apt-get install git-core

Once git is installed we will found git-http-backend under /usr/lib/git-core/git-http-backend. Next step is to setup the Apache configuration:

<IfModule mod_ssl.c>
<VirtualHost *:443>
    SSLEngine on
 
    SSLCertificateFile /etc/ssl/server.crt
    SSLCertificateKeyFile /etc/ssl/server.key
    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
 
    ServerName git.example.com
    ErrorLog /var/log/apache2/git-error.log
    CustomLog /var/log/apache2/git-access.log combined
 
    # GIT Config
    SetEnv GIT_PROJECT_ROOT /opt/git/repositories
    SetEnv GIT_HTTP_EXPORT_ALL
 
    # Route Git-Http-Backend
    ScriptAlias / /usr/lib/git-core/git-http-backend/
 
    # Require Acces for all resources
    <Location />
        AuthType Basic
        AuthName "Private"
        Require valid-user
        AuthUserFile /opt/git/user.passwd
    </Location>
</VirtualHost>
</IfModule>

Now we only need to create our repositories under /opt/git/repositories (The repositories must be owned by the apache user to work):

cd /opt/git/repositories
git --bare init test.git
chown -R www-data:www-data /opt/git/repositories

And thats all, now we can checkout the repository using the url https://git.example.com/test.git:

git clone https://username@git.example.com/test.git
cd test
mkdir testdir
touch testdir/README
git add .
git commit -m 'test commit'
git push origin master

This two environment variables are usefull to avoid problems checking out your repository:

# Disable SSL Certificate verification,
# usefull with self-signed certificates
export GIT_SSL_NO_VERIFY=true

# Activates verbosity for HTTP Requests
export GIT_CURL_VERBOSE=1

Here is a comparison of Redmine/ChiliProject and Trac features:

The first thing that made me not to test Redmine/ChiliProject immediately was that it is RoR and the complexity to make it run stable under apache, but after searching a bit, I found Phusion Passenger and Ruby Enterprise, which is a very good solution to run RoR products stable under Apache, and you have the ability to run Ruby with custom user, usefull for shared environments.

Installation

1. Ruby Enterprise

   I downloaded and installer from source code, so that it’s compiled for my server and I can store it in a specific location. So, the first we have to do is download latest version from Ruby Enterprise Download page

   wget http://rubyenterpriseedition.googlecode.com/files/ruby-enterprise-1.8.7-2011.03.tar.gz
   tar zxvf ruby-enterprise-1.8.7-2011.03.tar.gz
   cd ruby-enterprise-1.8.7-2011.03
   ./installer

   Follow installer instructions, and install dependencies if needed (the installer tells us which packages we need for our Linux distro)

2. Phusion Passenger

   Next thing to do, is install the Passanger module for apache, this can be done with the passenger-install-apache2-module script available at Ruby Enterprise installation

   cd /opt/ruby-enterprise-1.8.7-2011.03/bin
   ./passenger-install-apache2-module

   This script also checks the dependencies and says what packages you need for your Linux distro

3. Apache

   Now we need to configure apache, first we need to activate and configure the passenger module

   /etc/apache2/mods-enabled/passenger.load

   LoadModule passenger_module /opt/ruby-enterprise-1.8.7-2011.03/lib/ruby/gems/1.8/gems/passenger-3.0.7/ext/apache2/mod_passenger.so

   /etc/apache2/mods-enabled/passenger.conf

   <ifmodule mod_passenger.c>
     PassengerRoot /opt/ruby-enterprise-1.8.7-2011.03/lib/ruby/gems/1.8/gems/passenger-3.0.7
     PassengerRuby /opt/ruby-enterprise-1.8.7-2011.03/bin/ruby
    
     PassengerFriendlyErrorPages Off
     PassengerUserSwitching On
     PassengerDefaultUser www-data
     PassengerDefaultGroup www-data
   </ifmodule>

   And the last thing is configure a vhost under which we will run this ChiliProject installation

   /etc/apache2/sites-enabled/chiliproject

   NameVirtualHost *:443
   <virtualhost *:443>
   	SSLEngine on
    
   	SSLCertificateFile    /etc/apache2/ssl/server.crt
   	SSLCertificateKeyFile /etc/apache2/ssl/server.key
    
   	<ifmodule mod_passenger.c>
   		PassengerUser chiliproject
   		PassengerGroup chiliproject
   	</ifmodule>
    
           ServerAdmin webmaster@chiliproject.org
   	ServerName chiliproject.org
    
   	DocumentRoot /home/chiliproject/public
   	<directory />
   		Options -MultiViews
   		AllowOverride All
   	< /Directory>
    
   	ErrorLog /var/log/apache2/chiliproject-error.log
    
   	CustomLog /var/log/apache2/chiliproject-access.log combined
   </virtualhost>

4. ChiliProject

   First install needed gems

   /opt/ruby-enterprise-1.8.7-2011.03/bin/gem install -v=0.4.2 i18n
   /opt/ruby-enterprise-1.8.7-2011.03/bin/gem install -v=1.0.1 rack
   /opt/ruby-enterprise-1.8.7-2011.03/bin/gem install mysql

   Download the last available ChiliProject version from ChiliProject Files Page

   wget https://www.chiliproject.org/attachments/download/99/chiliproject-1.4.0.tar.gz
   tar zxvf chiliproject-1.4.0.tar.gz
   mv chiliproject-1.4.0 /home/chiliproject

   Create the mysql database and user for ChiliProject

   CREATE DATABASE chiliproject CHARACTER SET utf8 COLLATE utf8_unicode_ci;
   GRANT ALL privileges ON chiliproject.* TO 'chiliproject'@'localhost' IDENTIFIED BY 'my_password';

   Configure ChiliProject Database Connection

   mv config/database.yml.example config/database.yml

   production:
     adapter: mysql
     database: chiliproject
     host: localhost
     username: chiliproject
     password: my_password

   Now initialize ChiliProject (session Store, DB Tables, DB Default Data

   /opt/ruby-enterprise-1.8.7-2011.03/bin/rake generate_session_store
   RAILS_ENV=production /opt/ruby-enterprise-1.8.7-2011.03/bin/rake db:migrate
   RAILS_ENV=production /opt/ruby-enterprise-1.8.7-2011.03/bin/rake redmine:load_default_data

   And the last thing we need to do before we can restart apache and begin to use the new installed ChiliProject, we need to create the chiliproject user

   adduser --home /home/chiliproject --shell /bin/false --no-create-home chiliproject
   chown -R chiliproject:chiliproject /home/chiliproject

5. (Optinal) Rmagick

   If we would like to enable Gantt export to png image we need to install Rmagick (available as gem). First we need to install imagemagick ang graphicsmagick dev packages and then we can install the rmagick gem.

   apt-get install libmagickcore-dev libgraphicsmagick1-dev libmagickwand-dev
   /opt/ruby-enterprise-1.8.7-2011.03/bin/gem install rmagick

Now we only need to restart Apache and load ChiliProject in our Browser. The default user is admin/admin

In Debian we have a package called spidermonkey-bin.

apt-get install spidermonkey-bin

After installing you will have a program called smjs.

If you start the program without parameters you will get a Javascript shell, in which you can write and test javascript.

$ /usr/bin/smjs
js> function test() {
print('test');
}
js> test
function test() {
    print("test");
}
js> test();
test
js> function test() {
print('test');
test2(123);
}
js> function test2(param) {
print ('test2: ' + param);
}
js> test();
test
test2: 123
js>

To exit the shell, just press “Ctrl+D“.

It’s important to note that in spidermonkey you doesn’t have the “document” Object. If you want to print out text, you cant use document.write, you should use print.

document.write('test'); // In browser
print('test'); //spidermonkey

You can also make smjs to execute the content of a file.

$ /usr/bin/smjs test-local.js
Rand: 407
Old: 600
New: 800
Result: old

First of all we need to install needed packages

apt-get install libapache2-mod-wsgi python-virtualenv python-setuptools

Once we have installed the required packages proceed to create the Python environment

mkdir /usr/local/trac
cd /usr/local/trac
virtualenv python

We now have the isolated Python environment locate under /usr/local/trac/python.

To make possible to use easy_install with repositories we need to upgrade easy_install. I use this to install Trac plugins directly from SVN.

/usr/local/trac/python/bin/easy_install -U trunk

We now can install trac 0.12 using the 0.12b1 SVN Tag (http://svn.edgewall.com/repos/trac/tags/trac-0.12b1 or Trac==0.12b1) or directly from SVN Trunk:

/usr/local/trac/python/bin/easy_install http://svn.edgewall.org/repos/trac/trunk

This will download and install the latest trunk version for Trac.

To have webaccess to the Trac projects, we need a .wsgi script, were we define where our local python environment is located:

# Not needed if mod_wsgi >= 3.0
import sys
sys.stdout = sys.stderr
 
# Load Trac
import trac.web.main
application = trac.web.main.dispatch_request

And finally we need to configure apache. If you want only one Trac project, you should define trac.env to the location of your trac, but if you want multiproject support, you must use trac.env_parent_dir (this is what I used)

<virtualhost *:80>
    ServerName trac.dns.com
 
    DocumentRoot /usr/local/trac/htdocs
    ErrorLog /var/log/apache2/trac-error.log
    CustomLog /var/log/apache2/trac-access.log combined
 
    # Trac Auth
    <location />
        AuthType Basic
        AuthName "Trac"
        AuthUserFile /usr/local/trac/.htpasswd
        Require valid-user
    < /location>
 
    #Trac
    #Define ProcessGroup with user and group under which it should run
    WSGIDaemonProcess trac user=trac group=trac python-path=/usr/local/trac/python/lib/python2.5/site-packages python-eggs=/usr/local/trac/python/cache
    WSGIScriptAlias / /usr/local/trac/htdocs/trac.wsgi
 
    <directory /usr/local/trac/htdocs>
        WSGIProcessGroup trac
        WSGIApplicationGroup %{GLOBAL}
        SetEnv trac.env_parent_dir /usr/local/trac/projects
    </directory>
</virtualhost>

We need to create the user and change the permissions for /usr/local/trac for that user trac

adduser --home /usr/local/trac --shell /bin/false --no-create-home trac
chown -R trac:trac /usr/local/trac

If you get an error “ImportError: No module named simplejson” just install it using easy_install

/usr/local/trac/python/bin/easy_install simplejson

For now the only implemented function is that you can login using only “user” and roundcube will authenticate against IMAP using the domain extracted from the webmail URL.

You can get download the plugin from the Vlogin sourceforge project page.

So I decided to install Spamassassin and Clamav to detect and reject some of this spam.

First of all, we need to install needed packages:

apt-get install spamassassin amavisd-new clamav clamav-daemon

We will begin configuring amavisd-new, the configuration files are at /etc/amavis/conf.

In file 20-debian_defaults I changed the header that will be added to each mail processed:

$X_HEADER_LINE = "AntiSpam/Antivirus Scanner at $mydomain";

We need to activate antispam and antivirus check in amavis, this is found in file 15-content_filter_mode. We need to uncomment @bypass_virus_checks_maps and @bypass_spam_checks_maps. The file will look like this:

use strict;
 
# You can modify this file to re-enable SPAM checking through spamassassin
# and to re-enable antivirus checking.
 
#
# Default antivirus checking mode
# Please note, that anti-virus checking is DISABLED by
# default.
# If You wish to enable it, please uncomment the following lines:
 
 
@bypass_virus_checks_maps = (
   \%bypass_virus_checks, \@bypass_virus_checks_acl, \$bypass_virus_checks_re);
 
 
#
# Default SPAM checking mode
# Please note, that anti-spam checking is DISABLED by
# default.
# If You wish to enable it, please uncomment the following lines:
 
 
@bypass_spam_checks_maps = (
   \%bypass_spam_checks, \@bypass_spam_checks_acl, \$bypass_spam_checks_re);
 
1;  # ensure a defined return

By default, amavis will use the hostname for $mydomain, but thats not what I want, so I edited file 05-domain_id, setting $mydomain to binware.org

use strict;
 
# $mydomain is used just for convenience in the config files and it is not
# used internally by amavisd-new except in the default X_HEADER_LINE (which
# Debian overrides by default anyway).
 
$mydomain = 'binware.org';
 
# amavisd-new needs to know which email domains are to be considered local
# to the administrative domain.  Only emails to "local" domains are subject
# to certain functionality, such as the addition of spam tags.
#
# Default local domains to $mydomain and all subdomains.  Remember to
# override or redefine this if $mydomain is changed later in the config
# sequence.
 
@local_domains_acl = ( ".$mydomain" );
 
1;  # ensure a defined return

Next step is to add the clamav user to the amavis group, so that amavis can call clamav

adduser clamav amavis

Now it’s time to configure postfix. The first file to edit is main.cf:

# Amavisd-new
content_filter = amavis:[127.0.0.1]:10024

And in master.conf add this at the end of file:

amavis unix - - - - 2 smtp
  -o smtp_data_done_timeout=1200
  -o smtp_send_xforward_command=yes
 
127.0.0.1:10025 inet n - - - - smtpd
  -o content_filter=
  -o local_recipient_maps=
  -o relay_recipient_maps=
  -o smtpd_restriction_classes=
  -o smtpd_client_restrictions=
  -o smtpd_helo_restrictions=
  -o smtpd_sender_restrictions=
  -o smtpd_recipient_restrictions=permit_mynetworks,reject
  -o mynetworks=127.0.0.0/8
  -o strict_rfc821_envelopes=yes
  -o smtpd_bind_address=127.0.0.1

That’s all! Now restart services:

/etc/init.d/clamav-daemon restart
/etc/init.d/clamav-freshclam restart
/etc/init.d/amavis restart
/etc/init.d/postfix restart

Despues de buscar un poco por google me encuentro con este articulo que explica como hacer funcionar el certificado en Linux con Firefox. Asi que me puse a mirarlo con Firefox3, el cual ya tiene el certificado de FNMT instalado.

Asi que lo unico que necesitamos hacer es ir a about:config aceptar el mensaje de aviso que nos sale

Y buscar el string signed.applets.codebase_principal_support y dandole doble-click dejarlo en true

Con esto listo, simplemente reiniciamos Firefox y ya podemos empezar a presentar nuestras declaraciones sin tener que arrancar VMware ;o)

La replicacion funciona por medio de los binary log de mysql, asi que lo primero sera configurar correctamente el servidor maestro. Asi que añadimos estas opciones en el fichero my.cnf si aun no estan.

[mysql]
#Activamos el log binario
log-bin=mysql-bin
#Establecemos un id para el servidor, el maestro SIEMPRE sera 1
server_id=1
#Esto ayuda por si el master tiene un cuelgue y no haya problemas en la replicacion al volver a arrancarlo
sync_binlog=1
#Si trabajamos con INNODB, hay que activar esto
innodb_flush_log_at_trx_commit=1

IMPORTANTE: Hay que comprobar que la linea skip-networking no este puesta en el master, ya que sino no abrira el puerto

Ahora dejaremos lista la configuracion en el esclavo

[mysql]
#Activamos el log binario
log-bin=mysql-bin
#Id del esclavo, este tiene que ser unico
server_id=2

Ahora en el maestro le damos permisos al esclavo

GRANT REPLICATION SLAVE ON *.* TO slave@IP_ESCLAVO IDENTIFIED BY 'slavepass';

Ahora vamos a hacer un snapshot de la posicion actual del maestro para dejar el esclavo en la misma posicion para empezar a replicar. Nos conectamos al servidor maestro y ejecutamos lo siguiente:

FLUSH TABLES WITH READ LOCK;
SHOW MASTER STATUS;

Esto nos va a devolver la posicion actual del log, asi que apuntamos “File” y “Position“, que lo necesitaremos para ponerselo al esclavo, en caso de que salga en blanco “File” es ” y “Position” es 4

Ahora sin cerrar la conexion mysql (sino se pondria en marcha otra vez), ejecutamos esto desde otro terminal:

$ mysqladmin -u root -p shutdown

Realizamos ahora la copia de la base de datos, hay dos metodos:

• mysqldump

  $ mysqldump --all-databases --master-data -u root -p > /tmp/dump.sql

• tar

  $ cd /var/lib ; tar cf /tmp/mysql.tar mysql

Pasamos la copia al esclavo y lo importamos:

• mysqldump

  $ mysql -u root -p < /tmp/dump.sql

• tar

  $ cd /var/lib ; tar xcf /tmp/mysql.tar

Lo siguiente es ponerle los datos del maestro al esclavo:

CHANGE MASTER TO master_host='IP_MAESTRO', master_user='slave', master_password='slavepass', master_log_file='', master_log_pos=4;
START slave;

Lo primero que hay que hacer es descargarse la ultima version de eAccelerator, tambien necesitaremos en el server las utilidades de desarrollo de php

apt-get install php5-dev

La instalacion es realmente muy sencilla, solo tenemos que descomprimir, compiler, instalar y configurar.

• Descomprimimos

tar xvfj eaccelerator-0.9.5.tar.bz2

• Compilamos

cd eaccelerator-0.9.5
phpize
./configure
make

• Instalamos (nos pondra el modulo en la carpeta de modulos de php)

make install

• Copiamos la configuracion para que la cargue php

cp eaccelerator.ini /etc/php5/conf.d/

Lo primero que hay que hacer en la configuracion es decirle que no es una zend_extension, por lo tanto cambiamos

zend_extension="/usr/lib/php4/eaccelerator.so"

por

extension="eaccelerator.so"

Luego yo en la configuracion he dejado todo como venia por defecto excepto

eaccelerator.log_file = "/var/log/apache/eaccelerator_log"

Descargar hacker::quiz

• Level1

• Aparentemente no parece que hay ningun error de programacion, pero si pruebas de buscar los .bak, *~… encuentras el fichero login.php~ y en el aparece la contraseña en md5. Con un cracker de md5 como por ejemplo lcrack. En pocos minutos saldra la contraseña del nivel.

• Level2

• Aqui hay que fijarse que en el codigo hay un “src=javascript” y que el codigo bueno esta en el fichero javascript. Aqui se una un algoritmo de encriptacion super sencillo, que se puede desencriptar facilmente cambiando la funcion generatePass para sacar la contraseña.

• Level3

• Este nivel es un formulario con sql injection super sencillo, cuando pones un ‘ el error cambia a “Error Sql”, por lo tanto con un sencillo “‘ OR 1=1 — a” te saltas la autenficiacion y pasas al siguiente nivel

• Level4

• En este nivel hay un applet java que gestiona la autentificacion. Descargando el .class y descompilandolo con un java decompiler tipo jad. Analizando el codigo ves que accede a un fichero del que saca el usuario y contraseña.

• Level5

• En este nivel, se puede ver que el formulario es multi-idioma, pero si cambias el parametro del idioma, intenta acceder a un fichero, por lo tanto, cuando pones “login/index” da un error de que no encuentra authdata.php, apuntas a ese fichero y te aparece el usuario y contraseña por pantalla

• Level6

• Aqui puedes ver que la autentificacion tiene unas estadisticas creadas con awstats, investigando un poco te das cuenta que la version de awstats es vulnerable a injeccion de comandos en la variable “configdir”. Haciendo un ls ves que hay un fichero “instructions-next-level.pl”, haciendole un simple “cat” se puede ver en los comentarios la contraseña

• Level7

• Aqui te dan una linea de un usuario de la maquina, al cual con por ejemplo “john the ripper” crackeas la contraseña y consigues acceso a la maquina. Una vez dentro de la maquina, buscando un poco te encuentras con un fichero “getsh” (el codigo fuente esta incluido en el fichero) con suid en “/opt/…/”. Analizando el fichero con un editor normal o un editor hexadecimal, encuentras el string “/opt/…/theshell”, y basta con copiar el fichero “mysh” a “theshell” y ejecutas el “getsh” y ya eres root.