分类： Internet

  • DNS software

    Copy from:  http://maradns.samiam.org/dns_software.html

    DNS software

    The “big five”. The “CVE” links point to the National Vulnerability Database’s list of security issues for the program in question; I also have a comparison of DNS servers’ security history.

    • BIND is the swiss army knife of DNS servers. It has a lot of features and can do pretty much everything. It’s also a big binary and sometimes difficult to configure. CVE
    • Unbound and NSD make up a suite of DNS servers; they are both from NLnet Labs.Basically, one (NSD) puts your web page on the Internet; the other (Unbound) looks for web pages on the Internet. NSD CVE (None of those entries look to point to NSD; it appears to have no CVE entries) Unbound CVE
    • PowerDNS (which like Unbound/NSD, is two separate programs) has a lot of flexibility with connecting to databases or what not to resolve a DNS name. Used by Wikimedia, among others. CVE.
    • DjbDNS. Great tiny two-program DNS suite that sadly hasn’t been updated by DJB since 2001. Yes, it does have security problems (That’s a CVE link). Note that there are still people on the Internet who pretend DjbDNS 1.05 is magically perfectly secure. Sigh; there’s a lot of stupid out there on the ’net.For anyone who wants to use DjbDNS, use N-DjbDNS, which is patched against all known security holes (be sure to use a version with commit 16cb625e).
    • MaraDNS. I think it’s the best one, but my opinion is a little biased. It was once a single program, now two separate programs (like Unbound/BSD and PowerDNS) Easy-to-configure; tiny binary suitable for embedded systems. CVE

    There are many many other DNS servers, both open source and non-open source.

    Some other DNS servers:

    Freely downloadable DNS servers

    Caching DNS servers

    • DnsMasq is a non-recursive caching DNS server.
    • pdnsd is a recursive caching DNS server. Paul Rombouts is (was?) the current maintainer of this program.
    • Posadis is another DNS server project, similar to MaraDNS. This server is now both a resolving and an authoritative DNS server. Hasn’t been updated in a while.

    Non-recursive DNS servers

    • Knot DNS has DNSSEC support.
    • MyDNS is an authoritative-only DNS server which uses MySQL as a database back end. The most currently updated version appears to be MyDNS-ng, the “next generation” version of MyDNS.
    • SDNS is a project written in the late 1990s by Sandia Labs. Like MaraDNS, this project was written with security in mind. Since this is a government project, the code is public domain. The program does not seem to be downloadable anywhere, so I am mirroring it here. I would like to thank Fred Cohen for informing me about this package.
    • The Pliant language/package comes with a DNS server. This DNS server can not recursively process DNS queries given a list of root servers.
    • Twisted includes a non-recursive DNS server.
    • DnsJAVA is an authoritative-only DNS server written in Java.
    • The Eddit project includes a DNS server
    • SheerDNS is a simple non-caching DNS server that stores all records as their own files.

    Abandoned DNS server projects

    These are DNS server projects which have not released any files for a significant period of time, and are not fully functioning DNS servers (either because the program did not have basic DNS functionality when abandoned, the program was not documented before being abandoned, or because the program was abandoned so long ago that it is not fully functional on today’s internet).

    • Oak DNS is a DNS server written completely in python. It is compatible (I think) with both BIND zone files and cache files. The file can be downloaded here, or here. The most recent alpha version can be downloaded here. The most recent file in this alpha is from February of 2003; the original website is now owned by a cyber-squatter. (Thanks, Michel Talon, for the update)
    • MooDNS is another DNS server project. A CVS checkout on January 21, 2003 shows that no files have been updated since July 20, 2002, except for a single readme file updated on August 1, 2002. This project is abandoned.I have made a tarball available for people who do not want to bother with a CVS checkout.
    • Dents is a DNS server that showed a lot of promise. Unfortunately, no files have been released since 1999.
    • Yaku-NS is a DNS server geared towards embedded systems. According to the changelog, no one has made any changes to this software since Feburary, 2001.
    • CustomDNS has not released any files since the summer of 2000.

    Other

    Proprietary DNS solutions

    No, I have not listed every single DNS server that exists here.

  • DNS proxy

    Penetration Testers and Malware Analysts

     

    DNSChef:         (Python)

    https://thesprawl.org/projects/dnschef/

     

    Tcp-DNS-proxy   (Python)

    https://github.com/henices/Tcp-DNS-proxy

     

    DNSCrypt-proxy   ( DNS => DNSCrypt protocol )

    http://dnscrypt.org/

     

    dnsproxy

    http://www.wolfermann.org/dnsproxy.html

     

    Acrylic DNS Proxy  (windows)

               http://sourceforge.net/projects/acrylic/

  • iptables

    Iptables 指南 1.1.19
    http://man.lupaworld.com/content/network/iptables-tutorial-cn-1.1.19.html

    Linux数据包路由原理、Iptables/netfilter入门学习
    http://itindex.net/detail/49448-linux-%E6%95%B0%E6%8D%AE%E5%8C%85-%E8%B7%AF%E7%94%B1

    Iptables入门教程
    http://drops.wooyun.org/tips/1424

    linux防火墙iptables常用规则
    http://www.xker.com/page/e2012/0926/120758.html

    NAT – Network Address Translation
    http://www.karlrupp.net/en/computer/nat_tutorial

    Quick HOWTO : Ch14 : Linux Firewalls Using iptables

    http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch14_:_Linux_Firewalls_Using_iptables#.VMnDgyz2CXQ

  • uninstal DD-WRT from WNDR3700 v4

    Download factory image WNDR3700v4-V1.0.1.32 from netgear web site
    Flash back via TFTP method

    http://forum1.netgear.com/showthread.php?t=53239

    – plug the PC into LAN port 1
    – set the pc to a static IP of 192.168.1.2
    – power on the router
    – press and hold the RESET button as soon as the switch LEDs light up.
    – keep holding RESET until the power LED begins to flash orange and then green.
    – only the power LED is flashing green (and of course port 1), release RESET and than
    -tftp -i -v 192.168.1.1 PUT <filename>

  • Install dd-wrt onto wndr3700 v4

    Hardware:                       2.4G/5G Wifi,  USB,  128MB RAM/128B NAND

    Version Installed:             DD-WRT v24-sp2 (01/04/15) std – build 25760

    Feature Integrated:

    FreeRadius,                   PPPoE Server / Relay
    PPTP Server / Client,     OpenVPN Server / Client
    USB:                               Printer,  Storage,     USB Over IP
    FTP Server,                    DLNA Server,          Samba Server
    SIP Proxy,                       Http Server (Lighttpd)
    Mikrotik MAC Telnet,      IP over DNS Tunneling (nstx)
    SNMP,                            VNC Repeat,          Zabbix client

     

    Add 32G USB key with following partition setting:

    Part1 LABEL=”EXEC”   SIZE=2G   TYPE=”ext4″ With Journal

    Part2  LABEL=”DATA”   SIZE=30G  TYPE=”ext4″ Without Journal

     

    SSH into the route and execute:

    umount /dev/sda1
    umount /dev/sda2
    mkdir /mnt/exec
    mkdir /mnt/data
    mount /dev/sda1 /mnt/exec
    mount /dev/sda2 /mnt/data
    cp -r -p  /opt /mnt/exec/
    cp -r -p  /etc /mnt/exec/
    cp -r -p /www /mnt/exec/
    cp -r -p /jffs /mnt/exec/

    Startup Script:
    umount /dev/sda1
    umount /dev/sda2
    cp -r -p /tmp /tmp/mnt
    mkdir /mnt/exec
    mkdir /mnt/data
    mount /dev/sda1 /mnt/exec
    mount /dev/sda2 /mnt/data
    mount –bind /mnt/exec/www /www
    mount –bind /mnt/exec/opt /opt
    mount –bind /mnt/exec/etc /etc
    mount –bind /mnt/exec/jffs /jffs
    mv /tmp/mnt/tmp /mnt/exec/
    mount –bind /mnt/exec/tmp /tmp

  • Block IP Addr

    How To List Your Existing IP Address Rules

    iptables -L

    How To Help

    iptables -h

    How do I block an IP address ?

    iptables -A INPUT -s xx.xx.xx.xx -j DROP

    How To Block A Range of IP Addresses ?

    iptables -A INPUT -s xx.xx.xx.xx/8 -j DROP

    How can I block a particular PORT for a particular IP ?

    iptables -A INPUT -s IP-ADD -p tcp --destination-port portnumber -j DROP
    iptables -A INPUT -s xx.xx.xx.xx -p tcp --destination-port 25 -j DROP

     How to start/stop iptables

             /etc/init.d/iptables stop/etc/init.d/iptables start

    How do I unblock an IP address ?
    iptables -D INPUT -s IP-ADDR -j DROP

     How do I save iptables ?

           /etc/rc.d/init.d/iptables save
           service iptables save
    *****************************************************
    Script for Debian 6
      /etc/init.d/save_iptables
      /etc/init.d/load_iptables
      /usr/sbin/blockip
      /etc/network/if-pre-up.d/load_iptables  -> /etc/init.d/load_iptables
      How to Block IP:
      blockip  103.41.124.64
      cat /usr/sbin/blockip
           #!/bin/sh
           if  [  $# -eq 0 ];then
              echo “Usage:  $0 ip_addr”
              exit
           fi
           echo “ip address $1 will be blocked”
           iptables -A INPUT -s $1 -j DROP
           /etc/init.d/save_iptables
          clear
          iptables -L
       cat /etc/init.d/save_iptables
       #!/bin/sh
       /sbin/iptables-save > /etc/iptables
      cat /etc/init.d/load_iptables
      #!/bin/sh
      /sbin/iptables-restore < /etc/iptables

  • WNDR3700V4

    WNDR3700 v4:
    Atheros AR9344 560MHz + AR9582 [an 2×2:2] + AR9344 [bgn 2×2:2]
    128MiB RAM + 128MiB NAND
    1 WAN + 4 LAN (GBit) + 1 USB 2.0

    WNDR4300 v1
    3×3 5GHz (AR9580 instead of AR9582)

    TP-LINK TL-WDR4300 v1.0-v1.7
    Similar as WNDR4300
    8 MiB NAND
    2 USB

    DDWRT:
    http://www.dd-wrt.com/wiki/index.php?title=TP-Link_TL-WDR4300&redirect=no

    OpenWRT:
    http://wiki.openwrt.org/toh/netgear/wndr3700

    Netgear GPL:
    http://kb.netgear.com/app/answers/detail/a_id/2649/related/1

    wiki
    https://wikidevi.com/wiki/Netgear_WNDR3700v4

    Reset to OEM image:
    Enter into TFTP mode
    tftp -i 192.168.1.1 put WNDR3700-V1.0.4.68NA.img
    http://www.dd-wrt.com/phpBB2/viewtopic.php?t=79802

  • Where to get SSL certificate ?

    http://qiaodahai.com/cheapest-ssl-certificates.html

    最便宜的SSL证书

    SSL和TLS简介

    安全套接层（Secure Sockets Layer，SSL），一种安全协议，是网景公司（Netscape）在推出Web浏览器首版的同时提出的，目的是为网络通信提供安全及数据完整性。SSL在传输层对网络连接进行加密。

    SSL采用公开密钥技术，保证两个应用间通信的保密性和可靠性，使客户与服务器应用之间的通信不被攻击者窃听。它在服务器和客户机两端可同时被支 持，目前已成为互联网上保密通讯的工业标准。现行Web浏览器亦普遍将HTTP和SSL相结合，从而实现安全通信。此协议的继任者是TLS。

    IETF（www.ietf.org）将SSL作了标准化，即RFC2246，并将其称为TLS（Transport Layer Security），其最新版本是RFC5246,版本1.2。从技术上讲，TLS1.0与SSL3.0的差异非常微小。

    TLS利用密钥算法在互联网上提供端点身份认证与通讯保密，其基础是公钥基础设施（public key infrastructure，PKI）。不过在实现的典型例子中，只有网络服务者被可靠身份验证，而其客户端则不一定。这是因为公钥基础设施普遍商业运 营，电子签名证书通常需要付费购买。协议的设计在某种程度上能够使主从式架构应用程序通讯本身预防窃听、干扰（Tampering）和消息伪造。

    SSL和TLS证书的主要用途

    一、确认网站真实性（网站身份认证）：用户需要登录正确的网站进行在线购物或其它交易活动，但由于互联网的广泛性和开放性，使得互联网上存在着许多假冒、钓鱼网站，用户如何来判断网站的真实性，如何信任自己正在访问的网站，可信网站将帮你确认网站的身份。

    二、保证信息传输的机密性：用户在登录网站在线购物或进行各种交易时，需要多次向服务器端传送信息，而这些信息很多是用户的隐私和机密信息，直接涉及经济利益或私密，如何来确保这些信息的安全呢？可信网站将帮您建立一条安全的信息传输加密通道。

    SSL证书认证等级

    从证书认证的等级来分，ssl证书可以分为DV, OV和EV三种：

    1、DV是Domain Validation 的缩写，意思就是对网站域名所有权进行验证。CA认证机构会向域名持有者的邮箱发送相应的邮件，以确认证书和域名的所有权关系。其特点是简单快捷，价格便 宜，缺点是无法保证网站经营者的身份，因此一般仅用来提供数据加密的功能，属于Class 1验证的证书。

    2、OV是Organization Validation 的缩写，这种证书在颁发的时候会对网站所有单位的身份和域名的所有权进行证实行验证，所以一般电子商务类的网站往往会做OV的认证。价格当然也会比较昂 贵，证书颁发周期也会比较久，属于Class 2或者Class 3 验证的证书。

    3、EV是Extended Validation 的缩写，也是最严格的身份验证，此证书审核证书申请人对域名的所有权，以及详细的企业/组织相关信息审核，当用户在访问通过EV认证的网站时候，浏览器的 显示为绿色，当然价格也是相当的昂贵，属于Class 4 验证的证书。

    以上域名证书一般都支持一个或多个域名，还有一种SSL证书支持泛域名（Multiple Subdomains），就是通配符SSL证书（Wildcard SSL Certificates）。

    国外SSL证书提供商

    (1).StartSSL.comStartCom公司提供免费StartSSL（Class 1）证书，有效期1年，证书到期后可以免费续期，它的根证书很久之前就被一些具有开源背景的浏览器支持（Firefox浏览器、谷歌Chrome浏览器、苹果Safari浏览器等）。

    (2).WoSign.com沃通公司提供免费基础级 (Class 1) DV SSL 证书，有效期1年，证书到期后可以免费续期，免费SSL证书仅支持Windows平台。

    (3).CloudFlare.com提供免费的SSL 证书，支持大部分浏览器。

    (4).SSLs.com专 门代理各大公司的SSL证书，价格比较实惠，最便宜的Comodo PositiveSSL为4.99美元/年（购买五年优惠价24.95美元/5年），GeoTrust RapidSSL为7.99美元/年（购买四年优惠价31.96美元/4年），而且还可以使用10%优惠码 MissedYou 。

    (5).GoDaddy.com的Standard SSL促销价格为5.99美元/年（购买五年优惠价29.95美元/5年）。

    (6).RapidSSL.comRapidSSL 拥有自己的根证书，是名符其实的 SSL 数字证书发放单位(Certificate Authority)提供全球最具成本效益的单根 (Single Root)且稳定的 128 / 256 位数字证书，最便宜的RapidSSL为49美元/年。

    (7).PositiveSSL.comCOMODO 通过了基于WebTrust标准的严格审查，并且每一次均合格通过，是您值得信赖的SSL证书提供商。只有通过WebTrust国际安全审计认证，根证书 才能预装到主流的浏览器而成为一个全球可信的认证机构。最便宜的Comodo PositiveSSL为49美元/年。

    (8).AlphaSSL (Standard/Wildcard)全 球著名SSL证书颁发机构 GlobalSign 旗下的信息安全产品，是专业的SSL证书提供商，提供超低价格的SSL证书。AlphaSSL 在SSL证书行业拥有多年服务经验，并以低廉的价格和优质的服务向全球SSL证书用户提供服务，满足SSL低端用户市场的需求，同时它也是高可信、支持 256位加密的SSL证书。

     

     

    http://www.v2ex.com/t/96920

     

  • 转：ubuntu NFS

    http://os.51cto.com/art/201001/176511.htm

    对大家推荐很好使用的nfs服务系统之前，像让大家对Ubuntu nfs服务系统有所了解，然后对Ubuntu nfs服务系统全面讲解介绍，希望对大家有用配置Ubuntu nfs服务器，可见Ubuntu隶属于linux阵营。顺便问一句楼主既然没有文档何必一定要学ubuntu,还是学有文档的比较方便。

    在Ubuntu下安装、配置Ubuntu nfs服务的步骤如下：

    1、安装Ubuntu nfs
    Ubuntu上默认是没有安装Ubuntu nfs服务器的，因此我们首先安装Ubuntu nfs服务器端：$sudo apt-get install nfs-kernel-server
    在一些文档中，提出还需要使用apt-get来手动安装nfs的客户端nfs-common，以及端口映射器portmap，但其实这是没有必要的，因为在安装nfs-kernel-server时，apt会自动为我们把它们安装好。

    2、配置/etc/exports
    Ubuntu nfs允许挂载的目录及权限在文件/etc/exports中进行了定义。
    例如，我们要将根目录下的rootfs目录共享出来，那么我们需要在/etc/exports文件末尾添加如下一行：/rootfs *(rw,sync,no_root_squash)
    其 中：/rootfs是要共享的目录，*代表允许所有的网络段访问，rw是可读写权限,sync是资料同步写入内存和硬盘，no_root_squash是 Ubuntu nfs客户端分享目录使用者的权限，如果客户端使用的是root用户，那么对于该共享目录而言，该客户端就具有root权限。

    其它Ubuntu nfs常用的参数有：
    ro 只读访问
    rw 读写访问sync 所有数据在请求时写入共享
    async nfs在写入数据前可以响应请求
    secure nfs通过1024以下的安全TCP/IP端口发送
    insecure nfs通过1024以上的端口发送
    wdelay 如果多个用户要写入nfs目录，则归组写入（默认）
    no_wdelay 如果多个用户要写入nfs目录，则立即写入，当使用async时，无需此设置。
    hide 在nfs共享目录中不共享其子目录
    no_hide 共享nfs目录的子目录
    subtree_check 如果共享/usr/bin之类的子目录时，强制nfs检查父目录的权限（默认）
    no_subtree_check 和上面相对，不检查父目录权限
    all_squash 共享文件的UID和GID映射匿名用户anonymous，适合公用目录。
    no_all_squash 保留共享文件的UID和GID（默认）
    root_squash root用户的所有请求映射成如anonymous用户一样的权限（默认）
    no_root_squas root用户具有根目录的完全管理访问权限
    anonuid=xxx 指定nfs服务器/etc/passwd文件中匿名用户的UID
    anongid=xxx 指定nfs服务器/etc/passwd文件中匿名用户的GID

    3、Ubuntu nfs重启服务
    $sudo /etc/init.d/portmap restart
    $sudo /etc/init.d/nfs-kernel-server restart

    4、测试Ubuntu nfs
    此时可以运行以下命令来显示一下共享出来的目录：
    $showmount -e
    或者可以使用以下命令把它挂载在本地磁盘上，例如将/rootfs挂载到/mnt下：
    $ sudo mount -t nfs localhost:/rootfs /mnt
    可以运行df命令查看是否挂载成功。查看后可以使用以下命令卸载：
    $ sudo umount /mnt

     

     

    ###########################

    # eample #

    sudo apt-get install nfs-kernel-server

    cat /etc/exports

    /data/download/iso *(ro,insecure,all_squash)

    sudo service portmap restart

    sudo /etc/init.d/nfs-kernel-server restart

    showmount -e

    mkdir /tmp/iso

    sudo mount -t nfs 127.0.0.1:/data/download/iso /tmp/iso

  • 转：企业级云存储评测：Box与Dropbox领衔的终极对决

    http://os.51cto.com/art/201402/430312_all.htm