OpenLDAP Software is an open source implementation of the Lightweight Directory Access Protocol. Many graphical interfaces are available for managing user accounts in OpenLDAP like PHPLDAPAdmin (http://phpldapadmin.sourceforge.net/wiki/index.php/Main_Page) or LAM (https://www.ldap-account-manager.org/lamcms/). When generating a bulk amount of accounts with automation or just managing user details with a simple script, allows much more flexibility and can be…
With AppArmor enabled on Debian/ Ubuntu systems, starting up virtual machines with libvirt can cause startup failures if not AppArmor is not properly configured. AppArmor will write messages to the kernel log (visible with either the dmesg command or in kernel.log if available) regarding its actions. If your libvirt guests are not starting up or…
Logging with IPTables requires the use of an extra IPTables extension called NFLOG (https://manpages.debian.org/experimental/iptables/iptables-extensions.8.en.html#NFLOG) and a separate daemon process, called ulogd2 (https://www.netfilter.org/projects/ulogd/index.html). Ulogd2 reads out the packets sent to the above mentioned extension and stores them in local files or databases. First, install the ulogd2 package (example is based on Debian/ Ubuntu): Example: log and…
Time based ACL (access control lists) features do not exist in BSD’s packet filter (PF). Having your network “shut down” at certain times (for instance, allow certain network ranges or specific IP addresses only during “business hours” or a specific time range), can be achieved with a simple PF table and a cronjob. First, let’s…
Same as in the previous article, full countries can be easily blocked on OpenBSD firewall using the pf command and https://ipdeny.com/. The zone files provided by https://ipdeny.com/ need to be stored locally. A simple way to achieve this is by having a cronjob downloading those periodically (for instance once per day): We store them directly…
Certain server setups do not require access for all countries or just want to block certain countries since they are know for their malicious activity. One simple (not full bullet-proof) way of doing this, is by setting up block rules on firewall level, which can be achieved on Linux servers with iptables and zone files…
Recently I bought a Soekris net6501 to build a home network in my new house.Things you need before you start: USB / mSSD drive to install OpenBSD on USB drive to boot from Serial cable for the initial installation First go to a mirror and download the amd64 OpenBSD install image, which ends on the…
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response. It runs on most operating systems, including Linux, MacOS, Solaris, HP-UX, AIX and OpenBSD. There is no OSSEC package available on the OSSEC website or in the OpenBSDs ports repositry,…
IMAP folders are really because you can have your e-mails synchronized on multiple devices, without losing e-mails across your devices when retrieving your new e-mails. IMAP folders actually also aren’t that cool because e-mails are usually never deleted or even archived. Having millions of e-mails can make some e-mail readers on certain devices really slow….
At my recent job, I was asked to create a backup procedure, which would dump a PostgreSQL schema to a compressed file and which was able to create weekly and daily backups.The backups had to be full backups each time a backup was made and the amount of daily and weekly backups should be defined…
