How to bypass BT unreliable nameservers with your own fedora linux dhcp server

I was happily browsing via my BT Homehub broadband connection when for some reason sourceforge.net failed to be resolved in DNS.

I checked with
dig sourceforge.net
and sure enough no answer from nameserver.
The default nameserver was 192.168.1.254 which is my BT Homehub router.
Assuming this then delegated to BT nameservers  dynamically supplied when the broadband connection was made, I looked up these nameservers from the homehub status pages (http://192.168.1.254) and tried them directly and still no answer.

However google nameservers were able to provide an answer.
dig @8.8.8.8 sourceforge.net

I tried rebooting the router and got different nameservers but still not fully functional for all domains.

Google was still working for most sites (but not for some bt community forums which google was showing might have a solution for me).

Sadly the nameservers are not configurable in the BT HomeHub.

I could configure my PC to not use the automatic DHCP supplied DNS servers for this session by editing /etc/resolv.conf to use google nameservers:-

# Generated by NetworkManager
domain cycom.co.uk
search cycom.co.uk cycom.co.uk.
nameserver 8.8.8.8
nameserver 8.8.4.4


(note microsoft users can do something similar by editing the IPV4 and IPV6 properties of  their network connection as explained in my next blog post).

but /etc/resolv.conf was going to be overwritten by network manager next time I connect and I really wanted to continue to use DHCP for everything including from my android phones so with the temporary fix in place I started to configure a dhcp server on my local fedora linux server.

You do need a local linux server configured with a fixed (local network) ip on your home network (e.g. 192.168.1.72).

On this local server, I installed dhcpd with:-
yum install dhcp

Then I edit the config file /etc/dhcp/dhcp.conf to have this content:-

# dhcpd.conf
#
# Sample configuration file for ISC dhcpd
#

# option definitions common to all supported networks...
option domain-name "cycom.co.uk";
option domain-name-servers 8.8.8.8, 8.8.4.4;
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.1.255;
option routers 192.168.1.254;
option domain-search "cycom.co.uk";

default-lease-time 6000;
max-lease-time 72000;

# Use this to enable / disable dynamic dns updates globally.
#ddns-update-style none;

# If this DHCP server is the official DHCP server for the local
# network, the authoritative directive should be uncommented.
authoritative;

# Use this to send dhcp log messages to a different log file (you also
# have to hack syslog.conf to complete the redirection).
log-facility local7;

subnet 192.168.1.0 netmask 255.255.255.0 {
   range 192.168.1.100 192.168.1.200;
}

and then enable and start the dhcpd service:-

systemctl enable dhcpd
systemctl start dhcpd

On the BT HomeHub router I disabled dhcp server leaving me with just the dhcp server on my linux server.

After testing with my android devices, I rebooted my linux laptop (this is the one where I had temporarily overridden the nameservers) and confirmed that the DHCP supplied values now matched google nameservers.

I can sleep much happier now knowing that my DNS is independent of the unreliable BT nameservice.

How to foil ssh brute force cyber attacks on your fedora linux server

I ssh logged into my home network fedora 19 linux server as root today and was told that there had been 2000 failed login attempts since my last login.
My fedora 20 cloud server had 54516 failed login attempts!

So I looked in /var/log/secure and saw that there was a brute force attack on my root login obviously probing for weak passwords.

Jun 22 03:43:51 localhost sshd[13226]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.10.191.222  user=root
Jun 22 03:43:51 localhost sshd[13226]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 22 03:43:53 localhost sshd[13226]: Failed password for root from 116.10.191.222 port 53486 ssh2
Jun 22 03:43:53 localhost sshd[13226]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 22 03:43:56 localhost sshd[13226]: Failed password for root from 116.10.191.222 port 53486 ssh2
Jun 22 03:43:56 localhost sshd[13226]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 22 03:43:59 localhost sshd[13226]: Failed password for root from 116.10.191.222 port 53486 ssh2
Jun 22 03:43:59 localhost sshd[13226]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 22 03:44:01 localhost sshd[13226]: Failed password for root from 116.10.191.222 port 53486 ssh2
Jun 22 03:44:02 localhost sshd[13226]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 22 03:44:04 localhost sshd[13226]: Failed password for root from 116.10.191.222 port 53486 ssh2
Jun 22 03:44:04 localhost sshd[13226]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 22 03:44:06 localhost sshd[13226]: Failed password for root from 116.10.191.222 port 53486 ssh2
Jun 22 03:44:06 localhost sshd[13226]: Disconnecting: Too many authentication failures for root [preauth]
Jun 22 03:44:06 localhost sshd[13226]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.10.191.222  user=root
Jun 22 03:44:06 localhost sshd[13226]: PAM service(sshd) ignoring max retries; 6 > 3

Google research revealed that it is normal for any server with exposed ports such as the ssh port 22 to be attacked 100s of times a day.

It will not be the attacker performing the attack from his own machine but rather it will be a robot he installed on the machine of the last sucker that had a weak password.

So the solution is not to get mad or waste any innocent persons time by reporting it to a human, rather just :-

• say 'thankyou for testing my security and keeping me vigilent'
• '5 attempts was more than enough and I value my cpu time so ...'
• I am disconnecting you from all ports for 100 hours!

The package that will do this is installed as follows:-

yum install fail2ban
cd /etc/fail2ban
ls

You  read jail.conf and for fedora 19 (fail2ban 0.8) it will tell you to create a new file jail.local with the following contents:-

[DEFAULT]
bantime = 360000

[ssh-iptables]
enabled = true

but for fedora 20 (fail2ban 0.9) it will tell you to create a new file jail.local with the following contents :-

[DEFAULT]
bantime = 360000

[sshd]
enabled = true


Next you can enable the fail2ban service and start it:-

systemctl enable fail2ban
systemctl start fail2ban


Happily for me I did not have to test it since my attacker conveniently continued to do it for me. Each ip address he used was added to the banned list until he ran out of ip addresses.

You can see the list by using:-
iptables -L

and see that the last few lines of the rules list (fedora 19) have a section like:-
Chain fail2ban-SSH (1 references)
target     prot opt source               destination        
REJECT     all  --  224.51.174.61.dial.wz.zj.dynamic.163data.com.cn  anywhere             reject-with icmp-port-unreachable
REJECT     all  --  116.10.191.221       anywhere             reject-with icmp-port-unreachable
REJECT     all  --  184.50.174.61.dial.wz.zj.dynamic.163data.com.cn  anywhere             reject-with icmp-port-unreachable
REJECT     all  --  113.17.171.80        anywhere             reject-with icmp-port-unreachable
RETURN     all  --  anywhere             anywhere           
 
for fedora 20 the output looks like this :-

Chain INPUT (policy ACCEPT)
target     prot opt source               destination        
f2b-sshd   tcp  --  anywhere             anywhere             multiport dports ssh

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination        

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination        

Chain f2b-sshd (1 references)
target     prot opt source               destination        
REJECT     all  --  222.186.26.122       anywhere             reject-with icmp-port-unreachable
RETURN     all  --  anywhere             anywhere       

fail2ban has features for many other ports such as mail and ftp but I felt that the ssh port 22  was good enough as an irresistible honey pot as once banned, all ports are closed to the attacker. I will wait and see and enable them if needed.

If I had time it would be fun to allow the attacker in as apparent root with any password to a sandbox and record what he tries to do with his root access. But make sure it really is a sandbox! and that he can't sniff the local network or call out.

How to write and use web services

I am a computer programmer by profession. I have created many web services for clients such as transferring planning applications between local authorities and the government planning portal.

A web service is a bit like a web page in that it contains useful information that is delivered to the end user via the internet using web (http) protocols.
The difference between a web service and a web page is that the information from a web service is usually very dynamic (freshly calculated) and is very tailored to the requesters needs (the requester usually supplies a few parameters to the query to indicate his exact needs).

The immediate consumer of a web service is usually a computer program such as another web service and so the format of the information returned is usually very machine readable (e.g. xml, json, csv) rather than human readable (html).

To write a web service you can use a programming language such a Java, and package it as a servlet so that it can be plugged into a web application server such as JBoss.

There are many frameworks designed for supporting web services, e.g. Spring, J2EE, OSGi, Apache CXF and NetKernel. The frameworks often supply their own web server as well as adapters to plug into other frameworks (usually via a servlet).

We need to narrow down the choices.

Use a RESTful API for your service where the service name and parameters are mostly encoded inside the URL. This makes it easy to call from a simple web page while testing and permits caching. E.g. a url such as http://myhost/myservice/customer/15423/balance

If you just have one big service then a simple java servlet is the simplest choice. This will deploy anywhere and can use any helper APIs you know of.

If you have a variety of coordinated services that are interdependent then you need to consider dependency management, finding (resolving) services at runtime and hot deployment and inter-service call efficiency. All frameworks provide some support for this.

Netkernel goes the furthest in terms of designing for all scales and allows quite fine grained composition of micro-services with good control of scope and dynamic service resolution. It models itself similar to the web and unix so that new services can be added and evolved cheaply.

A static tutorial is here
http://docs.netkernel.org/book/view/book:tutorial:guide/doc:tutorial:selections:rest-web-services

I may create my own tutorial soon and I intend to deploy your web services with a web service so you wont need to install anything. I like to live dangerously.

Easy way to add protein to your diet

I have read a few diet books and magazines over the years. These are my memories on protein.

1. Your body uses it to repair and build muscle.
2. Your body does not store it so don't eat more than 26 grams per meal.
3. It has various amino acids etc and whey protein is a source that is "complete" in that it has all those components that the body needs and can't make itself.
4. Protein is hunger satisfying.

So I tried buying whey protein powders. They are very expensive in shops so the best source is bulk pouch e.g. 5Kg via internet. It costs less than £10/Kg which is a third of the price in shops. Given that whey is 80% dry protein, then it is cheaper than most wet sources of protein (read the labels).

I bought the unflavoured impact whey which is very versatile.
You will need a hand-held soup blender to mix it in a saucepan or large jug. The blender then easily is cleaned by a rinse under the tap.

Some of my favourite uses are:-

1. protein + little water make a great frothy milk substitute which can be used to make a cappuccino. So your morning coffee doubles as a low carb, high protein meal!.
2. protein + skimmed mild +banana + yoghurt +peanut butter makes a good smoothie to drink after a gym session.
3. protein +pancake mix to make some high protein pancakes.
4. protein + little water to make a milk substitute to go with cereals/porridge.

Obviously I eat a brilliant diet with kippers, fish, chicken, eggs, lots of salad, peppers, celery, nuts, cheeses, yogurts, beans and steamed greens from my garden and generally try to seek out new fresh foods all the time (e.g. fennel bulbs, black beans, watercress, rocket, tofu, olives, haggis, sauerkraut, coconut milk). So the protein powder is not a substitute for fresh food but just helps up the protein without fat or sugar.