Encrypt a disk using Luks on Linux
August 13, 2007 at 2:31 pm | Posted in encryption, luks | 1 Commenthttp://www.saout.de/tikiwiki/tiki-index.php?page=EncryptedDeviceUsingLUKS
This HOWTO shows you how to take a completely new hard disk and encrypt its entire contents using dm-crypt and LUKS. Actually, it’s the partitions that are encrypted, not the disk itself (details below). So if you wish, you can make multiple partitions with different passphrases, or some not encrypted. With a bit of work, you can adapt these instructions to make an encrypted partition on an existing disk, possibly with some unencrypted partitions on the same disk.
dm-crypt asks for a passphrase before you can mount the disk. This provides good protection against your PC getting stolen – once they reboot your PC, the thieves have lost access to your data. Throughout, I will use the ‘cryptsetup’ interface to dm-crypt.
What is LUKS? See http://luks.endorphin.org/about. In simple terms, it’s better encryption, but more importantly to the end user, it allows you to change the password for your disk, without requiring a very slow re-encode of the whole disk. You also have the option of having several different passwords for the same data.
Note : if you want your encryption to defeat a full cryptoanalytic attack, not just casual snooping, you need to fill the disk with high quality random data. Badblocks below justs uses ‘libc’ random(), but is fast (your limitation will be disk speed, not CPU speed). /dev/urandom is better (takes about 5 minutes per gigabyte on my system), /dev/random is best (takes about 1 year per gigabyte on my system, much too slow!).
Step 0: Get the right cryptsetup
You need the version of cryptsetup with luks enabled, you can get it at http://luks.endorphin.org/dm-crypt. To test whether it’s installed, try:
# cryptsetup –help
If you see a help page including details like ‘luksFormat’, then you have the right version already.
Step1a : (Optional) Check the hard disk for errors (side effect, fill it with random data).
It’s probably a good idea to check your entire disk for errors before you start. Not only is this good practise, but modern hard disks contain a few ‘spare’ sectors, and if they detect errors in reading, they can silently replace the bad sector with a backup sector (this is invisible to the OS). So writing and reading the entire disk before you start should allow this to happen.
You need to know what device your new disk is attached to. For PATA disks (parallel ATA) on Linux, they’ll probably be /dev/hda, /dev/hdb and so on. For SATA, SCSI or USB attached disks, they’ll probably be /dev/sda, /dev/sdb, /dev/sdc and so on. I am attaching a USB disk, I already have 2 SATA disks so this disk seems to appear under /dev/sdc. Make sure you find out, and adapt the below commands as necessary, or you may overwrite your existing data!
It’s good to fill an encrypted disk with initial random data. This makes breaking the passphrase so much harder. The below method is sufficient for a casual attack but is not ‘random enough’ to defeat sophisticated cryptographers. If you need that, use the ‘/dev/urandom’ method below or read a good book on cryptography and random numbers!
I recommend the disk check and the fill with random data be done at the same time. Read the man page for more details on this command:
# /sbin/badblocks -c 10240 -s -w -t random -v /dev/sdc
(wait several hours…)
Checking for bad blocks in read-write mode
From block 0 to 295360984
done
Reading and comparing: done
Pass completed, 0 bad blocks found.
#
This will take some time, on my USB-attached 300Gb disk it took around 8 hours. Phase 1 will write random data to the disk, phase 2 will read it back and verify it.
Step 1b (Optional) Fill the disk with random data
If you didn’t do step 1a, do step 1b. This will take a long time (around 5 minutes per gigabyte on my system), because generating good quality random data is very CPU intensive. Method 1a has an easy progress indicator, while “dd” only shows its progress when a USR1 signal is sent to it (“kill -USR1 `pidof dd`”). However, this method is ‘more random’ (and more secure) than the primitive random number generator included in ‘badblocks’, above.
# dd if=/dev/urandom of=/dev/sdc
(wait several hours…)
#
Step 2 : Partition the disk
Remember, the data on a hard disk consists of (1) a partition table (2) one or more partitions.
The way dm-crypt works is, you mount an encrypted partition. So we won’t encrypt the whole hard disk, rather we’ll create a partition table (unencrypted) as usual, then create one or more partitions on the disk, as usual, except the partition(s) can be encrypted if we choose.
So, we partition the hard disk. In my case, I am partitioning my entire 300Gb hard disk as a single partition.
# /sbin/fdisk /dev/sdc
Device contains neither a valid DOS partition table, nor Sun, SGI or OSF disklabel
Building a new DOS disklabel. Changes will remain in memory only,
until you decide to write them. After that, of course, the previous
content won’t be recoverable.
The number of cylinders for this disk is set to 36481.
There is nothing wrong with that, but this is larger than 1024,
and could in certain setups cause problems with:
1) software that runs at boot time (e.g., old versions of LILO)
2) booting and partitioning software from other OSs
(e.g., DOS FDISK, OS/2 FDISK)
Warning: invalid flag 0x0000 of partition table 4 will be corrected by w(rite)
Command (m for help): p
Disk /dev/sdc: 300.0 GB, 300069052416 bytes
255 heads, 63 sectors/track, 36481 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Device Boot Start End Blocks Id System
Command (m for help): n
Command action
e extended
p primary partition (1-4)
p
Partition number (1-4): 1
First cylinder (1-36481, default 1): 1
Last cylinder or +size or +sizeM or +sizeK (1-36481, default 36481): (enter)
Using default value 36481
Command (m for help): p
Disk /dev/sdc: 300.0 GB, 300069052416 bytes
255 heads, 63 sectors/track, 36481 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Device Boot Start End Blocks Id System
/dev/sdc1 1 36481 293033601 83 Linux
Command (m for help): w
The partition table has been altered!
Calling ioctl() to re-read partition table.
Syncing disks.
#
Step 3 : Create mapping between logical and physical partitions
dm-crypt works by transparently translating (in the kernel) between a physical on-disk partition (which is encrypted) and a logical partition which you can then mount and use as normal. This step takes no time and writes no data, it just establishes the mapping for future use.
The physical (encrypted) partition will be /dev/something
The logical (unencrypted) partition will be /dev/mapper/something2
I prefer to keep the names the same, so something=something2. That makes things easier to remember.
# cryptsetup –verbose –verify-passphrase luksFormat /dev/sdc1
WARNING!
========
This will overwrite data on /dev/sdc1 irrevocably.
Are you sure? (Type uppercase yes): YES
Enter LUKS passphrase: (enter your passphrase, and write it down somewhere!)
Verify passphrase: (repeat passphrase)
# cryptsetup luksOpen /dev/sdc1 sdc1
Enter LUKS passphrase:
#
If all is well, you now have a special file called /dev/mapper/sdc1. This is what you will mount.
# ls -l /dev/mapper/
total 0
crw——- 1 root root 10, 63 Jul 16 01:34 control
brw-r—– 1 root root 253, 0 Jul 16 01:52 sdc1
#
Step 4 : Create a filesystem on the logical partition
This is just like making a normal filesystem, just point ‘mkfs’ at the logical partition. Use your favourite options, filesystem type etc (I use ext3) or just copy my options. As always, remember to change ‘sdc1’ as appropriate.
# /sbin/mkfs.ext3 -j -m 1 -O dir_index,filetype,sparse_super /dev/mapper/sdc1
(wait several minutes…)
mke2fs 1.35 (28-Feb-2004)
Filesystem label=
OS type: Linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
36634624 inodes, 73258400 blocks
732584 blocks (1.00%) reserved for the super user
First data block=0
2236 block groups
32768 blocks per group, 32768 fragments per group
16384 inodes per group
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
4096000, 7962624, 11239424, 20480000, 23887872, 71663616
Writing inode tables: done
Creating journal (8192 blocks): done
Writing superblocks and filesystem accounting information: done
This filesystem will be automatically checked every 39 mounts or
180 days, whichever comes first. Use tune2fs -c or -i to override.
#
Step 5 : Mount the Filesystem
This is just like a normal mount, except you use the logical (/dev/mapper) device. First make a mount point if necessary. In my case I am using /home4
# mkdir /home4
# mount /dev/mapper/sdc1 /home4
# df -H
Filesystem Size Used Avail Use% Mounted on
/dev/hda3 11G 5.2G 4.2G 56% /
/dev/hda1 510M 63M 395M 14% /boot
/dev/hda2 11G 3.5G 5.9G 37% /usr
none 797M 0 797M 0% /dev/shm
/dev/mapper/sdc1 296G 34M 294G 1% /home4
#
Hoorah! Now just use /home4(or whatever) as normal. In my case, I now have another 300Gb to play with 
It may be slower than a normal disk, due to the CPU time required to encrypt/decrypt. If you wish, use /sbin/hdparm to benchmark. However my benchmarks on an AMD Athlon 3200 indicate no great difference between an encrypted and a normal unencrypted partition.
Step 6: Mounting and unmounting in future
This is a simple procedure. You may be even able to edit your /etc/rc.local script to prompt for a password and mount your encrypted partition at boot.
To mount:
# cryptsetup luksOpen /dev/sdc1 sdc1
Enter LUKS passphrase: (enter passphrase)
key slot 0 unlocked.
# mount /dev/mapper/sdc1 /home4
#
To unmount:
# umount /home4
# cryptsetup luksClose sdc1
#
To add an additional password, so you can unlock your partition with a choice of different passwords (you can do this with the encrypted partition mounted, if you wish):
#cryptsetup luksAddKey /dev/sdc1
Enter any LUKS passphrase: (enter an existing password for this partition)
key slot 0 unlocked.
Enter new passphrase for key slot: (enter the extra password)
#
To delete an existing password (but don’t delete the last one, your data will be lost forever, you will be warned if you try this), you need to know which slot the password is in. The first password goes in slot 0, any additional passwords go in slot 1, 2 etc. You can do this with the encrypted partition mounted, if you wish. So to delete the very first password you used, use:
#cryptsetup luksDelKey /dev/sdc1 0
#
To change the password, first add an additional password then delete the original password.
Bastille Linux: A Walkthrough
August 13, 2007 at 1:26 pm | Posted in Bastile | Leave a comment
2000-06-06
|
You use a “hardening program” to try to make your system as secure as possible, from the ground up. Generally, you deactivate unnecessary services and better the configurations of the ones you leave enabled. This is wildly effective, as it can eliminate many of the vulnerabilities that are common on Linux/Unix platforms. This article presents a walkthrough of Bastille Linux, a popular hardening program for Red Hat and Mandrake, available for free from Jon Lasser, Pete Watkins, myself, and the rest of the Bastille Linux project. This walkthrough won’t be the kind of “paranoid” setup that I enjoy most, as that could remove too much functionality for the average reader. Don’t worry – I’ll explain what we’ll break in each setting, how we’ll break it, and how you can fix it. But first, a shameless plug: I’ll let you know about the cool features in the newest Bastille version, which we’ve just released.
Cool Features in Bastille Linux 1.1:
With all that said, please be assured that development is continuing. We’re implementing even more cool functionality and we’re all quite sure that Bastille is, and will continue to be, one of the most full-featured hardening programs out! Got a suggestion? E-mail me at jay@bastille-linux.org. With that said, let’s get to the walkthrough!
Starting The Walkthrough:At the time of this writing, Bastille 1.1.0 has been released. It might be a little rough around the edges, but if something doesn’t work as planned, it can be easily undone or we can release a quick fix. I’m recommending this version specifically because the new architecture is much more featureful. Let’s download, install and run Bastille on an x86-based Red Hat 6.x box. First, switch to console mode. While Bastille uses a GUI-like (curses-based) Text User Interface, it’s still a console tool that runs best on a standard size 80×25 screen. # cd /root Download Bastille From http://downloads.sourceforge.net/bastille-linux/Bastille-3.0.9.tar.bz2?modtime=1145340334&big_mirror=0 and place it in your root folder, and un-archive it. # cd /root/Bastille Bastille starts with the four most powerful steps you can take to secure a Linux/Unix box:
Let’s step through these… (Module: IPCHAINS)Bastille starts by offering to configure a firewall. While this is not all that is required to secure a machine, firewalls can be great start. They function to block network traffic from hitting your machine’s network daemons. Why not just secure the daemons or deactivate them? Actually, we’ll take all three of these actions. Why not just do one or the other? The answer is a basic tenet of operating system security: Defense in Depth.
Defense In Depth Protect each service or possible vulnerability through multiple means, so that if one fails, the remaining methods keep your machine from being compromised.
To keep this article from getting too deep too fast, we’ll skip firewalling for now. Bastille has very good explanations in the IPCHAINS module – further, the default answers should be fairly safe. Unfortunately, this module is long enough to necessitate its own walkthrough. Look for a future article, Real Soon Now on this topic.
Q: Would you like to run the ipchains script? [N] A: N (Module: Patch Download)Bastille now tells us about downloading new patches. This is VERY important. Bastille can minimize damage from vulnerable services through preventive measures, but it really is most effective to patch the security holes in the first place! Most operating systems (save OpenBSD) seem to release with vulnerable programs, some of which can be abused to gain root on your system. If you’re still not patching, please remember the remote vulnerability present in Red Hat 6.0’s BIND version… This step, however, is best done manually…
Q: Would you like to download and install updated rpms? A: N (Module: File Permissions)Now we’ll audit file permissions. If you’re an advanced user, you may use the general permissions audit. This audit, adapted from a SANS document, restricts permissions on many binaries. Most people should choose N here.
Q: Would you like to set more restrictive permissions on the administrative utilities? [N] A: N
Now we get to that third “most powerful action” quoted from above: the SUID Audit. Bastille lets us strip the SUID bit on about half of the SUID programs on a Red Hat 6.x or Mandrake system. Since this is the non-paranoid run, we won’t disable all of them…
We’ll leave the SUID bit on mount/umount, so that ordinary users can still mount floppies and cdroms.
Q: Would you like to disable suid status for mount/umount? A: N
We’ll also leave ping and traceroute active, so ordinary users can test network connectivity. These are really not needed, but I am attempting to be less paranoid, in the name of user convenience.
Q: Would you like to disable suid status for ping? A: N
We’ll strip the SUID bit from dump and restore, which are used for system backups. Root can take care of system backups.
Q: Would you like to disable SUID status for dump and restore? A: Y
We’ll also rip SUID status off of cardctl, which is used to configure PCMCIA services – you can answer N here if you’re running a notebook.
Q: Would you like to disable SUID status for cardctl? A: Y
We’ll also rip SUID status off of at, because it has had a rich history of security problems. You can achieve all the same functionality with cron, so this is safe.
Q: Would you like to disable SUID status for at? A: Y
We can safely tear SUID off of dos (dosemu). Dosemu is a DOS emulator for Linux and, as such, is very open to manipulation by the user. It also is used by few users – feel free to re-enable suid if you’re planning on making this available to many users.
Q: Would you like to disable SUID status for DOSEMU? A: Y
It is also very safe to remove the SUID bit from the news (UseNet) server control utilities, inndstart and startinnfeed. Most people reading this article aren’t running a news server on their machines… Even if they were, only root should be starting the news server! Ordinary users can read news without needing to be able to start a news server, especially since most people read UseNet via their ISP’s news server.
Q: Would you like to disable SUID status for news server tools? A: Y
We’ll leave the SUID bit on the printing utilities, though you should disable these if your machine won’t be used for printing.
Q: Would you like to disable SUID status for printing utilities? A: N
Now, we get to one of my favorite topics, the Berkeley r-tools, like rcp, rlogin and rsh. These harbingers of doom use IP addresses for authentication, which unfortunately is not a suitable method of authentication. Trust me here, turn these the heck off!
Q: Would you like to disable SUID status for the r-tools? A: Y
We’ll slip back to permissive mode now, and leave SUID on usernetctl. This utility is used by ordinary users to activate and deactivate network interfaces, like their dial-up modems. Feel free to leave this on…
Q: Would you like to disable SUID status for usernetctl? A: N
Q: Would you like to disable SUID status for traceroute?A: N
Now, I promise there aren’t so many questions in most of the other modules! Module: Account SecurityBastille now moves to Account Security, which is not the last of the four “most powerful steps” that I outlined above. Don’t panic! We’ll come back to that one… Often a system cracker starts by stealing one of your user’s accounts or by compromising a non-user account. The AccountSecurity module enforces some Best Practices and creates a few tricks, as we’ll show below.
We’ll create a second superuser account. You should use this for root activities and leave the root account untouched.
Q: Would you like to set up a second UID 0 account? A: Y
Bastille will now request permission to disable the Berkeley r-tools: rsh, rlogin, rcp by making PAM modifications, commenting out lines in inetd.conf, and removing all permissions on these binaries.
Q: May we take strong steps to disallow the dangerous r-protocols? [Y] A: Y
We’ll now elect to enforce password aging, to freeze unused accounts before they can be used to compromise your system.
Q: Would you like to enforce password aging? [Y] A: Y
If you haven’t created an ordinary user account, you should let Bastille do this for you. Otherwise, skip it like so:
Q: Would you like to create a non-root user account? [N] A: N
We’ll restrict most users from using cron – it represents a double risk: first, it runs as root and might be open to compromise. Second, an attacker can use cron to hide commands and run them outside of the interactive sessions that you’d be able to monitor easily.
Q: Would you like to restrict the use of cron to administrative accounts? [Y] A: Y
We’ll also go ahead, in the future, and assign a restricted/useless shell, like /bin/false, to all non-user accounts.
Module: Boot SecurityInterestingly enough, in Red Hat 6.0, anyone who can get to a LILO prompt can have root on your system! Try this at the LILO prompt: type “linux single”. You’ll find yourself with a nice root shell! If we deactivate that, you can still type at the LILO prompt: linux init=/bin/bash. We can do something about this.
Q: Would you like to password-protect the LILO prompt? [N] A: Y
Q: Enter LILO password, please. [] A: put-in-your-own-password-please-or-you’ve-done-something really-dumb
This solution actually prevents both of the exploits above, as it protects the LILO prompt. We can protect this prompt further by not giving an attacker any chance to even try a password…
Q: Would you like to reduce the LILO delay time to zero? [N] A: N
We can write this lilo configuration to our hard drive or to a pre-made boot floppy, or both. Supposing that we boot from your hard drive only:
Q: Do you ever boot Linux from the hard drive? [Y] A: Y
Q: Would you like to write the LILO changes to a boot floppy? [N] A: N
We could disable CTRL-ALT-DEL rebooting, but this doesn’t always make sense.
Q: Would you like to disable CTRL-ALT-DELETE rebooting? [N] A: N
We can take one final step to prevent the “LILO: linux single” root-grab. Remember: Defense in Depth!
Q: Would you like to password protect single-user mode? [Y] A: Y Module: SecureInetdOK, back to the fourth of the “four most powerful steps.” Our last “powerful” step, restricting and deactivating unnecessary services, follows from another basic tenet of system security: Minimalism.
(Applied) Minimalism Since crackers may discover an exploitable vulnerability in any service running with privilege, minimize both the number of these services and their levels of privilege.
This principal will save your butt over and over. A Red Hat 6.0 box running with “Everything” installed and every service active can be rooted remotely rather easily through, among other things, its Name Server. If you take the five minutes to turn this off, you win! If you had to leave it on, but you lower its level of privilege by setting it to run as an ordinary user, you win again. Otherwise, you can be rooted by the least experienced script kiddie.
We’ll start the process of restricting unnecessary services by changing /etc/inetd.conf and the TCP Wrappers /etc/hosts.allow file. We’ll disable telnet, ftp, pop, imap, rsh, rlogin, and talk. Pop and imap are mail protocols that should be disallowed unless you really do use them. Telnet, rlogin and rsh are all horribly insecure and can be replaced by ssh. Often, rcp and ftp can be replaced by the much safer scp. We remove talk simply because we don’t need it.
Q: Would you like to modify inetd.conf and /etc/hosts.allow to optimize use of Wrappers? [Y] A: Y
You can turn these back on, or allow them from required systems, by editing the /etc/hosts.allow file. Try: man hosts_access. Moving on, we’ll choose to leave ssh open to the entire Internet, for now.
Q: Would you like to set sshd to accept connections only from a small list of IP addresses. [N] A: N
Finally, we’ll choose to add “Authorized Use Only” banners to the system. These are often required to successfully prosecute system crackers.
Q: Would you like to make “Authorized Use” banners? [Y] A: Y Module: DisableUserToolsFollowing the principle of Minimalism, we can now set permissions to only allow root to use the compiler. If you need users to run this, please don’t choose Y here.
Q: Would you like to disable the compiler? [N] A: Y Module: ConfigureMiscPAMSidetracking from the “minimalism” stuff, we make some modifications that should make it difficult for any one user, including the “nobody”, “web” or “ftp” users, to abuse system resources to cause a Denial of Service (DoS) attack.
Q: Would you like to put limits on system resource usage? [Y] A: Y
Q: Should we restrict console access to a small group of user accounts? [N] A: N Module: LoggingWe’ll add some additional logging to the system, creating special logs for kernel messages and severe error messages and, furthermore, logging important information to two virtual TTY’s. After we’re done, you’ll use – and – to view these and – to get back to an X server. Q: Would you like to add additional logging? [Y] A: Y
Unless you have a remote logging host, we’ll answer the next question like so:
Q: Do you have a remote logging host? [N] A: N
Process accounting logs every process as it starts. If you’ve got the disk space and CPU time to spare, or are very paranoid, this can be very useful. Most people shouldn’t touch this.
Q: Would you like to set up process accounting? [N] A: N Module: MiscellaneousDaemonsWe now get directly back to our Minimalism-motivated process. We’ll turn off every system daemon that you don’t need. In this walkthrough, we turn most everything off. You can turn it back on with the command chkconfig on.
Q: Would you like to disable apmd? [Y] A: Y
Q: Would you like to deactivate NFS and Samba? [Y] A: Y
Q: Would you like to disable atd? [Y] A: Y
Q: Would you like to disable PCMCIA services? [Y] A: Y
Q: Would you like to disable the DHCP daemon? [Y] A: Y
Q: Would you like to disable GPM? [Y] A: Y
Q: Would you like to disable the news server daemon? [Y] A: Y
Q: Would you like to deactivate the routing daemons? [Y] A: Y
Q: Would you like to deactivate NIS server and client programs? [Y] A: Y
Q: Would you like to disable SNMPD? [Y] A: Y Module: SendmailContinuing to follow the principle of Minimalism, we can now deactivate sendmail’s “listen mode.” It will still be available to send mail off the system, but won’t receive any from the network. If you need to receive mail via sendmail, choose Y:
Q: Do you want to leave sendmail running in daemon mode? [Y] A: N
To disable automated sendmail altogether, we’d choose N for the next question.
Q: Would you like to run sendmail via cron to process the queue? [N] A: Y
Finally, we’ll disable some sendmail commands that are commonly used to gain information about your system for cracking or spamming.
Q: Would you like to disable the VRFY and EXPN sendmail commands? [Y] A: Y Module: RemoteAccessYou should install Secure Shell (ssh) on every system that needs remote access, though you may want to do it manually.
Q: Would you like to download and install ssh? [N] A: Y Module: DNSYou might notice a strange practice in the remaining modules: we tighten services that we turn off. We recommend you do this because you never known when you might have to turn them back on. Paranoid, yes, but from experience, a sound practice. We secure DNS initially by running it as an ordinary user and restricting (chroot-ing) it to a small subset of the filesystem. This turns the recent BIND (DNS) exploit from a root-grab into DNS server Denial of Service (DoS). Actually, we (and the guys at SANS) implemented and suggested this months before the exploit was found.
Q: Would you like to chroot named and set it to run as a non-root user? [N] A: Y
Q:Would you like to deactivate named, at least for now? [Y] A: Y
You’ll have to get used to two small changes in the way your admin your DNS server when you do this – read the Bastille explanations carefully. Module: ApacheUnless you’ll be using your web server immediately, we’ll turn it off for now. Reactivate it later with chkconfig httpd on.
Q: Would you like to deactivate the Apache web server? [Y] A: Y
If you only need the webserver to test web pages that you’re working on locally, we can bind it to a your local interface. We could also bind it to only one interface (like your ethernet card, but not your PPP link.) I assume here that your web server must be viewable by the entire internet.
Q: Would you like to bind the web server to listen only to the localhost? [N] A: N
Q: Would you like to bind the web server to a particular interface? [N] A: N
We have more choices than just deactivating Apache. While Apache has some nice features, we’d prefer to disable features we aren’t directly using. Apache can follow symbolic links, so that if one of your users makes a link from his web directory to /, Apache can show any user-viewable file to the entire Internet! We’ll turn this off:
Q: Would you like to deactivate the following of symbolic links? [Y] A: Y
Server side includes aren’t used by most casual users. They can be rather dangerous.
Q: Would you like to deactivate server-side includes? [Y] A: Y
CGI scripts incredibly useful on servers – simultaneously, badly written CGI scripts represent one of the most common methods of system compromise today. Decide carefully: will you be writing, downloading or buying CGI scripts? Many conscious sites run them on only some servers and then only after auditing each CGI script for problems.
Q: Would you like to disable CGI scripts, at least for now? [Y] A: Y
Lastly, we think about indices. In the absence of a index.html file, Apache will list all files in the current directory. These aren’t as bad as symbolic links, since they don’t enable an attacker to see files outside the web directories.
Q: Would you like to disable indexes? [N] A: N Module: PrintingIf your box isn’t being used to print, we can disable the printing daemon and strip SUID from lpr and lprm, like so:
Q: Would you like to disable printing? [N] A: Y Module: FTPLast module! Anybody tired yet? We now can prune back the access of the FTP daemon, wu-ftpd. From a security perspective, FTP is a very problematic protocol. Further, wu-ftpd has had a number of security alerts lately. Most security-conscious people try to avoid running an ftpd like the plague and you might want to follow their example. Even if you can, let’s prune this daemon.
Of all possible configurations, the worst is one that allows anonymous upload. Luckily, this is not the default configuration! Still, Red Hat’s default configuration allows user/password access as well as anonymous download. You can deactivate one or both of these. Here, we deactivate only user ftp access:
Q: Would you like to disable user privileges on the FTP daemon? [N] A: Y
Q: Would you like to disable anonymous download? [N] A: N
Wrap-Up:OK, that’s it. We’ve made our choices in the front end, which should now create a configuration file. Let’s implement these choices like so:
( Exit from the Credits screen by pressing Tab ) # ./BackEnd.pl
Your changes should now be implemented. You’ll find your machine to be slightly less functional, but only in ways that you chose. You’ll find backup copies of every configuration file changed in /root/Bastille/undo/backup. Reboot your machine and notice the changes. An attacker will find far fewer avenues of attack against your machine, depending on what options you picked.
Jay Beale is the Lead Developer of the Bastille Linux Project (http://www.bastille-linux.org). He is the author of several articles on Linux/Un*x security, along with the upcoming book “Securing Linux the Bastille Way,” to be published by Addison Wesley. At his day job, Jay is a security admin working on Solaris and Linux boxes. |
How To use Yum
August 8, 2007 at 2:32 pm | Posted in yum | Leave a comment
- To seach for a application
Yum will search all your enabled repos and tell you where you can obtain the package from
yum search application_name
- Yum can list all available packages from your enabled repos and tell you where you can obtain the package from:
yum list available
- To find out more info about some package
yum info application_name
- Installing applications
Inastalling is as easy as
yum install application_name
- Listing rpms
yum can list installed rpms for you from the repos you have enabled
yum list extras
- Removing rpms
Yum can remove a application and the dependenciesit installed with tat application. it will not remove depenencies if another application installed needs them.
yum remove application_name
- Updating the system
Yum can update the system for you with out user interact if you want it to.
yum update
- Not sure if you have upates?
yum check-update
- Local install
downloaded a rpm and cannot install it with rpm because of dependencies?
yum localinstall /path/to/the/rpm
Convert .wmv to .avi on Linux
August 6, 2007 at 3:15 pm | Posted in avi, convert, mencoder, wmv | 3 CommentsOn Ubuntu: sudo apt-get install mencoder
On Fedora: yum install mencoder
mencoder infile.wmv -ofps 23.976 -ovc lavc -oac copy -o outfile.avi
and done!
Windows: Change Default Action for Blank CD
August 1, 2007 at 3:28 pm | Posted in Windows | Leave a commentSometimes simple answers to problems can be a pain in the rear to find, this is one of them.
A step by step guide:
1 – open my computer
2 – right click the cd drive and open properties from the menu
3 – in the proprties popup click the autoplay tab
4 – select Blank CD from the pulldown menu
5 – in actions select the “prompt me each time to choose an action” dot
6 – hit “OK”
linux shell automatic logout
July 12, 2007 at 7:07 pm | Posted in Linux, Security | Leave a commentThe Problem
Many users (including system administrators) leave their logged in Linux shell open and leave their desk. There is no lock screen option if you are running your Linux box in pure CLI mode so any sneaker can access your documents, the situation is worse if a root user leaves his session as the sneaker can poke their nose into the whole system and do whatever they want.
The Solution
Luckily there is an environment variable in BASH1 called TMOUT by using you can instruct the shell to exit (or logout) if it is idle for the given seconds. Note the shell will only exit if it is idle that is no actively running program like vi editor session. Use the following in your ~/.bash_profile file to make this permanent.
export TMOUT=300
This is will make the shell to exit automatically if left idle for 300 seconds (5 minutes)
http://www.apsivam.in/tips/linux/linux_shell_automatic_logout
Secure your X Window System
July 12, 2007 at 6:55 pm | Posted in Security, X windows | Leave a commentThe Problem
What will you do when you leave your X Window desktop on a Linux box?
obviously, lock it to protect your precious data. But this is not a full protection yet, why? because one can still press <Ctrl> + <Alt> + BackSpace key to kill your entire session. If you have any unsaved documents they all are gone.
The Solution
Open /etc/X11/xorg.conf file in your favorite text editor and look for
Section “ServerFlags” line. If one already exists add the following line between start and end of that section.
Option "DontZap" "true"
If the section does not exists at all, append the following lines to your xorg.conf file
Section "ServerFlags"
Option "DontZap" "true"
EndSection
Note
You can also add the following option to disable switching to full text mode (VT).
Option "DontVTSwitch" "true"
BE WARNED! this will disable both killing your X session forcefully and switching to text mode. If some application got hung and your X session is not responding you will have to restart your machine.
http://www.apsivam.in/tips/linux/secure_your_x_window_system
Securing Firefox: How to avoid hacker attacks on Mozilla’s browser
July 12, 2007 at 1:27 pm | Posted in Firefox, Security | Leave a commentSecurity problems with Microsoft’s dominant Internet Explorer browser helped pave the way for Mozilla Firefox to emerge as an alternative for Web surfers.However, Firefox users should be aware that hackers can exploit software flaws and design features to launch attacks.
The following configuration changes, recommended by CERT/CC, can disable various features and set up the browser to run in a secure state, limiting the damage from malware attacks.
To get started, select Tools, then Options.
In the General tab, you can manually set your home page and check to ensure Firefox is your default browser
In the Privacy tab, select the Cookies sub-category. Here you can disable cookies or change your preferences for how the browser handles them.CERT/CC recommends enabling cookies for the original site only. Additionally, by enabling the option unless I have removed cookies set by the site, a web site can be “blacklisted” from setting cookies when its cookies are removed manually. See below:
In general, CERT/CC recommends you do not use the Firefox feature to store passwords.If you decide to use the feature, be sure to use the measures available to protect the password data on your computer.
Under Firefox’s Privacy category, the Passwords subcategory contains various options to manage stored passwords, and a Master Password feature to encrypt the data on your system.
Use this option if you decide to let Mozilla Firefox manage your passwords.
From the Content category, you can configure Firefox to block pop-up ads and warn when web sites try to install extensions or themes.You should also Disable Java unless required by the site you wish to visit. Again, you should determine if this site is trustworthy and whether you want to enable Java to view the site’s content.
CERT/CC recommends disabling all of the options displayed in this dialog.
Click on “Advanced” to disable specific JavaScript features. Also you might want to try out NoScript extention found here:
Firefox’s Downloads tab offers the option to change actions taken when files are downloading.Any time a file type is configured to open automatically with an associated application, this can make the browser more dangerous to use. Vulnerabilities in these associated applications can be exploited more easily when they are configured to open automatically.
Click the View & Edit Actions button to view the current download settings and modify them if necessary.
The Download Actions dialog shows the file types and the actions the browser will perform when it encounters a given file type.
For any file type listed, click on either Remove Action or Change Action.
If you click on Change Action (from previous slide), select Save them on my computer to save files of that type to the computer.
This helps prevent automated exploitation of vulnerabilities that may exist in these applications.
Firefox also includes a feature to Clear Private Data to give users the option to remove potentially sensitive information from the web browser.
Click on Tools, then Save Private data to find the settings (See next slide…)
A beginner’s introduction to the GNU/Linux command line—Managing processes
July 12, 2007 at 12:28 pm | Posted in CLI, User Management | Leave a commentPlease See: Intro to the Commandline
Function Securely off a USB Key (dated)
July 6, 2007 at 8:11 pm | Posted in Uncategorized | Leave a commentYou can also find this article as a “Part 2” on Traveling Forever, here as this was written as a continuation of an article posted here . So most of the credit goes to this guy, I’ve just added a ton more to it to ensure that you are anonymous and secure. So don’t be suprised if some of the things here are directly copied and pasted. Descriptions for Firefox exntensions mentioned are copied from their linked locations as well.
So whether you’re just a paranoid guy looking to not be monitored, or a kid at school trying to browse Myspace.. I have some tips.
We’ll be working with running everything from a USB key so no trace (or very little) of use of the application will be on your computer. Firefox and OpenOffice will leave a small registry key but it doesn’t convey much.
This How To has gotten pretty long. So for a quick summary, these are the things that i will be covering:
1. What is a Portable Application
2. How to setup encryption and password protect your USB Key
3. Run and tweak TorPark (Firefox + Tor routing app)
4, Run and tweak a portable Firefox
5. The best extensions for Firefox and Torpark
6. Howto get and use Portable Thunderbird with GPG Encryption
7. Howto get and use Portable GAIM
8. How to setup encryption through GAIM
9. How to use GAIM through Tor
10. How to run & encrypt uTorrent from the USB key
11. How to run OpenOffice from your USB key and tweak it for speed
12. How to use RealVNC to connect to your home compute
13. Use PStart as a launcher for your USB programs
14. Encrypt Files and Folders within TrueCrypt with Challenger
15. Run Skype from your USB key
16. Other USB applications you might find useful
17. Installing Tor Onion Routing to a Hard-drive
18. Generic proxy sites
19. AnonymOS
20. Test your privacy and anonymity
What is a Portable Application?
First off, what is a portable application? They are software programs that are not required to be “installed” onto a computer’s permanent storage device to be executed, and can be stored on a removable storage such as a USB flash drive and used on multiple computers. Ideally it can be configured to read its configuration from the same location as the software. Portable applications come in a zip file. Contained in the zip file is their folder. There is NO installation process. The program runs from the folder itself without requirements of a Windows registry, without the requirements of putting DLL files in C:/Windows/Sytem32, without the need to create folders in your hidden folder C:/Documents and Settings/Username/Application Data (among other areas) MOST of the time. Occassionally some programs will leave a small footprint on a hard-drive, but we’ll address that. Portable Apps simply run from the files on the USB key and it knows the location of supporting files that Windows already has (such as codecs, fonts, and such).
First thing’s first. What good is it to have your data stored, or portable applications running from, a removable disc if someone who connects remotely can access that disc? What if you lose that disc? Everything must be encrypted.
First you want to make sure that at minimum you have at least a 512MB USB Drive (aka thumb drive, jump drive, etc). You’ll need at least 1 GB USB drive if you wish to do every single thing listed here.
We’re going to be using TrueCrypt to do this. Which you can download here:
http://www.truecrypt.org/downloads.php
What we’re about to do is create a file, and create a hidden “volume” (it’ll show up as another drive) in that file and we’re going to password protect it. Encryption is automatic, real-time (on-the-fly) and transparent. It provides two levels of plausible deniability, in case an adversary forces you to reveal the password. The first is b/c it’s a hidden volume(steganography), the 2nd is that no TrueCrypt volume can be identified (volumes cannot be distinguished from random data). The encryption algorithms it uses are as follows: AES-256, Blowfish (448-bit key), CAST5, Serpent, Triple DES, and Twofish.
You want to download this application and run the installer. Do not install it to it’s default location.
Install it to your USB drive. The program will run on every computer from the USB drive. Once installed click the “Create Volume” button. This will guide you through the creation of two volumes, one viewable and one hidden. The hidden one is impossible to prove existing, and thus, the software you will install next won’t exist to someone who steals your key. During creation of the viewable volume, you want to make sure that you have a little breathing room so the drive can still be used without TrueCrypt..and enough so that TrueCrypt can still exist on the disc outside of the hidden volume. When you go to create the hidden volume the data path needs to be to your USB drive of course. 5-10 MB free will be enough. So if you’re running a 512MB USB stick, make you’re viewable volume 500MB (the hidden volume will the the same size).
Make sure the passwords you create for the viewable and hidden volumes are different. The hidden volume password should be alpha-numeric, not contain any common words or names, and at minimum 12 character long. (Also make sure you remember them b/c if you forget them you’re screwed).
Back at the Truecrypt main menu. We are going to need to mount the hidden volume. So what you do is press the Select File Button, and select the file you used to create the volume. Click mount volume, put in your password for the hidden volume and be sure to check the protect hidden volume option if you plan on writing to the volume everyone can see. This prevents us from accidentally corrupting our hidden programs or files. TrueCrypt will mount your hidden volume as a drive letter.
If all of this wasn’t quite clear, I did post a “HowTo” install and setup TrueCrypt over at TalkingForever’s Forums. This HowTo will walk you through screenshots, step by step on how to create an encryption hidden volume on a USB key.
Step by Step HowTo: Setup TrueCrypt
Starting with Portable Applications
And here’s where the fun begins.
Torpark is Firefox and the Tor Onion Routing Software Combined. To explain Onion routing, Tor helps to reduce the risks of both simple and sophisticated traffic analysis by distributing your transactions over several places on the Internet, so no single point can link you to your destination. The idea is similar to using a twisty, hard-to-follow route in order to throw off somebody who is tailing you—and then periodically erasing your footprints. Instead of taking a direct route from source to destination, data packets on the Tor network take a random pathway through several servers that cover your tracks so no observer at any single point can tell where the data came from or where it’s going.
Tor in itself requires a computer install, but not with Torpark. Note: the tor aspects of Torpark only work for this browser. For more info on how Tor works see:
http://tor.eff.org/overview.html.en
Download TorPark here:
http://torpark.nfshost.com/
Extract the zip file to your newly created Hidden Volume. The hidden volume will show up as a 2nd local disc on your My Computer. Chances are the drive letter is Z: (but not always by anymeans). And that’s it. It’s installed.
Browsing through TorPark is signifigantly slower than a regular connection. Here you will have to decide what’s more important, speed, or staying anonymous. Unless you build and host a Tor server yourself, you can’t complain.
Tweak TorPark
But alas there are hacks/tweaks to make TorPark run faster. (This can also be used on Portable Firefox as well).
First we’ll Kill the amount of RAM Firefox uses for it’s cache feature
Here’s how to fix it:
1. type “about:config” (no quotes) in the browser address bar
2. Find browser.sessionhistory.max_total_viewer
2. set it’s value to “0”
Increase the Speed in Which Firefox loads pages
1. stay in about:config
2. Alter the entries as follows:
Set “network.http.pipelining” to “true”
Set “network.http.proxy.pipelining” to “true”
Set “network.http.pipelining.maxrequests” to some number like 30 (this might piss off some website owners as it will request the page 30 times)
3. Lastly right-click anywhere and select New-> Integer. Name it “nglayout.initialpaint.delay” and set its value to “0”.
This value is the amount of time the browser waits before it acts on information it receives.
Kill RAM usage to 10mb when FF is minimized
This little about:config hack will drop Firefox’s/Torpark’s RAM usage down to 10 Mb when minimized
1. Open Firefox and go to the Address Bar. Type in about:config and then press Enter.
2. Right Click in the page and select New -> Boolean.
3. In the box that pops up enter config.trim_on_minimize. Press Enter.
4. Now select True and then press Enter.
5. Restart Firefox or Torpark.
Torpark Switch Proxy Extension
You may decide you don’t want 2 browsers on your USB key, but you don’t always want to use the Tor network to do your browsing due to speed. If this is the case install the Switch Proxy Extension and configure it.
(Note, this will undue Torpark’s default settings)
1. To Configure, install the extension, then restart TorPark.
2. A new toolbar has appeared.
3. Torpark already has a proxy configured.
4. Make sure the selected proxy says “None” and Hit Apply Now Torpark is no longer using Tor.
To set the option to turn Tor on:
1. So we’ll press Add
2.. Select “Standard” and “Next”
3.. Name it Tor and select “Manual Proxy Configuration”
4. Add the values 127.0.0.1 to the SOCKS Host and Port 81 (note, port 81 is just for Torpark. With a hard-drive install of Tor Firefox and Thunderbird will run through 8118.)
5. Socksv5 should be Selected
6. Hit Apply. Now Torpark is using Tor and you have the ability to switch back and forth.
(If you use Tor off the hard-drive and not just TorPark, the Switch Proxy extension can be used in Thunderbird to send e-mail as well. To download, you right click the install file and “Save As”, then in Thunderbird go to File –> Open. You’d configure it the same as the above.)
There’s a multitude of reasons you may not wish to use TorPark. And below is some reasons why:
1) Too slow and you value speed more than anonymous traffic
2) If you’re running applications through a hard-disk installed version of Tor (which you might decide to do with GAIM) you cannot run 2 Tor circuits simultaneously. You’d either have to run TorPark, or GAIM through Tor, but not both at the same time.
Download from here:
Portable Firefox
and do the same thing we did with TorPark. Unzip it to your hidden volume.
Firefox and TorPark Extensions
There’s a ton of extensions for usability and other issues that i love and use, but i’m not going to cover these. I’m only going to cover issues of a security nature.
All firefox plugins work with both TorPark and Portable Firefox. You will have to install an instance of each, to use them on both. Or just install them on the browser you chose to use most often. I do recommend these extensions for ALL versions of Firefox (portable, tor, or not).
NoScript – (already included in TorPark) Disables all website Java script by default and allows you to whitelist the sites you chose.
Customize Google– This will allow you to block Google ads, anonymize your Google cookie ID, and it’ll stop you from sending traffic to google analytics.
AdBlock-(already included in TorPark) Websites call ads that are actually just hot link scripts, flash files, images from other sites. These have the potential to install spyware. Best to block them. Ad block allows you to right click and ad and get rid of it for good.
Adblock Filterset G.Update– This loads a filterlist of most internet ad sites out there. This saves alot of time compared to manually blocking ads. It also updates itself automatically.
CookieSafe– This extension will allow you to easily control cookie permissions. It will appear on your statusbar. Just click on the icon to allow, block, or temporarily allow the site to set cookies.
SafeHistory– Restricts the marking of visited links on the basis of the originating document, defending against web privacy attacks that remote sites can use to determine your browser history at other sites. A link on a.com pointing at b.com will only be marked visited if you previously visited the b.com page with a referrer in the domain of a.com. On-site links work normally. Checks cookie settings (allow, originating site only, deny) to determine your desired privacy level (segmented by origin, don’t mark links visited in offsite frames, or never mark links visited).
SafeCache– Segments the cache on the basis of the originating document, defending against web privacy attacks that remote sites can use to determine your browser history at other sites. For example, a b.com image appearing on an a.com page would have a separate cache entry from the same image appearing on a b.com page, so a.com cannot use timing techniques to determine if you have visited b.com before. Checks cookie settings (allow, originating site only, deny) to determine your desired privacy level (segmented cache, cache originating site only, or never cache).
ClamGlue (will only work if WinClam is installed on the hard-drive.) This plugin uses WinClam anti-virus to scan every file Firefox downloads for viruses.
Portable Thunderbird with GPG Encryption
Same process. Download, unzip, setup to connect to your mail server. When you want to send an email, use Portable Thunderbird w/ Enigmail & GPG. Secure and anonymous e-mail has been addressed much earlier than secure and anonymous web browsing. This means the technology for e-mail is more mature, and has been tested a whole lot longer. We know GPG encryption can be relied upon to make sure all of our email transmissions are at least as secure as sealed mail. It works by creating a public key and a private key. You give your public key to anyone you want to write to. They give you their public key, and you encrypt your email with the public key of the person you’re talking to. Your email is then only readable by the person you send it to. With plenty of anonymous emailers around to send our email through, we can also be reassured our communication is anonymous. In other words, we can say it’s technically impossible to prove an email was sent by us. This is a good thing.
Portable Gaim, Encryption and Tor
We have 2 routes we can go here. The portable way, or the non-portable.
First, place the PortableGaim directory on your hidden share. We must also install GAIM on the hard-drive first (the full version) in order to install GAIM encryption. Currently the GAIM encryption will not let you change the install location so we’ll have to move the plugin manually. ( FYI: Gaim-Encryption uses NSS to provide transparent RSA encryption as a Gaim plugin.)
Lets get Encryption Working on Portable Gaim
1. Uncompress Portable Gaim into your hidden volume.(you may have already)
2. Download GAIM (the full version for Windows) and install it.
3. Download GAIM Encryption
4. Install Gaim Encryption on your hard-drive
5. Now it gets complex. We need to copy a series of files (about 20) from one location to another. Below is a list of the files that need to be copied from the install folder on your hard-drive, to the corresponding folder on your hidden volume. (If the folder isn’t there on the hidden volume, it needs to be created)
What a pain in the ass you say!?! Well i wrote a batch file to automate this. You’re welcome.
You MUST have your hidden volume mounted at Z:\ for this to work. and your Gaimportable directory needs to be directly in that volume. So.. Z:\Gaimportable should exist. Then right click and save this zip file, then extract it and run it.
gaimencryptportable.zip
If that file doesn’t work..Download it here, Right Click and Save As Once downloaded, right click and change the name. Change the extension from txt to bat. Double click to run it. and voila.
It copies these files and directories:
C:\Program Files\Gaim\plugins\encrypt.dll
C:\Program Files\Gaim\locale\cs\LC_MESSAGES\gaim-encryption.mo
C:\Program Files\Gaim\locale\da\LC_MESSAGES\gaim-encryption.mo
C:\Program Files\Gaim\locale\de\LC_MESSAGES\gaim-encryption.mo
C:\Program Files\Gaim\locale\es\LC_MESSAGES\gaim-encryption.mo
C:\Program Files\Gaim\locale\fr\LC_MESSAGES\gaim-encryption.mo
C:\Program Files\Gaim\locale\hu\LC_MESSAGES\gaim-encryption.mo
C:\Program Files\Gaim\locale\it\LC_MESSAGES\gaim-encryption.mo
C:\Program Files\Gaim\locale\ja\LC_MESSAGES\gaim-encryption.mo
C:\Program Files\Gaim\locale\nl\LC_MESSAGES\gaim-encryption.mo
C:\Program Files\Gaim\locale\pl\LC_MESSAGES\gaim-encryption.mo
C:\Program Files\Gaim\locale\pt_BR\LC_MESSAGES\gaim-encryption.mo
C:\Program Files\Gaim\locale\ru\LC_MESSAGES\gaim-encryption.mo
C:\Program Files\Gaim\locale\sl\LC_MESSAGES\gaim-encryption.mo
C:\Program Files\Gaim\locale\uk\LC_MESSAGES\gaim-encryption.mo
C:\Program Files\Gaim\locale\zh_TW\LC_MESSAGES\gaim-encryption.mo
6. Load Gaim and go to Tools –> Plugins and you should have the option to set encryption (Don’t click it yet)
7. Uninstall Gaim and Gaim Encryption from your computer in Add/Remove programs. Delete any residual folders in Program Files. and now test to see if the encryption plugin loads and creates a key.
This ONLY works if you’re chatting with someone else using encryption. Good to note, that most simple packet sniffers that capture and translate AIM/Yahoo/MSN/Jabber traffic tend to read person to person conversations, not chat rooms. More sophisticated ones read both without a hitch. Encryption is meaningless in chatroom for AIM, MSN, and Yahoo. It simply does nothing.
If you want to have a secure connection that’s encrypted for a chat room, (this is great of business conferences across the web), GAIM can connect you to another client. SILC. It will automatically assign you a name and password and prompt you to accept or deny encryption keys. Of course the people you chat with, will to use SILC as well.
Route GAIM through Tor
You can still chose to just use the above setup if you wish.. or you can use GAIM + encryption plugin loaded onto your hard drive and route it through Tor.
You’ll need to install Tor Bundle for Windows (on the hard-drive.. it’s not a portable application) and change the proxy for each account you’re chatting on to a SOCKS4 proxy.
1.Go to Create a new or Modify an existing account.
2.Select “Show More Options”. Here you can input proxy data.
3.Select Socksv4. You’ll want to use the term “localhost” (no quotes) as the proxy (this will access the tor circuit). The port you’d chat on would be 9050.
Download the standalone application here
uTorrent is the most lightweight bit torrent application i can find. Weighing in at 154kb (smaller than this tutorial). Beware though, you can route this through Tor if you have a hard-drive install, but otherwise it’s unencrypted. I also don’t recommend doing bit torrent through the Tor network. Tor’s network is slow enough as it is without people hogging it with bit torrent traffic. There’s also no SafePeer-like plugin like there is for Azureus. I’m currently working to find an alternative that will allow you to load blocklists of IP addresses to ensure the RIAA or MPAA isn’t tracking what files you’re leeching/seeding. (among other issues). So use at your own risk. You know, if you’re using it for illegal purposes. But you know, none of us would dare do that, would we?
If you could care less about if it’s a portable app, i’d say go with Azureus and get the Safepeer plugin.
Encrypt uTorrent
Taken from here
More and more ISP’s are limiting throttling BitTorrent traffic on their networks. By throttling BitTorrent traffic the speed of BitTorrent downloads decrease, and high speed downloads are out of the question.
The list of ISP’s that limit BitTorrent traffic, or plan to do so is growing every day, and according to the BBC, the ‘bandwidth war’ has begun. Are you not sure if your traffic is being throttled Check the list of bad ISP’s.
But there is a solution. Encrypting your torrents will prevent throttling ISP’s from shaping your traffic. I will explain how to enable encryption in µtorrent.
1. Go to: Options > Preferences > Network
2. Go to ‘Protocol encryption’, you can choose between ‘enabled’ and ‘forced’. ‘Enabled’ will give you more connections but offers less protection against traffic shapers. I would recommend to try ‘enabled’ first, if that doesn’t increase your speeds you need to swich to ‘forced’.
3. Ticking ‘Allow legacy incoming connections’ allows non ecrypted clients to connect to you. This improves compatibility between clients but makes you more vulnerable to traffic shapers.
That’s it, your Bittorrent traffic is encrypted now.
I would recommend to tick this box, but if that doesn’t increase your speeds, untick it!
Portable Open Office and Abi Word
People tend to define their office software by the quality of the word processor more than anything. OpenOffice’s Writer just doesn’t add up, but the rest of the suite is more than suitable IMO. You can choose to go with or without Abi Word as Open Office does come with Writer, their word processor. I just prefer Abi Word over Writer myself.
I pick these apps, not only because they’re portable, but unlike MS Office (which isn’t portable) they don’t leave behind data showing who made the file, edits and changes that were done to the file over time, etc. MS Office has the ability to turn those features off, but it’s a pain in the ass.
Download and unzip just like all the rest.
Here for Open Office Here for Abi Word
OpenOffice tends to open up a bit slow. Once extracted to the hidden volume you can improve this by doing the following. Open any of OpenOffice’s apps (Writer, Calc, Impress, Draw, Base, Math) and do the following:
1. Go to Tools
2. Go to Options
3. Go to Memory
4. Change number of steps to 10.
5. Change “Use for Open Office” to 30.
6. Change “Memory per Object” to 7.
7. Change “Remove After Memory” to 0:00:05
8. Change Number of Objects to 10
9. Close the app.
VNC can allow us to do some nifty tricks as well, or you may just need it to aid in technical problems of another, but we’ll focus on hiding our network activity here.
- Download it here http://www.realvnc.com
- Install it (make sure to get the zip file, not the exe)
- And run vncviewer.exe
Now how to browse the web, chat, and e-mail from anywhere on your home computer:
1. You can install this on your home computer (this time install both the server and the viewer).
2. Password protect the server.
3. Make sure port 5900 is open on your firewall.
4. If you have a router, make sure your router forwards port 5900 to the private IP address of the machine you installed the VNC server on. (More than likely 192.168.x.x or 10.0.x.x)
5. Now mount your hidden volume on a computer at your place of business, education, a library, or a from friend/family’s house. Open VNCViewer, type the IPaddress and password to your home computer. Now you should be able to view the desktop of your home machine.. and use that to browse, chat, send e-mail. All traffic analyzing would see is that you’re passing ARP packets and bmp files on port 5900. You’re web activity on your home computer is untracable to the LAN you’re connected to.
Pstart
Creates a tray icon that allows you to link in your portable applications. It simplifies access to the programs,rather than continually having to dig through folders to get the executable.
Challenger Encryption
So lets say you do something really stupid and you have extra senstive files you absolutely cannot have anyone have access to. Bank records, credit card records, files in regards to your business, etc.. and you leave your hidden volume mounted and walk away from your machine? These files are now exposed to a threat. Now, we wouldn’t ever want this situation happening. But it happens, and interested parties could take advantage of it.
This is where Challenger comes in. Download the app here.
1. Use 7-zip to extract the folders.
2. Place these folders in a folder on your hidden volume
3. The app is in the device folder and is named cha.exe
4. Type Berlin for the first word pass
5. Click Activate Phrase
6. Select A “Masterphrase” and click new. Then input your password. Do not forget it.
7. Then go to File > Settings.
8. Make sure all 3 on security are checked, and the drop downs are all 7-vsitr (NSA 7 Pass)
9. Hit Encrypt File or hit Folder-or-Drive
10. Select the folder or file(s) that you need protected.
What this will do is encrypt the files. The file extension will change to a *.cha file, and the original file will be deleted with 7 passes (garbage re-writes). When you go to unencypt the file, the encrypted file will also be deleted with 7 passes. Leave the files you need to absolutely protect as encrypted until you need to access them. If these files are that important, it’s a good idea to have a secure and encrypted backup of them somewhere as well.
Skype
The encryption behind Skype’s VoIP is amazing. So it’s rather great the folks over at U3P to make a portable version of the software. You can obtain the U3P file here
Download it, use a program like 7-Zip to extract it your to hidden volume and in the Skype/host directory is the Skype.exe.
These Portable Apps you may or may not need.
ClamWin Anti-Virus
VLC Media Player
Scribus
GIMP Image Editor
NVU HTML Editor
Notepad2 (open source Notepad with more functionality than MS’s notepad
FoxitPDF Reader
Cyber Shredder (has NSA 7 Pass deletion method)
CurrPorts
Angry IP Scanner
Rootkit Revealer
Regmon
Filemon
Diskmon
XAMPP: portable Apache, mySQL, PHP and phpMyAdmin
Microburner (CD burning app)
Locknote: create an encrypted note to yourself on the fly
I’ve created a zip file for download via rapid share, a torrent will be coming soon. The zip contains these portable applications.
- Crap Cleaner (you must run the RunCCleaner.bat to run the application)
- Foobar2000 Media Player
- GiveMeToo Packet Sniffer (easier than Ethereal, leaves a folder C:\GrabbedStuff for logs)
- Portable Ad-Aware
- Portable Spybot
- Portable Spyware Blaster (comes with VB and Java lib install files in case the app doesn’t work)
- Restoration (Restores files deleted by a normal Windows delete)
- utool (uninstalls apps, sees apps Add/Remove programs do not, light weight and speedy)
- Avast Antivirus (scaled down version, only finds about 50 major viruses)
- Calculator
- Flushcode
- HiJackThis (advanced spyware removal)
- MsPaint
- Process Monitor
- Putty (telnet and ssh client)
- SafeXP (make it easy to shut off system broadcasts and services)
- McAfee Stinger (scaled down version to remove viruses)
- TweakUI
- UPXShell
- Killbox (deletes files that windows won’t allow you to)
- Winpooch (monitors system folders for spyware)
Download it here from rapidshare PortableApps.zip
Download all these apps via bit torrent (430MB)
and… we’re done for the Portable stuff. Now you have a USB key you can take around with you and open your TrueCrypt volumes anywhere and run this software anywhere with a heightened sense of security. Whether at school, a library, work, a family’s house.. your private business, stays private. Just don’t be cocky. There’s no such thing as being 100% secure, and 100% anonymous.
Common Sense Tips
1. Make sure you’re firewall is on, and make sure it’s configured well. Allowing through only the programs you need to allow through.
2. Get a registry or spyware monitor. Regmon is a good registry monitor. Winpooch is an excellent Registry and system file monitor and can prevent system changes (it can also hook WinClam anti-virus, and gives it real time active scanning ability.. which it doesn’t have).
3. If it’s a computer you use often, get some anti-spyware apps and some anti-virus apps if allowed and installed them on the hard-drive, run them at the very least weekly.
4. Try using the latest software and keeping up to date with security updates on a machine.
Installing Tor to a Hard-drive
I’ve mentioned several times throughout the article, that there are advantages to having Tor run locally on the machine. You can download and install the application here:
http://tor.eff.org/download.html.en
You can also go this route of going through a proxy site. There’s hundreds of them. But be warned. Alot of websites also block these proxies. So don’t be suprised if you can’t post on your favorite message board with them. Also, it’s generally a bad idea to input a password into a site while browsing through one of these. As your cookies for the site are stored on their servers and all information you input can be extracted from their servers. Also, these should be used to get around web filters more than anything. Don’t expect them to keep you anonymous on your LAN, or on the servers of the pages you’re accessing. There are packet sniffers that can see where you’re going even through a web proxy
It should also be noted, that a proxy that will never go away is simply.. Google’s translate function. Take your favorite website and get Google to translate it to English. Google will then automatically act as a proxy for your activity on the site.
GO Anon
VTunnel
SickProxy
URhidden
Trickmy
aTunnel
For the truly dedicated, this is also a route to take. To do anonymous web activity (i wouldn’t suggest this in a work place or a school..) Download this Live CD, burn the ISO as a bootable disc, boot your computer on it, and use this to access someone else’s WiFi network. All your Windows Portable apps will not work with this as this is a version of Linux with applications installed for you. You merely boot your computer off the cd and the operating system loads. When you’re done, eject the cd, boot your computer back up, and you’ll be back to normal with Windows and all. From their homepage:
kaos.theory’s Anonym.OS LiveCD is a bootable live cd based on OpenBSD that provides a hardened operating environment whereby all ingress traffic is denied and all egress traffic is automatically and transparently encrypted and/or anonymized.
It would be good to note that if you use a LiveCD such as this one coupled with your USB key for permanent storage of files you download, it ensures a much higher level of security. Since absolutely nothing gets written to the harddrive. AnonymOS isn’t by far the only LiveCD out there (you got Knoppix, Damn Small Linux, etc), but it’s by far the best in terms of security so far.
Simple Tests
As the title says, SIMPLE. Meaning, just because you pass these tests doesn’t mean you’re 100% secure or anoymous (on the LAN side or the WAN side).
The easiest thing you can do to test your anonymity is to go to WhatismyIP.com and see if the IP showing up is yours or not.
After that you can check out services like:
AuditmyPC Privacy & Spyware Check
And then there are various proxy tests:
Proxy Test and Proxy Checker.
Here you can see if your machine is leaking any info.
Blog at WordPress.com.
Entries and comments feeds.
element14 