How (and why) to disable apache server signature on your web pages

In the default configuration of Apache, any error pages will contain the full signature of the server (version number) which could be exploited by hackers. Each version has some deficiencies that could be exploited, and a hacker who knows your version number may benefit from it by focused attacks.

To disable server signature, you will need to edit your /etc/apache2/apache2.conf file.

sudo nano /etc/apache2/apache2.conf

Press Ctrl+w to search for "ServerSignature" and press return. If you find it, edit it to:

ServerSignature Off
ServerTokens Prod

If you don't find it, just scroll to the end of the file and add these two lines.

Then, we need to reload apache configuration to put this new change in effect:

sudo /etc/init.d/apache2 reload

Check the new configuration by entering an invalid address on your server URL (e.g. www.server.com/invalidpage.html). You should not see the server signature now, just the server name.

Ubuntu votes for people's favorite packages automatically

While ransacking the system files to look for logs and other things, I noticed that cron runs an application called "popularity-contest" every month.

user@ubuntu:/etc$ ls cron*
crontab

cron.d:
php5

cron.daily:
apt find man-db samba sysklogd
bsdmainutils logrotate mysql-server standard

cron.hourly:

cron.monthly:
standard

cron.weekly:
man-db popularity-contest sysklogd


I was curious as to what is "popularity-contest"! The name is interesting! So I ran this application from CLI, and it spitted out a list of packages in Terminal. A quick google search revealed the following:

The popularity-contest package sets up a cron job that will periodically anonymously submit to the Debian developers statistics about the most used Debian packages on this system.

This information helps Debian making decisions such as which packages should go on the first CD. It also lets Debian improve future versions of the distribution so that the most popular packages are the ones which are installed automatically for new users.

This is a nice and democratic way, but a little creepy for the unsuspecting and new users like me.

Hack attempts at my server

I really love the ease of setting up a web server with Ubuntu - I set it up months back, and just forgot about it. Today morning I noticed some suspicious hard disk activity on my server, and I decided to check what's happening.

Someone might have been trying to hack into my box!!!

I got suspicious.

A common hacking technique in Linux involves dictionary based attacks on ssh (port 22), which is open on many servers for remote management. I have this port open too, because I love to connect to my server and administer it from my office etc. So, how do I know if someone is trying to hack my server by logging in via port 22?

Well, I read the SSH Daemon (sshd) log entries. By default, the sshd dumps its log in /var/log/auth.log . So I open that file in nano (command: nano /var/log/auth.log) and I see numerous failed login attempts through ssh. The log also contains their IP addresses, so I check their websites by entering their IP address in my browser. Many of such sites are actually running on commercial web servers, that have been hacked by exploiters. One such site is this:

203.86.101.123

This unsuspecting person has her website hacked, and there is an automated hacking tool installed there, which looks for more computers and hacks them. Thus, the hacker could soon control an army of hacked servers! This can be used very effectively for a DOS ("Denial of Service") attack on an enemy server to knock it down. I immediately wrote an email to this person to check the security of their server.

So, the SSH attack has been performed. Was it successful? The auth.log file will tell you if it accepted the password for a given user.

Also, you can use the last command to view the last few users who logged in (latest on the top) - this will also show the domain from which they logged in, the date and time, and also the length of time they stayed logged in. If you see any users logging in from any domains that you don't know of, they probably hacked your password! You might want to change the username and password (both) immediately, and please make a stronger password this time. Also check any suspicious modifications in the /etc/sudoers file (command: sudo nano /etc/sudoers), and check if any new users have been added to any groups (command: sudo groups root username)

A potential failure of this diagnostic process can be when the hacker clears the auth.log entries. I will explore more about this and update this post later.

Still, I am greatly amazed by the rock-solid security of Ubuntu - I just have the default system install and have not configured any firewall or anything, and my box is wide open to the internet, and still I'm not hacked! Extremely impressive!

My first experience with Linux kernel panic

I was running a web server from my apartment using Ubuntu Linux. During vacations, I traveled to Washington DC and was managing the server by SSH. I installed a kernel update, and then the server wanted restart. After restart, I couldn't login!

Sending a (-technologically challenged) friend for investigation revealed that the server now has a kernel panic each time it boots up. This was because I filled up its capacious 1GB hard drive by installing the update, and that led to kernel panic.

I agree not many people are running Linux on a 1GB hard disk. Still it has ruined my server in no time at all! My suggestion to the Linux developers is to have an intelligent software updater that can recognize updates that will fill up the entire HD. It should be pretty simple to do, just takes some thought.

Ubuntu and Vista: Trends by Google

Google Trends is a unique service aimed at studying the trends in online google searches. It compares keywords you supply based on the volume of Google searches as well as volume of news reporting on the keywords. I saw the trend for ubuntu vs. vista, and the results are here.

Some comments:

1. Vista has shown dramatic ups and downs, whereas Ubuntu continues its steady rise. The tremulousness of vista graph may in part be due to the Microsoft vs. EU court rows, as well as the continued delays in shipping of vista. However, Ubuntu has continued to rise up, despite the fact it's a two year old baby.

2. Ubuntu has come up with four major releases in the last two years, whereas Windows has struggled to release Vista after about five years of effort. There could be several reasons Windows is lagging behind:

(i) Microsoft is trying to drag XP as long as it can. Thus, by releasing Vista late, it's buying time to develop the next release (Vienna).
(ii) Microsoft servers were hacked few years down the lane. So they are trying to patch up any security holes the hacker community may exploit.
(iii) Microsoft is trying to build "curiosity" among its users for Vista by delaying its release
There could be more reasons... but it appears that the delay will ultimately benefit Microsoft more than what earlier versions of windows did.

2. Somehow all the trends searches are from major cities in the Europe. In fact, more people are searching for Ubuntu rather than Vista in Norway, Finland and Spain. I think I can explain Finland by the fact that Linus Torvalds, the creator of Linux, hails from Finland.

3. The regionwise trends show that South Africa is the second most popular region for Ubuntu rather than Vista. I can explain this because Mark Shuttleworth, the creator of Canonical Foundation for Ubuntu, hails from South Africa. I have an african friend who says that South Africa is perhaps the most developed country in the entire Africa.

4. When it comes to Ubuntu, it appears that more searches are done on Ubuntu than it appearing in the news. This is very typical of any linux related news - many people are interested in it but somehow that doesn't make headline on any major news site (leaving out technical news agencies).

5. Despite whatever Ubuntu fans might say, I'd contend that Ubuntu is in no way a competitor to Vista... at least not in the first few months. I remember somewhat similar speculations were circulating when XP was in the coming... people used to post fervently in forums "Apple and Red Hat will kill XP" and things like that. But that did not happen. People are resistant to change - they're more likely to continue with doing whatever they are doing. And they're doing Windows. You know what I mean.

6.

What is bicycle-repair?

The process of installing Linux is quite boring, just as installing any other OS. Some of you, who keep awake and sit near the computer while it's installing Linux must have noticed that it installs thousands of packages. Have you noticed that it also installs "bicycle repair" as one of the packages?

Does this mean that you can repair your broken bicycle by hooking it up with your linux computer?

"Eh.. Comeon! You must be kidding!"

Well yeah. I am kidding.

When I saw this "bicycle repair" package for the first time, I was curious, so set out to know what exactly is this. And I found the answer.

Bicycle Repair Man is a refactoring utility for Python. Basically, it manipulates the code of a program without changing input or output. The aim is to make the code more readable for the programmer.

But still, I wish my computer could repair my bicycle for me! :)

How to synchronize time with NTP servers on an ubuntu machine

Update: Thanks to Ben Dodd for pointing this out, this blog post is now obsolete. NTP synchronization is now built into Ubuntu. Just install ntp using the command:

sudo apt-get install ntp

and you're done.

After the last two power failures in my area, I realized that the server loses its time after every hard restart. Its BIOS battery is totally exhausted. The time is now erroneous, systemwide! I remember Ubuntu includes a tool with which it can (and does, by default) synchronize time with its NTP servers. In my case, it isn't working well. So here's how I made it work:

1. First, make sure NTP is intstalled.

sudo apt-get install ntpdate

2. Then, run ntpdate, specifying an NTP server:

sudo ntpdate ntp.ubuntulinux.org

This should set the time correctly for that session. Note that superuser previleges are necessary to set the time, because setting time is really an "administrative task".

3. Now you shall want this to run this regularly, right? Since it's a server, I'd prefer to run it at startup. To do this, we shall add a little script to the startup.

First, open a terminal, and pass this command:

sudo nano /etc/init.d/ntpdate

In the blank file that comes up, copy and paste this:

#! /bin/sh
echo "Synchronizing system time with Ubuntu Servers..."
ntpdate ntp.ubuntu.com
echo "Setting hardware clock to updated time..."
hwclock --systohc

Note the last line: It resets the hardware time ("BIOS time") to the system time. Press Ctrl+O to write out this file, and Ctrl+X to quit nano. Now we shall make this little script executable. To do this,

sudo chmod 700 /etc/init.d/ntpdate

And finally, let's inform the system about this new startup script we just added:

sudo update-rc.d ntpdate defaults 90

And you're done.

To test this, you must restart your system, and keep a close watch on the messages being shown on the system. Alternatively, you could also read the system log files later (/var/log/syslog)

Free "Parallels" for Mac OS X

I want to run Ubuntu virtual machine on OS X, but don't want to pay for Parallels Desktop. So I was searching for few alternatives, and stumbled across one such tool. This one is called "Q" (pronounced "kju"). I installed it, and was able to create an Ubuntu virtual machine effortlessly. Even easier than VMware Workstation.

So I now have Ubuntu running under Mac OS X, with the help of Q.



Then I also tried Ubuntu and Kanotix Live CDs in Q - Both of which worked flawlessly. I tried installing Windows 98 SE in Q just for the sake of experimenting, but it wouldn't boot from a bootable CD! Don't know why!

In a nutshell, If you want to run another OS on your Mac without rebooting, Q is a formidable candidate.

Ubuntu Server: CDROM problem

My server, a 1997 old desktop, has Ubuntu Server Edition running on it. I had inserted my Ubuntu CDROM in its drive, and kept it over there ever since. But now, I needed to take the CD out, for installing an Ubuntu virtual machine on my laptop.

Okay, so I sit in front of my server, and press the eject button of CDROM. Nothing happens. Did that again - nothing yet. I pressed the button really hard one more time. But the machine won't budge.

I thought that the old CDROM drive is dead for good.

But wait... I just remembered: I couldn't eject CDs by pressing the eject button on my previous linux laptop! What is going on here?

Lacking a GUI, I decide to do something from CLI (command line interface) to eject the CD. So I type this:

eject

and press enter.

Viola...!!!! The CD is out now! :)

Empty iptables in Ubuntu default installation

Now that my site is famous (almost), I'm beginning to think about security. Actually I should have thought about it even before opening the site to the public. So here I am, sitting in front of my black box, thinking about security.

Googling around for some time revealed more details about a word I happened to know previously - "iptables". A quick check at my iptables configuration in default ubuntu installation revealed that I do not have any firewall rules set at all! Now, this makes me think twice about my server security. How then, no one was able to hack the site?

The answer is my router. It has an in-built firewall, which I had configured to allow only ports 80 (HTTP) and 22 (SSH). I would just have port 80 open, but I needed remote management. So I opened port 22 as well.

I'll find more details about server security, and post them here.