Erudite Relics of Loc Huu Ho

The central idea of this poem is that success comes from self-control and a true sense of the values of things. In extremes lies danger. A man must not lose heart because of doubts or opposition, yet he must do his best to see the grounds for both. He must not be deceived into thinking either triumph or disaster final; he must use each wisely–and push on. In all things he must hold to the golden mean. If he does, he will own the world, and even better, for his personal reward he will attain the full stature of manhood.

If you can keep your head when all about you
Are losing theirs and blaming it on you,
If you can trust yourself when all men doubt you,
But make allowance for their doubting too;
If you can wait and not be tired by waiting,
Or being lied about, don’t deal in lies,
Or being hated don’t give way to hating,
And yet don’t look too good, nor talk too wise:

If you can dream–and not make dreams your master;
If you can think–and not make thoughts your aim,
If you can meet with Triumph and Disaster
And treat those two imposters just the same;
If you can bear to hear the truth you’ve spoken
Twisted by knaves to make a trap for fools,
Or watch the things you gave your life to, broken,
And stoop and build ‘em up with worn-out tools:

If you can make one heap of all your winnings
And risk it on one turn of pitch-and-toss,
And lose, and start again at your beginnings
And never breathe a word about your loss;
If you can force your heart and nerve and sinew
To serve your turn long after they are gone,
And so hold on when there is nothing in you
Except the Will which says to them; “Hold on!”

If you can talk with crowds and keep your virtue,
Or walk with Kings–nor lose the common touch,
If neither foes nor loving friends can hurt you,
If all men count with you, but none too much;
If you can fill the unforgiving minute
With sixty seconds’ worth of distance run,
Yours is the Earth and everything that’s in it,
And–which is more–you’ll be a Man, my son!

Rudyard Kipling.

From “Rudyard Kipling’s Verse, 1885-1918.”

The three essentials of the English language are: Purity, Perspicuity and Precision.

By Purity is signified the use of good English. It precludes the use of all slang words, vulgar phrases, obsolete terms, foreign idioms, ambiguous expressions or any ungrammatical language whatsoever. Neither does it sanction the use of any newly coined word until such word is adopted by the best writers and speakers.

Perspicuity demands the clearest expression of thought conveyed in unequivocal language, so that there may be no misunderstanding whatever of the thought or idea the speaker or writer wishes to convey. All ambiguous words, words of double meaning and words that might possibly be construed in a sense different from that intended, are strictly forbidden. Perspicuity requires a style at once clear and comprehensive and entirely free from pomp and pedantry and affectation or any straining after effect.

Precision requires concise and exact expression, free from redundancy and tautology, a style terse and clear and simple enough to enable the hearer or reader to comprehend immediately the meaning of the speaker or writer. It forbids, on the one hand, all long and involved sentences, and, on the other, those that are too short and abrupt. Its object is to strike the golden mean in such a way as to rivet the attention of the hearer or reader on the words uttered or written.

What are the qualities of ideal manhood? Various people have given various answers to this question. Here the poet states what qualities he thinks indispensable.

Four things a man must learn to do
If he would make his record true:
To think without confusion clearly;
To love his fellow-men sincerely;
To act from honest motives purely;
To trust in God and Heaven securely.

Henry Van Dyke.

From “Collected Poems.”

Original Document Here

How to install and configure Linux as a Web server? What are the main steps to go? This article should cover the main configuration steps for LAMP – Linux Apache MySQL PHP server.

1. Which Linux distribution to install?
2. Before installation
3. Partitioning
4. Package selection
5. Set runlevel to 3
6. Turn off needless services
7. Firewall
8. Forbid ssh access for root

1. Which Linux distribution to install?
List of Linux distributions are huge, please see Linux distribution list (after page load, click on Go button). Among that list, there exists several main Linux distributions (streams): RedHat, Debian, Suse, Ubuntu

Original Document Here

WHM

Step one was to login to Web Host Manager (the server management front-end for cPanel), and run their configuration wizard. The only things that required non-default action were:

• setting the hostname
• added a resolver (DNS) server ip

After the wizard was complete, these additional settings were performed manually:

• Server Contact E-Mail
• Turned on awstats web stats reporting tool
• Changed hostname. (Even though the wizard set it, this was an additional, different place.)
• Changed system mail preferences to send root email to an admin alias.
• Changed root password.
• Set Nameservers

Also ran Update Server Software and Update System Software within WHM to update as many components as reasonable.

Linux Kernel

The original configuration as delivered by the server farm:

WHM 10.1.0 cPanel 10.2.0-R82
RedHat Enterprise 3 i686 – WHM X v3.1.0
Linux kernel version: 2.4.21-27.ELsmp

Since that’s not the latest kernel at the time of delivery, and cPanel will not update the kernel automatically, I was advised to update. I upgraded the kernel to 2.4.21-32.0.1.ELsmp, which went smoothly.

Remote Access

One of the areas for almost immediate security tweaking is remote access. If you’ve ever examined a server’s logs, you know that they’re regularly probed with various types of attacks. There are several modifications to render those attacks pointless, as well as secure remote access in general.

SSH

SSH, or secure shell, is the remote command-line access mechanism of choice. It’s single biggest claim to fame is simply that everything is encrypted, though it includes many more features as well.

I first created a couple of non-root login accounts, and installed RSA public keys for eventual RSA/public key-only logins. (Also created end-user instructions for creating, and using, SSH key pairs.)

I then made the following changes to /etc/ssh/sshd_config:

• Protocol 2 – this disables protocol version 1, which is known to have security issues.
• PermitRootLogin without-password – this disables root login, unless a public key is used.
• PasswordAuthentication set to no – this disables the ability to login with just a username and password. A username and public key are required.

Telnet

I disabled telnet, as it allows passwords to be transmitted in the clear, and is a known security risk.

FTP

Normally at this point I would also disable the FTP service for the same reasons as Telnet – it’s a known security risk. For reasons I didn’t bother to investigate further, cPanel either complained repeatedly via email if the service was stopped, or it would restart it, depending on the technique I was attempting to use. I gave up on this and left the FTP service running, but blocked at the firewall, discussed below.

TMP

The /tmp directory is an interesting and apparently common place for hackers to exploit to breech a system. One approach to securing it without breaking its functionality is to create it as a new partition that disallows program execution. Where in the past a hacker could use an exploit to place a file in /tmp and then execute it, the ability to execute is now removed by creating a secure /tmp partition.

Firewall

Installed APF which is, essentially, an intelligent front end to the built in Linux firewall, iptables. I found a good how-to, though I did not yet configure the antidos (denial of service) component. The one change that I did make to the default configuration is that I disabled or blocked all ports that we know are not explicitly used for something specific. For example, this is where I blocked all FTP access. I also whitelisted my own static IP address, and that of the client.

Logging

Logwatch is a server log summary tool that emails a report to the server admins nightly. An older version was installed. I updated to latest, and increased the reporting level to “medium”.

Rootkit Checks

Installed nightly backup script, which includes nightly reporting of both rkhunter and chkrootkit runs.

Apache

Installed mod_security, which guards against exploits via the Apache web server, using a basic ruleset. This how to was helpful in setting that up.

General

A few additional tweaks and settings …

• Installed LES – “LES is intended as a facility to quickly & easily secure Redhat/RPM based environments (i.e: turbo Linux, open Linux). It does such by enforcing root-only permissions on system binaries (binaries that have no place being executed by normal users), enforcing root-only path traversal on system paths, enforcing immutable bit on essential rpm package contents (i.e: coreutils), and enforcing immutable bit on shell profile scripts.”
• Added a mail line to /etc/rc.d/rc.local, to automatically notify on reboots.
• Removed the cpbackup cron job, since we don’t use cPanel’s backup approach.
• Modified reverse-DNS to be correct.

Ongoing Maintenance

Even with all the tools and updates in place, there’s still on-going work and vigilance required.

• Monitor the nightly logs and reports generated for anomalies.
• Manually install updates as reported available by up2date.
• Monitor Redhat for kernel updates, and install as appropriate.
• Monitor chkrootkit for updates, and install as appropriate.

Still More Options

I haven’t implemented these, but they’ve been recommended, and they’re on the list to evaluate at some point.

• mod_doevasive. “mod_dosevasive is an evasive maneuvers module for Apache to provide evasive action in the event of an HTTP DoS or DDoS attack or brute force attack. It is also designed to be a detection and network management tool, and can be easily configured to talk to ipchains, firewalls, routers, and etcetera. mod_dosevasive presently reports abuses via email and syslog facilities.” How To
• Evaluate BFD. “BFD is a modular shell script for parsing applicable logs and checking for authentication failures.”