Restrict SSH Linux

# /etc/hosts.allow

Variant 1

sshd:  192.168.1.0/24

Variant 2

sshd: 111.11.1.111, 222.2.22.222, 333.3.33.333

Variant 3 (with sshdfwd-X11):

sshd,sshdfwd-X11: 192.168.1.0/24

# /etc/hosts.deny

Variant 1

sshd: ALL

Variant 2

sshd,sshdfwd-X11: ALL

Squid and squidGuard Install

Install Squid3

root@Squid1:~# apt-get install squid3

Configure File Squid.conf  (/etc/squid3/squid.conf)

acl VLAN101 src 10.0.101.0/24 
http_access allow
http_port 8080 (listen Port)

Install SquidGuard

root@Squid1:# apt-get install squidguard

Create Blacklist Directory

root@Squid1:/etc/squidguard# mkdir blacklist

Create Log Directory

root@Squid1:/etc/squidguard# mkdir log

Download Blacklists 

(http://www.squidguard.org/blacklists.html)

root@Squid1:/etc/squidguard/blacklist# wget http://squidguard.mesd.k12.or.us/blacklists.tgz

Decompress Blacklist

root@Squid1:/etc/squidguard/blacklist# tar xvfz blacklists.tgz

Install Blacklist (Compilation  *.db)

root@Squid1:~# squidGuard -C all

Configure squidGuard.conf (/etc/squidguard/squidGuard.conf)

dbhome /etc/squidguard/blacklist/blacklists   (Note: Blacklist Directory)
logdir /etc/squidguard/log                    (Note: Log Directory)

dest porn {
domainlist porn/domains
urllist porn/urls
}

dest warez {
domainlist warez/domains
urllist warez/urls
}

dest ads {
domainlist ads/domains
urllist ads/urls
}

acl {
default {
pass    !porn  !warez  !ads  all
redirect http://admin.foo.bar.de/cgi-bin/blocked.cgi?clientaddr=%a&clientname=%n&clientuser=%i&clientgroup=%s&targetgroup=%t&url=%u
}
}

(Were !porn = denegar porn)
Search where Squid is installed

root@Squid1:~# which squidGuard
/usr/bin/squidGuard

Search where is SquidGuard Configuration (squidGuard.conf)

root@Squid1:/etc/squidguard# ls -l

-rw-r----- 1 proxy proxy 1459 Oct 13 23:49 squidGuard.conf

Configure squid.conf to support squidGuard (/etc/squd3/squid.conf)


Add This lines in squid.conf 

url_rewrite_program /usr/bin/squidGuard -c /etc/squidguard/squidGuard.conf

Restart Squid3

root@Squid1:~#service squid3 restart

Create ACLs to permit HTTP(8080) trafic and Deny HTTP (80) without Proxy

R1(config)#access-list 101 deny tcp 10.0.101.0 0.0.0.255 any eq 80
R1(config)#access-list 101 permit tcp 10.0.101.0 0.0.0.255 host 10.0.250.11 eq 8080


Now Change Your Proxy Settings In Your Browser 

Done !

Configure TFTP Server In Debian

#Before you download aftpd server, remove all old tftp servers from your linux 
apt-get remove tftp tftpd
apt-get remove xinetd
ps axu | grep tftp
rm /etc/xinetd.d/tftp
rm -r /tftpboot

#Download inetd, inetutils-inetd and atftpd
apt-get install inetd
apt-get install inetutils-inetd
apt-get install atftpd

#Create User
mkdir /home/backup
adduser backup -d /home/backup

#Change Permission, Owner and Group
chmod 750 /home/backup
chmod 750 /home/backup/Network/
chown -R backup:backup /home/backup

#Cheack Permission
drwxr-x--- 3 backup backup 4096 Oct  3 13:44 backup
drwxr-x--- 2 backup backup 4096 Oct  4 11:01 Networkp

#Configure Your Server 
nano /etc/inetd.conf

#:BOOT: TFTP service is provided primarily for booting.  Most sites
#       run this only on machines acting as "boot servers."
tftp dgram udp4 wait backup /usr/sbin/tcpd /usr/sbin/in.tftpd --tftpd-timeout 300 --retry-timeout 5 --mcast-port 1758 --mcast-addr 239.239.239.0-255 --mcast-ttl 1 --maxthread 100 --verbose=5 /home/backup/Network

#Restart tftp
/etc/init.d/inetutils-inetd restart

Note: Nmap scan 

nmap -sU -p69 10.0.10.100 
Nmap scan report for 10.0.10.100
PORT        STATE            SERVICE
69/udp    open|filtered      tftp

-p69 = Scan Port 69 
-sU = Only UDP

Install and configure SysLog Server in Debian and Cisco

#Download SysLog Server
apt-get install sysklogd -y

#Change Configuration 
vi /etc/default/syslogd

add SYSLOGD="-r"
Note: -r = Recive Remote Logs

#Configure syslog.conf file Add this line
vi /etc/syslog.conf

local7.debug         /syslog/remote.log 

Note: Where /syslog/remote.log is syslog file 

Other way

daemon.*;mail.*;\
        news.err;\
        *.=debug;*.=info;\
        *.=notice;*.=warn       |/dev/xconsole

*.* /var/log/network/network.log
#*.* /var/log/network/%HOSTNAME%.log
#:msg, contains, "dsw1"  /var/log/network/DSw1.log

:fromhost-ip,isequal,"10.0.10.11" /var/log/network/ASw1.log
:fromhost-ip,isequal,"10.0.10.12" /var/log/network/ASw2.log
:fromhost-ip,isequal,"10.0.10.13" /var/log/network/ASw3.log
:fromhost-ip,isequal,"10.0.10.14" /var/log/network/ASw4.log
:fromhost-ip,isequal,"10.0.10.1" /var/log/network/DSw1.log
:fromhost-ip,isequal,"10.0.10.2" /var/log/network/DSw2.log
:fromhost-ip,isequal,"10.0.5.1" /var/log/network/iNetR1.log
:fromhost-ip,isequal,"10.0.5.2" /var/log/network/iNetR2.log
:fromhost-ip,isequal,"10.1.1.1" /var/log/network/remote1.log
:fromhost-ip,isequal,"10.1.2.1" /var/log/network/remote2.log
:fromhost-ip,isequal,"10.1.3.1" /var/log/network/remote3.log
:fromhost-ip,isequal,"10.1.4.1" /var/log/network/remote4.log

#Restart Service 
/etc/init.d/sysklogd restart

#Check if Syslog is on 
ps -ef | grep syslog
netstat -a | grep syslog

#Configure Cisco Device 
configure terminal
logging source-interface [interface]
logging <ip address of your Debian system>
logging trap debug
logging on 
service timestamps log datetime msec localtime show-timezone
ntp-server <ntp-server>


Done !

Install FTP Server in Debian and configure Cisco IOS as Client

#Download FTP 
apt-get install  proftpd -y

Note: select standalone Durring Installation

#Stop FTP Service
/etc/init.d/proftpd stop

#Configure Youre FTP Server
vi /etc/proftpd/proftpd.conf

#Create User With Password and With Working Directory 
useradd file -p 12345 -d /ftp -s /bin/false 

#Change Password
passwd file 
New Password !!!

#Change Bash Config 
vi /etc/shells
Note: add in last line ->  /bin/false

#Create FTP Folder And Assign Permis (User level)
cd /
mkdir ftp
chown file:file /ftp/
chmod 770 ftp

#Restart FTP server 
service proftpd restart

#Configure Cisco Divace as FTP client
R1#configure terminal
R1(config)#ip ftp username file
R1(config)#ip ftp password 12345
R1#copy running-config ftp://10.10.10.100/run-config.txt

#In Debian now you can see this file
more /ftp/run-conf.txt