Linux how to install update SSH

http://www.tecmint.com/install-openssh-server-in-linux/

On RHEL/Centos/Fedora

Type the following yum command to install openssh client and server.

# yum -y install openssh-server openssh-clients

Configuration of OpenSSH

It’s time to configure our OpenSSH behaviour through the ssh config file, but before editing the/etc/ssh/sshd_config file we need to backup a copy of it, so in case we make any mistake we have the original copy.

Open a terminal and run the following command to make a copy of the original sshd configuration file.

$ sudo cp /etc/ssh/sshd_config  /etc/ssh/sshd_config.original_copy

As you can see from the command I typed, I added the original_copy suffix, so every time I see this file I know it is an original copy of the sshd config file.

 nc -v -z 127.0.0.1 22

Referring to the netcat results, the ssh service is running on port 22 on my machine. Very good! What if we want to use another port, instead of 22? We can do that by editing the sshd configuration file.

Set your OpenSSH to listen on TCP port 13 instead of the default TCP port 22. Open the sshd_config file with your favourite text editor and change the port directive to 13.

# What ports, IPs and protocols we listen for
Port 13

Restart OpenSSH server so the changes in config file can take place by typing the following command and runnetcat to verify if the port you set for listening is open or not.

$ sudo /etc/init.d/ssh restart

Should we verify is our openssh server is listening on port 13, or not?. This verification is necessary, so I am calling my lovely tool netcat to help me do the job.

# nc -v -z 127.0.0.1 13

Do you like to make your openssh server display a nice login banner? You can do it by modifying the content of/etc/issue.net file and adding the following line inside the sshd configuration file.

Banner /etc/issue.net

Ｌｉｎｕｘ ｃｏｐｙ ｆｏｌｄｅｒ ｃｏｍｍａｎｄ

http://www.cyberciti.biz/faq/copy-folder-linux-command-line/

Linux: HowTo Copy a Folder [ Command Line Option ]

I'm a new Linux user. How do I copy a directory or folder under Linux operating system using command line options and bash shell?

You can use various command to copy a folder under Linux operating systems.

cp Command

cp is a Linux command for copying files and directories. The syntax is as follows:

 
cp source destination
cp dir1 dir2
cp -option  source destination
cp -option1 -option2  source destination
 

In this example copy /home/vivek/letters folder and all its files to /usb/backup directory:

 
cp -avr /home/vivek/letters /usb/backup
 

Where,

• -a : Preserve the specified attributes such as directory an file mode, ownership, timestamps, if possible additional attributes: context, links, xattr, all.
• -v : Explain what is being done.
• -r : Copy directories recursively.

Example

Copy a folder called /tmp/conf to /tmp/backup:
$ cp -avr /tmp/conf/ /tmp/backup
Sample outputs:

Fig.01: cp command in action

rsync Command

You can also use rsync command which is a fast and extraordinarily versatile file copying tool. It can make copies across the network. The syntax is as follows:

 
rsync -av /path/to/source /path/to/destination
rsync -av /path/to/source/ /path/to/destination/source

CISCO NTP access group on the NTP client

NTP access group on the NTP client

we will use ntp access-group serve-only 15

• Peer: Peer access-groups allow both request and control queries to be processed meaning the router will be allowed to update its time from the allowed peers.
• Query-only: This only allows control queries to be accepted, control queries don’t actually the effect the date/time so I’m going to skip this one. See RFC 1305 for addition information about this.
• Serve: Allows the router to reply to request as well as control queries.
• Serve-only: Does not allow control queries and only replies to NTP requests.

access-list 15 remark NTP Peer Only ACL
access-list 15 permit host %{NTP_SERVER_PRIMARY}%
access-list 15 permit host %{NTP_SERVER_SECONDARY}%
access-list 15 deny any log
!
access-list 16 remark NTP Serve Only ACL
access-list 16 permit %{CLIENT_NETWORK}% %{CLIENT_WILDCARD}%
access-list 16 deny any log
!
ntp source %{NTP_SOURCE_INT}%
!
ntp authentication-key %{NTP_KEY_ID}% md5 %{NTP_KEY}%
ntp trusted-key %{NTP_KEY_ID}%
ntp authenticate
!
ntp access-group peer 15
ntp access-group serve-only 16
!
ntp server %{NTP_SERVER_PRIMARY}% key %{NTP_KEY_ID}% prefer
ntp server %{NTP_SERVER_SECONDARY}% key %{NTP_KEY_ID}%
!
ntp logging
ntp max-associations 4

CISCO Understanding the “NTP access-group” command in IOS

https://www.packet-forwarding.net/2013/06/02/understanding-the-ntp-access-group-command-in-ios/

NTP has always been one of those things I have found tricky to really lab up. Its fairly easy to setup, but verifying whether everything is working as you expect, can be hard because it takes a while to synchronize (and even unsynchronize).

In this post I will try and shed some light on the “ntp access-group” command set in Cisco IOS.

When you perform a “?” on the command set it looks like the following (on 12.2(33)SRD7):

1 2 3 4 5

R1(config)#ntp access-group ?   peer        Provide full access   query-only  Allow only control queries   serve       Provide server and query access   serve-only  Provide only server access

For each of the options you can specify an access-list:

1 2 3

R1(config)#ntp access-group peer ?   <1-99>       Standard IP access list   <1300-1999>  Standard IP access list (expanded range)

The trick to understanding how this lightweight security system works is to understand the following sentence in the documentation:

“If you specify any access groups, only the specified access is granted.”

Along with the ordered list of most open to least open:

1 2 3 4

peer query-only serve serve-only

Lets illustrate this with an example. If you apply the following:

1 2 3 4

access-list 90 deny any access-list 91 permit 10.1.2.10 ntp access-group peer 90 ntp access-group serve-only 91

What you are really doing is telling the router that it cant “peer” with anything (allow time requests and allow the system itself to synchronize). However processing of an incomming time request will go down the list and meet the “ntp access-group serve-only 91” command. This allows time requests from the hosts permitted in the access-list.

In our case host 10.1.2.10 can get its time from the local system.

The example above is for demonstration purposes since the “ntp access-group peer 90” is the same as not having specified the “ntp access-group peer” command in the first place.

So you see, an incomming request goes down the list of things “allowed” and if it finds itself allowed by anything, it succeeds. However if it reach the end of the list and nothing has permitted the request, it is discarded.

Caution

In my example, I have actually locked out any chance for the router itself to synchronize its time. This is due to the fact that since only peer and serve-only is allowed, and the only one of those two that will allow the router itself to synchronize is the peer option and this option denies everything.

Cisco SSLv3 and TLSv1 Protocol Weak CBC Mode Vulnerability

http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118518-technote-esa-00.html

Solution

Disable CBC mode ciphers in order to leave only RC4 ciphers enabled. Set the device to only use TLS v1, or TLS v1/TLS v1.2:

1. Log in to the CLI.
2. Enter the command sslconfig.
3. Enter the command GUI.
4. Choose option number 3 for "TLS v1", or as listed in AsyncOS 9.6 "TLS v1/TLS v1.2".
5. Enter this cipher:

   MEDIUM:HIGH:-SSLv2:-aNULL:@STRENGTH:-EDH-RSA-DES-CBC3-SHA:
   -EDH-DSS-DES-CBC3-SHA:-DES-CBC3-SHA

6. Enter the command: INBOUND.
7. Choose option number 3 for "TLS v1", or as listed in AsyncOS 9.6 "TLS v1/TLS v1.2".
8. Enter this cipher:

   MEDIUM:HIGH:-SSLv2:-aNULL:@STRENGTH:-EDH-RSA-DES-CBC3-SHA:
   -EDH-DSS-DES-CBC3-SHA:-DES-CBC3-SHA

9. Enter the command OUTBOUND.
10. Choose option number 3 for "TLS v1", or as listed in AsyncOS 9.6 "TLS v1/TLS v1.2".
11. Enter this cipher:

    MEDIUM:HIGH:-SSLv2:-aNULL:@STRENGTH:-EDH-RSA-DES-CBC3-SHA:
    -EDH-DSS-DES-CBC3-SHA:-DES-CBC3-SHA

12. Press Enter until you return to the hostname prompt.
13. Enter the command commit.
14. Finalize committing your changes.

The ESA is now configured to only support TLS v1, or TLSv1/TLS v1.2, with RC4 ciphers while it disallows any CBC filters.

Here is the list of ciphers used when you set RC4:-SSLv2. Note that there are no CBC mode ciphers in the list.

ECDHE-RSA-RC4-SHA SSLv3 Kx=ECDH Au=RSA Enc=RC4(128) Mac=SHA1
ECDHE-ECDSA-RC4-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=RC4(128) Mac=SHA1
ADH-RC4-MD5 SSLv3 Kx=DH Au=None Enc=RC4(128) Mac=MD5 
RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1
RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 
PSK-RC4-SHA SSLv3 Kx=PSK Au=PSK Enc=RC4(128) Mac=SHA1
EXP-ADH-RC4-MD5 SSLv3 Kx=DH(512) Au=None Enc=RC4(40) Mac=MD5 export
EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export

While this exploit is of very low concern due to its complexity and requirements to exploit, performance of these steps is a great safeguard for the prevention of possible exploits, as well as to pass strict security scans.