Nguyen Tien Huy: February 2017

#apt-get install build-essential git
#apt-get install libssl-dev zlib1g-dev libpcre3-dev libgd2-xpm-dev libgeoip-dev libxslt1-dev libxml2-dev

#wget https://www.openssl.org/source/openssl-1.0.2l.tar.gz
#tar -xzvf openssl-1.0.2l.tar.gz
#git clone https://github.com/nbs-system/naxsi.git

#wget http://nginx.org/download/nginx-1.12.0.tar.gz
#tar -xzvf nginx-1.12.0.tar.gz
#cd nginx-1.12.0
#./configure --with-cc-opt='-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2' --with-ld-opt=-Wl,-z,relro --prefix=/usr/share/nginx --sbin-path=/usr/local/sbin --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --user=www-data --group=www-data --with-debug --with-pcre-jit --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_addition_module --with-http_dav_module --with-http_geoip_module --with-http_gzip_static_module --with-http_image_filter_module --with-http_sub_module --with-http_xslt_module --with-mail --with-mail_ssl_module --with-http_v2_module --with-http_slice_module --with-file-aio --with-http_secure_link_module --with-openssl=../openssl-1.0.2l --add-module=../naxsi/naxsi_src
#make
#make install

Here is content of nginx.conf

user www-data;

worker_processes auto;

pid /run/nginx.pid;

events {

        worker_connections 4096;

        multi_accept on;

        use epoll;

}

http {

        server_tokens off;

        sendfile on;

        tcp_nopush on;

        tcp_nodelay on;

        types_hash_max_size 2048;

        client_max_body_size 50M;

        client_body_buffer_size 1m;

        client_body_timeout 15;

        client_header_timeout 15;

        keepalive_timeout 2 2;

        send_timeout 15;

        include /etc/nginx/mime.types;

        error_log /var/log/nginx/error.log;

        access_log off;

        charset                         utf-8;

        gzip on;

        gzip_disable "msie6";

        gzip_vary on;

        gzip_proxied any;

        gzip_comp_level 6;

        gzip_min_length 1100;

        gzip_buffers 16 8k;

        gzip_http_version 1.1;

        gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;

        open_file_cache max=2000 inactive=20s;

        open_file_cache_valid 60s;

        open_file_cache_min_uses 5;

        open_file_cache_errors off;

        include /etc/nginx/naxsi-core.rules;

        include /etc/nginx/sites-enabled/*.conf;

}

Here is content of naxsi-core.rules

##################################

## INTERNAL RULES IDS:1-999     ##

##################################

#@MainRule "msg:weird request, unable to parse" id:1;

#@MainRule "msg:request too big, stored on disk and not parsed" id:2;

#@MainRule "msg:invalid hex encoding, null bytes" id:10;

#@MainRule "msg:unknown content-type" id:11;

#@MainRule "msg:invalid formatted url" id:12;

#@MainRule "msg:invalid POST format" id:13;

#@MainRule "msg:invalid POST boundary" id:14;

#@MainRule "msg:invalid JSON" id:15;

#@MainRule "msg:empty POST" id:16;

#@MainRule "msg:libinjection_sql" id:17;

#@MainRule "msg:libinjection_xss" id:18;

##################################

## SQL Injections IDs:1000-1099 ##

##################################

MainRule "rx:select|union|update|delete|insert|table|from|ascii|hex|unhex|drop" "msg:sql keywords" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1000;

MainRule "str:\"" "msg:double quote" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8,$XSS:8" id:1001;

MainRule "str:0x" "msg:0x, possible hex encoding" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:2" id:1002;

## Hardcore rules

MainRule "str:/*" "msg:mysql comment (/*)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1003;

MainRule "str:*/" "msg:mysql comment (*/)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1004;

MainRule "str:|" "msg:mysql keyword (|)"  "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1005;

MainRule "str:&&" "msg:mysql keyword (&&)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:8" id:1006;

## end of hardcore rules

MainRule "str:--" "msg:mysql comment (--)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1007;

MainRule "str:;" "msg:semicolon" "mz:BODY|URL|ARGS" "s:$SQL:4,$XSS:8" id:1008;

MainRule "str:=" "msg:equal sign in var, probable sql/xss" "mz:ARGS|BODY" "s:$SQL:2" id:1009;

MainRule "str:(" "msg:open parenthesis, probable sql/xss" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$SQL:4,$XSS:8" id:1010;

MainRule "str:)" "msg:close parenthesis, probable sql/xss" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$SQL:4,$XSS:8" id:1011;

MainRule "str:'" "msg:simple quote" "mz:ARGS|BODY|URL|$HEADERS_VAR:Cookie" "s:$SQL:4,$XSS:8" id:1013;

MainRule "str:," "msg:comma" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1015;

MainRule "str:#" "msg:mysql comment (#)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1016;

MainRule "str:@@" "msg:double arobase (@@)" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1017;

###############################

## OBVIOUS RFI IDs:1100-1199 ##

###############################

MainRule "str:http://" "msg:http:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1100;

MainRule "str:https://" "msg:https:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1101;

MainRule "str:ftp://" "msg:ftp:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1102;

MainRule "str:php://" "msg:php:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1103;

MainRule "str:sftp://" "msg:sftp:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1104;

MainRule "str:zlib://" "msg:zlib:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1105;

MainRule "str:data://" "msg:data:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1106;

MainRule "str:glob://" "msg:glob:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1107;

MainRule "str:phar://" "msg:phar:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1108;

MainRule "str:file://" "msg:file:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1109;

MainRule "str:gopher://" "msg:gopher:// scheme" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$RFI:8" id:1110;

#######################################

## Directory traversal IDs:1200-1299 ##

#######################################

MainRule "str:.." "msg:double dot" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1200;

MainRule "str:/etc/passwd" "msg:obvious probe" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1202;

MainRule "str:c:\\" "msg:obvious windows path" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1203;

MainRule "str:cmd.exe" "msg:obvious probe" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1204;

MainRule "str:\\" "msg:backslash" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:4" id:1205;

#MainRule "str:/" "msg:slash in args" "mz:ARGS|BODY|$HEADERS_VAR:Cookie" "s:$TRAVERSAL:2" id:1206;

########################################

## Cross Site Scripting IDs:1300-1399 ##

########################################

MainRule "str:<" "msg:html open tag" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$XSS:8" id:1302;

MainRule "str:>" "msg:html close tag" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$XSS:8" id:1303;

MainRule "str:[" "msg:open square backet ([), possible js" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$XSS:4" id:1310;

MainRule "str:]" "msg:close square bracket (]), possible js" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$XSS:4" id:1311;

MainRule "str:~" "msg:tilde (~) character" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$XSS:4" id:1312;

MainRule "str:`"  "msg:grave accent (`)" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$XSS:8" id:1314;

MainRule "rx:%[2|3]."  "msg:double encoding" "mz:ARGS|URL|BODY|$HEADERS_VAR:Cookie" "s:$XSS:8" id:1315;

####################################

## Evading tricks IDs: 1400-1500 ##

####################################

MainRule "str:&#" "msg:utf7/8 encoding" "mz:ARGS|BODY|URL|$HEADERS_VAR:Cookie" "s:$EVADE:4" id:1400;

MainRule "str:%U" "msg:M$ encoding" "mz:ARGS|BODY|URL|$HEADERS_VAR:Cookie" "s:$EVADE:4" id:1401;

#############################

## File uploads: 1500-1600 ##

#############################

MainRule "rx:\.ph|\.asp|\.ht" "msg:asp/php file upload" "mz:FILE_EXT" "s:$UPLOAD:8" id:1500;

Here is content of /lib/systemd/system/nginx.service

[Unit]

Description=The NGINX HTTP and reverse proxy server

After=syslog.target network.target remote-fs.target nss-lookup.target

[Service]

Type=forking

User=root

Group=root

PermissionsStartOnly=true

ExecStartPre=/bin/mkdir -p /var/lib/nginx

ExecStartPre=/bin/chown -R www-data:www-data /var/lib/nginx

PIDFile=/run/nginx.pid

ExecStartPre=/usr/local/sbin/nginx -t

ExecStart=/usr/local/sbin/nginx

ExecReload=/bin/kill -s HUP $MAINPID

ExecStop=/bin/kill -s QUIT $MAINPID

PrivateTmp=true

[Install]

WantedBy=multi-user.target

#systemctl enable nginx.service

As a system administrator, you may have a certain directory that you want to give read/write access to every user on a Linux server. In this guide, we will review how to enable write access to all users on a particular directory (shared directory) in Linux.

This calls for setting the appropriate access permissions, and the most effective as well as reliable method to allocating a common group for all the users who will share or have write access to the specific directory.

So, start by creating the directory and common group in case it doesn’t already exist on the system as follows:

$ sudo mkdir -p /var/www/reports/
$ sudo groupadd project

Then add an existing user who will have write access to the directory: /var/www/reports/ to the group project as below.

$ sudo usermod -a -G project tecmint

The flags and arguments used in the above command are:

-a – which adds the user to the supplementary group.
-G – specifies the group name.
project – group name.
tecmint – existing username.

Afterwards, proceed to configure the appropriate permissions on the directory, where the option -Renables recursive operations into subdirectories:

$ sudo chgrp -R project /var/www/reports/
$ sudo chmod -R 2775 /var/www/reports/

Explaining the permissions 2775 in the chmod command above:

2 – turns on the setGID bit, implying–newly created subfiles inherit the same group as the directory, and newly created subdirectories inherit the set GID bit of the parent directory.
7 – gives rwx permissions for owner.
7 – gives rwx permissions for group.
5 – gives rx permissions for others.

You can create more system users and add them to the directory group as follows:

$ sudo useradd -m -c "Aaron Kili" -s/bin/bash -G project aaronkilik
$ sudo useradd -m -c "John Doo" -s/bin/bash -G project john
$ sudo useradd -m -c "Ravi Saive" -s/bin/bash -G project ravi

Then create subdirectories where the new users above will store their project reports:

$ sudo mkdir -p /var/www/reports/aaronkilik_reports
$ sudo mkdir -p /var/www/reports/johndoo_reports
$ sudo mkdir -p /var/www/reports/ravi_reports

Now you can create files/folders and share with other users on the same group.

source

Nguyen Tien Huy

Wednesday, February 15, 2017

compile nginx-1.1x.x

Friday, February 3, 2017

How to Create a Shared Directory for All Users in Linux

Nguyen Tien Huy