Web aplicaciones security checklist

Modern day web is mainly a hostile environment.




Accesing a H2 server database with PostgreSQL driver via ODBC

In order to setup a h2 instance we must start h2 daemon with the following syntax:
java -jar h2-1.3.163.jar -tcp -pg  -baseDir /temp/db2
This command line means :
start h2 in server mode, allowing connections only from localhost setting root database to /temp/db2.

Other interesting options are:

-tcpPort 9101

-tcpAllowOthers

-pgAllowOthers 

In order to create the database you must connect with admin user (SA and password recommended) for the very first time. For that you only need a jdbc connection.

If the database does not have a password for the SA user, you must set it with the folling command:
ALTER USER SA SET PASSWORD 'sa'


Then you can connect with a PostgreSQL client to the h2 database. 

OpenSSL Cheat sheet

Today I have found a very interesting web page http://wiki.samat.org/CheatSheet/OpenSSL it contains a lot of interesting recipes with short descriptions about functionallity.

OPENSSL CA

Selfsigned CA:
Steps
1) Create private key

openssl genrsa -aes128 -passout pass:foobar -out keys/privkey.pem 2048

2) Create public key

openssl req -new -x509 -days 1001 -key keys/privkey.pem -passin pass:foobar -out ca.cer <<EOF
>ES
>Spain
>Madrid
>Test
>Security
>AutoridadVal
>tt@none.es
>EOF

Script for data encryption with openssl

#!/bin/bash
export data=$2
openssl enc -blowfish -e -a -pass pass:$1 <<EOF
$data
EOF

Changing unix password with a script

This script is a test, use it at your own risk

#!/bin/bash
export pass=$1 
export user=$2
# we have assigned the data 
passwd $user << END
$pass
$pass
END

Miscelaneus

Timing a command

 time ls 

Edit a file with cat

cat </tmp/test

Dasource deployment with Tomcat

Deploying a datasource shows the following error:

 org.apache.commons.dbcp.SQLNestedException: Cannot create JDBC driver of class '' for connect URL 'null', cause:
java.sql.SQLException: No suitable driver

Check if /conf/catalina/localhost/ is up to date with your current configuration.

Check if your application has the datasource definition on META-INF/context.xml

Check if both /conf/catalina/localhost/ and META-INF/context.xml match in the datasource definition.

Squid configuration samples

Http Authentication

debug_options ALL,9
http_port 80 accel defaultsite=wamp
cache_peer wamp parent 80 0 no-query originserver name=myAccel
external_acl_type ext_acl children=5 %PATH /etc/squid3/external_acl_test.sh admin123 paso123
acl script external ext_acl
acl aport port 80
http_access allow script aport
http_access deny all

For offline cache:

 visible_hostname www.demo.es


## DEF DE CACHES
cache_dir ufs /usr/local/squid/cache 200 16 256

## DEF DE LOGS
access_log /usr/local/squid/logs/access.log
cache_store_log /usr/local/squid/logs/store.log
cache_log /usr/local/squid/logs/cache.log
pid_filename /usr/local/squid/logs/squid.pid

## Directiva de configuracion
## se define el puerto de servicio 3380
## como acelerador y le decimos q se asocia a www.demo.es
http_port 3380 accel defaultsite=www.demo.es

## Directiva de configuracion
## el servidor que tiene los contenidos es localhost
## el cache es de tipo superior
## el puerto es el 80
## el puerto del icp no esta definido
## no se solicita ICP queries
## es un originserver
cache_peer localhost parent 80 0 no-query originserver name=myAccel

## Directiva de configuracion
##  definimos la acl "reverse_proxy" cuyo dstdomain es "www.demo.es"
acl reverse_proxy dstdomain www.demo.es


## Directiva de configuracion
## Directiva de configuracion
http_access allow reverse_proxy
offline_mode on


maximum_object_size 64 MB
refresh_pattern -i (/cgi-bin/|\?) 5 20% 20 ignore-no-store ignore-no-cache

Jailing environmente with chroot.

First: directory structure

 ./
.script.rc  bin  config  lib64  spool

./bin:
.lsd  bash  cat  init.rc  ls  sqlite3 echo 

./config:
current

./lib64:
ld-linux-x86-64.so.2  libc.so.6        libpthread.so.0   libselinux.so.1
libacl.so.1           libdl.so.2       libreadline.so.5  libsqlite3.so.0
libattr.so.1          libncurses.so.5  librt.so.1

./spool:
commands

Second. Creating a custom console.

 exec /usr/bin/rooted /var/cage /bin/init.rc

Third. Creating suid exec for chroot.

 cp /usr/bin/chroot /usr/bin/rooted
chmod u+s /usr/bin/rooted

Adendum. /bin/init.rc

 /bin/bash --init-file /.script.rc

Top shows incorrect amount of memory in use

Just in case that there's someone as clueless as i was... "top" command lies about your memory usage with "new" kernels (2.6.x series) .Let me explain how this game works. 

jupiter:/disponible/cargaMasivaDesa # top
Tasks: 108 total,   1 running, 105 sleeping,   2 stopped,   0 zombie
Cpu0  :  0.0%us,  0.0%sy,  0.0%ni,100.0%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st
Cpu1  :  0.0%us,  1.0%sy,  0.0%ni, 99.0%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st
Mem:   6127780k total,  6072248k used,    55532k free,   297820k buffers
Swap:  2096472k total,     3320k used,  2093152k free,  3969068k cached

After a reboot everything seems in place, I mean you can "top" and watch your memory report correctly but after some hours (in my case more or less a day) you'll see that almost your memory is gone. But if you calm your nerves you'll see that counting process and the memory used by them will report that your memory is okey... So???

It seems that the important info is not on free/used fields reported by this tool. The stuff that really matters is in /proc/meminfo.

 jupiter:/disponible/cargaMasivaDesa # cat /proc/meminfo
MemTotal:        6127780 kB
MemFree:           56568 kB
Buffers:          297864 kB
Cached:          3865668 kB
SwapCached:         1268 kB
Active:          2135488 kB
Inactive:        3655580 kB

Active: means memory in used

Inactive: means memory free but not available

Now i can sleep better!! . For more information you can have  a look to the following articles:

http://www.netadmintools.com/art416.html

http://www.tldp.org/LDP/tlk/mm/memory.html

Cheers

P.S: memory reporting command by process

 ps -eo pmem,pcpu,rss,vsize,args | sort -k 1 -r | head -10

Practical rc sripting in FreeBSD.

 Check out this link

Basic monitorization

Filesystem usage

#!/bin/bash
export data=`df -h |awk {'print $5 "@" $6'}|grep -v Use|sed 's/%//g'`
export result=""
for value in $data
do
export number=`echo $value|cut -d @ -f1`
export filesys=`echo $value|cut -d @ -f2`



if [ $number -gt 80 ]
then
result="${result} ${filesys}"
fi
done




export count=`echo $result|wc|awk {'print $2'}`
if [ $count -eq 0 ]
then
exit 0
else
echo $result
exit 1
fi

Cpu and memory usage per process

ps -eo pcpu,pid,size,vsize,user,cmd|sort -k 1 -r|head -10