8%B2%E0%B8%A1%E0%B8%A0%E0%B8%B2%E0%B8%A9%E0%B8%B2%E0%B9%84%E0%B8%97%E0%B8%A2%E0%B9%81%E0%B8%A5%E0%B9%89%E0%B8%A7%E0%B8%81%E0%B8%A5%E0%B8%B2%E0%B8%A2%E0%B9%80%E0%B8%9B%E0%B9%87%E0%B8%99%E0%B8%A0%E0%B8%B2%E0%B8%A9%E0%B8%B2%E0%B8%95%E0%B9%88%E0%B8%B2%E0%B8%87%E0%B8%94%E0%B8%B2%E0%B8%A7_00014.html

เมื่อวานมีเวลามาลองติดตั้ง Freebsd อีกครั้ง จึงลอง update ports โดยใช้ cvsup เป็นเรื่องเลย เพราะมีข้อความที่ไม่เคยเจอมาก่อนปรากฎขึ้นมาในขณะที่ติดตั้งโปรแกรมใหม่ อ่านแล้วได้ใจความว่ามีการเปลี่ยนแปลงจาก cvsup มาเป็น svn(subversion) แล้ว ทำไงดี มันคืออะไร เลยหาข้อมูลได้ความว่าอย่างนี้

Updating ports through SVN (subversion) instead of csup

 

Changing over to SVN for updating your ports:
1. You’ll want to get SVN installed as root….

cd /usr/ports/devel/subversion && make install clean && rehash

(you can run with the defaults in the config screen)
2. Now I find that deleting the old ports tree that I built over time using csup cleans up any garbage that can be in there (old distfiles you forgot to clean, INDEX-*, and more). Then I do the following….

rm -rf /usr/ports/ && mkdir /usr/ports && rehash

Keep in mind with root permissions already with you, that the ports directory will automatically be built with the correct permissions. I through in a rehash because the system hated me twice, on two different servers, for killing the /usr/ports directory and recreating it… the rehash wakes up the system to the change.
3. From here, and this is where I found the instructions distracting… If you are reading this, you probably aren’t a developer, in fact, you just want a fresh copy of the ports tree so you can run portupgrade or whatever method you like to use. The directions that I found out there require logins and more, but that’s because “you are a developer” from the perspective of the authors…. Our lives our easier than those instructions by using….

svn co svn://svn.freebsd.org/ports/head /usr/ports

The co is just “copy” and from there, I would do a portupgrade -ar , which will rebuild that INDEX-* file in /usr/ports and correctly continue from where it should as if you did a csup.
4. So how do you update for new ports???? Simple…

svn update

that’s it…

Now, what about updating the /usr/src… I normally don’t do that, I leave that to freebsd-update fetch and freebsd-update install , but if you HAD To rebuild it, it would be:

rm -rf /usr/src/ && mkdir /usr/ports

svn co svn://svn.freebsd.org/base/release/8.2.0 /usr/src (or whatever release you wanted)

freebsd-update fetch

freebsd-update install

Though there isn’t a huge reason for us end users to change, IMO, it is way easier for the developers to make changes and slip in updates, plus, on our end we do enjoy a faster process than csup does for updates.

Hardening FreeBSD

General Information

After a fresh install, it is important to harden the security on a server before it hits your network for use. Not only making configuration changes aid in the security of your box, but there are some practical rules to abide by. These are some hardening tips to make your FreeBSD box more secure and will apply to both the 5.x and 4.x branches, but I will assume you are running 5.x. If a 4.x change is different, I will note it.

Note: Please do not apply these changes carelessly on a production server. Make sure you test, test, test on a separate box to note the effects of the changes.

Requirements

Clean installation of FreeBSD

Local root access on the box or be able to su to root.

A SSH client that supports ANSI colors such as puTTy or SecureCRT (if you aren't on the box).

Your favorite text editor (I prefer nano).

Hardening

Filesystem Structure

On a default install, you will find two places for temporary files -- /tmp and /var/tmp. Different packages and daemons use the different directories and there really isn't any need to use two different partitions for temporary files. Here we will replace /var/tmp with a link to /tmp.

#

#

# mv /var/tmp/* /tmp/

rm -rf /var/tmp

ln -s /tmp /var/tmp



Disable Local root Access



The first rule to securing your box is to never treat the root account as a regular user. Never conduct mundane business while you are logged in as root. As the superuser, there are no restrictions as to what root can do, so always log in with a normal user and su to root only when needed.



With that in mind, it may be tempting to log on locally as root so let's prevent root from directly logging on to your system console. Open /etc/ttys with your editor and change every occurence of "secure" to "insecure" as this will prevent root from logging in locally. *Note: changing the console entry will result in being prompted for the root password when booting into single-user mode; thus, making the recovery of the root password more difficult.

# nano -w /etc/ttys



***output omitted***

console none unknown off insecure

#

ttyv0 "/usr/libexec/getty Pc" cons25 on insecure

# Virtual terminals

ttyv1 "/usr/libexec/getty Pc" cons25 on insecure

ttyv2 "/usr/libexec/getty Pc" cons25 on insecure

ttyv3 "/usr/libexec/getty Pc" cons25 on insecure

ttyv4 "/usr/libexec/getty Pc" cons25 on insecure

ttyv5 "/usr/libexec/getty Pc" cons25 on insecure

ttyv6 "/usr/libexec/getty Pc" cons25 on insecure

ttyv7 "/usr/libexec/getty Pc" cons25 on insecure

ttyv8 "/usr/X11R6/bin/xdm -nodaemon" xterm off insecure

# Serial terminals

# The 'dialup' keyword identifies dialin lines to login, fingerd etc.

ttyd0 "/usr/libexec/getty std.9600" dialup off insecure

ttyd1 "/usr/libexec/getty std.9600" dialup off insecure

ttyd2 "/usr/libexec/getty std.9600" dialup off insecure

ttyd3 "/usr/libexec/getty std.9600" dialup off insecure

# Dumb console

dcons "/usr/libexec/getty std.9600" vt100 off insecure

***output omitted***

Save and exit and your changes will take effect immediately.



SSH Logins



By default, FreeBSD prevents root from logging in via ssh, but it gives anyone else with a valid user account access. If you are not running a shell server, it is a good idea to restrict ssh access to only members of the wheel group -- or you can create a separate group if you want some people to log in but not be able to su to root, say a group named "sshlogins." Let's add the following to the end of the sshd configuration file:

#

#

#

#

#

#

# cat << EOF >> /etc/ssh/sshd_config

PermitRootLogin=no

AllowGroups wheel sshlogins

Protocol 2

X11Forwarding=no

VersionAddendum

EOF

We also want to ensure only SSHv2 connections are made as SSHv1 does not offer all the security of v2. Servers don't need to be running X11 so we might as well turn off forwarding for X11 to make sure there aren't any attempts. The final entry we made was to disable the OS display.



An optional security measure to take is add a banner for users to see before they log on. If you like the idea, follow these steps:

#

#

#

#

#

#

#

#

#

#

#

#

#

#

#

# echo "Banner /etc/welcomemsg" >> /etc/ssh/sshd_config

cat << EOF > /etc/welcomemsg

!!WARNING!!!

READ THIS BEFORE ATTEMPTING TO LOGON



This System is for the use of authorized users only. Individuals

using this computer without authority, or in excess of their authority,

are subject to having all of their activities on this system monitored

and recorded by system personnel. In the course of monitoring individuals

improperly using this system, or in the course of system maintenance,

the activities of authorized users may also be monitored. Anyone using

this system expressly consents to such monitoring and is advised that if

such monitoring reveals possible criminal activity, system personnel may

provide the evidence of such monitoring to law enforcement officials.



EOF



Password Rules



By default, FreeBSD uses md5 for password hashing and encryption. It's not bad, but blowfish is much better suited for passwords and we need to update some files to reflect blowfish. *Note: Passwords will not be converted to blowfish until they have been changed.

# echo "crypt_default=blf" >> /etc/auth.conf

You need to manually edit /etc/login.conf and change the password format in the default class to blf. We should also modify the default password policy to put a minimum password length requirement and mix upper and lower case. Let's also cause passwords to expire after 90 days and to automatically log users out if they are idle for 30 minutes. It's also a good idea to set the default umask to prevent global access. The umask is the inverse to the chmod. So in this case when new files and directories are created, they will get the permissions of 0750.

# nano -w /etc/login.conf



***output omitted***

default:\

:passwd_format=blf:\

:copyright=/etc/COPYRIGHT:\

:welcome=/etc/motd:\

:setenv=MAIL=/var/mail/$,BLOCKSIZE=K,FTP_PASSIVE_MODE=YES:\

:path=/sbin /bin /usr/sbin /usr/bin /usr/games /usr/local/sbin /usr/local/bin /usr/X11R6/bin ~/bin:\

:nologin=/var/run/nologin:\

:cputime=unlimited:\

:datasize=unlimited:\

:stacksize=unlimited:\

:memorylocked=unlimited:\

:memoryuse=unlimited:\

:filesize=unlimited:\

:coredumpsize=unlimited:\

:openfiles=unlimited:\

:maxproc=unlimited:\

:sbsize=unlimited:\

:vmemoryuse=unlimited:\

:priority=0:\

:ignoretime@:\

:minpasswordlen=8:\

:mixpasswordcase=true:\

:passwordtime=90d:\

:idletime=30:\

:umask=027:

***output omitted***

Update the login database with:

# cap_mkdb /etc/login.conf

After you change the user's password, you will notice the hashing for the password in /etc/master.passwd begins with $2a. This means blowfish is being used.



Restrict User Access



Scheduling jobs is a powerful feature in *nix, but at the same time, it can pose a security concern for your system if you allow users to schedule jobs -- especially if they are set up incorrectly. The potential harm could be looping a process endlessly, running malicious code (though this wouldn't pose too big of a problem if it's not run as root), or incorrect schedules. It is recommended to restrict cron and at to only root.

#

#

#

#

#

#

#

# echo "root" > /var/cron/allow

echo "root" > /var/at/at.allow

chmod o= /etc/crontab

chmod o= /usr/bin/crontab

chmod o= /usr/bin/at

chmod o= /usr/bin/atq

chmod o= /usr/bin/atrm

chmod o= /usr/bin/batch

The next thing we need to restrict is read and execution of certain files. Regular users should not have access to the following configuration files:

#

#

#

#

#

#

#

#

#

#

#

#

#

#

#

# chmod o= /etc/fstab

chmod o= /etc/ftpusers

chmod o= /etc/group

chmod o= /etc/hosts

chmod o= /etc/hosts.allow

chmod o= /etc/hosts.equiv

chmod o= /etc/hosts.lpd

chmod o= /etc/inetd.conf

chmod o= /etc/login.access

chmod o= /etc/login.conf

chmod o= /etc/newsyslog.conf

chmod o= /etc/rc.conf

chmod o= /etc/ssh/sshd_config

chmod o= /etc/sysctl.conf

chmod o= /etc/syslog.conf

chmod o= /etc/ttys

Attackers tend to clear out all log files when they are finished with your box. If they don't have access to the logs and cannot edit them or delete them, then you can go in and see what was done. First, let's disable user access to the log file directory and then we will set the permissions so the log files cannot be deleted.



Note: Applying these changes to the log files will also mean logs can no longer be rotated.



#

#

# chmod o= /var/log

chflags sappnd /var/log

chflags sappnd /var/log/*

You may want to restrict users from trying to execute certain programs like the following:

#

#

#

#

#

#

# chmod o= /usr/bin/users

chmod o= /usr/bin/w

chmod o= /usr/bin/who

chmod o= /usr/bin/lastcomm

chmod o= /usr/sbin/jls

chmod o= /usr/bin/last

chmod o= /usr/sbin/lastlogin

There are a few services that should be disabled permanently:

#

# chmod ugo= /usr/bin/rlogin

chmod ugo= /usr/bin/rsh

And of course, any third-party utilities you install and don't want general users to access should be chmoded as well.

#

# chmod o= /usr/local/bin/nmap

chmod o= /usr/local/bin/nessus



System Configuration for Daemon Startup



Now it is time to enable or disable certain services by editing /etc/rc.conf. Here we will disable sendmail as it is an insecure MTA. If you want to run a mail server, I recommend using qmail.

# echo 'sendmail_enable="NONE"' >> /etc/rc.conf

The default kernel level is -1, meaning not much gets protected. You probably only need the secure level at 2, but 3 is the most secure. If you want more information on the secure levels, read the man pages for init(8). Note: The securelevel can only increase once the kernel is loaded.

#

# echo 'kern_securelevel_enable="YES"' >> /etc/rc.conf

echo 'kern_securelevel="3"' >> /etc/rc.conf

If you aren't running NFS, disable portmap:

# echo 'portmap_enable="NO"' >> /etc/rc.conf

inetd, or the network daemon dispatcher, is insecure so we want to make sure it is disabled.

# echo 'inetd_enable="NO"' >> /etc/rc.conf

It's a good idea to clear your /tmp directory at startup to make sure there isn't anything malicious hanging around in your temp files.

# echo 'clear_tmp_enable="YES"' >> /etc/rc.conf

If you are not logging to a remote machine, it is a good idea to make sure syslogd does not bind to a network socket.

# echo 'syslogd_flags="-ss"' >> /etc/rc.conf

ICMP Redirect messages can be used by attackers to lead you to their router or some other router, which would be bad. Let's ignore those packets and log them.

#

# echo 'icmp_drop_redirect="YES"' >> /etc/rc.conf

echo 'icmp_log_redirect="YES"' >> /etc/rc.conf

The following option is a good choice as it will log all attempts to closed ports. This is good to know if people are trying to access your box through a specific port.

# echo 'log_in_vain="YES"' >> /etc/rc.conf



Set Kernel States



There are some kernel states we need to change and we'll add them to /etc/sysctl.conf to make them permanent. The first one is to prevent users from seeing information about processes that are being run under another UID.

# echo "security.bsd.see_other_uids=0" >> /etc/sysctl.conf



Note: 4.x users use the following instead:



# echo "kern.ps_showallprocs=0" >> /etc/sysctl.conf

The second change to make is to enable the concept of blackholing. This is so RST packets don't get sent back in response to closed ports. This helps to block port scans.

#

# echo "net.inet.tcp.blackhole=2" >> /etc/sysctl.conf

echo "net.inet.udp.blackhole=1" >> /etc/sysctl.conf

We want to generate a random ID for the IP packets as opposed to incrementing them by one. This will prevent remote observers from determining the rate packets are being generated by watching the counter.



Note: This setting is only for 5.3 and beyond. If you are running any older version of FreeBSD, you will need to compile your kernel with this option.



# echo "net.inet.ip.random_id=1" >> /etc/sysctl.conf



Kernel Entries



There are a couple of security settings we can fix at the kernel level. One security hole we need to plug is disabling ctrl+alt+del so somebody can't walk up to your box and reboot your server with the three-finger solute. Add the following lines to the options:



Note: The RANDOM_IP_ID option is only for versions of FreeBSD that are older than 5.3.



# nano -w /usr/srs/sys/i386/conf/MYKERNEL



***output omitted***

options SC_DISABLE_REBOOT # Disable Ctrl+Alt+Del

options RANDOM_IP_ID # Enables random IP ID generation

***output omitted***

If you haven't already compiled a custom kernel for your hardware, make the necessary kernel config changes at this time. If you have never done that before, use Derrick's kernel config guide as a guideline.



Once you finish customizing your kernel, install it and then reboot. Once it comes back up, log in and update your ports tree so you can upgrade your ports.





Optional Settings For a Stealthier System



The following options may be used, but are only recommended for system that are gateways, log servers, or dedicated firewalls. You may apply these to normal servers if you would like, but they may decrease performance -- especially on web servers.



We can configure FreeBSD to drop SYN/FIN packets:

# echo 'tcp_drop_synfin="YES"' >> /etc/rc.conf

Add the following to your kernel configuration to enable the ability to drop SYN/FIN packets and to enable stealth forwarding. Stealth forwarding passes packets without touching the TTL, so this is useful for hiding firewalls from traceroutes.

# nano -w /usr/src/sys/i386/conf/MYKERNEL



***output omitted***

options TCP_DROP_SYNFIN # Enables the ability to drop SYN/FIN packets

options IPSTEALTH # Enable stealth forwarding

***output omitted***

Now your FreeBSD server has been hardened and ready for your production use. You can also use the lockdown utility (/usr/ports/security/lockdown) and it will automate a lot of this, but not everything.





Author: Jon LaBass

jon at bsdguides dot org



Find this guide useful?

Support the author:











--------------------------------------------------------------------------------



13 Comments



Posted by infovein420 on August 27, 2005 at 10:40:38 am PDT



This sshd_config line should have the comma removed. Only a space is required for more than 1 parameter.



AllowGroups wheel, sshlogins

to

AllowGroups wheel sshlogins



Leaving the comma will cause authentication problems for a client.

---

Scott









--------------------------------------------------------------------------------

Posted by Jon on August 27, 2005 at 10:40:38 am PDT



Thanks Scott. But, leaving the comma doesn't cause authentication problems as I just tested it on FreeBSD 5.3. However, I read the manpages and it does say to separate using spaces. I've updated the guide to reflect that.





--------------------------------------------------------------------------------

Posted by rickster on August 27, 2005 at 10:40:38 am PDT



how to undo this change

chmod o= /var/log

chflags sappnd /var/log

chflags sappnd /var/log/*





--------------------------------------------------------------------------------

Posted by Jon on August 27, 2005 at 10:40:38 am PDT



You can undo the chflags by lowering your kernel securelevel and rebooting.



To do this, first edit /etc/rc.conf and change kern_securelevel equal to -1. Then



# reboot

# chflags nosappend /var/log

# chflags nosappend /var/log/*



The default permissions on /var/log is 755 so the following will restore it.



# chmod o=rx /var/log



Just reboot again after changing the kernel securelevel to whatever you want.





--------------------------------------------------------------------------------

Posted by z0rmus on August 27, 2005 at 10:40:38 am PDT



About the section "Password Rules":



"The minpasswordlen and minpasswordcase facilities for enforcing restrictions on password quality, which used to be supported by login.conf, have been superseded by the pam_passwdqc(8) PAM module."



"PAM configuration for the 'passwd' service passwd(1) does not use the auth, account or session services."



So you must to change in /etc/pam.d/passwd the statement password to:



# password

password requisite pam_passwdqc.so enforce=users



-------------

Sandro Herman





--------------------------------------------------------------------------------

Posted by X-Istence on August 27, 2005 at 10:40:38 am PDT



To do this, first edit /etc/rc.conf and change kern_securelevel equal to -1



That would defeat the purpose of kern_securelevel being set in the first place, as any attacked could remove that, reboot the server, edit the log files, set it again, and reboot again. That is also one of the reasons why if you do set securelevel in either rc.conf or sysctl.conf you also chflags them to not be able to touch them in secure level.





--------------------------------------------------------------------------------

Posted by shadowbq on August 10, 2006 at 8:28:39 am PDT



When running X11, by default it wants to rotates the X11 logs

you have to manually unset the chflags on



/var/log/Xorg.0.log

/var/log/Xorg.0.log.old



If you dont the Xorg/X11 server will not start.





--------------------------------------------------------------------------------

Posted by staffan on February 15, 2007 at 6:27:50 am PST



I have followed the instructions in this guide and now I can't start X11 (startx or GDM gnome). I removed the restrictions on the /var/log, but still no luck...



Does anyone has any tip on how to make it work again? or why it may not work.



//Staffan Öhrberg





--------------------------------------------------------------------------------

Posted by staffan on February 15, 2007 at 7:24:59 am PST



I can run X11 when kern_securelevel=-1, but this is not secure, right?



//Staffan





--------------------------------------------------------------------------------

Posted by Jon on May 24, 2007 at 10:00:41 am PDT



Setting the kern_securelevel is really more effective for production servers that are Internet-facing. Therefore, there really isn't a reason to set the securelevel when running X11.





--------------------------------------------------------------------------------

Posted by FissionChips on June 03, 2008 at 4:43:53 am PDT



Trying to get x11 running again, I can't remove restrictions OR edit rc.conf



(root):

# echo 'kern_securelevel_enable="YES"' >> /etc/rc.conf

cannot create /etc/rc.conf: Read-only file system



Any hints?







--------------------------------------------------------------------------------

Posted by FissionChips on June 03, 2008 at 4:58:50 am PDT



I'm not usually one to post his problems on discussion forums, but I'd been toying around with this one a while and ran out of ideas. Untill I tried one more thing, and it worked.



Excuse my newbieness.. Thanks for all the great guides!





--------------------------------------------------------------------------------

Posted by jas on July 05, 2011 at 5:12:14 pm PDT



Regarding the portion on enabling blowfish hashing, when using the adduser command to create a new user with password I had to additionally run the passwd command to allow the newly created account to log in.



Is this a bug with the adduser binary?



Steps I took:

a - Configured auth.conf to enable blowfish hashing

b - Modified the login.conf to reflect hashing mechanism to use for authentication

c - Added a new user w/ password (verified hash created was of blowfish strength compared to sha1, md5 or des)

d - Logged off as root

e - Attempted to login as new account (2 times without success)

f - Logged back in as root

g - Used passwd command for new account

h - Logged off and tested account when then worked



Thanks

http://www.bsdguides.org/guides/freebsd/security/harden.php

FreeBSD Router with Traffic Shaping with PF and ALTQ HFSC

FreeBSD Router with Traffic Shaping with PF and ALTQ HFSC

Here is a tutorial about building a FreeBSD router with traffic shaping using OpenBSD's PF and ALTQ HFSC discipline.

Step 1. Compile Kernel with support for PF and ALTQ
-------------------------------------------------------------------------

cd /usr/src/sys/i386/conf/
cp GENERIC ROUTER

edit ROUTER file and add the following lines at the end of file:

# ------------------ add the following lines to ROUTER file ------------------
# pf support
device mem
device pf
device pflog
device pfsync

# altq support
options ALTQ
options ALTQ_CBQ
options ALTQ_RED
options ALTQ_RIO
options ALTQ_HFSC
options ALTQ_PRIQ

# other optimizations
options HZ=1000
options DEVICE_POLLING
# ---------------------------------- eof ----------------------------------------------

Next, compile kernel with configurations from ROUTER file

cd /usr/src
make -j4 buildkernel KERNCONF=ROUTER
make installkernel KERNCONF=ROUTER

Reboot the machine and you have support in kernel for PF and ALTQ


Step 2 Create pf.conf file for your firewall and traffic shaper
---------------------------------------------------------------------------------

Rename your default /etc/pf.conf file and create a new config file. In our example we asume your network cards are fxp0 for WAN and fxp1 for LAN. also your LAN subnet is 192.168.0.0/24, and we setup LAN IP of router with value 192.168.0.1. Our LAN being on a private subnet (we only have one public IP) we will use NAT from PF.

Shaping rules are for two PCs on LAN. Both have asigned a maximum of 5Mb bandwidth, with a guaranteed bandwidth of 1Mb

Next is presented pf.conf file:

# --------------------- pf.conf ---------------------
ext_if="fxp0"
int_if="fxp1"
pc1="192.168.0.2"
pc2="192.168.0.3"

altq on $ext_if hfsc bandwidth 10Mb queue {def_up,pc1_up, pc2_up}
altq on $int_if hfsc bandwidth 10Mb queue {def_down,pc1_down, pc2_down}


queue pc1_up bandwidth 5Mb hfsc(realtime 1Mb linkshare 50% upperlimit 5Mb)
queue pc2_down bandwidth 5Mb hfsc(realtime 1Mb linkshare 50% upperlimit 5Mb)

queue def_up bandwidth 128Kb hfsc(realtime 128Kb linkshare 10% upperlimit 256Kb default)
queue def_down bandwidth 128Kb hfsc(realtime 128Kb linkshare 10% upperlimit 256Kb default)

nat on $ext_if from $int_if:network to any -> ($ext_if)

# ------ Pass rules, Shaping for PC1
pass in quick on $ext_if from any to $pc1
pass out quick on $int_if from any to $pc1 queue pc1_down

pass in quick on $int_if from $pc1 to any
pass out quick on $ext_if from $pc1 to any queue pc1_up

# ------ Pass rules, Shaping for PC2
pass in quick on $ext_if from any to $pc2
pass out quick on $int_if from any to $pc2 queue pc2_down

pass in quick on $int_if from $pc2 to any
pass out quick on $ext_if from $pc2 to any queue pc2_up

block all
# ----------------------- end pf.conf file ---------------------------


Step 3. Edit your /etc/rc.conf file and enable pf at startup to load config from /etc/pf.conf file
----------------------------------------------------------------------------------------------------------------------------

Your rc.conf file should look like this:

# -------------- rc.conf -----------------
hostname="router.example.com"
gateway_enable="yes"
defaultrouter="80.80.0.1"

ifconfig_fxp0="inet 80.80.0.2 netmask 255.255.255.224"
ifconfig_fxp1="inet 192.168.0.1 netmask 255.255.255.0"

sshd_enable="yes"

pf_enable="YES"
pf_rules="/etc/pf.conf"
# ---------------- end rc.conf ---------



Tips to debug PF rules:
--------------------------------

pfctl -vvsr (see PF loaded rules)
pfctl -vvsq (see PF queues in realtime)
pfctl -f /etc/pf.conf (load pf.conf file)
pfctl -F state (flush states)

From : http://www.freebsdonline.com/content/view/513/506/

สิ่งที่ต้องทำหลังติดตั้ง Ubuntu 10.04

It has become a tradition with my to do lists. This time, it’s for “Lucid Lynx”, the new Ubuntu release from Canonical. And yep it’s better than the previous version “Karmic Koala”. There have been some drastic changes in the UI and under the hood. Lucid Lynx, out of box, is faster, more social, cloud integrated…basically it feels like an operating system you would want to use today. So without wasting any more word let’s get on with the list :) :

1 – Expand the Software Repository List

First of all, lets make Ubuntu “see” more packages. Go to the terminal and edit your sources.list with :

sudo gedit /etc/apt/sources.list

Here is the content of my sources.list which I think is quite complete to have all the necessary applications you could ever need. So delete the whole content of your sources list and replace it with the content of mine

Save it. Now import the necessary repositories keys to avoid “aptitude” crying about some missing keys, go to the terminal and type:

sudo apt-key adv --recv-keys --keyserver keyserver.ubuntu.com DCF9F87B6DFBCBAE F9A2F76A9D1A0061 A040830F7FAC5991 2EBC26B60C5A2783

Get your system up to date with :

sudo aptitude update && sudo aptitude full-upgrade

Now all your programs will run on the last version.

2 – Anti-Virus

Windows equivalent : AVG AntiVirus, NAV, TrendMicro, F-Prot, Kaspersky, …

Ubuntu equivalent : ClamAV, Avast

ClamAV

sudo aptitude install clamav clamtk

Access it through System Tools → Virus Scanner .

Avast

wget http://files.avast.com/files/linux/avast4workstation_1.3.0-2_i386.deb && sudo dpkg -i avast4workstation_1.3.0-2_i386.deb

Access it through Accessories → avast! Antivirus .

3 – Essential tools for compiling from sources

sudo aptitude install build-essential checkinstall cdbs devscripts dh-make fakeroot libxml-parser-perl check avahi-daemon

4 – Java runtime environment

Java is a very important thing to install, now that many programs like Azureus need it to run. So type:

sudo aptitude install sun-java6-jre sun-java6-plugin equivs

6 – Multimedia

Windows equivalent : windows media player, real player, vlc, mplayer

Ubuntu equivalent : vlc, mplayer, helix player

To have Ubuntu playing all kinds of stuff, you need to install many codecs. So on the Terminal, type:

* Installing vlc and mplayer (plays almost everything):

sudo aptitude install vlc mplayer

* Common packs

sudo aptitude install non-free-codecs libxine1-ffmpeg gxine mencoder mpeg2dec vorbis-tools id3v2 mpg321 mpg123 libflac++6 ffmpeg libmp4v2-0 totem-mozilla icedax tagtool easytag id3tool lame nautilus-script-audio-convert libmad0 libjpeg-progs libmpcdec3 libquicktime1 flac faac faad sox ffmpeg2theora libmpeg2-4 uudeview flac libmpeg3-1 mpeg3-utils mpegdemux liba52-dev

* Gstreammer 0.10

sudo aptitude install gstreamer0.10-ffmpeg gstreamer0.10-fluendo-mp3 gstreamer0.10-gnonlin gstreamer0.10-pitfdll gstreamer0.10-sdl gstreamer0.10-plugins-bad-multiverse gstreamer0.10-schroedinger gstreamer0.10-plugins-ugly-multiverse totem-gstreamer

* More programs

sudo aptitude install gstreamer-dbus-media-service gstreamer-tools ubuntu-restricted-extras

* Enable dvd support

sudo aptitude install libdvdcss2 && sudo /usr/share/doc/libdvdread4/./install-css.sh

* Flash

sudo aptitude install gsfonts gsfonts-x11 flashplugin-nonfree

7. Tweak your eyecandy

Ubuntu 10.04 comes with compiz fusion effects OOTB but doesn’t offer a way to customize them.

In a terminal copy/paste this:

sudo aptitude install simple-ccsm

Now navigate to System → Preferences → Simple CompizConfig Settings Manager .

8 – Missing Windows software?? Run Windows softwares in Linux!!!

Run Windows Applications such as 7zip, Google Sketchup, AutoCAD, Dreamwaver, Flash MX, Fireworks MX, IE6, IE7, Safari, Itunes, Windows Media Player and many more…

Play Windows Games in Linux like Age Of Empires, Call Of Duty, Diablo, Fear, Fallout, Far Cry, Grand Theft Auto, Half Life, Halo, Hitman, Max Payne, Need For Speed, Prince Of Persia, Sim City Star Wars, The Simsworld of warcraft , Tomb Raider, Warcraft, World Of Warcraft, Counterstrike and many other can be played.

Install Playonlinux. It’s based on wine. Wine is a compatibility layer for running Windows programs in Linux.

sudo aptitude install wine playonlinux

9 – Clipboard Management

By Default in ubuntu when u copy something from an application and closes the application u will not be able to access it from the clipboard. And also when u copy severals text in serial u only have the last on available to you in the clipboard. To solve that install either of the following but Glipper is better because it supports plugins.

Glipper

sudo aptitude install glipper

Then right click ur panel → Add to Panel then drag Clipboard Manager to ur panel

Parcellite

sudo aptitude install parcellite

10 – Archiver/ Packing software

Windows equivalent : winrar, zip, 7zip

Ubuntu equivalent : tar, unrar, p7zip, arj, unace

It’s bad when you don’t have Internet on your computer/notebook, but you have to pack/unpack something but the file format isn’t recognized by the system. To prevent from this bad situation, you can install a bunch of packing software by typing this on the terminal:

sudo aptitude install unace rar unrar zip unzip p7zip-full p7zip-rar sharutils uudeview mpack lha arj cabextract file-roller

11 – Graphical web browser

Windows equivalent : Internet explorer, firefox, opera

Ubuntu equivalent : Firefox, opera, chromium

Opera

sudo aptitude install opera

Firefox (installed by default intrepid)

sudo aptitude install firefox

Chromium (open source equivalent of Google Chrome)

sudo aptitude install chromium-browser chromium-browser-l10n

12 – Download Manager

Windows equivalent : Free download manager

Ubuntu equivalent : Multiget

MultiGet is a http/ftp downloader with a nice GUI for linux desktop users. It can run on almost all desktops without any configuration. It has many powerful functions comparing to others.

sudo aptitude install multiget

Access it through Applications → Internet → MultiGet .

13 – Graphical Email client

Windows equivalent : Outlook

Ubuntu equivalent : Evolution, Thunderbird

Evolution (installed by default in lucid)

sudo aptitude install evolution

Access it through Applications → Internet → Evolution Mail .

Thunderbird

sudo aptitude install thunderbird

Access it through Applications → Internet → Mozilla Thunderbird Mail/News .

14 – Instant Messanging protocal clients

Windows equivalent : MSN messenger, Yahoo messenger, QQ, AIM, Gtalk, ICQ,IRC

Ubuntu equivalent : Empathy, Pidgin, emesene

Empathy IM Client (installed by default)

Add the related launchpad repository :
sudo add-apt-repository ppa:telepathy/ppa && sudo aptitude update

Then install it by running the following :
sudo aptitude install empathy telepathy-mission-control-5 telepathy-gabble telepathy-butterfly telepathy-haze telepathy-idle telepathy-salut telepathy-sofiasip libtelepathy-farsight0 python-tpfarsight galago-eds-feed python-galago python-galago-gtk msn-pecan

Access it through Applications → Internet → Empathy IM Client .

Pidgin

Pidgin is an easy to use and free chat client used by millions. Connect to AIM, MSN, Yahoo, and more chat networks all at once. Supported chat networks: AIM, Bonjour, Gadu-Gadu, Google Talk, Groupwise, ICQ, IRC, MSN, MySpaceIM, QQ, SILC, SIMPLE, Sametime, XMPP, Yahoo!, Zephyr

Add the launchpad repository :
sudo add-apt-repository ppa:pidgin-developers/ppa && sudo aptitude update

Then install it :
sudo aptitude install pidgin pidgin-data pidgin-lastfm pidgin-guifications msn-pecan pidgin-musictracker pidgin-plugin-pack pidgin-themes

Access it through Applications → Internet → Pidgin Internet Messenger .

Emesene only for MSN Messenger.

Add the launchpad repository :
sudo add-apt-repository ppa:bjfs/ppa && sudo aptitude update

Then install it :
sudo aptitude install emesene

Access it through Applications → Internet → Emesene .

15 – VOIP

Windows equivalent : skype

Ubuntu equivalent : skype

Skype

sudo aptitude install skype

Access it through Applications → Internet → Skype.

16 – Viewing PDF files

Windows equivalent : Adobe Reader

Ubuntu equivalent : Adobe Reader

Adobe Reader

sudo aptitude install acroread acroread-fonts

Access it through Applications → Office → Adobe Reader.

17– Adobe Air

wget http://airdownload.adobe.com/air/lin/download/latest/AdobeAIRInstaller.bin
chmod +x ./AdobeAIRInstaller.bin

sudo ./AdobeAIRInstaller.bin

Access it through Applications → Accessories → Adobe Air Application Installer.

18 – Music / MP3 / OGG Players

Windows equivalent : iTunes, Winamp

Ubuntu equivalent : Rhythmbox, Banshee, Amarok

Rhythmbox

sudo aptitude install rhythmbox

Access it through Applications → Sound & Video → Rhythmbox Music Player.

Banshee

sudo aptitude install banshee banshee-extension-ubuntuonemusicstore libappindicator0-cil banshee-extension-appindicator banshee-extension-lyrics banshee-extension-mirage

Access it through Applications → Sound & Video → Banshee Media Player.

Amarok

sudo aptitude install amarok amarok-common

Access it through Applications → Sound & Video → Amarok.

19– Hard Disk Partitions Manager

Windows equivalent : Symanted Partition Magic

Ubuntu equivalent : GParted

GParted

sudo aptitude install gparted ntfsprogs menu ntfs-config

Access it through System → Administration → Partition Editor.

20 – Vector Graphics Editor

Windows equivalent : Adobe Illustrator

Ubuntu equivalent : Inkscape

Inkscape

sudo aptitude install inkscape

Access it through Applications → Graphics → Inkscape Vector Graphics Editor.

21 – Image Editor

Windows equivalent : Adobe Photoshop, Paint.Net

Ubuntu equivalent : GIMP

GIMP

Add the launchpad repository :
sudo add-apt-repository ppa:matthaeus123/mrw-gimp-svn && sudo aptitude update

Then install it with the following command :
sudo aptitude install gimp gimp-data gimp-plugin-registry gimp-data-extras

Access it through Applications → Graphics → GIMP Image Editor.

PINTA

Add the launchpad repository :
sudo add-apt-repository ppa:moonlight-team/pinta && sudo aptitude update

Then install it with the following command :
sudo aptitude install pinta

Access it through Applications → Graphics → Pinta Image Editor.

22 – 3D Graphics Applications

Windows equivalent : 3D Studio MAX

Ubuntu equivalent : Blender

Blender

sudo aptitude install blender

Access it through Applications → Graphics → Blender (windowed).

23 – Simple Yet Advanced Text Editor

Windows equivalent : Notepad ++

Ubuntu equivalent : GEdit

GEdit

sudo aptitude install gedit gedit-plugins

Access it through Applications → Accessories → Text Editor.

24 – Office Applications

Windows equivalent : Microsoft Office

Ubuntu equivalent : OpenOffice

OpenOffice

sudo aptitude install openoffice.org

Access it through Applications → Office

25 – Microsoft Visio

Windows equivalent : Microsoft Visio

Ubuntu equivalent : Dia

Dia

sudo aptitude install dia

Access it through Applications → Graphics → Dia Diagram Editor

26 – Microsoft Project

Windows equivalent : Microsoft Project

Ubuntu equivalent : OpenProj

OpenProj

wget http://nchc.dl.sourceforge.net/sourceforge/openproj/openproj_1.4-2.deb && sudo dpkg -i openproj_1.4-2.deb

Access it through Applications → Office → OpenProj

27 – Development IDE

Windows equivalent : Dreamweaver

Ubuntu equivalent : Quanta, Kompozer, NetBeans

Quanta

sudo aptitude install quanta

Access it through Applications → Programming → Quanta Plus

Komposer

sudo aptitude install kompozer nvu

Access it through Applications → Internet → Kompozer

NetBeans

sudo aptitude install netbeans

Access it through Applications → Programming → NetBeans IDE

28 – Source Control Management

Windows equivalent : TortoiseSVN

Ubuntu equivalent : RabbitVCS

RabbitVCS

Add the launchpad repository :
sudo add-apt-repository ppa:rabbitvcs/ppa && sudo aptitude update

Then install it :
sudo aptitude install rabbitvcs-nautilus
killall nautilus

Right Click on any folder or file and access the RabbitVCS submenu

29 – Graphical FTP clients

Windows equivalent : CuteFTP, SmartFTP

Ubuntu equivalent : FileZilla

FileZilla

This is great FTP program, very complete, in my opinion, the best one for linux.

On the terminal type:

sudo aptitude install filezilla filezilla-common

Access it through Applications → Internet → FileZilla FTP Client.

30 – P2P Clients / Servers, File Sharing

Windows equivalent : utorrent, azureus, emule

Ubuntu equivalent : Deluge, azureus, amule

Bittorent clients

Deluge (written in python)

Add the launchpad repository :
sudo add-apt-repository ppa:deluge-team/ppa && sudo aptitude update

Then install it :
sudo aptitude install deluge-torrent

Access it through Applications → Internet → Deluge Torrent.

Azureus: Uses Java to run, very complete but a bit heavy

sudo aptitude install azureus

Access it through Applications → Internet → Azureus.

Emule Donkey Clients

Amule

Add the launchpad repository :
sudo add-apt-repository ppa:happyaron/amule-dlp && sudo aptitude update

Then install it with the following command :
sudo aptitude install amule-dlp amule-dlp-gnome-support amule-dlp-utils-gui amule-dlp-daemon

Access it through Applications → Internet → aMule.

31 – Programs for CD burning with GUI

Windows equivalent : Nero, Roxio Easy CD Creator

Ubuntu equivalent : K3b, Brasero

K3b

Nero is available for linux,but its not free.A trial is available for 1 month usage and later it asks or activation code.But K3B is as good as Nero.Have a good feature set as Nero.

sudo aptitude install k3b k3b-data libk3b6

Access it through Applications → Sound & Video → K3B.

Brasero (installed by default in Lucid)

sudo aptitude install brasero

Access it through Applications → Sound & Video → Brasero Disc Burning .

32 – Mountings ISO files

Windows equivalent : Alcohol

Ubuntu equivalent : acetoneiso

Acetoneiso

The best one for linux ACETONEISO, which is similar to ALCOHOL in windows

its supports almost all formats. AcetoneISO is CD/DVD image manipulator for Linux.Using this tool it is very easy to Mount and Unmount ISO,MDF,NRG Images . I dont think its available in ubuntu repository.

sudo aptitude install libksba8 libenca0 libtwolame0 fuseiso kommander p7zip-full gnupg-agent gnupg2 pinentry-qt mencoder cdrdao && wget http://darkstar.ist.utl.pt/getdeb/ubuntu/jaunty/ac/acetoneiso_2.1.1-1~getdeb1_i386.deb && sudo dpkg -i acetoneiso_2.1.1-1~getdeb1_i386.deb

33 – Install Vista like gadgets.

Windows equivalent : Vista Sidebar

Ubuntu equivalent : google-gadgets

Google gadgets

sudo aptitude install google-gadgets-gtk

This will complete the installation.

Now press Alt+F2, and type “ggl-gtk” to start them. You should see a small icon show up in your system tray, and a sidebar. Right click on any of them and select ‘Add Gadgets’ to show a menu. If you’d like to have Google Gadgets start automatically, go to System – Preferences – Session, click ‘Add’, paste ‘Google Gadgets’ for the name and ‘ggl-gtk’ for the command. Click OK and Close, and you’re good to go.

34 – Google Desktop

Google Desktop allows one to full text search of a user’s e-mail, computer files, music, photos, chat, and Web pages viewed,OpenOffice documents , PDF files and more .

Now similar tools already existed on Linux like beagle (supported by novell ) , meta tracker etc . However Google Desktop search is not based on any of these tools and uses its proprietary algorithms to search for files on the computer ,also being 1.0 release and more stable then these products it could be preferred over tools like beagle .

To install Google Desktop Search type the following command in the terminal window : -

sudo aptitude install google-desktop-linux

Access it through Applications → Google Desktop → Google Desktop

Now after choosing appropriate option through Applications → Google Desktop → Google Desktop Preferences, you would find Google Desktop icon in the bar at the top of the screen , now it would automatically scan and index files on computer and store it in local database which could be searched using web browser .

35 – Photo Management

Google Picasa

Google Picasa is an extremely professional good looking photo management application available on Windows ,Linux and Mac OS. Now Google Picasa has a number of features that many photo management software on Linux dont have further Google Picasa looks very user friendly as compared to similar open source application available on linux . Now Google Picasa for Linux is not a native linux application but runs on Linux thru application layer called wine which allows many windows application to run flawlessly on Linux.

Now to install Google – Picasa type the following command in the terminal window

wget http://dl.google.com/linux/deb/pool/non-free/p/picasa/picasa_3.0-current_i386.deb && sudo dpkg -i picasa_3.0-current_i386.deb

Access it through Applications → Graphics → Picasa → Picasa

36 – Map Viewing and Management

Google Earth

To install Google Earth type the following command in the Terminal Window.

sudo aptitude install googleearth

After downloading is over you will get a screen like this press ¨Yes¨ to accept the license agreement and complete software installation.

Now you can launch Google Earth from Application → Internet → Google Earth

37 – Gmail Notification

Checkgmail

If you would like to get notified when you have a new mail in your google mail account, checkgmail is for you. To install Checkgmail type the following command in the Terminal Window.

sudo aptitude install checkgmail

Now you can launch it from Application → Internet → CheckGmail

38 – Configure Firewall
If you are concern about your security, then it is pertinent that you activate the firewall and prevent any unauthorized access to your computer.

UFW is installed by default, but if you need a graphical interface, install GUFW.

sudo aptitude install gufw

39– Gnome Do

Gnome Do is a small application that allows you to search and do things faster and more efficiently in your Ubuntu machine. It is similar to QuickSilver in Mac and Launchy in Windows. For those who have not tried Gnome Do before, it might take some time for you to get used to it. But once you’re hooked to it, there will be no turning back for you.Gnome Do also comes with a dock interface that you can use it like any other docks.

sudo aptitude install gnome-do

Now you can launch it from Application → Accessories → Gnome Do

40 – Ubuntu Tweak

Ubuntu Tweak allows you to tweak your system settings, all in one place. You can install new applications, customize your desktop settings, configure your startup applications, changing the system filetype association and many more tweaks in this single application.

Add the launchpad repository :
sudo add-apt-repository ppa:ubuntu-tweak-testing/ppa && sudo aptitude update

Then install it with the following command :
sudo aptitude install ubuntu-tweak

Then access it through Applications → System Tools → Ubuntu Tweak

App Runner

App Runner is a small open source utility that makes it very easy to run any type of program/executable/script on any distro/OS that uses the nautilus file manager: Debian/Ubuntu/Super OS/Fedora/etc

wget http://hacktolive.org/files/app_runner/App_Runner_0.2.deb && sudo dpkg -i App_Runner_0.2.deb

Then right-click the file -> Scripts -> Run This App or Run This App (root)

ที่มา : http://theindexer.wordpress.com/2010/03/21/to-do-list-after-installing-ubuntu-10-04-aka-lucid-lynx/

ติดตั้ง Grub2

วิธีการ Reinstall GRUB 2 สำหรับ ubuntu 10.04
กรณีติดตั้ง UBUNTU คู่กับ Windows แล้วภายหลังได้ติดตั้ง Windows ใหม่จะทำให้ไม่สามารถบู๊ตเข้า UBUNTU ได้อีก จึงต้องติดตั้ง GRUB ใหม่ ซึ่งมีวิธีการตามนี้เลยครับ
1. บู๊ตด้วย Boot Ubuntu 10.04 Desktop CD
2.หลังจากเข้าระบบเรียบร้อยแล้วก็ เปิด Terminal ขึ้นมาเลยครับ
3.พิมพ์คำสั่งครับ sudo fdisk -l พาร์ทิชั่นต่างๆก็จะถูกแสดงขึ้นมา ให้ดูไว้ครับ ว่าพาร์ทิชั่นไหนที่มันเป็น Linux

ตัวอย่างของผม

Disk /dev/sda: 320.1 GB, 320072933376 bytes
255 heads, 63 sectors/track, 38913 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x0b8b4d2d

Device Boot Start End Blocks Id System
/dev/sda1 * 1 7180 57673318+ 7 HPFS/NTFS
/dev/sda2 7181 38914 254897499+ f W95 Ext'd (LBA)
/dev/sda5 7181 23107 127933596 b W95 FAT32
/dev/sda6 23108 31010 63480816 b W95 FAT32
/dev/sda7 31011 38585 60846012+ 83 Linux
/dev/sda8 38586 38914 2634752 82 Linux swap / Solaris

4.พิมพ์ต่อเลยครับ sudo mount /dev/sda7 /mnt (แทนที่ "sda7" ด้วยพาทิชั่นของคุณครับ)
5.จากนั้นสั่งต่อตามนี้ครับ sudo grub-install --root-directory=/mnt/ /dev/sda
6.รอสักพักเสร็จแล้ว Reboot หนึ่งรอบ
7.หลังจาก Reboot แล้ว ปรับปรุงเมนู grub ด้วยคำสั่ง sudo update-grub
เสร็จแล้วครับ
อ้างอิงจาก : https://help.ubuntu.com/community/Grub2#Reinstalling%20from%20LiveCD

เครดิตจาก http://phaa-love-ubuntu.blogspot.com/2010/06/reinstall-grub-2-ubuntu-1004.html

วิธีการ Reinstall GRUB 2 สำหรับ ubuntu 10.04
กรณีติดตั้ง UBUNTU คู่กับ Windows แล้วภายหลังได้ติดตั้ง Windows ใหม่จะทำให้ไม่สามารถบู๊ตเข้า UBUNTU ได้อีก จึงต้องติดตั้ง GRUB ใหม่ ซึ่งมีวิธีการตามนี้เลยครับ
1. บู๊ตด้วย Boot Ubuntu 10.04 Desktop CD
2.หลังจากเข้าระบบเรียบร้อยแล้วก็ เปิด Terminal ขึ้นมาเลยครับ
3.พิมพ์คำสั่งครับ sudo fdisk -l พาร์ทิชั่นต่างๆก็จะถูกแสดงขึ้นมา ให้ดูไว้ครับ ว่าพาร์ทิชั่นไหนที่มันเป็น Linux

ตัวอย่างของผม

Disk /dev/sda: 320.1 GB, 320072933376 bytes
255 heads, 63 sectors/track, 38913 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x0b8b4d2d

Device Boot Start End Blocks Id System
/dev/sda1 * 1 7180 57673318+ 7 HPFS/NTFS
/dev/sda2 7181 38914 254897499+ f W95 Ext'd (LBA)
/dev/sda5 7181 23107 127933596 b W95 FAT32
/dev/sda6 23108 31010 63480816 b W95 FAT32
/dev/sda7 31011 38585 60846012+ 83 Linux
/dev/sda8 38586 38914 2634752 82 Linux swap / Solaris

4.พิมพ์ต่อเลยครับ sudo mount /dev/sda7 /mnt (แทนที่ "sda7" ด้วยพาทิชั่นของคุณครับ)
5.จากนั้นสั่งต่อตามนี้ครับ sudo grub-install --root-directory=/mnt/ /dev/sda
6.รอสักพักเสร็จแล้ว Reboot หนึ่งรอบ
7.หลังจาก Reboot แล้ว ปรับปรุงเมนู grub ด้วยคำสั่ง sudo update-grub
เสร็จแล้วครับ
อ้างอิงจาก : https://help.ubuntu.com/community/Grub2#Reinstalling%20from%20LiveCD

เครดิตจาก http://phaa-love-ubuntu.blogspot.com/2010/06/reinstall-grub-2-ubuntu-1004.html

ติดตั้ง cairo-dock บน Ubuntu 10.04

To try it:
---------
If you're under Ubuntu >= 9.04 :
sudo add-apt-repository ppa:cairo-dock-team/weekly
sudo apt-get update
sudo apt-get install cairo-dock cairo-dock-plug-ins

otherwise :
echo "deb http://ppa.launchpad.net/cairo-dock-team/weekly/ubuntu $(lsb_release -sc) main ## Cairo-Dock-PPA-Weekly" | sudo tee -a /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys E80D6BF5
sudo apt-get update
sudo apt-get install cairo-dock cairo-dock-plug-ins

Update Ubuntu ผ่าน command line

sudo apt-get update
sudo apt-get dist-upgrade

PHP กับ SQL เหมือนกิ่งทองใบหยก อ่านซะ สุดยอดครับท่าน
http://www.w3schools.com/sql/

บทความมากมายเกี่ยวกับ Syslog-ng มีได้ไม่อั้น ด้านล่างเลย

http://www.syslog.org/wiki/Syslog-ng/HowToGuides

ว่าง ๆ ก่อน จะแปล

สองมือน้อยจัดการ Ultrasurf จอมป่วน

หลาย ๆ admin คงปวดหัวกับลูกข่ายที่ใช้ ultrasurf เพื่อปลดล็อก policy ของเรา แต่วันนี้เราจัดการได้ครับอาจจะไม่ร้อยเปอรฺ์เซ็น แต่ก็สร้างความอึดและอัดแก้ผู้ที่ใช้โปรแกรมนี้จนไม่อยากใช้ไปเลยครับ ต้องขอขอบพระคุณ คุณยิม (จาก http://www.thaibsd.com)

A lot of administrators have faced many problems with "Ultrasurf" software which is always breaks our policy. Now I have solution to solve this problem. If you are ones who have problem like this, bring this command to your system.

route add -net 65.49.2.0/24 10.0.0.2

10.0.0.2 ผมเปลี่ยนเป็น IP ของ Lan Card ใบที่ 1 ครับ
number 10.0.0.2 I change to be my first lan card's IP

คำสั่งสั้น ๆ แต่มากด้วยอานุภาพขอบอก เสร็จแล้วก็จิบกาแฟอย่างสบายอารมณ์ 5555555
Now, with this power of command you can take a cup of coffee and don't worry about that again.