How can you filter DHCP requests in Windows so only “approved” clients get a network address?  This is actually native to Linux after tweaking the dhcpd.conf file but hasn’t been a Windows feature until recently and is now native to Server 2008 R2.  My layer 2 switch doesn’t do NAC so I had considered rolling out a Linux DHCP server to meet my needs.  I personally think that Linux DHCP servers are much stronger than Windows DHCP however, this is a nice stop gap measure until I can implement a Linux DHCP server or if it works well I might forgo implementing the Linux server.

I ran into this article on a site I’ve used as a resource before, PETRI IT Knowledge base –> Link to article.  So to get this going download the “Mac Filter Installer” –> here or from my site –> here (just in case they took the download off the M$ blog site).  The PETRI site doesn’t explain how to implement DHCP MAC filtering and the M$ blog doesn’t either although the comments from others do help.  I thought I’d fill you in on how to implement Windows DHCP MAC Filtering from start to finish (here’s the link to the M$ blog that also hosts the download –> here)!

1. Extract the zip file
2. Double click the installer for your architecture, x32 or x64 (the “manual” gets put into %systemroot%\system32\SetupDHCPMacFilter.rtf but the “config” stuff is put into %systemroot%\system32\dhcp”)
3. Navigate to:  %systemroot%\system32\dhcp (click start > run > copy and past that into the dialog box and click OK to get there or just use explorer to get there)
4. Edit MACList.txt file, that’s where you want to put your filter of “allowed” addresses but note you can also do a “DENY” in place of the “ALLOW” to “deny” particular addresses but by default it’s set to allow only the MAC addresses in the list and is how I’ve got it configured and running.

My example config:

MAC_ACTION={ALLOW}
00E941007661 # My Cool Comment Here!!!
# You can also just make a comment
# Each one of these –># is “ignored” just like a Linux config file :P

Once you edit your file, and you put all your approved MAC addresses in the MACList.txt restart DHCP:  start > run > cmd > OK > type in:

net stop dhcp

net start dhcp

1. Open:  %systemroot%\system32\dhcp\MacFilterCalloutErrorLog.txt <– Check for errors!

If you see no errors (I had errors because I was using a MAC address like 00-00-00-00-00, it doesn’t like the “-“) then you’re golden.  Also note that an easy way to get MAC addresses into your MACList.txt file is to export your current list from DHCP.  Open the DHCP mmc snap in and navigate:  DHCP > Your server.domain > Scope > Address Leases; right click “Address Leases” and then click “Export List”.  Drag that text file into an Excel program, sort the list, copy it and past it into your MACList.txt file.  Restart DHCP and you’re DONE!

This is an additional layer of security to keep honest people honest.  If you can implement switch layer NAC you’re much better off since people could still set a static IP address that matches your IP network and successfully get onto your network however; using this method of DHCP MAC filtering you’re much better off than not having it since most people won’t know you can do that.  I’d expect anyone with an ounce of IT in them to try a static IP and find one they can use but again; you’re better off implementing this than not implementing it!

Install Core Components:

Open a terminal, command prompt or whatever you want to call it :)

sudo -i

Type in your password and hopefully you’ll get a prompt with root access

apt-get install apache2

apt-get install php5 libapache2-mod-php5

/etc/init.d/apache2 restart

apt-get install mysql-server

apt-get install libapache2-mod-auth-mysql php5-mysql phpmyadmin

nano /etc/php5/apache2/php.ini

At the bottom of that file add this line:

extension=mysql.so

Save it, usually I have to do a ctl+alt+x if I’m ssh’d to the machine or if you’re right on the console just ctl+x.

/etc/init.d/apache2 restart

Install Java

apt-get install sun-java6-bin

That’s pretty much it for installing your core components, Apache, PHP, MySQL and Java.

Preliminary Troubleshooting issues to look out for:

Issue: Apache PhpMyAdmin issue fix – I had some errors with Apache2 and PhpMyAdmin because of missing conf files

Does /etc/apache2/conf.d/phpmyadmin.conf exist? If not, does /etc/phpmyadmin/apache.conf exist?

If the first doesn’t exist and the second does, try this “fix”:

ln -s /etc/phpmyadmin/apache.conf /etc/apache2/conf.d/phpmyadmin.conf

/etc/init.d/apache2 restart

Issue: PhpMyAdmin issue

nano /etc/phpmyadmin/htpasswd.setup
* comment out the admin section

# admin:*

Pre-configuration for OpenFire:

Creating the DB’s – this is where I part ways with the reference site

MySQL Commands:

mysql -h localhost -u root -p

create database openfire;

CREATE USER ‘openfire’@’localhost’ IDENTIFIED BY ‘whateverpasswordyouwanthere’;

grant all on *.* to ‘openfire’@’%’ identified by ‘whateverpasswordyouusedhere’; flush privileges;

Now to “quit” your mysql prompt type in:  \q

* Note that you can call your database and user anything you want, I use “openfire” out of convenience.

OpenFire Installation:

Download the latest release:

wget http://www.igniterealtime.org/downloadServlet?filename=openfire/openfire_3.6.4_all.deb <– Can be whatever latest is

*Note:   it downloads the files as “downloadServlet?filename=openfire%2Fopenfire_3.6.4_all.deb” so you need to do a:
mv downloadServlet?filename=openfire%2Fopenfire_3.6.4_all.deb openfire_3.6.4_all.deb

dpkg -i openfire_3.6.4_all.deb
Browse to: http://yourhost.com:9090 it can also be http://ipaddresshere:9090

*Note: http://yourhost.com:9091 ← Secure Chat Channel

I think you get an “installation” page and you don’t have to logon the first time you hit that URL, it’ll walk you through the configuration upon first use, creating username and password, etc.

*Note: PhpMyAdmin Page URL: http://yourhost.com/phpmyadmin or http://ipaddresshere/phpmyadmin

Username:   root

Password:  Whatever_you_specified_at_setup_of_MySQL

*Note worthy:

Plugins directory for OpenFire on Ubuntu: /usr/share/openfire

Installing Red5 Plugin:

Site: http://www.igniterealtime.org/projects/openfire/plugins-beta.jsp

cd /usr/share/openfire/plugins

wget http://www.igniterealtime.org/projects/openfire/plugins-beta/red5.war

/etc/init.d/openfire restart

That should have downloaded the red5.war file and restarted openfire which THEN creates a “red5” directory in your plugins folder, the “red5” directory in the plugins folder will NOT be there until you do the above steps.

Red5 URL: http://yourhost.com:7070/red5/red5.html or http://ipaddress:7070/red5/red5.html

You can now login to your OpenFire Chat Server and navigate to the plugins directory, there you’ll see red5 in the list!

http://yourhost.com:9090/plugin-admin.jsp

Navigate to & configure your options for the red5 plugin:

http://yourhost.com:9090/plugins/red5/conf?action=display

Here’s the “sparkweb” page WITH Red5:

http://yourhost.com:7070/red5/sparkweb/index.html

Here’s the “sparkweb” page WITHOUT Red5:

http://yourhost.com:9090/login.jsp

Lastly!  Here’s where you can find the red5-plugin for the SPARK Chat Client:  /usr/share/openfire/plugins/red5/spark/red5-plugin.jar – just drop it in the plugins folder “C:\Program Files\Spark\plugins”, restart SPARK.

One of the ONLY bummers is the “video” on the web chat interface is tiny, I haven’t yet played with it enough to see if there are any options to make the video larger so it’s actually useful.  You can use the Red5 server for a lot of things not just OpenFire Chat.

Pidgin IM Settings for OpenFire

Here are my settings for Pidgin that worked over a secure connection.

Basic Tab:

Username: Pretty straight forward one :p

Domain: This must be the name of your chat server (mine was “chat”)

Resource: I left that blank

Password: Again; pretty straight forward :p

* Remember password, warning – it’s saved in an XML file in plain text

Advanced Tab:

Connection Security: Ese encryption if available (note that if you mandate this setting it doesn’t work but if it’s “optional” it will choose to use the secure connection over the non secured one if you have port 5223 open to your chat server).  After setting this I then went back and made it mandatory, not sure if setting it mandatory by default will work so let me know!  :)

Connection port: 5222 (5223 didn’t work even though I confirmed the port is open)

Connect server: Whatever yours is, maybe an IP (10.0.0.200) or maybe a FQDN like chat.imawesome.net.  * I recommend using the FQDN in case you change IP’s you don’t have to mess around.

Proxy Tab:

Proxy type: No Proxy

Once you get all those settings in you’re golden!  This is only if you want to use Pidgin IM as a chat client.  If you’re going to use the web chat feature with “fastpath” you need to have the spark chat client (which is actually pretty nice!).

Much of the content for this post comes from a post by “zcat” on fadorasolved.org in 2008.

I’ve only had to do this on CentOS so if you have any pointers for Ubuntu let me know.  I don’t happen to have any externally facing Ubuntu SSH servers to lock down at the moment :P

You can run these commands to see interesting data on sshd information:
Top 5 most recently attacked accounts:
lastb | awk ‘{print $1}’ | sort | uniq -c | sort -rn | head -5

Top 5 most attacked accounts:
awk ‘gsub(“.*sshd.*Failed password for (invalid user )?”, “”) {print $1}’ /var/log/secure* | sort | uniq -c | sort -rn | head -5

* Ubuntu’s log is /var/log/auth.log so change “/var/log/secure*” to “/var/log/auth*”

Top 5 attacker IP addresses:
awk ‘gsub(“.*sshd.*Failed password for (invalid user )?”, “”) {print $3}’ /var/log/secure* | sort | uniq -c | sort -rn | head -5

* Ubuntu’s log is /var/log/auth.log so change “/var/log/secure*” to “/var/log/auth*”

Thanks to the above commands you can see how desperately you need DenyHosts!  Here’s their homepage (–> link) and the author of DenyHosts is LOOKING FOR A JOB and you’d be NUTS to pass up on that talent!  On the SourceForge page they have newer versions, I haven’t installed the newer version yet because the version I installed below works well on CentOS 5.5 Final.

Download denyhosts:
wget http://centos.karan.org/el4/extras/stable/i386/RPMS/denyhosts-2.5-1.el4.kb.noarch.rpm

Install denyhosts:
rpm -i denyhosts-2.5-1.el4.kb.noarch.rpm

Turn denyhosts “on”:
/sbin/chkconfig denyhosts on

Edit your configuration file – modify as per your requirements:
nano /etc/denyhosts.conf

* Issues with some OS’s here’s what you need to do if you get this error: ImportError: No module named DenyHosts.python_version
* You need to find out how many python packages you have but if you DON’T CARE just run the below command
mv /usr/lib/python2.3/site-packages/DenyHosts /usr/lib/python2.4/site-packages/DenyHosts

Now start denyhosts *warning* this can take a while as denyhosts seems to search through your log files and depending on how you configured it; it’ll add all the offenders to the list which is great!

/sbin/service denyhosts start

Done!

* Update here for installing denyhosts on CentOS 6 *

Open a command prompt and add the EPL repository by typing:

su -c ‘rpm -Uvh http://download.fedoraproject.org/pub/epel/6/i386/epel-release-6-5.noarch.rpm’

yum install -y denyhosts

* Reference – I used “For EL6”: http://fedoraproject.org/wiki/EPEL/FAQ#How_can_I_install_the_packages_from_the_EPEL_software_repository.3F

I am posting what might seem “trivial” information sometimes but believe it or not some people need the help AND I often use my own site as a source of documentation so if you’re wondering how to install Flash Player 10 on Ubuntu here’s all you need to know…

1. Open a terminal / command shell
2. Type:  sudo -i
3. Type in your password, this will get you root access
4. Type in:  wget http://fpdownload.macromedia.com/get/flashplayer/current/install_flash_player_10_linux.deb
5. Type in:  dpkg -i install_flash_player_10_linux.deb

Open your web browser to this link and see the fruits of your labor.

Click here –> Test Flash Version

Now you can play Mafia Wars or Farmville to your hearts content on your Ubuntu install ;)