INT525W2L2

Modules you can add them dynamically or statically

Statically – part of the binary

Mod.so is required if you want the rest of the modules linked dynamically,

Dso vs Static


Mod.speling in the url simple module that makes you make one typographic submission in the resource you are going, cgi-bin without the - that will be an error mod.spelling will correct.

Mod.alias, gives you ability to alias directory,

Script.alias, like alias with executable power, don’t use it, does not give you the control of flexibility alias does with a directory container,

Talk about basic directive in apache we know, and some modules that supply them,

When you come to a website you are virtually hosting, the main thing that must be set, you have a principal one that you might call default or main,

If you ask for a IP it doesn’t know or a Name VH they don’t know, they have to have a default way for the request, one of the metrics it must be rebout and must be forgiving for arrant behaviour a forgiving behaviour

When it does not know the deafualt behaviour will give to the main server,

WE need to learn the simple procedure this is the default place to go and you come in for a name server, this is the place to go if we are not servicing that IP,

What things need to go into the virtual host container for the main or default server

ServerRoot parent of the apache binary trees,




LockFile /var/log/apache2/accept.lock



IfModule directive all supplied by modules, nested tree of a fork, the later one will hold true, the last declaration has more authority, precedence

Which one has higher precedence, the example is not particularly authoritative but they actually fork the decision tree, not at run time, the service is running, we are either going to go around it or go through it

So binary executable for the binary,

.c static linked component of the kernel,

This says IfModule, if you move the config to a machine and you recompile it wont blow simply trying to start so it will not do these things



This is the global configuration file httpd.conf

Reaps the child processes,

MaxSpare initiates repeaing responses,

MaxClients = Maximum requests

Worker.c

443 ssl’

Directory < “/export/srv/www/vhosts/main/htdocs”>

Main => ALL FQDN
Perl

AllowOverride None


Worker.c
A typical configuration of the process-thread controls in the worker MPM could look as follows:
ServerLimit 16
StartServers 2
MaxClients 150
MinSpareThreads 25
MaxSpareThreads 75
ThreadsPerChild 25

Server limit identifies what will initially launch when the server is started it must be greater or equal MaxClients / ThreadsPerChild

MinSpareThreads and MaxSpareThreads identify the the idle threads in all processes and forks or kills processes to keep this number within the declaration

MaxClients the maximum total number of threads in all processes.

MaxClients / ThreadsPerChild = Max Child Processes

150 / 25 = 6

ThreadLimit must be greater or equal to ThreadsPerChild

While the processes are started as root under Unix intorder to bind processes and threads binding them to port 80 Apache will use less-privileged users.



#
# If you wish httpd to run as a different user or group, you must run
# httpd as root initially and it will switch.
#
# User/Group: The name (or #number) of the user/group to run httpd as.
# It is usually good practice to create a dedicated user and group for
# running httpd, as with most system services.
#
User daemon
Group daemon



MaxRequestsPerChild controls how frequently the server recycles processes by killing old ones and launching new ones.
Description:Multi-Processing Module implementing a hybrid multi-threaded multi-process web server
worker.c
it retains much of the stability of a process-based server by keeping multiple processes available, each with many threads.
Or
Prefork.c
It is also the best MPM for isolating each request, so that a problem with a single request will not affect any other.
Directive and Declorations

Declarations = Server Name

Directive = alias this directory their

Directive that configure this to the relation to mother child

\

ONE PARENT


worker.c has a different parent the child process then prefork.c
worker.c uses ThreadsPerChild that controls the number of threads deployed by each child prcess and Max Clients right
while prefork.c uses MinServer and MaxServer that spawns childprocesses that are indepent from the kernel
threads works as a stream as prefork words as a dependent entity


First thing that your going run out of when your worker.c is cpu and prefork.c is memory

Remember to check
http://httpd.apache.org/docs/2.2/mod/prefork.html
http://httpd.apache.org/docs/2.2/mod/worker.html

SEC520W2L1

Exploits - things that can go wrong


5 years script kiddies, now its criminal activity and has really changed, over the next few
Years it’s going to change again.


The change from operating attacks to application attacks, when you have applicatios you have a lot more variables then with dealing with the os many more applications and all doing different things, OS are straight forward applicationts are dynamic.


You still have the same things the attackers will do,

What is a DoS

CIA

Confidentiality,

Keep it secret

Integrity

Information from the data is what it should be, for instance you look at your bank account and you want to know the numbers are really their.

What it should be when it should be.

Lot of do who changed it who can change it.

Identity how do you prove someone is who they are.

Accessibility


Avaliable when its needed in a timely fashion.

DoS denies accessibility

DDoS – Distributed Denial of service

One way is to break the software this is one way another common one its not through breaking the software but overloading or clogging the piped to it.

Thisi is where DDoS, BogNets one central system which controls many computers so no one can access the service

DoS the basic, it has been mostly preformed for kids in basements or unhappy employees, They have been used for extortion, if you shut down your site it can cost you 30000 dollars it can be a real problem and it has in some palces ,


Why is the web to vulnerable to risk,

When it first came out everything was open and a kind of utopian world,

John Morris, the son of a internet pioneer the son wrote a program to find how mayn users are on the internet, thousands of the them, it used the finger deamon and it would move itself on the machine and do finger searches, he forgot to do make it see if its their, it was a naïve thing, he wrote a program that invaded other peoples computers,

Firewalls – controls what gets in and out, a firewall originally, first basic fire wall did packet filtering, looks at each packet and looks at the ports what ports is it asking for suppose you have telnet inside which is port23 and you have ssh 22 and http 80 and so , suppose you want telnet internally but not externally lets say it gets stop at the fire wall if you wna the public to have access to your web server then you make them go through that only port, may port for 25 but you restrict it to the ports you want to get through,


What happened when it was in place, everyone started having a webserver, webservers would give you some documents, well the people that wrote webservers what if it can expand to dynamic content or video they made more expansive webserver and create dynamic content.

Dynamic more accessible to the public, then they explanded the firewall they had web services goes through mysql, and come up more complex and they have holes to powerful complex software, the attacks change what they do and start aiming at the dynamic attributes of the server not just HTTP, but HTTP are common cause they do so many things and because theya re complex they are perfect targets for running exploits the exploits have gotten more and more toward webbrowsers.


Embed macros, it’s a program in a program web applications become a good target

Email targets are great bc of spam

Media players complexity, YouTube.com vector to get into the system passed the firewall.


On the server side service os the OS security software becomes a target for attackers, get a couruppted version. File management servers and database software.


Also things aimed at people, user rights unauthed devices,

Phishing, your account is over due give ur password, got all the right graphics but its false,

Spear phishing when you target people, or you lap top of usb keys, wireless if a grate vector

Instant messaging, easy for all the dumbasses.



Zero Day Attack, an attack where the attackers know it can mount it before the vendors know its their, it usually happens with hacks someone finds the weakness posts it then it the software vendors will patch it.

Because we have sophisticated criminals before they use


Storm Worm,


Recognize trends

Talking about DoS

Another privileged escalation – its like a user getting root access, some users on a a system but you want to get higher.


Trying to get from out in the cloud through a couple of a server, if they see outside traffic doing into system they have logs or IDS, they can call your service, or police come knocking

They will break in further away to get closer to the machine, trying to get machines to do the work for them, this is slow so they can get privileged escalation.






Common things, two things you will see a lot of,

XSS - Cross Site Scripting

SQL Injection



Everyone is blogging, websites allow users to put stuff in, cross site scripting when you put data in a blog that will effect the behaviour of a server, thing about it like this someone goes to a site, and look at someone’s blog the big thing now is java script, Java script embeds some code in your webpage, when the browser gets the webpage it runs that code, it allows the code to run on the clients machine however evil stuff can get in it, in cross site scription when you look at a wikipage or a blog, that will not be visible by you that will be executed by ur browser.


A lot of sites and wikis check this, but if its sophisticated it will always get through,


SQL injection when a web server is sending queires to a database databases by nature have a lot of data, its in a hackers intrest to get access to this.

If you design ur self right you, you use –T cause if you web server is interactions with database server if someone slips some sql code in the stuff that gets stuff into the data server can do bad things, get access, integrity, unauthorized, find credit card numbers.


DNS poisoning put false entries, collecting data,

Identity theft,

New devices for password, MLS and email password for only 30 seconds


Assignment 1


WHOIS
GOOGLE
DNS Tools


CanadianISP.com

Take it a generate a report a .pdf file and you can upload it

INT420 SSL Encryption and Certification

ALlow for hyphens make sure your regular expressions are valuable
Display the Format of what you would want in side your text boxes

When you make the user registration validate all the data being entered, is it a valid e-mail phone number, name, come up with the regular expressions to this.

Common security hold is cgi scripts,

Understand the dangers and what we can use perl to pervent this
its called Taint mode

When you get data from a script(a form) so you have to be careful what they
enter in


Run your perl script sin taint mode all you got to do is add a -T anything supplied by the user can not be used in a os system, it will not be allowed to be used for a system call.


if you need to use the data you need to figure it how to untaint it, is to make it its not supplied by the forum but produced by the script itself, the dangers things you can do with data is system calls, system function you're executing a os command

0Back quotes thats dangerous, opening a file through a pipe thats os interaction anything we are doing opening deleting or renameing files, anything we are going to do you must un taint that data
0
e00xample a form were we colelct an 00000000e-mail address, and we want to use the email to email it to the user it will not work in taint mode, cause it can be possible that they wrote in a command like deleting files or w.e they can do to the systemEncryption on the exam,

When we want to send and encrypt data securly, the basic process
take the original data and an encryption key, random string of
characters, random very large number

take the data and teh encryption key and put them into a encryption alogrithem or prgram
what you get out of that in encrypted data, in order to read that data

you take the encrpyted data and a decryption key put it through the same algorithem/program,
then you end up with the original data,

Two basic models

semitrical encryption - a shared secret

with semitrical encryption you have a single key, and you use the same key to encrypt and decrypt the data

asymetrical encryption - public/private key pairs

two keys, that are designed to work togeter, a public and a private key, in this encryption you encrypt with one or decrypt with the other, u must use the other part of the pair, en pri / de pub



Client Machine Alice
AB-----
Connected to the Net
----AB
Client Machin Bob

using this semitrical encryption alas would need a copy of the key and bob will need the copy of the same key

Its good cause its fast,
you can generate a new key for every process/
---_FAST SECURE__----
Problem how do they get the copy of the same key, especially over a line, the problem with session key how do you get the key on both sides


in the past, generate it on place and take it from one to the other and install but again thats a 1 kind operation. Asymtrical alias an encrypted connect4ion for bob, he has the public key B and a private key B the private key never leaves bob,

BOb takes his public key gives it to aliace, she encrypts the data with the public and encryps with the private key,

so the communicatiosn going back to alice are not secure, when we encrypt wioth the private anyone can read it

so its not good coming back in the opposite direction but it does have a purpose,

When he sends it to alice and has the private, what does this prove to us anyone can read what bob is sending, it can only have only come from bob. Because bob only has the private this is called a digital signature, anyone with the public key can read the private key but it must come from that source,

its use for authentication as a signature
Alice can gen4erat her own public/private send it to bob send it and she can use it, heres the problem its slow and alot of work, and somewhat more compicated then it needs to be, in the internet when we want to secure over the wweb we use

SSL ---- secure socet layer, you know this from https


SSL uses all the things that were discussed above, this is how it essentially works


Bob the server alice the client,

in order to facilite encrypted communication, bob needs a public and a private key for bob, now

the admin of bob wneeds a 3rd party company to create a certificate to tell the company this is the company, they take the public keye

they take the public key and send it to CERTIFICATE AUTHORITY, dozens of company's that do this
CERTIFICATE REQUEST, name server e-mail the FQDN all info about the orginations and the computer along with the public key,
the certificate authority preforms sum auth then creats a certificate contains all the info from the certificate request + bob public key then the certificate signs it with their private key, so its digitally signed through the CA.
SSL connection
Alice sends a httpds conn to bob then he says ok then sends the certificate and it contained the public key and the didtal sign of the CA alice reciuves the certificate alices browsers is already wiiht the key of all the private ca's auth, now we accept that public key as coming to bob
BOb has his private key and alice has his public key now alice generates a symettrical key thats only good for this session and encrypts using bob public key, bob is the only way he can use it cause he has a private key



Conenection to his web server his e-mail server it puts the https yellow bar and the pad lock
if you go to Tools page info

You look at the page info and you look at security it tells the identify has been varified by Equifax

View the certificate


In the LAB
Re-install apache to include SSL you need to isntall it into a diff directory you will install OPEN SSL, allows you to generate pub and private keys and request and authority, install apache fresh,
M
M
M
we use to for trust, and the mechinism for a public key then facilitae a session key, then they use that session key

Building a Fast Internet

http://www.newsweek.com/id/129639

I don't really get the tech side of it...doesn't explain very much but at least their trying to steer away from packet switched networks (too slow).

I haven't been updating TOO MUCH WORK! During my break I will be finishing Uyless Black Emerging Communications Technologies and while taking school in the summer I will be discussing many of the professional classes here on this blog.

Chapter 1 - Introduction - ECT - Uyless Black

When examining the communications infrastructure and the major problems that are associated with using current technologies we see that the point of new technology is to over come deficiencies of current technologies.

The world is moving at fast pace, processors and applications just keep getting faster and faster, so we look at data communications and how it can improve the movement of information within a networked environment.

This chapter gives the general overview of the emerging technology to meet needs of applications.

Needs for Services
The Past
Development of high-speed inexpensive computers to meet the needs of the average person. This opened a vista to new powerful application. Examples of the applications that may be used are interactive real-time simulations, three dimensional modeling and color images.

The T1/E1 Legacies
1970s & 1980s = 1.5 to 2.048 Mbs
- T1/E1 meet the needs for most user applications

VPN - Share communications channels with other users

Switches - Relay traffic from multiple users.

Frame Relay fast packet service
-Lets the user support error recovery
-bandwidth and demand services
-data applications and some voice applications
-Suppose to solve WAN bottle neck services

MAN IEEE Standard 802.6
-distributed queue dual bus (DQDB) protocol to support integraded networks for multimedia applications
-interconnects LANs accross WANs

Switched Multimegabit Data Service (SMDS)
-Relies on the MAN technologies
-provides public high-speed transport system US and Eurpose
Services - highspeed ata applications that require bursts for high-speed data applications that require bursts of high bandwidth transmission for applications.
Such as, file transfer, CADéCAM, and imaging.

Asynchronous Transfer Mode
- part of B-ISDN solution
- cell relay technology
includes - high speed
- multiplexing and switching services for voice, data and video applications

Cell in ATM and IEEE 802.6 (MAN)
802.6 = basis of SMDS

CELL vs FR

Cell at the CPE a computer or PBX
which can be variable
is - segmented into smaller fixed length units called cells
5 header 48 payload

Supports transmission and reception of voice, video data and other applications

Interests = Large companies that have developed multiple networks to handle transmission schemes.

Why do we prefer cell

Cell is better then variable length frames, which provides the delay to be predictable in fixed length frames with the performance in the network then with variable length frames

-ATM queuing is done inside switch
-Fixed length buffers more easier to manage then variable.
-Cell relay has superior Quality of Service.

Wide spread commercial inception of computer and communication's networks in the 1960`s

1970`s - Communications archietecture was all software
Typically

Physical Layer = hardware
Datalink Layer = software
Late 1970`s early 1980`s
implemented into hardware some of the Data Link functions

Fostered HDLC which would
lead to -Link Access Procedure Balanced (LAPB)
-Link Access Procedure For the D channel (LAPD)
-Chip sets and firmware

Thats all I am going to introduce for now next post will continue Chapter 1, in later chapters Uyless Black goes into detail with every protocol mentioned here and that will be in next post. So don`t be to overwhelmed, I know I was the first time I read half the book.

Little note to me: Ch1 Pg5

About New Postings

Due to the Hands On Work in my program I will only be posting relevant information on every lecture for my courses.

I will be focusing on, Data Communications,

Book:

Emerging Communication Technology by Uyless Black

that will gradually move to

IP Routing Protocols by Uyless Black.

Any relevant information to courses within the Computer System Technology Diploma will be posted with the Title of the Course Code and Topic, mostly theory.

Note: Future online posting will change.

INT420 - Secure Socket Layer

Encryption on the exam,

When we want to send and encrypt data securly, the basic process
take the original data and an encryption key, random string of
characters, random very large number

take the data and teh encryption key and put them into a encryption alogrithem or program
what you get out of that in encrypted data, in order to read that data

you take the encrpyted data and a decryption key put it through the same algorithem/program,
then you end up with the original data,

Two basic models

symitrical encryption - a shared secret

with semitrical encryption you have a single key, and you use the same key to encrypt and decrypt the data

asymetrical encryption - public/private key pairs

two keys, that are designed to work togeter, a public and a private key, in this encryption you encrypt with one or decrypt with the other, u must use the other part of the pair, en pri / de pub



Client Machine Alice
AB-----
Connected to the Net
----AB
Client Machin Bob

using this semitrical encryption alas would need a copy of the key and bob will need the copy of the same key

Its good cause its fast,
you can generate a new key for every process/
---_FAST SECURE__----
Problem how do they get the copy of the same key, especially over a line, the problem with session key how do you get the key on both sides

in the past, generate it on place and take it from one to the other and install but again thats a 1 kind operation.


Asymtrical alias an encrypted connect4ion for bob, he has the public key B and a private key B the private key never leaves bob,

BOb takes his public key gives it to aliace, she encrypts the data with the public and encryps with the private key,

so the communicatiosn going back to alice are not secure, when we encrypt wioth the private anyone can read it

so its not good coming back in the opposite direction but it does have a purpose,

When he sends it to alice and has the private, what does this prove to us anyone can read what bob is sending, it can only have only come from bob. Because bob only has the private this is called a digital signature, anyone with the public key can read the private key but it must come from that source,

its use for authentication as a signature
Alice can gen4erat her own public/private send it to bob send it and she can use it, heres the problem its slow and alot of work, and somewhat more compicated then it needs to be, in the internet when we want to secure over the wweb we use
SSL ---- secure socet layer, you know this from https


SSL uses all the things that were discussed above, this is how it essentially works


Bob the server alice the client,

in order to facilite encrypted communication, bob needs a public and a private key for bob, now

the admin of bob wneeds a 3rd party company to create a certificate to tell the company this is the company, they take the public keye

they take the public key and send it to CERTIFICATE AUTHORITY, dozens of company's that do this
CERTIFICATE REQUEST, name server e-mail the FQDN all info about the orginations and the computer along with the public key,
the certificate authority preforms sum auth then creats a certificate contains all the info from the certificate request + bob public key then the certificate signs it with their private key, so its digitally signed through the CA.

SSL connection
Alice sends a httpds conn to bob then he says ok then sends the certificate and it contained the public key and the didtal sign of the CA alice reciuves the certificate alices browsers is already wiiht the key of all the private ca's auth, now we accept that public key as coming to bob
BOb has his private key and alice has his public key now alice generates a symettrical key thats only good for this session and encrypts using bob public key, bob is the only way he can use it cause he has a private key


Conenection to his web server his e-mail server it puts the https yellow bar and the pad lock

if you go to Tools page info

You look at the page info and you look at security it tells the identify has been varified by Equifax


View the certificate


In the LAB
Re-install apache to include SSL you need to isntall it into a diff directory you will install OPEN SSL, allows you to generate pub and private keys and request and authority, install apache fresh,
M
M
M
we use to for trust, and the mechinism for a public key then facilitae a session key, then they use that session key