Installing OpenVPN 2.2 on Centos 5.7

OpenVPN is an SSL based VPN. There are other VPN solutions such as IPsec, etc. but OpenVPN provides a cost effective alternative. I like OpenVPN as it support two-way authentication, i.e. both the client and server authenticate using certificates. To install OpeVPN on CentOS we need a number of cryptographic libraries. The simplest way is to use the DAG/RPMForge repository.

Set-up the RPMForge repository [1], as this contains the packages necessary for the installation and the instructions are provided below. The instructions below are just to document this specific installation and therefore this blog post is not to be misinterpreted as a best practises guide. The instructions are adapted from the OpenVPN website [2], but this blog post is intended more as a quick and dirty guide to getting OpenVPN running on CentOS 5.7. Additionally the set-up and configuration of the client is considered beyond the scope of this blog post.

1. Install packages
1. rpm -Uhv http://apt.sw.be/redhat/el5/en/i386/rpmforge/RPMS/rpmforge-release-0.3.6-1.el5.rf.i386.rpm
2. yum -y update
3. yum -y openvpn
2. Set-up configuration files
1. cd /etc/openvpn/
2. cp /usr/share/doc/openvpn-2.2.0/sample-config-files/server.conf .
3. mkdir -p /etc/openvpn/easy-rsa/keys
4. cd /etc/openvpn/easy-rsa
5. cp -rf /usr/share/doc/openvpn-2.2.0/easy-rsa/2.0/* .
6. chmod o+x,g+x clean-all, build-* vars whichopensslcnf pkitool inherit-inter list-crl revoke-full sign-req
3. Edit the PKI configuration
1. vi /etc/openvpn/easy-rsa/vars
1. Also consider setting the key length using KEY_SIZE variable, 1024 is the default 2048 is better, but slows down the TLS, but I am paranoid and use 4096 bit keys
2. Set the country (KEY_COUNTRY), state (KEY_PROVINCE), locality (KEY_CITY), organisation name (KEY_ORG), and support email (KEY_EMAIL)
4. Set-up the PKI infrastructure. This involves make a certificate authority and then generate the server certificate and any client machine certificates
1. Create the certificate authority
1. . ./vars
2. ./clean-all
3. ./build-ca
4. The CA key and certificate should not be in the keys directory inside the easy-rsa directory.
2. Create certificate for the server
1. ./build-key-server NAME_OF_SERVER
2. Answer the questions and commit the certificate into the database
3. Create the Diffie Hellman files
1. These files are used for the actual key exchange to ensure the confidentiality over an insecure channel, aka the Internet. Based on the length of the key used (KEY_SIZE) it may take a while.
2. ./build-dh
4. Create the certificate for each client
1. When doing this for clients, I generate one for each device a client may use, that way if a device is stolen or goes missing, I only have to revoke a single certificate and the others keep working as they do. Not sure if this a good approach, but its definitely my quick and dirty (lazy) approach.
2. ./build-key LAPTOP
3. ./build-key HOME-DESKTOP
4. ./build-key PDA
5. Edit the server configuration file 
1. vi /etc/openvpn/server.conf
2. Check/change
1. local
2. proto
3. dev
4. port
5. ca
6. cert
7. key
8. dh
9. max-clients
10. user
11. group
12. log-append
13. verb
6. Start everything
1. /etc/rc.d/init/openvpn start
2. chkconfig --level 235 openvpn on

Possible Errors:

1. If the OpenVPN server fails to start, ensure that logging is enabled, i.e. refer to log-append in the configuration file and examine the log. A common error is that OpenVPN fails to open certain files, check that the paths to these files are specified correctly.

References:

1. http://dag.wieers.com/rpm/FAQ.php
2. http://openvpn.net/howto.html

Installing OSSEC on Centos 5.7

OSSEC is an open source host-based IDS that performs log analysis, and is able to correlate and analyse logs for a number of Linux (and Windows, but that is outside the scope of this blog post) servers. The software architecture of OSSEC and the use of agents, lends OSSEC to flexible deployment and management [1].

Set-up the Atomic repository that already has the appropriate OSSEC packages and install them would be the easiest way. However I have a strong dislike for the use of the /var partition (most system administrators, hmm... well at-least I have always, set this up as a separate partition for ease of management and security reasons) as an install location, esp. when it has been specified as a "noexec" partition.

Please Note: 
Firstly, there are a number of dependencies of some of the set-up below, such as Apache, PHP, MySQL, but the installation and secure configuration of these services are beyond the scope of this blog post. Secondly, the configuration below is only to set-up OSSEC as a monitor and not run it in IPS, i.e. as an active response alert handler.

Installation using the repository

1. wget https://www.atomicorp.com/installers/atomic -O atomic.sh
2. . ./atomic.sh
3. yum -y update
4. yum -y install ossec-hids ossec-hids-server ossec-wui

Installation using the tar ball source

1. Download, compile and install the source
1. wget http://www.ossec.net/files/ossec-hids-2.6.tar.gz
2. tar zxvf ossec-hids-2.6.tar.gz
3. cd ossec-hids-2.6/src
4. make clean
5. make setdb
6. make all
7. cd ..
8. ./install.sh
1. en
2. local
3. /opt/ossec
4. y
5. user@domain
6. mx.domain
7. y
8. y
9. n
2. Setup mysql DB for logging
1. Grant access to database
1. mysql -u root -p
2. grant INSERT,SELECT,UPDATE,CREATE,DELETE,EXECUTE on ossec.* to ossecuser@localhost;
3. set password for ossecuser@localhost=PASSWORD('PASSWD');
4. quit;
2. Create database and tables
1. mysqladmin -u root -p create ossec
2. mysql -u root -p ossec < src/os_dbd/mysql.schema
3. Edit the /opt/ossec/etc/ossec.conf file
1. Check the wiki to setup logging to the database and syslog [2]
3. Install the Web User Interface, you will need Apache and php
1. Again, the installation and secure configuration of Apache is beyond the scope of this blog post. 
2. wget http://www.ossec.net/files/ui/ossec-wui-0.3.tar.gz
3. tar zxvf ossec-wui-0.3.tar.gz
4. mkdir -p /var/www/html/ossec-wui
5. cp -rf ./ossec-wui-0.3/* /var/www/html/ossec-wui/
6. cd /var/www/html/ossec-wui/
7. ./setup.sh
8. Edit the ossec_conf.php to point to the ossec installation completed in the previous stage
1. $ossec_dir="/opt/ossec";
4. Start the OSSEC services
1. /opt/ossec/bin/ossec-control enable database
2. /opt/ossec/bin/ossec-control enable client-syslog
3. /opt/ossec/bin/ossec-control start

Possible Errors:

1. When executing OSSEC-WUI you may get a page that displays. "Unable to access OSSEC directory". Ensure that the user that your Apache web server runs as, e.g. httpd or apache is added to the ossec group
1. usermod -a -G ossec apache.
2. "Unable to retrieve alerts". Ensure that you web server is able to open the alerts file. This issue is two fold, firstly ensure that the web server has permissions to open the file and secondly that the fopen command is enabled in PHP.
1. safe_mode Off
2. safe_mode_gid On
3. These two are no so much error, but warning that will be annoy your syslog server, but depend on your PHP configuration.
1. PHP Warning:  shell_exec() has been disabled for security reasons - This is because of a uname -a query in the /var/www/html/ossec-wui/lib/os_lib_agent.php script;
1. //$agent_list[$agent_count]{'os'} = `uname -a`;
2. $agent_list[$agent_count]{'os'} = "Linux";
2. PHP Warning:  fseek() expects parameter 3 to be long - This may be a simple programming error in the /var/www/html/ossec-wui/lib/os_lib_alerts.php
1. //fseek($fp, $seek_place, "SEEK_SET");
2. fseek($fp, $seek_place );

References:

1. http://en.wikipedia.org/wiki/OSSEC
2. http://www.ossec.net/wiki

Installing Snort 2.9.1.2 on CentOS 5.7

CentOS 5.7 uses an older version of libpcap (0.9.4), but Snort's Data Acquisition Library (daq) needs a newer version of libpcap (>=1.0.0). The latter is not an issue with the CentOS 6.0. Vishesh Kumar [1] provides an excellent instructions to getting Snort 2.9 to run on RHEL 5 (http://www.linuxmantra.com/2010/10/install-snort-29-on-rhel-5.html). The purpose of this post is not to duplicate his efforts, but to extend it slightly to include instructions for a complete Snort set-up.

1. libpcap - http://www.tcpdump.org/release/libpcap-1.1.1.tar.gz [3]
2. daq : http://www.snort.org/downloads/1221 [2]
3. snort : http://www.snort.org/downloads/1207 [2]

Download and install the libraries and software as per the instructions below;

1. Enable the Extra Packaged for Enterprise Linux (EPEL) repository to enable the installation of additional packages not available under the standard repositories
1. rpm -Uvh http://download.fedora.redhat.com/pub/epel/5/i386/epel-release-5-4.noarch.rpm
2. yum -y update
3. yum -y upgrade
2. Install developments to compile the libraries and source code, and additional libraries and header files that are required later on
1. yum -y groupinstall 'Development Tools'
2. yum -y install pcre-devel
3. yum -y install libdnet-devel
4. yum -y install zlib-devel
5. yum -y install mysql mysql-server mysql-devel mysql-bench
3. Download, compile and install libpcap
1. wget http://www.tcpdump.org/release/libpcap-1.1.1.tar.gz
2. cd libpcap-1.1.1
3. ./configure --prefix=/usr
4. make && make install
4. Download, compile and install daq
1. wget http://www.snort.org/downloads/1221 -O daq-0.6.2.tar.gz
2. cd daq-0.6.2
3. ./configure
4. make && make install
5. Download, compile and install snort
1. wget http://www.snort.org/downloads/1207 -O snort-2.9.1.2.tar.gz
2. cd snort-2.9.1.2
3. ./configure --with-mysql
4. make && make install
6. Download, compile and install Barnyard2
1. wget --no-check-certificate https://github.com/firnsy/barnyard2/tarball/master -O firnsy-barnyard2-405761e.tar.gz
2. tar zxvf firnsy-barnyard2-405761e.tar.gz
3. cd firnsy-barnyard2-405761e
4. ./autogen.sh
5. ./configure --with-mysql
6. make && make install
7. Create the snort database on the mysql enginer
1. mysqladmin -u root -p create snort
2. mysql -u root -p -D snort < schemas/create_mysql
3. mysql -u root -p
1. GRANT CREATE,INSERT ON root.* TO snort@localhost IDENTIFIED BY 'PASSWORD';
2. GRANT CREATE,INSERT,SELECT,DELETE,UPDATE ON snort.* TO snort@localhost IDENTIFIED BY 'PASSWORD';
8. To get the current registered user rules, you need to sign up and obtain an Oinkcode. The Oinkcode will be used for downloading the rules and used with pulledpork.
1. Sign in or request an account from https://www.snort.org/login
2. Get your oinkcode after signing in from https://www.snort.org/account/oinkcode
3. cd etc
4. wget http://www.snort.org/reg-rules/snortrules-snapshot-.tar.gz/OINKCODE -O snortrules-snapshot-LATEST.tar.gz
5. tar zxvf snortrules-snapshot-LATEST.tar.gz
9. Setup the configuration and rules files for snort
1. mkdir -p /etc/snort
2. mv -f etc/* .
3. rmdir etc/
4. mv snortrules-snapshot-LATEST.tar.gz ../../
5. rm -f Makefile Makefile.am Makefile.in
6. cp -rf * /etc/snort/
10. Edit the snort configuration
1. vi /etc/snort/snort.conf
1. ipvar HOME_NET
2. var RULE_PATH rules
3. var SO_RULE_PATH so_rules
4. var PREPROC_RULE_PATH preproc_rules
5. output database: log, mysql, user=snort password=PASSWORD dbname=snort host=localhost
6. output alert_syslog: LOG_LOCAL6 LOG_ALERT
11. Edit the syslog.conf file to log alerts to separate file and restart the syslog daemon
1. Include the line in syslog.conf "local6.*        /var/log/snort/alerts.log"
2. /etc/rc.d/init.d/syslog restart
12. Test the snort installation, and set-up environment to run snort if all OK
1. snort -c /etc/snort/snort.conf -T
2. useradd -G snort snort -s /bin/false
3. chown -R root:snort /var/log/snort
4. chmod -R g+w /var/log/snort
13. Configure barnyard [4]
1. mkdir -p /var/log/barnyard2
2. chmod 666 /var/log/barnyard2
3. touch /var/log/snort/barnyard2.waldo
4. cp etc/barnyard2.conf /etc/snort/
5. Edit the /etc/snort/barnyard2.conf
1. output database: log, mysql, user=snort password= dbname=snort host=localhost
2. config hostname:   localhost
3. config interface:  eth0
14. You can get snort to start automatically, but writing a customer script to start/stop/restart the daemon or simply kicking it off to start up when the machine boots. Edit the rc.local file and out the following in
1. /usr/local/bin/snort -D -u snort -g snort -c /etc/snort/snort.conf -i eth0
2. /usr/local/bin/barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log -w /var/log/snort/barnyard2.waldo -D

Common Errors:

1. ERROR: parser.c(5261) Could not stat dynamic module path "/usr/local/lib/snort_dynamicrules": No such file or directory.
   Fatal Error, Quitting..
1. mkdir -p /usr/local/lib/snort_dynamicrules
2. cp /etc/snort/so_rules/precompiled/DIST/i386/2.9.0.0/* /usr/local/lib/snort_dynamicrules/
2. ERROR: /etc/snort/rules/web-misc.rules(555) Cannot use the fast_pattern content modifier for a lone http cookie/http raw uri /http raw header /http raw cookie /status code / status msg /http method buffer content.
   Fatal Error, Quitting..
1. The fast_pattern option cannot be used with the http_method string. Edit the web-misc.rules file and remove it from the snort rule. Do a search for "2010-0388" and remove the alert option fast_pattern from the alert rule.
3. ERROR: /etc/snort/snort.conf(244) => 'compress_depth' and 'decompress_depth' should be set to max in the default policy to enable 'unlimited_decompress'
   Fatal Error, Quitting..
1. Edit the /etc/snort/snort.conf file and set the http_inspect compress_depth and decompress_depth to 65535 from 20480.
4. ERROR: ByteExtract variable 'bugtraq' in rule [3:13897] is used before it is defined
1. Ensure that the shared libraries copied above using "cp /etc/snort/so_rules/precompiled/DIST/i386/2.9.0.0/* /usr/local/lib/snort_dynamicrules/" are for the correct distribution
2. Ensure that the rules being used are for the version of snort being used.

Please note: 

1. These instruction are for 32bit hardware, for 64bit machines you will need to select appropriate 64bit RPM packages or configure and compile with appropriate compiler switches. These are considered beyond the scope of this post.
2. All instructions are executed with root privileges.

References:

1. http://www.linuxmantra.com/2010/10/install-snort-29-on-rhel-5.html
2. http://www.snort.org/snort-downloads?
3. http://www.tcpdump.org/#latest-release
4. http://www.snort.org/assets/145/Install_Snort_2.8.6_on_CentOS_5.5.pdf

Gnu Screen

Running some experiment on a VM server I rapidly ran out of patience having to wait for commands to run, and/or switching back and forth using Ctrl+Z, bg, and fg. My thoughts went back to Nick Black who had introduced me to Gnu Screen several years back, alas I has forgotten the short-cuts, Thankfully Google and the man page came to the rescue.

Since the VM server was a CentOS 6.0 box, with minimal install, I had to install Gnu Screen using;

1. yum -y install screen

Here's a summary of the shortcuts that may be useful;

• Ctrl+A, c : create a new screen
• Ctrl+A, A : set a name for the screen instead of the default shell name (bash)
• Ctrl+A, " : lists the screens available
• Ctrl+A, n : toggle to next screen
• Ctrl+A, p : toggle to previous screen

References:

1. http://www.gnu.org/s/screen/

APAcite on Mac OS X (Lion) with texlive

I had to recently rebuild my Mac Book Pro (gasp!), and decided to upgrade to Lion.  The whole process was relatively painless. Files were copied back from backups, and updated from my SVN repositories, however I had troubles installing the appropriate Mac port package for the APACite classes.

sudo port install texlive-bibtex-extra

The latter yielded errors, which were logged in

/opt/local/var/macports/logs/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_perl_p5-text-bibtex/p5.12-text-bibtex/main.log

Since the dependency p5.12-text-bibtex could not be installed, examination of the log file provided the following clues; error: 'main' must return 'int'

The same error was reported for;

1. /opt/local//var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_perl_p5-text-bibtex/p5.12-text-bibtex/work/Text-BibTeX-0.60/btparse/tests/namebug.c
2. /opt/local//var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_perl_p5-text-bibtex/p5.12-text-bibtex/work/Text-BibTeX-0.60/btparse/tests/tex_test.c

A quick rename of void to int enabled the package to be installed without further issues.

APAcite on Mac OS X with texlive

While compiling a LaTeX document, a blank template of my PhD thesis to be exact, when I got the following error "! LaTeX Error: File `apacite.sty' not found." Again a quick search for Mac ports indicated that the texlive-bibtex-extra package was required. It was quickly installed using;

sudo port install texlive-bibtex-extra

Subsequent compile yielded more errors, this time it was "! Undefined control sequence. \abstract". This was solved using the texlive-latex-extra package, installed using;

sudo port install texlive-latex-extra


Then adding the following to define the abstract in the book documentclass;

% Define abstract in book documentclass
\pagestyle{empty}
\newenvironment{abstract}%
{
  \onehalfspacing%
  \null
  \vfill
  \chapter*{\centering Abstract}%
  \addcontentsline{toc}{chapter}{Abstract}
}%
{\vfill\null}

% Start the actual abstract
\begin{abstract}
\end{abstract}

More errors resulted "! Use of \@year@ doesn't match its definition." I had to add "\bibliographystyle{apacite}" to the bibligraphy page, and all was well once again.

References:

1. https://trac.macports.org/wiki/TeXLivePackages
2. http://www.cs.utexas.edu/~witchel/errorclasses.html