Passwordless SCP/SSH/SFTP from linux to windows server

1. Install OpenSSH-server and client with PowerShell command

Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

Start-Service sshd

Set-Service -Name sshd -StartupType 'Automatic'

https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse

2. Generate public and private key on  linux server with below command

ssh-keygen -t rsa

3. copy content of /<user_home_direcotry>/.ssh/id_rsa.pub

4. Paste the copied data inside windows server C:\Users\<Administrator>\.ssh\authorized_keys

5. Edit C:\Windows\System32\OpenSSH/sshd_config_default and add below lines at bottom


Match User <administrator>
       AuthorizedKeysFile C:\Users\<Administrator>\.ssh\authorized_keys


6. Restart OpenSSH SSH Server Service.

Restart-Service sshd

Install Mariadb/Mysql 10.3 on centos8

yum install mariadb mariadb-server

systemctl enable mariadb

systemctl start mariadb

sync/change/update time with NTP server on windows

net stop w32time

w32tm /config /syncfromflags:manual /manualpeerlist:"time.windows.com, 0.us.pool.ntp.org,1.us.pool.ntp.org,2.us.pool.ntp.org,3.us.pool.ntp.org"

w32tm /config /reliable:yes

net start w32time

w32tm /query /configuration

update to kernel 5.2 on linux centos7

Note: Take a snapshot  before doing kernel update.

1. Install binaries required to compile Kernel

yum install gcc ncurses-devel make bc bison flex elfutils-libelf-devel openssl-devel grub2 -y

2. Download the latest kernel from https://kernel.org and extract it

curl -O https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.2.11.tar.xz

tar -xf linux-5.2.11.tar.xz


3. Copy the current Kernel configuration (.config) from the /boot to /root/linux-5.2.11

cp /boot/config-3.10.0-862.el7.x86_64 /root/linux-5.2.11

make menuconfig

save and exit

4. Make kernel and install

make
make install

5. Reboot

Linux root password hack

linux root password hack(Centos7, Redhat 7, Debian)

1. press any key to hold on to grub screen

2. press "e" to edit the grub file

3.a  add "rd.break" at end of the kernal line
3.b add init=/bin/bash   for debian of the linux line

4. press Ctrl+X

5a. mount -o remount,rw sysroot
5b. mount -o remount,rw / (for debian)

6.  chroot sysroot

7. passwd

8. touch /.autorelabel

9. reboot


Why   mount -o remount,rw sysroot ?
- When system boots in the single user mode the file system are in read-only mode. we cannot change the password in read only mode because these changes needs to be written in /etc/shadow file.

Why touch /.autorelabel?
- Relabel the filesystem for SElinux automatically.

Server hardening linux

Server harding is a process to make system secure and manageable.

for example.

1. root login disable on ssh
2. set password in single usermode
3. removing unwanted kernal module
4. enforcing SELinux
5. remote login warning banner
6. apply security patches
7. Disable xinetd service
8. unwanted network port blocked
9. Enable audit logs
10. logging is configured

Steps for hardening : https://www.cisecurity.org/cis-benchmarks/

install/run dotnet core on linux - Centos 7

1 . Install dotnet core, sdk https://dotnet.microsoft.com/download

2. 
rpm -Uvh https://packages.microsoft.com/config/rhel/7/packages-microsoft-prod.rpm
yum update
yum install aspnetcore-runtime-2.2
yum install dotnet-sdk-2.2


Run app:

dotnet coretest.dll --urls "http://*:80;"


Hosting on Nginx : https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/linux-nginx?view=aspnetcore-2.2

Hosting on Apache : https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/linux-apache?view=aspnetcore-2.2

Why should i use docker? container?

Docker is operating-system-level virtualization also know as containers.

Why should i use docker?

Ans: It's gives you want you want ( literally ). It run all application as an instance.


How to use Docker? ( eg if you want to run httpd on docker)

1. Install Docker on linux or windows box ( Linux preferred )

2. docker pull httpd

3. docker run -p 80:80 -d -v /var/www/html:/usr/local/apache2/htdocs:Z httpd

    (This will mount your local /var/www/html to /usr/local/apache2/htdocs of docker instance)

Other useful commands :

 ls -l /var/lib/docker/

 ls -l /var/lib/docker/containerd/

docker pull centos

docker run -it -d centos

docker container ls

docker commit 4f0b435cdbd7 man-centos

docker kill container_id

docker rm  container_id

docker exec -it [container-id] bash

docker run -p 80:80 -d -v /var/www/html:/usr/local/apache2/htdocs:Z httpd   - :Z

docker run ubuntu:14.04 echo "hola"

Simple Control Panel for webhosting - opensoruce

Simplest way to manage your webhosting/email/SSL

# Create new vm

# Connect to your server as root via SSH

ssh root@your.server

# Download installation script

curl -O http://vestacp.com/pub/vst-install.sh

# Run it

bash vst-install.sh

You will get he admin username and password at the end of installation.

Mining Bytecoin(BCN) on raspberypi 2, Ubuntu, Linux

Mining Bytecoin on Linux(ubuntu , raspberypi 2) :

Bytecoin pool : http://bytecoin-pool.org/t/en/

1. git clone https://github.com/tpruvot/cpuminer-multi

2. cd cpuminer-multi

3. ./build.sh ( cpuminer file will be created)

4. ./cpuminer -a cryptonight -o stratum+tcp://bytecoin-pool.org:3333 -u Your_Bytecoin_Adress -p x -t 3


-t 3 = use only 3 core
-u   = Your wallet address (Create wallet address)

Run mining in background :

screen -A -m -d -S mycpumine ./cpuminer -a cryptonight -o stratum+tcp://bytecoin-pool.org:3333 -u Your_Bytecoin_Adress -p x -t 3

Note for Debian/Ubuntu users:

apt-get install automake autoconf pkg-config libcurl4-openssl-dev libjansson-dev libssl-dev libgmp-dev make g++

Note for pi64 users:

 ./configure --disable-assembly CFLAGS="-Ofast -march=native" --with-crypto --with-curl

Raspberry 2 mining (3 core):

Hashrate : 5-6H/s
Estimated earning: 1.19 BCN/day

Top 12 cryptocurrency to buy in 2018

Top 12 cryptocurrency to buy in 2018

1. Ubiq (UBQ 6.4$) - (Smart contracts, stable than Ethereum, community)
2. Cardano (ADA -0.99$) - (Smart contracts, community)
3. NEM (XEM 1.1$) - (Smart contracts, community)
4. Bytecoin (BCN 0.006145$) - (Cheapest privacy coin, community)
5. Golem (GNT 1$)(super computing)
6. Ripple (XRP 2.5$) -(Fast,Most bank will be using it in future, community)
7. Verge (XVG 0.141010) - (Cheap privacy option coin)
8. Komodo (KMD 9.9$) - (Smart contracts, community)
9. XTRABYTES (XBY 0.801641$) - (STATIC Nodes,security, scalability and decentralization)
10. Stellar (XLM 0.850339$) - (Fast, Reliable, less transaction fee,Cross Borders payment)
11. BitShares (BTS 0.816756$) - (Stable currency, Decentralized Asset Exchange,Dynamic Account Permissions)
12. IOTA (MIOTA 4$) - (Free transaction, blockless distributed ledger)

Price as of 3rd Jan 2018

Note : Buy at your own risk.


Where to buy :

https://poloniex.com
https://cryptopia.co.nz/
https://www.cryptonator.com

How to mine XRY coin(royalties coin) - easiest coin to mine windows

Easiest coin to mine on windows PC 

1. Download and install the ROYALTIES Wallet from official website https://xry.io

2. Open Royalties wallet ( It will take some time to sync to the network however you can mine)

3. First take backup of your wallet and save it at some secure place(Gdrive, onedrive, etc.)

4. Goto Mining > add pool > host : 45.76.251.222 and port:3333

5. Click on start mining.


Note :

* Check your XRY earning by entering your address here : http://www.xrypool.co

* XRY calculator : 20hash/sec = 1.47 XRY /day estimated  (as of 8th Dec 2017)

* You can deposit your XRY to xrybank which will give you profit as below

* XRY Block explorer : http://xryexplorer.info/

* My mining status 1 :

Hashrate : 480H/s
Duration : 1 hours
Mined : 0.7 XRY

* My mining status 2 (intel i3 6006u):

Hashrate : 20H/s
Duration : 1 hours
Mined : 0.1 XRY

* Convert XRY to Bitcoin : https://www.cryptopia.co.nz/Exchange/?market=XRY_BTC

* Donate XRY : XRY1Em81NiKTgHU3nTVZxAMyiyu44MLTCBJ3Mdd6ns2eUw5XeZKMRwf92hLaVQqUxT48VSsqdtPA3H3b8mgZURLm3UeRATciAb

How to mine Monero on Linux CPU

How to create Monero wallet's public address

1. Go to https://mymonero.com/#/create-your-account

2. Enter private login key and save this in  key somewhere safe.

3. Once you logged in you will see your wallet address.

Mining Monero on Ubuntu 14 and above

Replace WALLET_ADDRESS with your own Monero wallet's public address. The "-t 2" option determines how many of your CPU threads will be used for mining.

1. sudo apt-get install git libcurl4-openssl-dev build-essential libjansson-dev autotools-dev automake

2. git clone https://github.com/hyc/cpuminer-multi cd cpuminer-multi

3. ./autogen.sh

4. CFLAGS="-march=native" ./configure

5. make

6. sudo ./minerd -a cryptonight -o stratum+tcp://pool.minexmr.com:4444 -u WALLET_ADDRESS -p x -t 2

Mining Monero on Fedora 24 and above

Replace WALLET_ADDRESS with your own Monero wallet's public address. The "-t 2" option determines how many of your CPU threads will be used for mining.

1. yum -y install git curl-devel libcurl glib-devel libtool 

2. git clone https://github.com/hyc/cpuminer-multi 

3. cd cpuminer-multi

4.  ./autogen.sh 

5. CFLAGS="-march=native" ./configure 

6. make 

7. sudo ./minerd -a cryptonight -o stratum+tcp://pool.minexmr.com:4444 -u WALLET_ADDRESS -p x -t 3

How to check mining status 

1. Go to http://minexmr.com/#worker_stats

2. Enter your wallet address

Note : The minimum withdrawal  is 0.5XMR ( you can set here http://minexmr.com/)

Estimate Mining Profits

1KH/s = 0.02XMR/day

This is only an estimate, you may receive more or less than stated

SCP secure copy directly between linux machines

SCP : secure copy directly between linux servers. SCP runs on port 22 by default.

server1 = 192.168.0.10
server2 = 192.168.0.11


Syntax : scp -[options] username@server1:/path  /local_path

Options :

p = Speed of connection
r = Recursive
v = Verbose details
C = Compression
l = Bandwidth Limit (l -500)
p= Port

root@server2:/tmp# scp -pr root@server1:/root/test /tmp
test1                                         100%    0     0.0KB/s   00:00
test2                                         100%    0     0.0KB/s   00:00

More : http://www.tecmint.com/scp-commands-examples/

Password less authentication in linux

Source : host A
Destination: host B


1. Run the below command for generating public and private key( host A)

ssh-keygen -t rsa

/home/username/id_rsa (private key)
/home/username/id_rsa.pub (public key)

2. ssh-copy-id -i  /home/username/id_rsa.pub host_B_ip_address



Alternate way:

* Copy the text inside id_rsa.pub file .

* Login into host B and go to /root/username/

and create new file "authorized_keys" and paste text copied from step 2.

*  Login into Host A to Host B password less.(ssh host B)


Simple:

Put public key(host A) to authorized_keys(host B)

Now Host A can login into host B without any password.

ffmpeg merge audio video

ffmpeg merge audio video:

Input file : song.mp3 , video.mp4
Output file : output.mp4


ffmpeg -i song.mp3 -i video.mp4 -acodec copy -vcodec copy -f mp4 output.mp4


If your audio or video stream is longer, you can add the -shortest option so that ffmpeg will stop encoding once one file ends.

ffmpeg -i song.mp3 -i video.mp4 -acodec copy -vcodec copy -f mp4 -shortest output.mp4

Linux user management commands

Create user in linux :

root@test2:~# useradd test1
root@test2:~# passwd test1
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully

Note : we can also create user with adduser command.

-Whenever user is created in linux the default access is assigned to user via /etc/profile file.
-Username is added to /etc/passwd file.
-Same as username one group is created in /etc/group file.
-Encrypted password save into /etc/shadow file.


Delete user in linux:

root@test2:~# userdel test1

Lock user account in linux:

root@test2:~# passwd -l test1
passwd: password expiry information changed.

when user will try to login he will get below message.

login as: test1

test1@192.168.0.10's password:

Access denied

When the user account is locked we can see ! sign after username in /etc/shadow file.

root@test2:~# cat /etc/shadow | grep test

test1:!$6$prWdpshs$A0WNBzbHC5sEke7hatNq8lFaB/Ux.SQ3vRc1.If4joDTD/AMpsuPYT.1mCmfBDUCoh6ND7izfcT9buo1wiZ581:17066:0:99999:7:::

Unlock user account in linux:

root@test2:~# passwd -u test1

passwd: password expiry information changed.

You can also unlock by editing /etc/sadow file. remove the ! sign from locked account.

Linux user account details :

root@test2:~# chage -l test1

Last password change                                    : Sep 22, 2016

Password expires                                        : never

Password inactive                                       : never

Account expires                                         : never

Minimum number of days between password change          : 0

Maximum number of days between password change          : 99999

Number of days of warning before password expires       : 7

See process run by user :

root@test2:~# ps  -u test1

  PID TTY          TIME CMD

 2442 ?        00:00:00 systemd

 2443 ?        00:00:00 (sd-pam)

 2463 ?        00:00:00 sshd

 2464 pts/0    00:00:00 sh

Root access to test1 user :

Edit the /etc/sudoers and add the below line.

%test1  ALL=(ALL:ALL) ALL

Switch to another user :

sudo su - username

root@test2:~# sudo su - test1

No directory, logging in with HOME=/

$ bash

test1@test2:/$

Simple linux boot process

When you press the power button of linux system these six steps are followed by linux system.

1. BIOS

• BIOS stands for Basic Input/Output System
• Performs some system integrity checks
• Searches, loads, and executes the boot loader program.
• It looks for boot loader in floppy, cd-rom, or hard drive. You can press a key (typically F12, F2, DEL,  but it depends on your motherboard) during the BIOS startup to change the boot sequence.
• Once the boot loader program is detected and loaded into the memory, BIOS gives the control to it.
• So, in simple terms BIOS loads and executes the MBR boot loader.

2. MBR

• MBR stands for Master Boot Record.
• It is located in the 1st sector of the bootable disk. Typically /dev/hda, or /dev/sda
• MBR is 512 bytes in size. It has three components 1) primary boot loader info in 1st 446 bytes 2) partition table info in next 64 bytes 3) MBR validation check in last 2 bytes.
• It contains information about GRUB (or LILO in old systems).
• MBR loads and executes the GRUB boot loader.

3. GRUB

• GRUB stands for Grand Unified Bootloader.
• If you have multiple kernel images installed on your system, you can choose which one to be executed.
• GRUB displays a splash screen, waits for few seconds, if you don’t enter anything, it loads the default kernel image as specified in the grub configuration file.
• GRUB has the knowledge of the filesystem (the older Linux loader LILO didn’t understand filesystem).
• Grub configuration file is /boot/grub/grub.conf (/etc/grub.conf is a link to this). The following is sample grub.conf of CentOS.

#boot=/dev/sda
default=0
timeout=5
splashimage=(hd0,0)/boot/grub/splash.xpm.gz
hiddenmenu
title CentOS (2.6.18-194.el5PAE)
          root (hd0,0)
          kernel /boot/vmlinuz-2.6.18-194.el5PAE ro root=LABEL=/
          initrd /boot/initrd-2.6.18-194.el5PAE.img

• As you notice from the above info, it contains kernel and initrd image.
• GRUB just loads and executes Kernel and initrd images.

4. Kernel

• Mounts the root file system as specified in the “root=” in grub.conf
• Kernel executes the /sbin/init program
• Since init was the 1st program to be executed by Linux Kernel, it has the process id (PID) of 1. Do a ‘ps -ef | grep init’ and check the pid.
• initrd stands for Initial RAM Disk.
• initrd is used by kernel as temporary root file system until kernel is booted and the real root file system is mounted. It also contains necessary drivers compiled inside, which helps it to access the hard drive partitions, and other hardware.

5. Init

• Looks at the /etc/inittab file to decide the Linux run level.
• Following are the available run levels
  • 0 – halt
  • 1 – Single user mode
  • 2 – Multiuser, without NFS
  • 3 – Full multiuser mode(mostly default)
  • 4 – unused
  • 5 – X11
  • 6 – reboot
• Init identifies the default initlevel from /etc/inittab and uses that to load all appropriate program.
• Run ‘grep initdefault /etc/inittab’ on your system to identify the default run level
• If you want to get into trouble, you can set the default run level to 0 or 6. Since you know what 0 and 6 means, probably you might not do that.
• Typically you would set the default run level to either 3 or 5.

6. Runlevel programs

• When the Linux system is booting up, you might see various services getting started. For example, it might say “starting sendmail …. OK”. Those are the runlevel programs, executed from the run level directory as defined by your run level.
• Depending on your default init level setting, the system will execute the programs from one of the following directories.
  • Run level 0 – /etc/rc.d/rc0.d/
  • Run level 1 – /etc/rc.d/rc1.d/
  • Run level 2 – /etc/rc.d/rc2.d/
  • Run level 3 – /etc/rc.d/rc3.d/
  • Run level 4 – /etc/rc.d/rc4.d/
  • Run level 5 – /etc/rc.d/rc5.d/
  • Run level 6 – /etc/rc.d/rc6.d/
• Please note that there are also symbolic links available for these directory under /etc directly. So, /etc/rc0.d is linked to /etc/rc.d/rc0.d.
• Under the /etc/rc.d/rc*.d/ directories, you would see programs that start with S and K.
• Programs starts with S are used during startup. S for startup.
• Programs starts with K are used during shutdown. K for kill.
• There are numbers right next to S and K in the program names. Those are the sequence number in which the programs should be started or killed.
• For example, S12syslog is to start the syslog deamon, which has the sequence number of 12. S80sendmail is to start the sendmail daemon, which has the sequence number of 80. So, syslog program will be started before sendmail.
• First it Kills the Program then Start the Program

Iptables linux firewall simple command

What is Iptables ?

Iptables is a rule based firewall and it is pre-installed on Linux operating system which control the incoming and outgoing traffic. We can create chain rule and block black listed IP.

For example:

Block IP:

If we got DDOS attack on web server from 192.168.1.10 now we can block the inbound traffic from this IP using Iptabes.

iptables -D INPUT -s 192.168.1.10 -j DROP

or range of IP

iptables -A INPUT -s 192.168.0.0/24 -j DROP

Now from 192.168.1.10 will not able to access anything on your server.

Restricting access with mac address :

iptables -A INPUT -m mac --mac-source 0E:0F:EA:91:04:08 -j DROP

iptables -A INPUT -m mac --mac-source 0E:0F:EA:91:04:08 -j ACCEPT


Restricting access on port:

iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 22 -j ACCEPT

iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 25-j ACCEPT

Port 22(SSH) and 25(SMTP)  is accessible only from 192.168.1.0/24

List of rule :

iptables -L -n -v

-L : List rules.

-v : Display detailed information. 

-n : Display IP address and port in numeric format.

Deleting rule :

iptables -D INPUT -s 192.168.0.10 -j DROP

iptables -D INPUT -m mac --mac-source 0E:0F:EA:91:04:08 -j DROP

iptables -D INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 22 -j ACCEPT

Run sudo command with php or Apache in linux

Ubuntu run apache as the www-data user and sudo command ask for password everytime you run sudo command. If you want to use sudo without a password from a web page, you need to allow www-data user to run sudo command with no password.

Steps:

1. Run  sudo visudo  command.

2. add below lines at the end of the file.

www-data ALL=NOPASSWD: ALL

3. or you can specify only for specific program.

www-data ALL=NOPASSWD: /sbin/iptables


Below PHP code to ban ip using ufw firewall in Linux ubuntu.

 <form action="" method="post">  
 Enter IP : <input type="text" name="ip">  
 <input type="submit" value="Ban IP">  
 </form>  
   
 <?php  
   
 if(isset($_POST["ip"]))  
 {  
 $ip= $_POST["ip"];  
 echo "$ip";  
 $ban = shell_exec("sudo ufw deny from $ip");  
 echo "Banned".$ban;  
 }  
   
 ?>

4. Done