Linux - alextafoya.com

Here are the steps I use when setting up WordPress on new Ubuntu server.

Log into the console and grab a root shell
Note: I don’t like typing sudo in front of every command
```
$ sudo bash
```
Install an ssh server to make remote management easy
```
# apt-get install openssh-server
```
Install a LAMP stack
Note: You will need to remember the root password you setup for MySQL
```
# apt-get install lamp-server^
```

Download the latest wordpress

# wget http://wordpress.org/latest.tar.gz

Extract the archive file
```
# tar -xzvf latest.tar.gz
```
Make a folder to hold the wordpress install
```
# mkdir /var/www/wordpress
```
Move all the WordPress files to folder you created
```
# cp -r ~/wordpress/* /var/www/wordpress
```
Create a mysql user account and database for wordpress.
Note: Will need the root password created when installing the lamp stack
```
# mysql -u root -p
```
Create now a new database for wordpress
Note: Replace WordPress with any name of your choice
```
mysql> CREATE DATABASE WordPress;
```
Add now a new mysql user for wordpress
Note: Replace “username” with any name of your choice
```
mysql> CREATE USER username;
```
Assign a password to the wordpress mysql user
Note: Replace “abcd” with your own password
```
mysql> SET PASSWORD FOR 'username' = PASSWORD('abcd');
```

Grant the wordpress user all privileges for the wordpress database

mysql> GRANT ALL PRIVILEGES ON WordPress.* TO 'username' IDENTIFIED BY 'abcd';

After setting up the database and user, exit MySQL
```
mysql> exit;
```
Create a WordPress configuration file by copying the template
Note: If you installed in another directory, then correct the given path to your own.
```
# cp /var/www/wordpress/wp-config-sample.php /var/www/wordpress/wp-config.php
```
Edit the WordPress configuration (wp-config.php) so it contains your MySQL information
Note: I use nano for all text editing, but feel free to use whatever tickles your fancy
```
# nano /var/www/wordpress/wp-config.php
```
Insert now your MySQL settings you have just created by replacing:
- database_name_here —> with the database name you have created. For this tutorial, it’s named “WordPress”
- username_here —> with the MySQL user you have created earlier
- password_here —> with the password you assigned to the MySQL user
Note: After editing is complete, exit nano by a ctrl-x, then y to save

Create an Apache config for the WordPress site by copying the default

# cp /etc/apache2/sites-available/default /etc/apache2/sites-available/wordpress

Open the config you copied to edit it

# nano /etc/apache2/sites-available/wordpress

Edit the wordpress config as follows:
- Change the DocumentRoot and Directory to /var/www/wordpress
- Edit the “AllowOverride” options to say All instead of None
Disable the default apache config, enable the WordPress apache config, and enable the rewrite module
```
# a2dissite default && a2ensite wordpress && a2emod rewrite
```
Create a .htaccess to hold the wordpress rewrite rules
```
# touch /var/www/wordpress/.htaccess
```

Give the apache service rights to the folder and allow editing of the .htaccess file

# chown -R www-data:www-data /var/www/wordpress/
# chmod -v 664 /var/www/wordpress/.htaccess

Restart apache to reload settings
```
# apachectl restart
```

Finished.

Having an Intrusion Detection System isn’t optional for network admins that are audited. An IDS is also very handy to have as it shows you everything that is going on. You don’t have to spend a lot of money on this, especially since most of the best tools are free. In my case, I wanted: network intrusion detection, network inventorying, and security scanning. I spent a lot of time messing around with separate packages for getting the functionality I wanted, but it was a pain to manage them all separately. I finally found an all-in-one system which met all of my requirements. OSSIM provides snort, nagios, ntop, and nessus (and various other security tools); this met all of my needs. It comes in the form of an installable debian linux image. Get it here.

I used an old PC as my server, adding an additional nic. When installing, I had to boot with –aspi=off since the power management settings on the board weren’t detected properly. After getting over that hurdle, I simply entered options applicable for my environment via the wizard that is provided. After the installation finished, I had to spend some time configuring. I made this guide piecing together info from various sources.

Update your linux patch level

Nothing fancy here. Its debian, so use apt to install patches

ssh into the OSSIM server as the admin user
```
#ssh root@192.168.1.3
```

Update the package list, install patches, and reboot

#apt-get update
#apt-get upgrade
#reboot

Configure Network Interfaces

The LAN that needs monitored is 192.168.1.0/24. Simply change the LAN address to suite your network. The OSSIM server has two nics: one with an IP address (192.168.1.3) used for management and another operating in promiscuous mode (0.0.0.0) for sniffing. Configure a port on the main backbone switch, a gigabit smart switch which all of my servers and internet connection sit on, to be a spanning or mirroring port of all other ports. This means that the port would receive a mirror of all traffic on all other ports; this is what the promiscuous nic is plugged into. The management interface (192.168.1.3) is plugged into a separate switch that is chained to my backbone switch. Change the OSSIM network configuration to reflect this setup.

Edit the interfaces configuration using your favorite linux text editor; I like nano
```
#nano /etc/network/interfaces
```

Set the /etc/network/interfaces file to be the following, you would need to replace addresses with ones applicable for your network.

auto lo eth0 eth1
iface lo inet loopback
 
# The primary network interface
# Used for web management
iface eth0 inet static
        address 192.168.1.3
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255
        gateway 192.168.1.1
        # dns-* options
        dns-nameservers 192.168.1.8
      
 
#eth1  is for monitoring the LAN A network
# no ip address, promiscuous mode
iface eth1 inet manual
        up ifconfig $IFACE 0.0.0.0 up
        up ifconfig $IFACE promisc
        down ifconfig $IFACE down

Save and close the file. Restart the network interfaces
```
#/etc/init.d/networking restart 
```
Configure ntop to use the promiscuous nic
```
#dpkg-reconfigure ntop 
```

Configure snort to use the proper interface

#nano /etc/snort/snort.debian.conf

Set the /etc/snort/snort.debian.conf to be the following:

DEBIAN_SNORT_HOME_NET="192.168.1.0/24"
DEBIAN_SNORT_INTERFACE="eth1"
DEBIAN_SNORT_OPTIONS=""
DEBIAN_SNORT_SEND_STATS="true"
DEBIAN_SNORT_STARTUP="boot"
DEBIAN_SNORT_STATS_RCPT="root"
DEBIAN_SNORT_STATS_THRESHOLD="1"

Install Oinkmaster and Update Snort Rules

Oinkmaster is a program used to update snorts detection rules. You will need to go to snort.org and sign up to receive an oink key; this lets your download rules.

Install Oinkmaster
```
#apt-get install oinkmaster
```
Edit Oinkmaster Configuration File
```
#nano /etc/oinkmaster.conf 
```

Add Rule URLS to Oinkmaster Configuration File

url = http://www.snort.org/pub-bin/oinkmaster.cgi/<your oink code>/
snortrules-snapshot-2.7.tar.gz
url = http://www.snort.org/pub-bin/oinkmaster.cgi/<your oink code>/
Community-Rules-CURRENT.tar.gz

Dowload and Install Rules

#oinkmaster -C /etc/oinkmaster.conf -o /etc/snort/rules
#perl /usr/share/ossim/scripts/create_sidmap.pl /etc/snort/rules/

Fix RRD Graphs

Ossim includes RRD for graphing values, I noticed that a table used for this purpose was missing. Here is how to fix that.

Go to your home folder and create a text file holding code for the missing table
```
#cd ~
#nano snort.event_stats.sql
```

Paste the following into the newly created file

CREATE TABLE `event_stats` (
`timestamp` datetime NOT NULL,
`sensors` int(10) unsigned NOT NULL,
`sensors_total` int(10) unsigned NOT NULL,
`uniq_events` int(10) unsigned NOT NULL,
`categories` int(10) unsigned NOT NULL,
`total_events` int(10) unsigned NOT NULL,
`src_ips` int(10) unsigned NOT NULL,
`dst_ips` int(10) unsigned NOT NULL,
`uniq_ip_links` int(10) unsigned NOT NULL,
`source_ports` int(10) unsigned NOT NULL,
`dest_ports` int(10) unsigned NOT NULL,
`source_ports_udp` int(10) unsigned NOT NULL,
`source_ports_tcp` int(10) unsigned NOT NULL,
`dest_ports_udp` int(10) unsigned NOT NULL,
`dest_ports_tcp` int(10) unsigned NOT NULL,
`tcp_events` int(10) unsigned NOT NULL,
`udp_events` int(10) unsigned NOT NULL,
`icmp_events` int(10) unsigned NOT NULL,
`portscan_events` int(10) unsigned NOT NULL,
PRIMARY KEY (`timestamp`),
KEY `sensors_idx` (`sensors`),
KEY `sensors_total_idx` (`sensors_total`),
KEY `uniq_events_idx` (`uniq_events`),
KEY `categories_idx` (`categories`),
KEY `total_events_idx` (`total_events`),
KEY `src_ips_idx` (`src_ips`),
KEY `dst_ips_idx` (`dst_ips`),
KEY `uniq_ip_links_idx` (`uniq_ip_links`),
KEY `source_ports_idx` (`source_ports`),
KEY `dest_ports_idx` (`dest_ports`),
KEY `source_ports_udp_idx` (`source_ports_udp`),
KEY `source_ports_tcp_idx` (`source_ports_tcp`),
KEY `dest_ports_udp_idx` (`dest_ports_udp`),
KEY `dest_ports_tcp_idx` (`dest_ports_tcp`),
KEY `tcp_events_idx` (`tcp_events`),
KEY `udp_events_idx` (`udp_events`),
KEY `icmp_events_idx` (`icmp_events`),
KEY `portscan_events_idx` (`portscan_events`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;

Save the file and run the following command to create the eventstats table in the snort database.

#cat snort.event_stats.sql | mysql -p snort

Update Other Components

Some of the components that come with OSSIM are old, but you can easily update them by following instructions found in the OSSIM forums.

Upgrade Nmap: see here.
Upgrade Nessus: see here.
Update Nessus rules using Alienvault’s free feed: see here.

It would be wise to reboot after installing all of the above. Afterwards, go to the web interface of your OSSIM server http://<ossim ip address>. You should see something like this:

Define your LAN(s) and run some nessus scans. Happy monitoring.

Cheers.

Tag: Linux

Setup WordPress on Ubuntu

Create an IDS on the Cheap