หน้าเว็บ

แสดงบทความที่มีป้ายกำกับ configure แสดงบทความทั้งหมด
แสดงบทความที่มีป้ายกำกับ configure แสดงบทความทั้งหมด

วันจันทร์ที่ 11 มกราคม พ.ศ. 2553

Introduction to IPSec

Introduction to IPSec

Internet Protocol security (IPSec) คือ ชุดโปรโตคอลเพิ่มเติมของโปรโตคอล IP เพื่อให้การติดต่อสื่อสารมีความปลอดภัยมากขึ้น โดยสิ่งที่เพิ่มเติมที่ทำให้มีความปลอดภัยนั่นคือ มีการทำ authentication และการ encryption ในข้อมูล IP packet ที่รับส่งกัน

ชุดโปรโตคอล IPSec นี้รวมถึงโปรโตคอลที่ใช้ในการทำ authentication ระหว่างกันเพื่อสร้าง session ที่ใช้ในการติดต่อสื่อสารและ โปรโตคอลที่ใช้เจรจา key ที่ใช้เข้ารหัสข้อมูลระหว่างการติอต่อสื่อสารของ session เราสามารถใช้ IPSec ป้องกันข้อมูลในการติดต่อสื่อสารได้ทั้งระหว่าง host กับ host (computer user or server) ระหว่าง security gateway กับ security gateway (router or firewall) หรือระหว่าง security gateway และ host โดย IPSec สามารถนำไปประยุกต์ใช้งานได้หลากหลายมาก เนื่องจากมันทำงานใน layer ที่ต่ำ (internet layer ใน TCP/IP model) ทำให้ Application ต่างๆ ไม่ต้องทำสิ่งใดเพิ่มเติมเพื่อให้ทำงานร่วมกับ IPSec ได้ ไม่เหมือนกับโปรโตคอลด้านความปลอดภัยตัวอื่น เช่น TLS/SSL ที่จะต้องออกแบบ Application ให้ทำงานร่วมกันกับมันได้

IPSec ประกอบด้วยโปรโตคอล ที่ทำหน้าที่หลักต่างๆกันดังนี้

· Internet Key Exchange (IKE) เป็นโปรโตคอลที่ใช้สำหรับการจัดตั้ง Security Association (SA) ที่ใช้เป็นช่องทางการสื่อสารระหว่างกัน และเป็นโปรโตคอลที่ใช้เจรจาว่าจะใช้โปรโตคอลใดและ algorithm ใด ทีจะใช้สร้าง key สำหรับ encrypt ข้อมูลและทำ authentication ระหว่างกัน

· Authentication Header (AH) เป็นโปรโตคอลที่ทำหน้าที่รักษาความถูกต้องสมบูรณ์ (integrity) ของข้อมูล เพื่อเป็นการยืนยันว่าข้อมูลที่ได้รับนั้นไม่ได้ถูกแก้ไขระหว่างทาง โดยการใช้ Hash Message Authentication Code (HMAC) ที่สร้างจาก algorithm เช่น MD5 หรือ SHA เป็นต้น

· Encapsulation Security Payload (ESP) เป็นโปรโตคอลที่ทำหน้าที่ในการรักษาความลับ(Confidentiality) ข้อมูลโดยการเข้ารหัส โดยใช้ algorithm เช่น DES, 3DES หรือ AES เป็นต้น

IPSec ทำงานอยู่ใน 2 mode ดังนี้

1. Transport mode ใน mode นี้ IPSec จะทำการ encrypt หรือ authenticate เฉพาะในส่วนข้อมูล (payload) ของ IP packet ที่จะส่ง แต่ไม่ทำในส่วนของ Header(หรือ IP Header) ของ IP packet

2. Tunnel mode ใน mode นี้จะทำการ encrypt หรือ authenticate ทั้ง IP packet (payload และ header) และสร้าง IP Header ขึ้นมาใหม่

ตัวอย่าง การตั้งค่า Router Cisco เพื่อใช้งาน IPSec

การตั้งค่า Router เพื่อใช้งาน IPSec มีขั้นตอนหลักๆ ดังนี้

· ตั้งค่า ISAKMP

· ตั้งค่า IPSec

ตั้งค่า ISAKMP

ทำความเข้าใจกันก่อนว่า IKE (ISAKMP/Oakley) คือ โปรโตคอลลูกผสมที่นำบางส่วนของโปรโตคอล Oakley และ ISAKMP แต่ใน Cisco IOS software โปรโตคอล IKE และ ISAKMP จะใช้สื่อความหมายถึงสิ่งเดียวกัน ดังนั้นการตั้งค่า ISAKMP ก็คือการตั้งค่า IKE โดยโปรโตคอล IKE นี้จะทำงานในช่วงการจัดตั้ง SA สำหรับ IPSec และมันต้องมี policy ที่ใช้ในการเจรจาเพื่อสร้าง SA ระหว่าง router กันด้วย

การตั้งค่า ISAKMP มีด้วยกันอยู 2 วิธีดังนี้

1. ใช้วิธี pre-shared keys ซึ่งตั้งค่าได้ง่ายและสะดวก (ตัวอย่างจะใช้วิธีนี้)

2. ใช้วิธี CA เหมาะกับรองรับการขยายตัวในการใช้งาน

หมายเหตุ โปรโตคอล IKE ทำงานบน UDP 500, IPSec ทำงานบน IP protocol 50 และ 51 โดย port เหล่านี้จะต้องไม่ถูกปิดกั้นระหว่าง router ด้วยกัน

วิธี Pre-Shared Keys

การใช้วิธีนี้จะต้องตั้งค่าตามขั้นตอนดังนี้

· ตั้งค่า ISAKMP Protection Suite(s)

· ตั้งค่า ISAKMP key

ตั้งค่า ISAKMP Protection Suite(s)

คำสั่งนี้เป็นการสร้าง object ของ ISAKMP policy

RouterName(config)#crypto isakmp policy 1

RouterName(config-isakmp)#

คำสั่ง group ใช้เพื่อบอกขนาดจำนวน bit ของ modulus ที่ใช้ในวิธีการคำนวณใน Diffie-Hellman(เป็นวิธีการการจัดตั้ง(establishment )การ shared key ผ่านบนช่องทางที่ไม่ปลอดภัย) โดย group 1 หมายถึงมีขนาด 768 บิต group 2 หมายถึง มีขนาด 1024 บิต โดย default Cisco IOS จะเป็น group 1

RouterName(config-isakmp)#group 2

คำสั่ง hash ใช้เพื่อบอกว่าจะใช้ hash algorithm แบบใด โดย default ของ Cisco IOS จะเป็นแบบ SHA ที่มีความปลอดภัยมากกว่า MD5

RouterName(config-isakmp)#hash md5

คำสั่ง lifetime ใช้เพื่อบอกว่า SA จะมีเวลาอยู่เท่าใด ก่อนที่จะมีการเจรจาสร้าง SA ใหม่ โดย default จะมีค่าอยู่ที่ 86400 วินาทีหรือ 1 วัน

RouterName(config-isakmp)#lifetime 500

คำสั่ง authentication ใช้เพื่อบอกว่าจะใช้ key อะไรในการยืนยันตัวตนของ router ทั้งฝั่ง

RouterName(config-isakmp)#authentication pre-share

ตั้งค่า ISAKMP key

คำสั่งที่จะแสดงต่อไปนี้ จะเป็นการบอกว่าค่า key เป็นอะไร และ ip ของ router ฝั่งตรงข้ามเป็นอะไร โดย key ที่ตั้งนี้จะต้องเหมือนกัน

RouterName(config-isakmp)#exit

RouterName(config-isakmp)#crypto isakmp key Slurpee address 192.168.10.38

ตั้งค่า IPSec

มีขั้นตอนย่อยๆดังนี้

· สร้าง extended access list

· สร้าง IPSec transform(s)

· สร้าง crypto map

· นำ crypto map ไปใส่ใน interface เพื่อใช้งาน

สร้าง extended access list

คำสั่งที่ใช้นี้เป็นการสร้าง access list สำหรับบอกว่า traffic ใดบ้างที่จะถูก encryption หรือไม่ถูก encryption โดยคำสั่ง permit เป็นเหมือนการบอกว่า traffic นั้นจะถูก encryption และคำสั่ง deny เป็นเหมือนการบอกว่า traffic นั้นไม่ถูก encryption โดยมีการนำไปใช้อ้างอิงใน crypto map

RouterName(config)#access-list 101 permit ip host 192.168.10.38 host 192.168.10.66

หรือ RouterName(config)#access-list 101 permit ip host 192.168.10.38 0.0.0.255 192.168.10.66 0.0.0.255

สร้าง IPSec transform(s)

คำสั่งนี้เป็นการสร้าง IPSec transform set เพื่อบอกว่าจะใช้วิธีการใดในการ encrypt ข้อมูล โดยมีการนำไปใช้อ้างอิงใน crypto map

RouterName(config)crypto ipsec transform-set MamaBear ah-md5-hmac esp-des

RouterName(cfg-crypto-trans)exit

สร้าง Crypto Map

ใน Crypto map จะมีการตั้งค่าต่างๆ ประกอบด้วย การตั้งค่าเพื่อบอกว่า peer ที่จะคุยด้วยเป็น IP อะไรโดยใช้คำสั่ง set peer การตั้งค่า session key ว่าจะมีอายุใช้งานเท่าใดก่อนมีการสร้างขึ้นใหม่ โดยมีการกำหนดได้สองแบบคือกำหนดด้วยเวลาและกำหนดด้วยขนาดข้อมูล traffic ที่รับส่งกัน การตั้งค่าผูกโยงกับ IPSec transform set ที่ได้มีการสร้างขึ้นมาก่อนหน้านี้ด้วยคำสั่ง set transform และการตั้งค่าอ้างอิงกับ access list ที่ได้สร้างขึ้นมาไว้ ด้วยคำสั่ง match address

RouterName(config)crypto map armadillo 10 ipsec-isakmp

RouterName(config-crypto-map)#set peer 192.168.10.38

RouterName(config-crypto-map)#set session-key lifetime seconds 4000

RouterName(config-crypto-map)#set transform-set MamaBear

RouterName(config-crypto-map)#match address 101

นำ crypto map ไปใส่ใน interface เพื่อใช้งาน

โดยใช้คำสั่งนี้

RouterName(config)#interface serial 0/0

RouterName(config-if)crypto map armadillo

ตัวอย่างคำสั่งที่ใช้ตรวจสอบ IPsec เช่น

Show crypto isakmp sa ใช้ดูตาราง ISAKMP(IKE) SA ถึงการมีอยู่ระหว่าง SA ของ router ทั้งสอง

Show crypto isakmp policy ใช้ดู policy ของ ISAKMP ที่ได้ตั้งค่าต่างไว้

Show crypto ipsec sa ใช้ดูค่าของ traffic ที่ถูก encrypt ฯลฯ


Thanks : kunggiggs

วันอังคารที่ 3 พฤศจิกายน พ.ศ. 2552

Introduction To VMware VIX API

Introduction to VMware VIX API.


The VIX API allows you to automate virtual machine operations on VMware Server or VMware Workstation.


About the VIX API

The VIX API (or "Vix") is a library for writing scripts and programs to manipulate virtual machines. It is high-level, easy to use, and practical for both script developers and application programmers. The VIX API is designed for three kinds of users:

  • Technically Adventurous Users - For example, dedicated IT personnel in an organization building their own in-house tools.
  • Partners - Software vendors using Vix to integrate VMware products with their own products or to build management products specifically for virtual machines.
  • VMware Engineering - VMware uses Vix in its own products as a general abstraction layer between core virtual machine processes and associated service processes.

The VIX API runs on Microsoft Windows (Windows95 or later) and Linux platforms (kernel 2.4.x or later recommended). It supports programs written in C, Perl, and COM (Visual Basic, VBscript, C#).


Compatibility

This release of the VIX API is compatible with VMware Server 2.0 and VMware Workstation 6.5.

Product Compatibility

VIX API Version

Compatible Platform Products

Library Location

1.0.3

VMware Server 1.0

server-1

1.1

VMware Workstation 6.0

ws-3

1.1.1

VMware Workstation 6.0.1 or earlier

ws-3

1.1.2

VMware Workstation 6.0.2 or earlier

ws-3

1.1.4

VMware Workstation 6.0.4 or earlier

ws-5

1.1.5

VMware Workstation 6.0.5 or earlier

ws-5

1.6.0

VMware Server 2.0 or earlier

VIServer-2.0.0

1.6.1

Workstation 6.5 or earlier

Workstation-6.5.0

The library location is not important if you use the wrapper library as recommended.

Vix Version 1.x supports programs written to version 1.x of the VIX API. Exceptions are noted on function reference pages. For example, VMware Server does not support record and replay, while VMware Workstation does not support virtual machine registration.

Vix libraries are installed with VMware Server and VMware Workstation and provide API compatibility corresponding to the product release. Vix libraries are downward compatible in most cases. If you upgrade VMware Server or VMware Workstation, you should also upgrade any separately installed Vix libraries. For instructions, see Installing the VIX API. You should also upgrade VMware Tools to match the product release.

With VMware Server, you can run Vix programs remotely. With VMware Workstation, Vix programs usually run on the host.


64-Bit Library Support

The VIX API provides 64-bit libraries for Linux only. Windows 32-bit libraries may work in 64-bit emulation mode.


Redistributable Code and Sample Code

As noted in the End User License Agreement, the VIX API allows you to build and distribute your own applications. To facilitate this, the following files are designated as redistributable for the purpose of that agreement:

  • VixAllProducts.lib and VixAllProductsd.lib
  • vix.lib and vix.dll
  • vixCOM.dll
  • libvixAllProducts.so
  • libvix.so

Redistribution of the open source libraries included with the VIX API is governed by their respective open source license agreements.

The VIX API also includes sample code, which you can use as a starting point for your own programs. Code is delivered in the Samples directory installed with VMware VIX. A Makefile is provided for Linux, and an nMakefile for Windows.


Installing the VIX API

On the VMware Server or VMware Workstation host, you do not need to install any additional VIX API components. Vix libraries are installed by default under “VMware VIX” or vmware-vix. To compile programs on these systems


To control VMware Server remotely from another machine, you need header files vix.h and vm_basic_types.h, as well as one or more library files. You can get these files in one of two ways: Use the Vix standalone installer to get the files needed to compile a program


Using the Windows Standalone Installer

To install the VIX API files on Windows:

  1. Download the installer program to your Desktop.
  2. Double-click the installer icon to run the graphical installer.

To uninstall the VIX API, go to Start > Settings > Control Panel and use the Add/Remove Programs control panel.


Using the Linux Standalone Installer

To install the VIX API files on Linux:

  1. Download the tar-gzip package. For example:
    wget http://www.vmware.com/downloads/server/VMware-vix-110068.i386.tar.gz
  2. As superuser, extract the package:
    sudo tar zxpf VMware-vix-110068.i386.tar.gz
  3. Change directory and, as superuser, run the VMware installer:
    cd vmware-vix-distrib
    sudo ./vmware-install.pl
  4. Read the EULA and type "yes" if you agree to its terms. You can accept most defaults by typing Enter when prompted.

To uninstall the VIX API, run the vmware-uninstall-vix.pl script. The uninstaller is at /usr/bin/vmware-uninstall-vix.pl by default.


Upgrading an Earlier Installation

If you are using older Vix libraries, VMware recommends that you upgrade those libraries using the standalone installer. The standalone installer provides a current version of the wrapper library, which allows programs to communicate with any Vix library, regardless of version or target architecture. The wrapper library dynamically loads appropriate library files at connection time.

Otherwise you must link your program to a Vix library that matches the server version. This gets inconvenient if your program communicates with more than one version of the server.

VMware Tools in virtual machines should be kept up-to-date with the VMware version on the host. When upgrading, also update VMware Tools in all guest operating systems. The VIX API relies on a current matching version of VMware Tools to perform many operations.

Upgrading the Vix libraries replaces the older header files, vix.h and vm_basic_types.h with newer header files. The header files are installed at the following locations by default:

  • On a Windows system:
    • C:\Program Files\VMware\VMware VIX\vix.h
    • C:\Program Files\VMware\VMware VIX\vm_basic_types.h
  • On a Linux system:
    • /usr/include/vmware-vix/vix.h
    • /usr/include/vmware-vix/vm_basic_types.h

Whether or not you use the wrapper library, your programs may call only the functions supported by the host. If you communicate with an older host, you cannot use newer features.


Sample Vix Programs

On Windows, the sample programs are installed in C:\Program Files\VMware\VMware VIX\Samples by default. An nMakefile is provided to compile all sample programs using nmake and the Visual Studio C compiler.

On Linux, the sample programs are installed in /usr/share/doc/vmware-vix/VMwareVix/samples/ by default. A Makefile is provided to compile all sample programs using make and the GNU C compiler.

Compiling on Windows With Wrapper Library

To use the wrapper library with VIX 1.6, you need Visual Studio 2005 (Visual C release 8.0) or later. To compile code on Windows using the wrapper library, use the following procedure. Files are in the C:\Program Files\VMware\VMware VIX folder.

  1. Add the header file to an include statement in your source code:
  2. #include "vix.h"
    ... program code here ...
  3. Compile for, and link with, the multithreaded version of the C runtime library. For Workstation 6.0.1 and later, you may use either the debug or the non-debug version of this library. For Workstation 6.0.0 and earlier, you must use the non-debug version.
    • To compile and link with the debug version (libcmtd.lib) use compiler options /MTd /nodefaultlib:libcmtd.lib.
    • To compile and link with the non-debug version (libcmt.lib) use compiler options /MT /nodefaultlib:libcmt.lib.
  4. Compile code to link with these files:
    • VixAllProducts.lib for non-debug, or VixAllProductsd.lib for debug.
    • kernel32.lib
    • user32.lib
    • advapi32.lib
    • ole32.lib
    • oleaut32.lib
    • ws2_32.lib
    • shell32.lib

Compiling on Linux With Wrapper Library

This procedure assumes that you have installed Vix components in the default directories. If you made different choices during the installation, specify your directory choices instead.

  1. Add an include statement in your source code for the header file:
    #include "vix.h"
    ... program code here ...
  2. Compile your application, linking to the wrapper library and dynamic load library:
    $ gcc -I/usr/include/vmware-vix vixapp.c -o vixapp -lvixAllProducts -ldl

Compiling on Windows Without Wrapper Library

If you do not use the wrapper, you need to link the appropriate Vix libraries for the VMware product to which your Vix program connects. Workstation 6.5 is able to link a debug version of the C runtime library.

To compile your code for use with Workstation 6.5:

  1. Make the required DLL files available to your program, either by placing them in the same directory as your executable, or by placing them in the system directory (C:\WINDOWS\system32). The easiest option is to copy DLL files from the directory C:\Program Files\VMware\VMware VIX\Workstation-6.5.0\32bit or 64bit.
    • vix.dll (or vixd.dll if you are using debug C runtime library)
    • iconv.dll (or inconvd.dll if you are using debug C runtime library)
    • libxml2.dll (or libxml2d.dll if you are using debug C runtime library)
    • libeay32.dll
    • ssleay32.dll
    • vmcryptolib.dll
    • zlib1.dll
  2. Add the header file to an include statement in your source code:
    #include "vix.h"
    ... program code here ...
  3. Compile your code to link in vix.lib statically.
  4. Compile for, and link with, the multithreaded version of the C runtime library. You may use either the debug or the non-debug version of this library.
    • To compile and link with the debug version (libcmtd.lib) use compiler option /MTd with Microsoft Visual Studio.
    • To compile and link with the non-debug version (libcmt.lib) use compiler option /MT with Microsoft Visual Studio.

To compile your code for use with Workstation 6.0.x:

  1. Make the required DLL files available to your program, either by placing them in the same directory as your executable, or by placing them in the system directory (C:\WINDOWS\system32). The easiest option is to copy DLL files from the directory C:\Program Files\VMware\VMware VIX\ws-2\32bit or ws-3\32bit.
    • vix.dll
    • iconv.dll
    • libxml2.dll
    • libeay32.dll
    • ssleay32.dll
    • vmcryptolib.dll
    • zlib1.dll
  2. Add the header file to an include statement in your source code:
    #include "vix.h"
    ... program code here ...
  3. Compile your code to link in vix.lib statically.
  4. Compile for, and link with, the multithreaded version of the C runtime library. You must use the non-debug version of this library (libcmt.lib) by using compiler option /MT with Microsoft Visual Studio.

To compile your code for use with VMware Server 1.0:

  1. Make the following DLL files available to your program, either by placing them in the same directory as your executable, or by placing them in your system directory (C:\WINDOWS\system32). The easiest option is to copy DLL files from the directory C:\Program Files\VMware\VMware VIX\server-1\32bit.
    • vix.dll
    • ssleay32.dll
    • libeay32.dll
  2. Add the header file to an include statement in your source code:
    #include "vix.h"
    ... program code here ...
  3. Compile your code to link in vix.lib statically.

Compiling on Linux Without Wrapper Library

To compile your code with VMware Server or VMware Workstation installed:

  1. Add an include statement in your source code for the header file:
    #include "vix.h"
    ... program code here ...
  2. Compile your application, linking statically to libvix.so, as in the following examples.
    • To link the VMware Workstation library on a 32-bit machine:
      gcc -I/usr/include/vmware-vix -o vixapp vixapp.c /usr/lib/vmware-vix/Workstation-6.5.0/32bit/libvix.so
    • To link the VMware Server 2.0 library on a 32-bit machine:
      gcc -I/usr/include/vmware-vix -o vixapp vixapp.c /usr/lib/vmware-vix/lib/VIServer-2.0.0/32bit/libvix.so
    • To link the old VMware Server 1.x library:
      gcc -I/usr/include/vmware-vix -o vixapp vixapp.c /usr/lib/vmware-vix/lib/server-1/32bit/libvix.so
Thanks : VMware.com

วันพฤหัสบดีที่ 15 ตุลาคม พ.ศ. 2552

How to Configure AWstats

AWstats is a free, popular log analyzer, released under the GPL. It can generate advanced graphical statistics from web, streaming, ftp or mail server log files. This document is not intended to be a review, but rather a quick installation and configuration guide for a specific web site, in order to have as accurate statistical data as possible for use in your traffic analysis reports.

AWstats is actually a Perl script (awstats.pl), which parses your server’s log files and generates reports either dynamically, when used as a CGI script through the web browser, or by creating static HTML pages, when used directly from the command line or through cron. It also comes with some other helper Perl scripts to make this task even easier.

Article Goals

The goals of this document are to:

  1. Install AWstats in a custom location as a normal user. Although it is possible to have a system-wide installation, I chose this approach for completeness. The differences between the two methods are just the scripts’ locations. The rest of the configuration stays the same.
  2. Create a configuration file for our web site (Apache Virtual Host) for as accurate statistics as possible.
  3. Parse this host’s log file and create a database with statistical data.
  4. Use this statistical data to generate web site traffic reports. We will focus on the creation of static HTML reports, but some info on how to use awstats.pl as a CGI is also provided.
  5. Make a quick introduction to user-defined charts.

Prerequisites

This document assumes that:

  • Our web site is configured to have its own log file.
  • The log file is written in the "combined" format (NCSA combined/XLF/ELF log format)
  • You have configured the Apache web server to do reverse DNS lookups (HostnameLookups On). This means that the log files contain the visitors’ hostnames instead of their IP addresses in the HOST field. This is not necessary though.
  • We have access to the log file.

Actually, only the last one is a necessity, as awstats can be configured to generate statistics even from heavily customized log formats. For this article we will use an apache log file in the "combined" format.

Custom installation in our Home directory

We will install the AWstats package in our Home directory. So, download the latest awstats version from the Project Page and extract it:

# tar -xzvf awstats-X.X.tar.gz -C /home/jsmith/

A new directory (awstats-X.X) is created in our Home. This is where all scripts and other supplemental files are installed. You may want to rename this to just awstats:

# mv awstats-X.X awstats

We will need to create two more directories, one for the awstats statistical data and one for the traffic reports (static HTML pages). So, we create the first one inside the awstats installation directory:

# mkdir /home/jsmith/awstats/statdata

The directory which will hold the traffic reports can be located inside our web site’s root directory, so that they are accessible from a web browser. Assuming that our DocumentRoot is /home/jsmith/public_html/, we create a new directory in there:

# mkdir /home/jsmith/public_html/traffic

Using this installation scheme, we avoid exposing the awstats scripts to the internet. Only the traffic reports will be accessible through a web browser. This means that it will not be possible to use awstats.pl as a CGI script to generate reports dynamically (directly from our statistical data), but this behaviour can easily be changed.

We also need to copy some images, which are used in the HTML or PDF traffic reports, to the traffic directory:

# cp -R /home/jsmith/awstats/wwwroot/icon/ /home/jsmith/public_html/traffic/

The last part of the installation process is to set the appropriate permissions to the AWstats directories and files. So, we set the mode to 0755 for directories and 0644 for all files. Because the Perl scripts (*.pl files) need to be executable, we set their mode to 0755. The following lines do all this:

# find /home/jsmith/awstats/ -type d | xargs chmod 0755
# find /home/jsmith/awstats/ -type f | xargs chmod 0644
# find /home/jsmith/awstats/ -type f -name *.pl | xargs chmod 0755

We also need to set the appropriate permissions to the directory which will hold the reports and which will be accessible from the internet:

# find /home/jsmith/public_html/traffic/ -type d | xargs chmod 0705
# find /home/jsmith/public_html/traffic/ -type f | xargs chmod 0604

That’s enough with the installation.

Configuration

We need to create a configuration file for our web site. This file will be read by awstats.pl in order to generate the statistical data or the traffic reports. There is a sample configuration file in the /home/jsmith/awstats/wwwroot/cgi-bin/ directory, named awstats.model.conf. We make a copy of this file in the same directory and replace the "model" part of the name with one that will represent our web site:

# cp awstats.model.conf awstats.mysite.conf

We will work on the copy. Although, modifying only a few basic directives, such as the logfile path and the statistical data directory path, would be enough, we will modify some more, so that our statistics are as accurate as possible and our reports look the way we want.

Open the awstats.mysite.conf file in your favourite text editor and let’s start customizing it.

Note: I would suggest that you do not use relative paths whenever needed, but rather absolute ones.

LogFile="/home/jsmith/logs/access_log"
LogType=W
LogFormat=1
LogSeparator=" "

These are log file specific directives. If your log file is in the "combined" format, all you have to modify is its path.

SiteDomain="www.mysite.com"
HostAliases="mysite.com"

Here we set our web site’s URL and all the aliases that can be used to reach the site with a web browser. Separate all aliases with a "space".

DNSLookup=0

By setting this directive to 0, no reverse DNS lookup requests will be sent to the nameserver. I have set the Apache web server to do these lookups, so a value of 0 is the proper one. You can set this to 1, which will lead to numerous lookup requests to the nameserver, or 2, which will make awstats do the resolving by examining a DNS cache file, if it exists. Keep in mind that having awstats do the reverse DNS lookups will slow the statistics update process dramatically.

DirData="/home/jsmith/awstats/statdata"

Set the directory where awstats will keep its statistical data. This is one of the directories we had created in the installation process.

DirCgi="/home/jsmith/awstats/wwwroot/cgi-bin"

This is the directory that contains the awstats.pl script.

DirIcons="icon"

Remember that we had previously copied the awstats icons to the directory which will hold our reports? That’s why we do not need to specify an absolute path for these. Just set it to icon.

CreateDirDataIfNotExists=0

If you had previously created the directory which will hold the statistical data, then a value of 0 will do. Otherwise set it to 1 to have the directory you have specified in the DirData directive created.

KeepBackupOfHistoricFiles=1

It’s a good habit to have awstats keep a backup of the historic data during the update process.

DefaultFile="index.php"

Here we define the index file for our web site. In other words, our home page. This depends on your site.

SkipHosts="OUR OWN PCs' HOSTNAMES"

This is a very important directive ragarding the accuracy of the statistics. Usually, we are our web site’s most regular visitor and it’s obvious that we do not want to be counted as a visitor. This directive can take IP addresses or hostnames as values, separated with a space. Regular expressions can be used in the form of REGEX[value]. IP addresses cannot be mixed with hostnames, so, if the DNS lookups take place at the web server level, then we have to use hostnames as values, otherwise we have to use IP addresses. Usually we need to set the IPs or hostnames of all our LAN computers or computers we use to edit the website, so that they are ignored. Below are some examples:

SkipHosts="localhost REGEX[^.*\.example\.dyndns\.org$] test.mysite.com windowspc1"
OR
SkipHosts="127.0.0.1 REGEX[^192\.168\.] REGEX[^10\.]"
SkipUserAgents=""

If you use any custom spiders or bots to test or analyze your web site, but you don’t want their access to be included in the stats, then you should add their "User Agent String" as a value to this directive. Again, regular expressions can be used in the form of REGEX[value].

NotPageList="css js class gif jpg jpeg png bmp ico swf"

This is another important directive. Here we set what file extensions will not be counted as Page Views or Downloads, but only as Hits. Usually, this list includes files that are part of a web page (images, stylesheets, flash animations, java applets etc.).

URLWithQuery=0
URLWithQueryWithOnlyFollowingParameters=""
URLWithQueryWithoutFollowingParameters=""
URLReferrerWithQuery=0

These do not need to be modified, unless you want the query string to be included in the web page URLs or Referrer URLs in the traffic reports. Enabling the URLWithQuery directive is important in the case your web page URLs are of the form /index.php?p=10, so that it is clear in the traffic reports which page was viewed. On the other hand, if your page URLs are of the above form, but you use permalinks, then it’s not needed to modify the default values for these directives.
Including the query string in the referrer URLs is not important, in fact it can lead to lengthy meaningless referrer lists, which is not so convenient. I just provide this info here for completeness.

LevelForWormsDetection=2

By default, the detection of worms that have crawled your web site is disabled. You may want to enable this by setting the above directive’s value to 2.

Lang="en"

If you need the reports to be in a specific language, set it here. A list of supported languages exists in the configuration file.

ShowAuthenticatedUsers=PHBL

If your reports are private, you may set this directive’s value to PHBL (details about what each letter represents can be found inside the conf file), so that a section with details about your web site’s authenticated users is included in the reports.

ShowWormsStats=HBL

If you had previously enabled the worm detection, then you may want to include a detailed section about worms in the reports.

IncludeInternalLinksInOriginSection=1

By setting this to 1, a summary of how many links to another internal page have been followed from your site’s pages is included in the reports.

MaxNbOfDomain = 10
MaxNbOfHostsShown = 10
MaxNbOfLoginShown = 10
MaxNbOfRobotShown = 10
MaxNbOfPageShown = 10
MaxNbOfOsShown = 10
MaxNbOfBrowsersShown = 10
MaxNbOfRefererShown = 10
MaxNbOfKeyphrasesShown = 10
MaxNbOfKeywordsShown = 10

Here follows some info about the reports. You can create only one main page with a summary of the web site’s traffic, but you can also generate some supplemental pages which have full lists of the visited pages, referrers, countries, search engines etc. Each section in the main page includes a predefined number of entries that are displayed. For example, it displays by default the top 10 referrers. This number can be customized by modifying the directives above.

ShowLinksOnUrl=1

By default, each URL shown in the reports is a clickable hyperlink. If you do not want them to be actual hyperlinks, then set this to 0.

MaxRowsInHTMLOutput=1000
DetailedReportsOnNewWindows=1

With these directives you set the number of entries each of the supplemental reports can have and if you want these supplemental reports to be opened in a new browser window.

LoadPlugin="tooltips"
LoadPlugin="decodeutfkeys"

The AWstats package includes some plugins you can enable. I found the above two to be helpful. The first one enables the display of some descriptive tooltips and the second one makes it possible to show keywords and keyphrases correctly using national characters.
There are some other interesting plugins inside the awstats package, but also some more from other contributors. You can find the latter at the project’s web site. Keep in mind, that each plugin may require certain Perl modules to be installed.

Update the statistics database

Now that we have finished customizing our web site’s configuration file, we can finally have awstats.pl parse our log file and create statistical data:

# perl /home/jsmith/awstats/wwwroot/cgi-bin/awstats.pl -config=mysite -update -showcorrupted

Notice that we do not use the whole configuration file’s filename (awstats.mysite.conf) to define our configuration, but only the part between awstats. and .conf.

The -showcorrupted option is not necessary. A total number of corrupted records would be displayed anyway. This just provides detailed info.

It would be convenient if you set cron to execute the above command on a daily or hourly basis. Here is a small BASH script that can be run through cron:

#! /bin/bash

# Update the statistics database
perl /home/jsmith/awstats/wwwroot/cgi-bin/awstats.pl -config=mysite -update -showcorrupted

# Calculate Total Visits for all months
TotVisits=$(grep ^TotalVisits /home/jsmith/awstats/statdata/*.txt | sed 's/^.*awstats.*TotalVisits.//' | awk '{sum += $1} END {print sum}')

# Export a small GIF image with the number of total visits
text2gif -t "$TotVisits" > /home/jsmith/public_html/traffic/counter.gif

# Set proper permissions on the GIF image
chmod 0604 /home/jsmith/public_html/traffic/counter.gif

exit 0

This small script updates the statistical data, calculates the total visits for all months and exports a small B&W GIF image which can be used as our custom counter in our web site. It’s not a real-time counter, but it’s better than nothing… Anyway, this just an example. The text2gif utility is part of the libungif-progs package.

Generate traffic reports

There are two methods to generate reports. Either by using awstats.pl directly or by using a helper script, named awstats_buildstaticpages.pl.

To generate the main report for November 2005 using awstats.pl, you can issue the following command:

# perl /home/jsmith/awstats/wwwroot/cgi-bin/awstats.pl -config=mysite -month=11 -year=2005 -output -staticlinks > /home/jsmith/public_html/traffic/awstats.mysite.200511.html

If the options -month and -year are omitted, then the report is generated for the current month. You can also generate a report for a whole year, by setting these two options to -month=all and -year=2005.

You can view the page with your web browser at:
http://www.mysite.com/traffic/awstats.mysite.200511.html

Furthermore, you can create supplemental reports (lengthy lists of referrers, countries etc.) or even apply filters. This info is covered in detail in the awstats documentation. See the relevant section here.

A quick way to create full reports (main and supplemental pages) is to use the helper script, awstats_buildstaticpages.pl. This can be used in the following way:

# perl /home/jsmith/awstats/tools/awstats_buildstaticpages.pl -configdir=/home/jsmith/awstats/wwwroot/cgi-bin -config=mysite -awstatsprog=/home/jsmith/awstats/wwwroot/cgi-bin/awstats.pl -dir=/home/jsmith/awstats/statdata -month=11 -year=2005 -builddate=200511

Here is an explanation for some of the options:
-configdir: Sets the path of the directory which contains the configuration files.
-awstatsprog: Sets the path to the awstats.pl script.
-dir: Sets the directory where the report files should be saved.
-builddate: Adds month and year info in the report’s filename.

Again, if the options -month and -year are omitted, then the report is generated for the current month and year.

Other options that can be used are:
-update: Updates the awstats statistics database before generating any reports.
-buildpdf: Creates a PDF file, after the generation of the HTML pages is done.

In order to generate PDF files, the package htmldoc needs to be installed in the system.

It would be more convenient if you set cron to execute the above command.

AWstats Extra Section Configuration

AWstats can be configured to include user-defined charts in the reports. These are defined in the "Extra Section" in the awstats.mysite.conf file. An explanation for each directive is included withing the conf file. Here I provide two examples that work together with some notes, just to get you started with custom charts.

Keep in mind the following two things:

  1. Every time you define a new extra chart, you have to increment the number in the name of each directive. For example, for the first extra chart the directive that defines the chart’s name would be ExtraSectionName1, for the second extra chart it would be ExtraSectionName2 etc.
  2. Every time you define a new extra chart, but you want it to include info from already parsed log files, you have to recreate the awstats historical statistical data. You can simply delete the contents of the /home/jsmith/awstats/statdata directory and parse all your log files again.

At least a basic knowledge of Regular Expressions is required in order to configure extra charts.

Top 50 RPM Downloads

This user-defined chart displays the Top 50 RPM package downloads (used for the current web site):

ExtraSectionName1="Top 50 RPM Downloads"
ExtraSectionCodeFilter1="200 304"
ExtraSectionCondition1=""
ExtraSectionFirstColumnTitle1="Package Name"
ExtraSectionFirstColumnValues1="URL,\/packages\/(.*)\.rcn.*\.rpm$"
ExtraSectionFirstColumnFormat1="%s"
ExtraSectionStatTypes1=HB
ExtraSectionAddAverageRow1=0
ExtraSectionAddSumRow1=1
MaxNbOfExtra1=50
MinHitExtra1=1
Top 100 Referrers by Domain

This user-defined chart displays the Top 100 Referrers by Domain. It also merges referrer URLs of the form www.domain.com and domain.com to just domain.com.

ExtraSectionName2="Top 100 Referrers by Domain"
ExtraSectionCodeFilter2="200 304"
ExtraSectionCondition2=""
ExtraSectionFirstColumnTitle2="Referring Domain"
ExtraSectionFirstColumnValues2="REFERER,^http:\/\/www\.([^\/]+)\/||REFERER,^http:\/\/([^\/]+)\/"
ExtraSectionFirstColumnFormat2="%s"
ExtraSectionStatTypes2=PHBL
ExtraSectionAddAverageRow2=0
ExtraSectionAddSumRow2=1
MaxNbOfExtra2=100
MinHitExtra2=1
Some notes

User-defined charts add much more flexibility to AWstats. Sometimes, even non-professional webmasters need to "dig" into the server logs for some special info about their web site. This can be perfectly achieved by using custom scripts, but the extra charts are a better way of doing this.

Three are the most important directives in the extra chart configuration:

  • ExtraSectionCodeFilter: This filters the log entries according to the HTTP code that the web server returned after a page or file request.
  • ExtraSectionCondition: With this we can set some rules that define which entries will pass or not. The rules are of the form "URL, regular expression" and they can be separated with "||", which means "OR". Instead of the URL field, other fields like the User Agent string or the Referrer URL can be checked. These are documented in the configuration file’s comments. This directive can be left blank
  • ExtraSectionFirstColumnValues: This defines what is the value that will be displayed in the custom chart. This is the same as the ExtraSectionCondition, but it could be considered as a third level of filtering. This directive cannot be left blank. An important thing to take a note of is that you need to specify a group in the regular expression. This means that a part or all of the regular expression must be in parenthesis. Whatever this group matches will be the value in the chart.

It’s clear that the knowledge of regular expressions is the absolute key in configuring an extra chart. This document is not intended to be a REGEX guide. I am not an expert on this anyway, so it would be pointless. Some helpful links can be found in the "Further Reading" section of this document.

Apache Configuration (optional)

Using this AWstats installation and configuration guide, there is no need for any special configuration at the web server level.

But, if you have not created the directory that holds the traffic reports (/home/jsmith/public_html/traffic) inside your DocumentRoot, then adding an Alias in your Apache VirtualHost configuration is necessary. For example, if you have created the traffic directory in /home/jsmith/traffic, then the following Alias must be added in your Apache or Virtual Host configuration file, so that the reports are accessible from a web browser:

Alias /traffic /home/jsmith/traffic

AllowOverride AuthConfig
Options None

Access control directives can be added inside the tags or in an .htaccess file, but this will not be covered in this document.

On the other hand, if you want to use awstats.pl as a CGI script in order to create the traffic reports dynamically from the web browser, then the addition of a ScriptAlias in your Apache or Virtual Host configuration is necessary. Assuming that you have followed the custom installation instructions of this guide, then this ScriptAlias could be:

ScriptAlias /traffic-bin/ "/home/jsmith/awstats/wwwroot/cgi-bin/"

AllowOverride None
Options None
Order allow,deny
Allow from all

Now, point your web browser at:

http://www.mysite.com/traffic-bin/awstats.pl?config=mysite

All the awstats.pl options, except for -staticlinks, are supported, so you can try the following:

http://www.mysite.com/traffic-bin/awstats.pl?config=mysite&month=08&year=2005

Using awstats.pl as a CGI script, the reports are created in real-time from the statistical data, so it might be slow. This adds unnecessary load on the server. Furthermore, AWstats had some security related issues in the past, so using it as a CGI script is not recommended, unless you are sure that these problems have been solved or you implement access restrictions.

Further Reading

Here are some documents you might find useful:

  1. The AWstats Documentation
  2. The AWstats FAQ
  3. HTTP Status Code Definitions
  4. Regular Expression HOWTO
  5. Syntax of regular expressions in Perl (Perl Documentation)
  6. How to build HTMLDOC RPM package for Fedora Core by Thomas Chung

Related Articles


Thanks : George Notaras || A quick AWstats guide

วันศุกร์ที่ 9 ตุลาคม พ.ศ. 2552

ฺBasic Firewall on iptables

เมื่อเรากำลัง ตรวจดู port ที่เปิดอยู่ของเครื่องของเราด้วย nmap localhost

ผลที่ได้ก็ประมาณนี้

*************************************************************
Starting Nmap 5.00 ( http://nmap.org ) at 2009-10-09 16:22 ICT
Warning: Hostname localhost resolves to 2 IPs. Using 127.0.0.1.
Interesting ports on localhost.localdomain (127.0.0.1):
Not shown: 981 closed ports
PORT STATE SERVICE
22/tcp open ssh
25/tcp open smtp
80/tcp open http
110/tcp open pop3
111/tcp open rpcbind
143/tcp open imap
443/tcp open https
465/tcp open smtps
587/tcp open submission
631/tcp open ipp
993/tcp open imaps
995/tcp open pop3s
5222/tcp open unknown
5269/tcp open unknown
5900/tcp open vnc
7025/tcp open unknown
7777/tcp open unknown
10024/tcp open unknown
10025/tcp open unknown

Nmap done: 1 IP address (1 host up) scanned in 0.33 seconds

*************************************************************


แล้วเราจะป้องกันเครื่องของเราได้อย่างไรหล่ะที่นี้ ลองมาดูกันนะ

1. ไปที่ iptables ซึ่งเป็น firewall ของเครื่องกันเลย

# vim /etc/sysconfig/iptables


-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 143 -j ACCEPT

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited



หรือ ไม่ก็ลองดูว่า port นี้ process ตัวไหน เป็นคนทำงานอยู่ ก็ปิดมันซะ

# netstat -tanp

หรือ จะดูข้อมูลอย่างละเีอียด

# nmap -A -T4 localhost


ผลที่ได้ก็ประมาณนี้

****************************************************************
Starting Nmap 5.00 ( http://nmap.org ) at 2009-10-09 16:17 ICT
Warning: Hostname localhost resolves to 2 IPs. Using 127.0.0.1.
Stats: 0:01:59 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 92.31% done; ETC: 16:19 (0:00:02 remaining)
Interesting ports on localhost.localdomain (127.0.0.1):
Not shown: 981 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 5.2 (protocol 2.0)
| ssh-hostkey: 1024 a6:1c:7d:c7:44:bf:fc:9e:29:a0:6b:a5:ae:ea:b5:d4 (DSA)
|_ 2048 4f:ee:5e:2e:e3:40:45:ef:ed:57:90:a5:b4:52:da:29 (RSA)
25/tcp open smtp Postfix smtpd
|_ smtp-commands: EHLO zimbra.agss.com, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN
80/tcp open http?
|_ html-title: Did not follow redirect to https://localhost/zimbra/?zinitmode=http and no page was returned.
110/tcp open pop3 Zimbra pop3d
|_ pop3-capabilities: USER STLS EXPIRE(31 USER) UIDL IMPLEMENTATION(ZimbraInc) XOIP TOP SASL
111/tcp open rpcbind
| rpcinfo:
| 100000 2,3,4 111/udp rpcbind
| 100024 1 42604/udp status
| 100000 2,3,4 111/tcp rpcbind
|_ 100024 1 58036/tcp status
143/tcp open imap Zimbra imapd
|_ imap-capabilities: CONDSTORE THREAD=ORDEREDSUBJECT ESEARCH STARTTLS BINARY UNSELECT LOGINDISABLED UIDPLUS SORT SEARCHRES ID SASL-IR WITHIN AUTH=X-ZIMBRA LIST-EXTENDED QUOTA QRESYNC CHILDREN ENABLE LOGIN-REFERRALS I18NLEVEL=1 RIGHTS=ektx ACL IDLE CATENATE IMAP4rev1 LITERAL+ ESORT NAMESPACE MULTIAPPEND
443/tcp open ssl/http Zimbra http config
|_ html-title: Zimbra Collaboration Suite Log In
465/tcp open ssl/smtp Postfix smtpd
|_ smtp-commands: EHLO zimbra.agss.com, PIPELINING, SIZE 10240000, VRFY, ETRN, AUTH PLAIN LOGIN, AUTH=PLAIN LOGIN, ENHANCEDSTATUSCODES, 8BITMIME, DSN
587/tcp open smtp Postfix smtpd
|_ smtp-commands: EHLO zimbra.agss.com, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN
631/tcp open ipp CUPS 1.4
993/tcp open ssl/imap Zimbra imapd
|_ imap-capabilities: CONDSTORE THREAD=ORDEREDSUBJECT ESEARCH AUTH=PLAIN SASL-IR IMAP4rev1 UNSELECT UIDPLUS SORT ID SEARCHRES WITHIN AUTH=X-ZIMBRA LIST-EXTENDED BINARY QUOTA QRESYNC CATENATE CHILDREN LOGIN-REFERRALS RIGHTS=ektx ACL I18NLEVEL=1 ENABLE IDLE LITERAL+ ESORT NAMESPACE MULTIAPPEND
995/tcp open ssl/pop3 Zimbra pop3d
|_ pop3-capabilities: USER EXPIRE(31 USER) UIDL IMPLEMENTATION(ZimbraInc) XOIP TOP SASL(PLAIN X-ZIMBRA)
5222/tcp open unknown
5269/tcp open unknown
5900/tcp open vnc VNC (protocol 3.7)
7025/tcp open lmtp Zimbra lmtpd
7777/tcp open socks5 (No authentication; connection not allowed by ruleset)
10024/tcp open smtp amavisd smtpd
| smtp-commands: EHLO [127.0.0.1], VRFY, PIPELINING, SIZE, ENHANCEDSTATUSCODES, 8BITMIME, DSN, XFORWARD NAME ADDR PORT PROTO HELO SOURCE
|_ HELP 2.0.0 See amavisd-new home page at: 2.0.0 http://www.ijs.si/software/amavisd/
10025/tcp open smtp Postfix smtpd
|_ smtp-commands: EHLO zimbra.agss.com, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN
3 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port80-TCP:V=5.00%I=7%D=10/9%Time=4ACEFFAF%P=i386-redhat-linux-gnu%r(Ge
SF:tRequest,117,"HTTP/1\.1\x20302\x20Found\r\nExpires:\x20Tue,\x2024\x20Ja
SF:n\x202000\x2020:46:50\x20GMT\r\nCache-Control:\x20no-store,\x20no-cache
SF:,\x20must-revalidate,\x20max-age=0\r\nPragma:\x20no-cache\r\nContent-Ty
SF:pe:\x20text/html;\x20charset=utf-8\r\nContent-Language:\x20en-US\r\nLoc
SF:ation:\x20https://127\.0\.0\.1/zimbra/\?zinitmode=http\r\nContent-Lengt
SF:h:\x200\r\n\r\n")%r(HTTPOptions,C7,"HTTP/1\.1\x20200\x20OK\r\nExpires:\
SF:x20Tue,\x2024\x20Jan\x202000\x2020:46:50\x20GMT\r\nCache-Control:\x20no
SF:-store,\x20no-cache,\x20must-revalidate,\x20max-age=0\r\nPragma:\x20no-
SF:cache\r\nAllow:\x20GET,\x20HEAD,\x20POST,\x20TRACE,\x20OPTIONS\r\nConte
SF:nt-Length:\x200\r\n\r\n")%r(RTSPRequest,2F,"HTTP/1\.1\x20400\x20Bad\x20
SF:Request\r\nConnection:\x20close\r\n\r\n")%r(X11Probe,2F,"HTTP/1\.1\x204
SF:00\x20Bad\x20Request\r\nConnection:\x20close\r\n\r\n")%r(FourOhFourRequ
SF:est,5BD,"HTTP/1\.1\x20404\x20Not\x20Found\r\nContent-Type:\x20text/html
SF:;\x20charset=utf-8\r\nContent-Language:\x20en-US\r\nContent-Length:\x20
SF:1356\r\n\r\n\n\n\n\n\n\n\n\n\nSF:ML\x20PUBLIC\x20\"-//W3C//DTD\x20HTML\x204\.01\x20Transitional//EN\">\n
SF:\n\n\n\n\n\n\n\n\n\n\n\x20\x20\x20\x20SF:"Content-Type\"\x20content=\"text/html;charset=utf-8\">\n\x20\x20\x20\x
SF:20404\x20-\x20Not\x20Found\n\x20\x20\x20\x20SF:e=\"viewport\"\x20content=\"width=320;\x20initial-scale=1\.0;\x20maximu
SF:m-scale=8\.0;\x20user-scalable=1;\">\n\x20\x20\x20\x20SF:escription\"\x20content=\"Zimbra\x20provides\x20open\x20source\x20serve
SF:r\x20and\x20client\x20software\x20for\x20messaging\x20and\x20collaborat
SF:ion\.\x20To\x20find\x20out\x20more\x20visit\x20http://www\.zimbra\.com\
SF:.\">\n\x20\x20\x20\x20SF:s\"\x20href=\"/zimbra/css/common,login,zhtml,skin\.css\?skin=&v=0909111
SF:85028\">\n\t\n\t\n\t\x20\x20\x20\x20\n\t\n\x20\x20\x20\x20SF:\"SHORTCUT\x20ICON\"\x20href=\"/zimbra/img/logo/favicon\.ico\">\nSF:>\n\n\n





\n<
SF:tr>\n==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port5222-TCP:V=5.00%I=7%D=10/9%Time=4ACEFFD2%P=i386-redhat-linux-gnu%r(
SF:Help,10,"")%r(X11Probe,10,"")%r(LPDStri
SF:ng,10,"")%r(TerminalServer,10,"");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port5269-TCP:V=5.00%I=7%D=10/9%Time=4ACEFFD2%P=i386-redhat-linux-gnu%r(
SF:Help,10,"")%r(X11Probe,10,"")%r(LPDStri
SF:ng,10,"")%r(TerminalServer,10,"");
Device type: general purpose
Running: Linux 2.6.X
OS details: Linux 2.6.15 - 2.6.27
Network Distance: 0 hops
Service Info: Hosts: zimbra.agss.com, 127.0.0.1

OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 127.55 seconds

*******************************************************************

Thanks : thaiadmin.org

Basic Sample DNS Configurations

A Record (Address Record)

Each of these records map a name to an IP address.

Example:

Name
TTL
Type
IP
www.dnsmadeeasy.com. 10800 A 192.168.1.2
  • Name - The www.dnsmadeeasy.com is the host.
  • TTL (time to live) - The 10800 indicates how often (in seconds) that this record will exist (will be cached) in other systems. The lower the number the more frequent systems will go to the DNS server for queries.
  • IP - 192.168.1.2 indicates the IP which this host will go to.
You are allowed multiple IPs per host for routing using "round robin" functionality. So the following is also valid:
Name
TTL
Type
IP
www.dnsmadeeasy.com. 10800 A 192.168.1.2
www.dnsmadeeasy.com. 10800 A 10.2.54.4

NOTE: It is important to know that only an A record can be made for your root host record. If you have a domain called example.com. and if you want an IP for example.com. then A record is the only valid solution for this. CNAME records are invalid.


Wildcard Record

Wildcard Records give you the ability to map all (or a section) of the records in your domain to one IP. All Wildcard records are created with A records.

If you create a record that is part of your domain (and inclusive of the wild card set) then only that record is directed to the other IP and everything else will goto the Wildcard record.

Example:
Name
TTL
Type
IP
*.dnsmadeeasy.com. 10800 A 192.168.1.2
www.dnsmadeeasy.com. 10800 A 10.2.54.4

The 'www' record would goto 10.2.54.4 but all of the other IPs would goto 192.168.1.2

All members can create Wildcard records for their domains.



Load Balancing / Round Robin

Load balancing / Round Robin allows you to distribute your server load evenly among multiple servers. This can all be handled in DNS Made Easy so you do not need to purchase expensive load balancers. The best part is that this service is "free" for all DNS Made Easy users!

All you have to do is create multiple A records with the same name but with a different IP / value.

Example:
Name
TTL
Type
IP
www.example.com. 10800 A 192.168.1.2
www.example.com. 10800 A 10.2.54.4

50% of the time a user would go to 192.168.1.2 and 50% of the time the users would go to 10.2.54.4.

You can even split the traffic to more hosts. For example:

  • If you have three (3) A records with the same name the traffic would be split evenly (33.333% to each host)
  • If you have four (4) A records with the same name the traffic would be split evenly (25% to each host).
  • etc.

NOTE: There is generally a limit of (thirteen) 13 hosts that you can round robined (13 A records with the same name and different values) due to the limitations of the UDP packet which is what the DNS protocol generally runs over.

You can even combine this service with our DNS Failover service to remove a server from the loop if it is down!


CNAME Record (Canonical Name Record)

These are usually referred to as alias records since they usually map an alias to its canonical name. The name server does handle these queries differently from an A record. When a name server looks up a name and finds a CNAME record, it replaces the name with the canonical name and looks up the new name. This allows you to point multiple systems to one IP without specifically assigning an A record to each host name. If your IP was ever to change you would only have to change one A record.

Example:

Name
TTL
Type
Data
www.dnsmadeeasy.com. 10800 A 192.168.1.2
ftp.dnsmadeeasy.com. 10800 CNAME www.dnsmadeeasy.com.

  • The A record is similar to the example above. Please read the section on A Records if this does not make sense to you.
  • Name - ftp.dnsmadeeasy.com is the host which are we are making an alias for.
  • TTL (time to live) - The 10800 indicates how often (in seconds) that this record will exist (will be cached) in other systems. The lower the number the more frequent systems will go to the DNS server for queries.
  • Data - www.dnsmadeeasy.com is the host which ftp.dnsmadeeasy.com is an alias to. It is important to realize that this value is never a CNAME value. This value should primarily be A record but could use an IP.

When the DNS server is queried for the ftp.dnsmadeeasy.com. system it realizes that it is an alias for www.dnsmadeeasy.com.. The system then returns the value of www.dnsmadeeasy.com.. which is 192.168.1.2. Whatever www.dnsmadeeasy.com. points to then so does ftp.dnsmadeeasy.com..

You can also use CNAME to point a record in one zone to a record in another zone. The following is valid:

Name
Expire Time
TYPE
Data / Value (A Record)
www.dnsmadeeasy.com. 10800 CNAME www.tiggee.com.

NOTE: It is important that CNAME always are to the left hand side. You should never make an alias to an alias. Or you should never use MX or NS records with CNAME records. You can read more about NS and MX records later in this document.

NOTE: It is important to know that only an A record can be made for your root host record. If you have a domain called example.com. and if you want an IP for example.com. then A record is the only valid solution for this. CNAME records are invalid.


NS Record (Name Server Record)

These records indicate which name servers are authoritative for the zone.

Example:

Name
TTL
Type
Data
ns.dnsmadeeasy.com. 10800 A 192.168.10.12
dnsmadeeasy.com. 10800 NS ns.dnsmadeeasy.com
  • The A record is similar to the example above. Please read the section on A Records if this does not make sense to you.
  • Name - dnsmadeeasy.com. is the domain which is being assigned an authoritative name server.
  • TTL (time to live) - The 10800 indicates the how often (in seconds) that this record will exist (will be cached) in other systems. The lower the number the more frequent systems will go to the DNS server for queries.
  • Data - ns.dnsmadeeasy.com. is the host which name servers will query for records in the dnsmadeeasy.com.. domain. It is important to realize that this value is never a CNAME value. This value should primarily be A record but could use an IP.

You can also use NS records to assign the authoritative name server for a subdomain.

Example:

Name
TTL
Type
Data (A Record)
sub.dnsmadeeasy.com. 10800 NS ns1.dnsmadeeasy.com.

Name servers will query ns1.dnsmadeeasy.com. for records in the sub.dnsmadeeasy.com. sub-domain


MX Record (Mail Exchange Record)

These records tell mail servers where to deliver mail. The name field of an MX record contains the host name which appears in the e-mail address, and the data field contains the hostname of the server to which the mail should be delivered. Two MX records that define the mail servers for the dnsmadeeasy.com domain might contain the following:

Name
Expire Time
Type
MX level
Data (A Record)
dnsmadeeasy.com. 10800 MX 10 mail.dnsmadeeasy.com.
dnsmadeeasy.com. 10800 MX 20 backupmail.dnsmadeeasy.com.

  • Name - Contains the domain dnsmadeeasy.com., meaning that these records are used for the entire domain. If the mail was addressed to username@dnsmadeeasy.com, the mail is directed to the mail exchangers defined by these records.
  • TTL (time to live) - The 10800 indicates the how often (in seconds) that this record will exist (will be cached) in other systems.
  • MX level - Sets the preference for the MX record. The mailserver will first try mail.dnsmadeeasy.com.. The lower the number the higher the preference. If the mail server with highest precedence is inaccessible the mail will be delivered to the mail server next in precedence. So if the server mail.dnsmadeeasy.com. is unavailable then backupmail.dnsmadeeasy.com. will get mail to be queued until mail.dnsmadeeasy.com. is ready to accept mail again. At that time backupmail.dnsmadeeasy.com will send it's queued mail to mail.dnsmadeeasy.com. Note: The email server must also be configured properly to queue mail for another system
  • Data - The host names which will have mail delivered to them for the domain. It is important to realize that this value is never a CNAME value. This value should primarily be A record but could use an IP.

HTTP Redirection Record

You can read all about the Redirection Service product here.

These are special records in that they are a combination of an A record and the use of an application server. There will be an A record pointing to our application servers which will redirect to the URL you specify.

HTTP Redirection Records allow you to map your FQDN to any URL of your choice.
For instance you can map. http://www.yourdomain.com
to
http://www2.yourdomain.com:9001/users/mypage.html

All users can create HTTP Redirection Records with any of the DNS Made Easy memberships.


TXT Record (Text Record)

These records are simply a list of strings, each less than 256 characters in length. TXT records can be used for anything you want.

Example Input for Domain Name: example.com
Name: mail
Data (TXT): This is the main mail server.
TTL: 1800 seconds

Result:
This will create a TXT record for the 'mail.example.com.' record and the description (text) of the record will be "This is the mail mail server.".


PTR Record (Pointer Record)

Pointer records are used to map a network interface (IP) to a host name. These are primarily used for reverse DNS.

Example Input for Domain Name: 1.168.192.in-addr.arpa
Name: 25
Data (PTR to): www.example.com.
TTL: 1800 seconds

Result:
This will create a reverse DNS entry for 192.168.1.25. The reverse DNS will be a pointer to 'www.example.com.'. This record will have a cache (TTL) of 30 minutes.

Of course 192.168.1.x is an internal network and would not be allowed in the DNS Made Easy system.


Thanks : dnsmadeeasy.com