DDoS is an attack on a computer/server or its resources and thereby making it unavailable to intended users.

1. Trinoo
2. TFN
3. TFN2K
4. ...]]> DDoS – Distributed Denial Of Service  Wiki : http://en.wikipedia.org/wiki/Denial-of-service_attack

   DDoS is an attack on a computer/server or its resources and thereby making it unavailable to intended users.

   Web-hosts must be familiar with this term and will be a victim at-least once. The intention of this post is to give  a brief description about DDoS, its prevention and cure if effected. Please note that this will not server as a perfect guide to the mentioned “Subject-line”, but a “tip-note”.

   Understanding DDoS:

   The four commonly used programs used by attackers to launch DDoS attacks are

   1. Trinoo
   2. TFN
   3. TFN2K
   4. Stacheldraht

   Symptoms of DDos:

   1. Unusually slow network performance (opening files or accessing web sites)
   2. Unavailability of a particular web site
   3. Inability to access any web site
   4. Dramatic increase in the number of spam emails received—(this type of DoS attack is considered an e-mail bomb)
   5. Packet loss for pings to IP/Domain

   How DDoS is done:

   

   Pictorial representation of Stacheldraht DDoS attack.

   In Stacheldraht DDoS attack, the attacker uses a client program to connect handlers which is a set of compromised machines that issues commands to the agents which in-turn facilitate the DDoS attack. The agents are another set of machines which is compromised using handlers by the attacker. Each handler can control thousands of agents  and all these widely distributed agents floods the target server and thereby increasing the impact of attack.

   DoS and DDoS are not the same:

   If the attacker initiates an attack from a single host, it is classified as a DoS  as it is not ‘distributed’. In fact, any attack against availability would be classed as a Denial of Service attack. On the other hand, if an attacker uses a thousand systems to simultaneously launch smurf attacks against a remote host, this would be classified as a DDoS attack.

   Then what is DRDoS? DRDoS is Distributed Refected Denial of Service. These attacks forge the source address of the IP packets with the victim’s IP and send pings/packets to intermediate hosts. When the intermediate sends back the reply to these pings , it is sent to the victims IP thereby flooding the victim.

   

   Some other types/methods of DDoS/DRDoS/Dos attacks are :

   Reflective ICMP attack: The reflective ICMP attack uses public sites like google.com that responds to ICMP ping requests to that of victims IP. The attacker spoofs the victims IP and send requests to the Public servers which will then reply to the actual IP.

   TCP SYN flood attack : The attacker sends a packet with SYS bit set of the well known TCP three way handshake. The victim responds to the request by sendong a reply packet with SYN_ACK bit set, but the attackr never responds and thereby increasing the TCP receive queues and denying new TCP connetions. But modern  UNIX and Windows fixed this by increasing the queue qize and limited the number of TCP SYS packets allowed.

   UDP attacks : The UDP is one of the most effective way of DDos/DoS attacks. UDP is a stateless protocol and does not have any acknowledgement mechanism by design. PROTOS,the SNMP test suite, and other SNMP tools have been used successfully to launch application level DoS attacks. The Slammer worm was extremely fast because it did not require a response from the compromised computer.

   TTL Expiration : The attacker forges the victims IP and send packets with low TTL set to it so that it will expire in the transmit at high speed router. When the TTL reaches zero, the router drops the packet and sends an ICMP TTL expired message to the source address, ie the Victim IP. This attack could be lowered by rate limiting ICMP to all routers in the service provider’s network.

   Permanent DoS attacks (PDoS) :  PDoS is an attack that damages the system so badly that it needs the hardware to be replaced or reinstalled. The PDoS is purely a hardware targeted attack in which the attacker modifies the devide fireware by the legitimate method caled flashing. The attacker replaces the hardware firmware with his own modified version which will make the device unstable and render it from the original purpose for which it is made or designed for. The is done by exploiting the hardware security flaws which will allow remote administration of devices such as routers, printers and other networking hardwares.

   Degradation Of Service Attacks : The compromised computers are used by the atackers to launch short-lived flooding on victims website which will slow down the website rather than crashing it. This is degradation of service rather than deniel of service and is more seriver than DoS as this is pretty difficult to detect and resolve.

   Un-intentional Denial Of Services :  Sudden spike in popularity for a website is the major cause for this. This happens when an extremely popular wesite posts a link to a second site as a part of referrence for news or article. This will lead significant increase in traffic to the secondary website which will result in crashing or server/services. An example for this hapened when Michael Jackson died in 2009 which took down sites like Google and Twitter. (In this case you cant just blame someone )

   Blind Denial Of Service : In Blind Deniel of Service, the attacker must be able to receive traffic from the victim, then the attacker must either subvert the routing fabric or use the attacker’s own IP address. Either provides an opportunity for the victim to track the attacker and/or filter out his traffic. With a blind attack the attacker uses a forged IP addresses, making it extremely difficult for the victim to filter out those packets. The TCP SYN flood attack is an example of a blind attack. Designers should make every attempt possible to prevent blind denial of service attacks.

   Tweet This Post

   ]]> http://www.supportsages.com/blog/2010/12/ddos-prevention-cure-part-1/feed/ 0 http://www.supportsages.com/blog/2010/10/setup-google-apps-on-your-domain-with-cpanel-and-create-upto-50-custom-email-accounts-for-free-%e2%80%93-part-2/ http://www.supportsages.com/blog/2010/10/setup-google-apps-on-your-domain-with-cpanel-and-create-upto-50-custom-email-accounts-for-free-%e2%80%93-part-2/#comments Fri, 22 Oct 2010 11:27:39 +0000 Bruce http://www.supportsages.com/blog/?p=1421 Step V : Setting Up Your E-mail Server. The next step is to set up the URL you want to use to access Webmail. In most cases, this is either webmail.example.com or simply mail.example.com. To make this change, click on the 'Service Settings' tab in the top menu of the dashboard. Then, click 'Email'. From there, specify that you want to use a custom URL, and enter the appropriate subdomain for your domain. Submit that form, and Google will then provide you with information about adding a CNAME entry for your ...]]> Step V : Setting Up Your E-mail Server.

   The next step is to set up the URL you want to use to access Webmail. In most cases, this is either webmail.example.com or simply mail.example.com. To make this change, click on the ‘Service Settings‘ tab in the top menu of the dashboard. Then, click ‘Email‘. From there, specify that you want to use a custom URL, and enter the appropriate subdomain for your domain.

   

   Submit that form, and Google will then provide you with information about adding a CNAME entry for your new subdomain. You should make corresponding entries in the DNS zone to implement this. For example if the URL with which you wish to access your mail is webmail.example.com then you must give a CNAME record ‘ ghs.google.com. ‘ in the DNS zone for webmail. This is shown below :

   

   Step VI : MX Record Changes

   Once you have finished creating all of the users, you can return to the dashboard and click ‘Activate email‘  and follow the MX change instructions provided by Google. If you are lucky enough to use one of the hosts included in the dropdown menu there, you should be able to get clear, specific instructions explaining how to make the changes in your domains control panel.

   Google will have you add seven new MX records to your DNS zone file. Those entries will probably look like:

   MX Server address                                  Priority

   ASPMX.L.GOOGLE.COM.                 10
   ALT1.ASPMX.L.GOOGLE.COM.       20
   ALT2.ASPMX.L.GOOGLE.COM.       20
   ASPMX2.GOOGLEMAIL.COM.         30
   ASPMX3.GOOGLEMAIL.COM.         30
   ASPMX4.GOOGLEMAIL.COM.         30
   ASPMX5.GOOGLEMAIL.COM.         30

   It’s important that you copy and paste those addresses exactly as they appear in the Google instructions. They all include dots at the end of the addresses, and that dots need to be included. I am attaching a screenshot below which will hopefully give you an idea on how it should be entered.

   

   Your new entries will need to look similar to:

   your-domain.com    14400    IN    MX    10    ASPMX.L.GOOGLE.COM.

   Where your-domain.com is your domain name, the second spot is the TTL or Time To Live (which can be left blank if required), the word ‘IN‘ is in the third spot, the fourth spot is filled with ‘MX‘ , the fifth spot is the ‘Priority‘ and the last spot includes the address provided by Google.

   Also, in most of the cases you can only add four or five entries to the zone file at a time, so you’ll have to add this first, save the file, and then add the rest.
   Once you’ve made those changes, click the  ‘I’ve made these changes‘ button in the Google Apps window.
   Finally you can return to dashboard and click on the ‘Activate email‘ tab which you will find right below the ‘Email‘ option. See below :

   

   The last and most difficult Step : Waiting.

   At this point, you’re pretty much done. You now simply have to wait because It can take anywhere from one hour to 48 hours before the changes are complete.

   Once the changes have completed, though, you can set up your e-mail client (Outlook, Thunderbird etc.) to check your e-mail. The Gmail IMAP settings are fairly simple. They are as follows:

   IMAP (incoming) mail:
   Server: imap.gmail.com
   Port: 993
   Encryption: SSL

   SMTP (outgoing) mail:
   Server: smtp.gmail.com
   Port: 465 or 587
   Encryption: TLS

   ***********************************************************************************************************

   Tweet This Post

   ]]> http://www.supportsages.com/blog/2010/10/setup-google-apps-on-your-domain-with-cpanel-and-create-upto-50-custom-email-accounts-for-free-%e2%80%93-part-2/feed/ 0 http://www.supportsages.com/blog/2010/10/setup-google-apps-on-your-domain-with-cpanel-and-create-upto-50-custom-email-accounts-for-free-part-1/ http://www.supportsages.com/blog/2010/10/setup-google-apps-on-your-domain-with-cpanel-and-create-upto-50-custom-email-accounts-for-free-part-1/#comments Fri, 22 Oct 2010 10:43:59 +0000 Bruce http://www.supportsages.com/blog/?p=1367 This article is on how to setup Google Apps to work on your domain with 6 easy steps. When you purchase a domain (e.g. your-domain.com) for your website from any of the domain registrars such as Godaddy , you normally get a single free email account that includes limited storage space. This is where Google apps comes in for your rescue. By using this feature, provided to you by Google, you can use Google mail servers for transferring your mails and that too from your very own domains. The advantages are plenty, as we all know Gmail has proven over the years that it provides the most reliable e-mail service. How many times have you moved your domain to a new server and been frustrated by the fact that you lost all of your e-mail messages? If you switch over to Google Apps, you never have to worry about that again. Again the service and support provided by google is without doubt the best and uncomparable with your hosting companie’s or your service provider’s. Another advantage is that the server limits of your account will not affect the number of mails that you can sent or recieve if you use the Google apps. I have only mentioned a few above but the list goes on and on.

   The praises can be sung without a pause but its better I stop the boasts here and get down to the original topic.  I’m going to explain, step-by-step, on how to accomplish this task. It’s actually very simple, but it might take quite some time depending on how good a techy you are. To begin with, head on over to Google and sign up for an account. I am siting the link below where you can do this :

   http://www.google.com/apps/intl/en/business/index.html

   

   In the above page click on the ‘ Apps Editions ‘ tab and you will be able to view different schemes they offer, from which you will be able to select the one which suits you the most. For most of us, the standard edition offered by Google is more than enough. However, they do offer a “Premier edition” if your needs exceed the services of the free accounts. In addition to the Standard edition and Premier edition there are  Educational schemes, Govermental schemes etc etc. Once you choose the package required you will be directed to a page with a blue colored ‘ Get started ‘ tab on the right most top corner of the page. This is your key, click on it and you are on your way to setting Google apps for your domain. I am going to list  everything step by step from here on in a detailed manner.
   

   Step I : Tell them your registered Domain name.

   In the very first step you need to provide your domain name as prompted. Obviously enough you should possess a registered domain or you can buy a new domain name through Google which automatically sets everything up for you. You also need to verify that you own the domain or if you are a member of the domain.

   

   Step II : Tell them who you are.

   Fill in all of your contact information. At least make sure that you fill in all the boxes which have an aestrics symbol (*) to the right of the label with proper and valid information. If you don’t provide the required information, you will receive an error when you submit the form.
   An important thing that you should be absolutely sure of before filling up the form is that you are able to edit your server’s DNS zone files. If you cannot edit your DNS zone files, do not proceed. You will have to enter MX records pointing to the Google mail servers in your DNS configuration. Signing up for the Google Apps account is useless if you’re not going to be able to modify your server appropriately to have the e-mail go where it’s intended.

   

   The screenshot above was limited by my monitor boundaries, but you will be able to see the ‘ Continue ‘ tab at the bottom of your screen. Click this and you are on step III.
   

   Step III : Create your first administrator account.

   Create your first e-mail account. This e-mail account will be used as the administrative account for the Google Apps services.

   

   Below this you will be able to see the terms and conditions, which mostly contains the usual stuff but still worth a read, where you should click on the ‘ I accept. Continue with setup ‘ tab to proceed to the next step.

   Step IV : Verify Domain Ownership.

   The next step in the process is to prove to Google that you own and have administrative rights to the domain you chose.

   

   Here you will have an option to do it later, but sooner the better. Once you choose the option to continue you will be prompted for the password you chose in the previous step.
   You have three options to prove that you own the domain. The first option is to modify your DNS entries to add a unique CNAME record. Next option is to add a meta tag to your site’s home page.  The last option is to simply create and upload an HTML file to your Web server. Okay now there is no reason for you to panic from hearing all the complex terms, all you need to do is click on these options and viola, all the information you need on ‘How to’ gets detailed (or rather spoon fed) right on the screen.

   

   As you can see the screenshot above you will have a drop down menu for a list of domain registrars among which you can choose yours and do as instructed. Otherwise you can simply choose the ‘ Others ‘ option from the drop down menu and follow the simple set of instructions which gets listed.
   This will look somewhat like the following :

   <<

   A TXT record is an entry within the Domain Name System (DNS) that provides supplemental information about your domain. You can create a TXT record that proves to Google that you own the domain.

   1. Add the TXT record below to the DNS configuration for your-domain.com.
   google-site-verification=Zy5aERjpb4-T1S0Ig36pGuHDOE5MycRBGsVmCtVeTLY
   2. Click verify below.
   When Google finds this DNS TXT record, we’ll make you a verified owner of the domain. (Note: DNS changes may take some time. If we don’t find the record immediately, we’ll check for it periodically.)
   Leave the TXT record in place even after verification succeeds.

   >>
   

   For adding the TXT record in the DNS zone log into your domain control panel and choose the edit DNS zone option. The name of the option might vary between control panels, but they provide the same functionalities. I am pasting yet another screenshot which might help you through this simple process.

   NOTE : For the rest of the article I will be siting examples and providing screenshots only from, and in reference to, the cPanel. But it will not be difficult to figure out how it is done in other control panels once you get an idea on what we are doing here.

   

   You can see that I simply pasted the text mentioned in the instructions. After doing this you can click on ‘Verify‘ which will, quite obviously, verify if the entry is made and thereby confirming your authority over the domain.

   Tweet This Post

   ]]> http://www.supportsages.com/blog/2010/10/setup-google-apps-on-your-domain-with-cpanel-and-create-upto-50-custom-email-accounts-for-free-part-1/feed/ 0 http://www.supportsages.com/blog/2010/10/ruby-gems-not-getting-updated/ http://www.supportsages.com/blog/2010/10/ruby-gems-not-getting-updated/#comments Fri, 22 Oct 2010 10:42:03 +0000 George http://www.supportsages.com/blog/?p=1425 gem update --system Updating RubyGems... ERROR: While executing gem ... (Gem::RemoteSourceException) HTTP Response 302 fetching http://gems.rubyforge.org/yaml Solution was to specify another source as below, which was the 302 redirection of http://gems.rubyforge.org/yaml . May be gem now handles the 302 redirection properly. [bash]gem install rubygems-update --source http://production.s3.rubygems.org/ [/bash] followed by the gem update itself. [bash]sudo gem update --system --source http://production.s3.rubygems.org/[/bash] To add the source permanently, use the command below ...]]> On a cPanel server, I ran /scripts/installruby which updated the ruby version from 1.8.6 to 1.8.7

   ruby -v
   ruby 1.8.7 (2009-06-08 patchlevel 173) [i686-linux]

   But when updating the gems and the gem itself, we were getting error as below,

   
gem update --system
Updating RubyGems...
ERROR: While executing gem ... (Gem::RemoteSourceException)
HTTP Response 302 fetching http://gems.rubyforge.org/yaml


   Solution was to specify another source as below, which was the 302 redirection of http://gems.rubyforge.org/yaml . May be gem now handles the 302 redirection properly.

   gem install rubygems-update --source http://production.s3.rubygems.org/ 

   followed by the gem update itself.

   sudo gem update --system --source http://production.s3.rubygems.org/

   To add the source permanently, use the command below and for more help

   gem help sources

   gem sources -a http://production.s3.rubygems.org/

   Tweet This Post

   ]]> http://www.supportsages.com/blog/2010/10/ruby-gems-not-getting-updated/feed/ 1 http://www.supportsages.com/blog/2010/09/ifs/ http://www.supportsages.com/blog/2010/09/ifs/#comments Thu, 02 Sep 2010 18:51:19 +0000 victor http://www.supportsages.com/blog/?p=1236 How many times have you written scripts and a had bad time with those having spaces? The remedy to this situation is your IFS value.

   IFS or Internal Field Seperator holds the value which seperates the various entities. This can be file names, values read into a script by read etc. It is the character or characters designated as whitespace by the operating system.

   The IFS is set to the newline and space character. The global variable $IFS stores the value. To view the exact value stored in IFS execute:

   echo "$IFS" | cat -vTE
    ^I$
   $
   

   Running echo “$IFS” will not give you any visible output (after all, you are going to see a space and a newline). cat -vTE displays non printable characters , tabs as ^I and ends each line with a $ sign.

   In a script which utilises filenames (with spaces), it is always preferable to change the IFS to include only the newline character opposed to the default space and newline character. Lets check out one such script which accepts filenames wih spaces. This scripts simply prints the file names in your current directory. (Remember to create some files in your currenct directory which has spaces. You may try the same script removing the lines with the IFS variable in reference to see the difference)

   #!/bin/bash
   OIFS=$IFS # Original IFS
   
   IFS=$(echo -en "\n\b") # New IFS
   
   for fil in $(ls -1 $PWD); do
   	echo $fil
   done
   
   IFS=$OIFS # Restore earlier IFS
   

   IFS can also be used to read files with lines sepearated by a special character. For example in the /etc/passwd, to store the various entries like username, homedirectory etc.

   The following script uses the while construct to determine the users who have the shell portion as /bin/false

   #!/bin/bash
   
   OIFS=$IFS
   IFS=':'
   
   while read username password userid groupid comments homedir shell_avail
   do
   	if [[ $shell_avail == /bin/false ]]; then
                   echo "$username has no shell"
           fi
   
   done < /etc/passwd
   IFS=$OIFS
   

   In the above script each of the 7 portions of the /etc/passwd file is assigned to the 7 variables
   username password userid groupid comments homedir shell_avail with the read command. The if portion in the script compares the seventh variable – shell_avail to /bin/false to determine the username and outputs it.

   From now on you can use the IFS variable for all those files with spaces and extracting values separated by a special character.

   Tweet This Post

   ]]> http://www.supportsages.com/blog/2010/09/ifs/feed/ 0 http://www.supportsages.com/blog/2010/08/error-while-installing-magento-blue-theme/ http://www.supportsages.com/blog/2010/08/error-while-installing-magento-blue-theme/#comments Thu, 26 Aug 2010 09:37:30 +0000 Fabian http://www.supportsages.com/blog/?p=1220 Interface_Frontend_Default correct version [bash]./pear install magento-core/Interface_Frontend_Default[/bash] And then the Blue theme [bash]./pear install magento-core/Interface_Frontend_Default_Default_Blue[/bash] You can get help for pear command by executing [bash]pear help ...]]> We used to get tickets complaining that the customers are not able to install Magento Blue theme via Magento Connect. When you try to install you may get the below error.

   ERROR:
   Via magento connect
   magento-core/Interface_Frontend_Default_Default_Blue  requires package "magento-core/Interface_Frontend_Default" (version  >= 1.3.1, version <= 1.4.0, excluded versions: 1.4.0), installed  version is 1.4.0.0
   Install Errors
   No valid packages found
   PEAR  ERROR: install failed
   
   magento-core/Interface_Frontend_Default
   magento-core/Mage_Core_Modules

   To fix this, login to your account via SSH and navigate to the Magento installation folder and execute the below command.

   Install Interface_Frontend_Default correct version


   ./pear install magento-core/Interface_Frontend_Default

   And then the Blue theme

   ./pear install magento-core/Interface_Frontend_Default_Default_Blue

   You can get help for pear command by executing

   pear help 

   And to list Channels

   pear list-channels Registered Channel

   Tweet This Post

   ]]> http://www.supportsages.com/blog/2010/08/error-while-installing-magento-blue-theme/feed/ 0 http://www.supportsages.com/blog/2010/08/postgresql-for-the-sage-must-know-basics-for-the-system-administrators/ http://www.supportsages.com/blog/2010/08/postgresql-for-the-sage-must-know-basics-for-the-system-administrators/#comments Thu, 05 Aug 2010 16:24:44 +0000 victor http://www.supportsages.com/blog/?p=1144 Objects and Inheritance Database consists of objects and the database administrators can design custom or user-defined objects ...]]> PostgreSQL or Postgres is an object-relational database management system (ORDBMS). Unlike MySQL, PostgreSQL is not controlled by any single company, it is a community developed project. It is a advanced version of the ‘Ingres’ Database project (which is how the project gets the name post-ingres or postgres ).

   Postgres is one of the best open-source database alternative which is fully object oriented and transactions compliant. It has stored procedures, multiple views and a huge set of datatypes. Some of the other notable features are as follows.

   Objects and Inheritance

   Database consists of objects and the database administrators can design custom or user-defined objects for the tables. Inheritance is another feature. Tables can be set to inherit their characteristics from a “parent” table.

   Functions

   Functions can be used in Postgres. These can be written in the postgres’ own procedural language called ‘PL/pgSQL’ which resembles Oracle’s procedural language ‘PL/SQL’ or any other common scripting languages which support posgtres’ procedural language like PL/Perl, plPHP, PL/Python, PL/Ruby etc. Run the following in the psql client to determine if functions is enabled:

   SELECT true FROM pg_catalog.pg_language WHERE lanname = 'plpgsql'; 

   To create user-defined functions we use the CREATE OR REPLACE FUNCTION command. Example:

   CREATE OR REPLACE FUNCTION fib (
   
   fib_for integer
   
   ) RETURNS integer AS $$
   
   BEGIN
   
   IF fib_for < 2 THEN
   
   RETURN fib_for;
   
   END IF;
   
   RETURN fib(fib_for - 2) + fib(fib_for - 1);
   
   END;
   
   $$ LANGUAGE plpgsql;

   Indexes

   An index is like a summary of a certain portion of the table. It is an optimization technique which increases speed of accessing records from a database. PostgreSQL supports indexes like Btree, hash etc. User-defined index methods can also be created. Indexes are created on tables with respect to a particular field (based on which there are a number of queries). As an example for a table:

   CREATE TABLE name (
   
   id integer,
   
   fname varchar
   
   lname varchar
   
   );

   To create an index on table name with respective to the field id (as there are many queries on this table requesting for firstname or lastname from the id provided), we use the index:

   CREATE INDEX name_id_index ON name (id);

   Triggers

   Triggers are events or functions run upon the action of certain SQL statements which modify data in some records. Depending on the kind of modification we can have multiple triggers in a database. Postgres supports multiple triggers written in PL/PgSQL or it’s scripting counterparts like PL/Python. The trigger function must be defined before the trigger can be created. The trigger function must be declared as a function taking no arguments and returning type trigger. CREATE TRIGGER command is used to declare triggers.

   Concurrency

   PostgreSQL ensures concurrency with the help of MVCC (Multi-Version Concurrency Control), which gives the database user a “snapshot” of the database, allowing changes to be made without being visible to other users until a transaction is committed.

   PostgreSQL’s MVCC keeps all of the versions of the data together in the same partition in the same table. By identifying which rows were added by which transactions, which rows were deleted by which transactions, and which transactions have actually committed, it becomes a straightforward check to see which rows are visible for which transactions.

   Inorder to accomplish this, Rows of a table are stored in PostgreSQL as a tuple. Two fields of each tuple are xmin and xmax. Xmin is the transaction ID of the transaction that created the tuple. Xmax is the transaction ID of the transaction that deleted it (if any).

   Along with the tuples in each table, a record of each transaction and its current state (in progress, committed, aborted) is kept in a universal transaction log.

   When data in a table is selected, only those rows that are created and not destroyed are seen. That is, each row’s xmin is observed. If the xmin is a transaction that is in progress or aborted, then the row is invisible. If the xmin is a transaction that has committed, then the xmax is observed. If the xmax is a transaction that is in progress or aborted and not the current transaction, or if there is no xmax at all, then the row is seen. Otherwise, the row is considered as already deleted.

   Insertions are straightforward. The transaction that inserts the tuple simply creates it with the xmax blank and the xmin set to its transaction ID. Deletions are also straightforward. The tuple’s xmax is set to the current transaction. Updates are no more than a concurrent insert and delete.

   Views

   A view is a table which does not exist in the database. It is a virtual table created from fields in various tables and is joined together based on some criteria. Views can be used in place of tables and will accomplish the task same as that of a table. The CREATE VIEW statement is used to accomplish this eg:

   CREATE VIEW best_sellers AS
   
   SELECT * FROM publishers WHERE demand LIKE 'high';

   Foreign Keys

   The primary key used in one table which is used to refer to the records in a second table is called the foreign key of the second table.

   CREATE TABLE products (
       product_no integer PRIMARY KEY,
       name text,
       price numeric
   );
   CREATE TABLE orders (
       order_id integer PRIMARY KEY,
       product_no integer REFERENCES products (product_no),
       quantity integer
   );

   Here product_no is the foreign key in the second table created. The foreign key field may have values which are repeated unlike primary keys.

   Files Users and Configuration

   The main configuration file of Postgres is postgresql.conf. This can be located in the ‘data’ directory. It may be present either in /var/lib (/var/lib/pgsql/data/postgresql.conf) or /usr/local (/usr/local/pgsql/data/postgresql.conf). Temporary changes to the configurations can be made using postmaster command.

   The init script that starts the postgres service is /etc/init.d/postgresql . It runs a number of child processes concurrently. The postgres server process is postmaster. These processes and files associated with PosgreSQL are owned by the user/group postgres. The default port used for database connections is 5432

   The user postgres is the PostgreSQL database superuser. We can create a number of super users for the database (this accomplished by the create role command ), however, the default super user is postgres. The postgres user has the privilege to access all the databases and files in the server (Unless the user root is created in postgres as a superuser).

   Client Authentication is controlled by the file pg_hba.conf in the data directory, e.g., /var/lib/pgsql/data/pg_hba.conf. (HBA stands for host-based authentication.)

   Each record specifies a connection type, a client IP address range (if relevant for the connection type), a database name or names, and the authentication method to be used for connections matching these parameters.A record is typically in one of two forms:

   local database authentication-method [ authentication-option ]

   host database IP-address IP-mask authentication-method [ authentication-option ]

   local : This record pertains to connection attempts over Unix domain sockets.

   host : This record pertains to connection attempts over TCP/IP networks.

   database : Specifies the database that this record applies to. The value all specifies that it applies to all databases, while the value sameuser identifies the database with the same name as the connecting user.

   authentication methods

   trust: The connection is allowed unconditionally.

   reject: The connection is rejected unconditionally.

   password: The client is required to supply a password which is required to match the database password that was set up for the user.

   md5: Like the password method, but the password is sent over the wire encrypted using a simple challenge-response protocol.

   ident: This method uses the “Identification Protocol” as described in RFC 1413. It may be used to authenticate TCP/IP or Unix domain socket connections, but its reccomended use is for local connections only and not remote connections.

   Front-ends

   The minimalistic front-end for PostgreSQL is the psql command-line. It can be used to enter SQL queries directly, or execute them from a file. phpPgAdmin is a web-portal used for PostgreSQL administration written in PHP and based on the popular phpMyAdmin. Likewise pgAdmin is a graphical front-end administration tool for PostgreSQL, which has support on multiple platforms. The latest stable version of the same is pgAdmin III.

   Some administration related commands

   Command to login to psql database mydb as user myuser:

   psql -d mydb -U myuser

   Command to login to psql database mydb as user myuser on a different host myhost:

   psql -h myhost -d mydb -U myuser

   If the port the server runs is different we use -p [port number] . Upon entering the psql shell the prompt will show the database name currently being used. In the above example it will show

   mydb=> (if logged in as an ordinary user )

   mydb=# (if logged in as a super user like postgres)

   Create a PostgreSQL user

   There are two ways to create a postgres database user. The only user initially allowed to create users is postgres. So one has to switch to this user before creating other users with varying privileges.

   1. Creating the user in the shell prompt, with createuser command.

   switch to the postgres user with:

   su - postgres
   
   createuser tom
   
   Shall the new role be a superuser? (y/n) n
   
   Shall the new role be allowed to create databases? (y/n) y
   
   Shall the new role be allowed to create more new roles? (y/n) n

   2. Creating the user in the PSQL prompt, with CREATE USER command.

   switch to the postgres user with:

   su - postgres
   
   create user mary with password 'marypass';

   Creating and deleting a PostgreSQL Database

   There are two way to create databases.

   1. Creating database in the PSQL prompt, with createuser command.

   CREATE DATABASE db1 WITH OWNER tom;

   2. Creating database in the shell prompt, with createdb command.

   createdb db2 -O mary

   To delete an entire database from within the psql prompt do :

   DROP DATABASE db1;

   Determining execution time of a query

   Turn on timing with

   \timing

   Now execute the qery:

   SELECT * from db1.employees ;
   
   Time: 0.065 ms

   Calculate postgreSQL database size in disk

   SELECT pg_database_size('db1');

   to get the values in human readable format

   SELECT pg_size_pretty(pg_database_size('db1'));

   to calculate postgreSQL table size in disk

   SELECT pg_size_pretty(pg_total_relation_size(‘big_table’));

   Slash commands used in psql

   To list all slash commands and thier purpose. Login to psql and issue to the command \? . Some of the most commonly used slash commands are the following:

   List databases	\l
   System tables	\dS
   Types	\dT
   Functions	\df
   Operators	\do
   Aggregates	\da
   Users	\du
   Quit from psql	\q
   Connect to different database db2	\c db2
   Describe Table/index/view/sequence	\d

   The below can be used with a specific table/index/view name for description of the specific table/index/view

   Tables	\dt
   Indexes	\di
   Sequences	\ds
   Views	\dv

   Useful Bash commands

   Bash command to list all the postgresql databases:

   psql -l #This can be run as a unix user who is also a super user in postgresql

   Indirect bash command to list all the postgresl users:

   psql -c '\du' #-c is used to run an internal or sql command in psql shell

   Backing up and restoring databases

   To dump the database to an sql file use the bash command:

   pg_dump mydb > db.out

   To restore a database from an sql backup file (via bash)

   psql -d newdb -f backupdb.out
   
   or
   
   psql -f backupdb.out newdb

   (here the database newdb must be already created and the file backupdb.out must be present in the current directory)

   To take the backup of all the Postgres databases in the server:

   pg_dumpall > /var/lib/pgsql/backups/dumpall.sql

   (Only possible with the postgres or the database superuser )

   Resetting database user’s password

   To change the password for a database user (say ‘thomas’):

   ALTER USER thomas WITH PASSWORD 'newpassword';

   This same command can be used to reset the password for the postgresql super user postgres, but in this case, you will have to enable password less login for postgres user by adding the following line to the top of the file pg_hba.conf in the data directory of postgres. Once the password is reset this line can be removed:

   local	all	postgres	trust

   Next we issue the same command but for the user postgres

   ALTER USER postgres WITH PASSWORD 'newpassword';

   To create a super user via bash with multiple roles

   createuser -sPE mysuperuser

   Instead of this we can also use the below psql shell command:

   CREATE ROLE mysuperuser2 WITH SUPERUSER CREATEDB CREATEROLE LOGIN ENCRYPTED PASSWORD 'mysuperpass2';

   Physical database files in postgres

   The files in data/base are named by the oid (Object Identifier) of the database record in

   pg_database, like this:

   cd /var/lib/pgsql/data/base
   
   ls -l
   
   total 33
   
   drwx------ 22 postgres postgres 4096 Jul 23 20:06 ./
   
   drwx------ 11 postgres postgres 4096 Aug  1 05:59 ../
   
   drwx------  2 postgres postgres 4096 Jun 20 09:32 1/
   
   drwx------  2 postgres postgres 4096 Mar  3 13:36 10792/
   
   drwx------  2 postgres postgres 4096 Jun 20 15:09 10793/
   
   drwx------  2 postgres postgres 4096 May 27 01:40 16497/
   
   drwx------  2 postgres postgres 4096 May 27 01:40 16589/
   
   drwx------  2 postgres postgres 4096 Jun 20 10:28 16702/
   
   drwx------  2 postgres postgres 4096 May 27 01:40 16764/
   
   drwx------  2 postgres postgres 4096 May 27 01:40 16785/
   
   drwx------  2 postgres postgres 4096 Aug  1 04:37 16786/
   
   drwx------  2 postgres postgres 4096 Aug  1 04:36 19992/
   
   drwx------  2 postgres postgres 4096 May 27 01:40 19997/

   To obtain the oid, execute the following command in psql prompt

   postgres=# select oid,datname from pg_database order by oid;
   
      oid  |         datname
   
   ---------+--------------------------
   
   1 | template1
   
   10792 | template0
   
   10793 | postgres
   
   16497 | gadgetwi_Unable
   
   16589 | vimusicc_filehost
   
   16702 | personea_altissimo
   
   16764 | shopping_businessfinance
   
   16785 | ansonyi_wp2
   
   16786 | ansonyi_wp
   
   19992 | globook_PostgreSQL

   Tweet This Post

   ]]> http://www.supportsages.com/blog/2010/08/postgresql-for-the-sage-must-know-basics-for-the-system-administrators/feed/ 0 http://www.supportsages.com/blog/2010/07/all-about-ssl/ http://www.supportsages.com/blog/2010/07/all-about-ssl/#comments Wed, 07 Jul 2010 22:14:05 +0000 victor http://www.supportsages.com/blog/?p=962 SSL or Secure Sockets Layer (Notice the last s in sockets) is used to secure the communication over the internet. This technique was introduced by Netscape. It uses the RSA public key cryptography for encryption/decryption.

   In the protocol stack used in the internet. The SSL protocol runs above TCP/IP and below higher-level protocols such as HTTP or IMAP.

   The SSL protocol includes two sub-protocols:
   1) SSL record protocol
   2) SSL handshake protocol

   The SSL record protocol defines the format used to transmit data. The SSL handshake protocol involves using the SSL record protocol to exchange a series of messages between an SSL-enabled server and an SSL-enabled client when they first establish an SSL connection.

   Now SSL for the layman
   SSL basically creates an encrypted communication channel between the two parties involved in the communication. For a third person involved in the middle of this communication channel, the data seems to be garbled.

   Suppose Alice (A, the browser) wishes to communicate with Bob (B, the server) then the exact steps that takes place inorder to begin the encrypted communication are:

   1) A -> B hello
   Alice contacts Bob and requests for a private communication (request for an https link at port 443)

   2) B -> A Hi, I’m Bob, bobs-certificate
   Bob send back to Alice his certificate. A certificate authenticates that it is Bob who is actually communicating with Alice. It is like a unique ID card displayed.

   3) A -> B prove it
   Alice requests Bob to prove his identity.

   4) B -> A Alice, This Is bob { digest[Alice, This Is Bob] } bobs-private-key
   Bob sends back a message and its digest encrypted with his private key. This step can also be like sending a document with a digital signature (when you have Alice’s public key).

   5) A -> B ok bob, here is a secret {secret} bobs-public-key
   Alice sends back to Bob some secret. Usually a session key encrypted using Bob’s public key obtained from his certificate

   6) B -> A {some message,MAC}secret-key
   Next Bob generates a secret key from Alice’s secret (earlier step) and sends back to Alice the real message and its MAC encrypted with this secret key. This is actually the encrypted website.

   Terminologies

   Certificate
   This is actually bobs public key containing document which is digitally signed by a certificate issuer’s private key (like Verisign). In this process Verisign gets all the necessary documents to verify that Bob’s identity is correct and it gets Bob’s public key (and some other data like certificate expiry period, Bobs identity) and encrypts it with its own private key. Now Verisign’s public key comes built-in along with every browser (so that the browser can get bobs public key from within it).

   Digest
   Digest or more appropriately Message Digest is like a summary of the actual message or a portion of the message. The digest of a message is is unique for every unique message, it is a one way function such that obtaining the digest, it is never possible to recover the original message (This does not involve using any key in the process). Message Digest always appears with the original message. Upon reception of this Message and its digest at the receiver’s end, the receiver can once again calculate the digest from the original message and verify the integrity of the message.

   Digital signature
   Let Bob send a document to Alice which is digitally signed. For this Bob must have Alice’s public key and Alice must have Bob’s public key.Bob takes the document, encrypts it first with Alice’s public key and next with its own private key(Bob’s)

   B -> A [{message}alices-public-key ]bobs-public-key

   Session Key
   The only secret which is communicated using public key encryption is a session key. Now the session key is chosen from the ‘secret’ that the parties accept. the session key could be the secret itself or a portion of the secret or the result when the secret is passed through a previously agreed algorithm. The SSL encrypted communication does’t necessary have to be created using a public key encryption technique (This uses a lot of overhead, i.e. processing and time), it may be simple symmetric cypher(less overhead) using this session key once agreed upon. There are a variety of cypher suites available (IDEA Blow-fish RSA DES MD5 KEA) and both the parties may choose some encryption technique based on the protocol used (SSL1.0 SSL2.0 TLS etc)

   MAC
   MAC or Message Authentication Code is similar to the Message Digest we have discussed. It is used to verify the integrity of the Message.

   MAC := Digest[ some message, secret ]

   Files associated with SSL

   CSR
   CSR or Certificate Signing Request is a string of text generated by the server. This file is sent to the SSL vendor while purchasing an SSL. In the process of generating your CSR, you provide a number of details regarding the domain being registered. Excerpts of text from all these are taken to generate your private key. This private key is present only within the server and nowhere else. The content of the CSR basically contains the public key along with all the details you have used. You get this as domain.com.csr or domain_com.csr.

   CA bundle
   CA (Certificate Authority) bundle file is one which contains the public key of the Certificate Issuer (Like Verisign’s public key). Usually this is not required while installing the SSL and most browsers will have this detail in advance to decrypt the SSL certificate (the CRT file) from the server. You get this as domain.com.cabundle or domain_com.ca-bundle.

   CRT
   This is the actuall SSL certificate as obtained from the SSL vendor. It is a file (containing the public key of the domain secured with SSL and other details like the expiry date, owner information, address etc of the SSL) which is encrypted with the private key of the SSL vendor (Digitaly signed by the SSL vendor). You get this as domain.com.crt or domain_com.crt .

   Key file
   This is the file which holds your private key (strictly confidential material). The file will have the RSA private key as generated by your server software. You get this as customcardsplus.com.key or customcardsplus_com.key. This file is not usually send to your SSL vendor unlike the CSR. You get this as domain.com.key or domain_com.key .

   SSL in a cPanel server
   Any service can be secured in a communication channel which is encrypted with SSL. Each of this service on the encrypted channel will be on a different port. Some of them are as follows:

   service	normal	ssl
   http	80	443
   telnet	23	992
   imap	143/220	993
   pop	109/110	995
   smtp	25	465

   A domain served as a secure webpage will require a dedicated IP (in a shared environment). SSL protocol is designed to use IP-based mapping. SSL does not support host headers. Therefore, you should have a unique IP address assigned to your secure site. These pages are served from the port 443. Let us examine the configuration of such a website in the apache’s config file /usr/local/apache/conf/httpd.conf.

   Every website (in our example domain.com with username: doma) enabled with SSL has a unique set of directives in the VirtualHost section for the 443 port as:

   <VirtualHost 266.11.208.293:443\> Dedicated IP of the domain
   
   ServerName domain.com #Domain name secured with SSL
   ServerAlias www.domain.com
   
   DocumentRoot /home/doma/public_html
   
   ServerAdmin webmaster@domain.com
   UseCanonicalName off
   CustomLog /usr/local/apache/domlogs/domain.com combined
   
   CustomLog /usr/local/apache/domlogs/domain.com-bytes_log "%{%s}t %I .\n%{%s}t %O ."
   ScriptAlias /cgi-bin/ /home/doma/public_html/cgi-bin/
   SSLEngine on #This directive enables the SSL on this domain
   SSLCertificateFile /etc/ssl/certs/www.domain.com.crt #Location of CRT file
   SSLCertificateKeyFile /etc/ssl/private/www.doma.com.key #Location of Private key
   SSLCACertificateFile /etc/ssl/certs/www.domain.com.cabundle #Location of CAbundle file
   CustomLog /usr/local/apache/domlogs/domain.com-ssl_log combined #Log specific for the SSL served webpage
   SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
   
   <Directory "/home/doma/public_html/cgi-bin">
   SSLOptions +StdEnvVars #This directive will pass mod_ssl environment variables to the server scripts.
   </Directory>
   
   </VirtualHost>
   

   Some times the directive SSLCertificateChainFile is used in place of SSLCACertificateFile. The minimal addition you will have to make to enable SSL in your httpd.conf file is:

   <VirtualHost 192.168.0.1:443>
   DocumentRoot /var/www/html
   ServerName www.yourdomain.com
   SSLEngine on
   SSLCertificateFile /path/to/your_domain_name.crt
   SSLCertificateKeyFile /path/to/your_private.key
   SSLCertificateChainFile /path/to/DigiCertCA.crt
   </VirtualHost>
   

   There are two locations where you are likely to find the SSL related files in your cPanel server. Usually the crt, key and the ca bundle are present in the home directory of the user in /home/username/ssl/, if it was installed using the client’s cpanel. However if the WHM was used instead to install the same, you will find it in /etc/ssl/. In either of these locations you will find two directories: certs/ and private/. certs contain the crt and cabundle while the private contains the keys.

   Now you know how ssl works in your server, Any more questions? just comment!

   Tweet This Post

   ]]> http://www.supportsages.com/blog/2010/07/all-about-ssl/feed/ 1