Alexandro Silva: Palestras no VI WorkShop Seginfo e na Vale Security Conference

O Workshop SegInfo promovido pela Clavis Security ocorrerá dias 12 e 13 de agosto na Bolsa de Valores do Rio de Janeiro,e contará com a presença de grandes nomes do cenário de segurança da informação brasileiro como Anchises Morais (@anchisesbr), Nelson Brito (@nbrito), Rodrigo Rubira (@bsdaemon), Tony Rodrigues (@OctanesLabs) entre outros.

Neste evento estarei palestrando sobre segurança de servidores, hardening e demonstrando como proteger um servidor de forma simples e efetiva.

Em setembro estarei dividindo o palco com grandes nomes como Luiz Eduardo (@effffn), Wagner Elias (@welias), Andrew Cushman, entre outros na Vale Security Conference que ocorrerá nos dia 03 e 04 no Parque Tecnológico de São José dos Campos.

Nele apresentarei as principais falhas na implementação em ambientes JBoss, como corrigi-las e alguns pentests realizados em portais existentes na internet (#MEDO kkkkk)

Agradeço antecipadamente aos organizadores destes eventos por aceitarem meus papers e espero conhecê-los por lá.

Que venham H2HC 8, Ekoparty 2012 e YSTS 9 (2012) kkkkkkk.

Mônica Paz: Defesa de mestrado aborda softwares livres gráficos usados na Arquitetura

Acontecerá no dia 11/08/2011 (quinta) às 16:00h, a defesa de mestrado de Antonio Carlos de Sousa Brito pela Faculdade de Arquitetura da UFBA. O trabalho é intitulado "O SOFTWARE LIVRE GRÁFICO NA ARQUITETURA: uma experiência de avaliação” no qual são analisados o uso do Caduntun, Inkscape e do Blender nesta área.

A banca de Brito tem a seguinte composição: Prof. Dr. Antonio Pedro Alves de Carvalho  - (PPGAU/FAUFBA), Profª. Dra. Chirstina Araújo Paim Cardoso -  (FAUFBA) e Profª. Dra. Patrícia Lustosa Brito – (Escola Politécnica/UFBA).

O PSL-BA já havia conhecido parte do trabalho de Brito através do artigo compartilhado no site do coletivo com o título "Contribuições do III Encontro Nordestino e IV Festival de Software Livre da Bahia Para o Desenvolvimento do Estudo das Perspectivas de Utilização de Software CAD Livre na Prática de Projetos de Arquitetura".

Antonio Terceiro: Playing with JPEG quality and file size

This is probably no news at all for graphics/image processing experts, but its something I've just learnt myself  and I thought it would be fun to share.

I am writing a static HTML photo algum generator and was a little suspicious of the size of the generated JPEG images. I thought "well, these JPEGs should not be that large ..."

I did some quick research and found out that ImageMagick uses JPEG quality 92 by default and was curious how file size would vary as I changed the output quality.

Then I took an image and produced thumbnails for it with the "JPEG quality" parameter ranging from 1 to 100 to check 1) how the file size varies with quality and 2) how much quality actually makes any difference when viewing the images.

To generate the thumbnails with varying quality, I did the following:

$ for i in $(seq -f %03g 1 100); do convert -scale 640x480 -quality $i /path/to/original.jpg $i.jpg; echo $i; done

Then I generated a data file by calculating the size of each file with du and piping the results through sed and awk:

du -b [0-9]*.jpg | sed 's/.jpg//' | awk '{ print $2 " " $1 }'

The generated data file looks this, with JPEG quality in first column and file size in bytes in the second column:

001 20380
002 20383
003 20634
004 21106
[...]

Regarding to file size, it seems like between 1 and 50, file size grows sublinearly with quality. Beyond that, the curve reaches an inflection point and grows in a way that looks, if not exponentially, at least polynomially.

The above plot was produced in a R session that looked like this:

$ R

R version 2.13.1 (2011-07-08)
Copyright (C) 2011 The R Foundation for Statistical Computing
ISBN 3-900051-07-0
Platform: i486-pc-linux-gnu (32-bit)

R é um software livre e vem sem GARANTIA ALGUMA.
Você pode redistribuí-lo sob certas circunstâncias.
Digite 'license()' ou 'licence()' para detalhes de distribuição.

R é um projeto colaborativo com muitos contribuidores.
Digite 'contributors()' para obter mais informações e
'citation()' para saber como citar o R ou pacotes do R em publicações.

Digite 'demo()' para demonstrações, 'help()' para o sistema on-line de ajuda,
ou 'help.start()' para abrir o sistema de ajuda em HTML no seu navegador.
Digite 'q()' para sair do R.

> png()
> data <- read.table('points.dat')
> quality <- data[[1]]
> quality
  [1]   1   2   3   4   5   6   7   8   9  10  11  12  13  14  15  16  17  18
 [19]  19  20  21  22  23  24  25  26  27  28  29  30  31  32  33  34  35  36
 [37]  37  38  39  40  41  42  43  44  45  46  47  48  49  50  51  52  53  54
 [55]  55  56  57  58  59  60  61  62  63  64  65  66  67  68  69  70  71  72
 [73]  73  74  75  76  77  78  79  80  81  82  83  84  85  86  87  88  89  90
 [91]  91  92  93  94  95  96  97  98  99 100
> filesize <- data[[2]]
> filesize
  [1]  20380  20383  20634  21106  21551  22012  22469  22878  23323  23715
 [11]  24103  24494  24952  25327  25725  26127  26507  26886  27216  27550
 [21]  27917  28288  28627  28945  29271  29583  29919  30280  30516  30813
 [31]  31099  31367  31679  31873  32232  32538  32704  33072  33324  33443
 [41]  33860  34055  34253  34633  34804  35074  35216  35491  35871  35935
 [51]  36030  36443  36743  36898  37120  37382  37726  38077  38307  38581
 [61]  39002  39270  39700  39962  40388  40762  41086  41629  42062  42544
 [71]  43048  43392  44062  44824  45023  45682  46532  47347  47833  48701
 [81]  49612  50423  51694  52637  53635  55243  56340  58304  59709  62162
 [91]  64207  66273  70073  74617  79917  86745  94950 105680 128158 145937
> plot(quality, filesize, xlab = 'JPEG Quality', ylab = 'File size')
> 
Save workspace image? [y/n/c]: y

Looking at the actual generated thumbnails, somewhere after quality > 60 I stopped noticing the difference between increasing quality factors. Settling with a default quality of 75 seems to be good enough: the resulting static HTML algum generated from a folder with 82 pictures dropped from 12MB with the default ImageMagick quality factor to 6MB with quality 75, with very little perceivable image quality loss.

Alexandro Silva: Proteção contra portscans com Ossec HIDS e Portsentry

&lt;a href=&quot;http://blog.alexos.com.br/?p=2717&amp;amp;lang=pt-br&quot; title=&quot;Proteção contra portscans com Ossec HIDS e Portsentry&quot;&gt;&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;http://blog.alexos.com.br/wp-content/uploads/2011/08/network-security-scanning.jpg&quot;&gt;&lt;img class=&quot;alignright size-medium wp-image-2745&quot; title=&quot;Binary man&quot; src=&quot;http://blog.alexos.com.br/wp-content/uploads/2011/08/network-security-scanning-198x300.jpg&quot; height=&quot;300&quot; alt=&quot;&quot; width=&quot;198&quot; /&gt;&lt;/a&gt;O &lt;a href=&quot;http://www.ossec.net&quot;&gt;Ossec HIDS&lt;/a&gt; é sem sombra de dúvidas uma das maiores ferramentas de proteção de host, mas como nada é perfeito existe uma deficiência na detecção e bloqueio de portscans.&lt;/p&gt; &lt;p&gt;O próprio Daniel Cid, pai da criança, informou isso em resposta a um &lt;a href=&quot;http://www.mail-archive.com/ossec-list@googlegroups.com/msg00889.html&quot;&gt;questionamento&lt;/a&gt; sobre o assunto na &lt;a href=&quot;http://groups.google.com/group/ossec-list&quot;&gt;lista&lt;/a&gt; do Ossec. Vejo o trecho abaixo:&lt;/p&gt; &lt;blockquote&gt;&lt;p&gt;“Ossec by itself does not detect portscans. However, if you send your firewall&lt;br /&gt; logs to ossec it can detect portscans by analyzing your fw logs…”&lt;/p&gt;&lt;/blockquote&gt; &lt;p&gt;Para ajudar neste tarefa Daniel &lt;a href=&quot;http://www.ossec.net/wiki/Detecting_port_scan_with_Ossec_and_iplog&quot;&gt;indica&lt;/a&gt; o uso do &lt;a href=&quot;http://ojnk.sourceforge.net/&quot;&gt;iplog&lt;/a&gt; em conjunto com o Ossec, mas a última versão é de 2001 e sem manutenção como informa seu desenvolvedor:&lt;/p&gt; &lt;blockquote&gt;&lt;p&gt;“I am through working on this project. I will not be making any updates, and I will ignore just about all email about it. If anybody wants to take it over (for whatever reason), let me know.”&lt;/p&gt;&lt;/blockquote&gt; &lt;p&gt;Para atender está demanda podemos utilizar o &lt;a href=&quot;http://sourceforge.net/projects/sentrytools/&quot;&gt;Postsentry&lt;/a&gt;, IDS responsável por detectar e bloquear tentativas de varredura de portas TCP/UDP.&lt;/p&gt; &lt;p&gt;Neste artigo irei apresentar como integrar o Ossec ao Portsentry tornando mais robusta a segurança do seu host. Estou levando em conta que você já possui o Ossec instalado e funcionando.&lt;/p&gt; &lt;p&gt;Instale e inicie o Portsentry&lt;/p&gt; &lt;p&gt;aptitude install portsentry &amp;amp;&amp;amp; portsentry -atcp &amp;amp;&amp;amp; portsentry -audp&lt;/p&gt; &lt;p&gt;Prepare o Ossec para trabalhar juntamente com o Portsentry adicionando algumas regras locais e do decoder[1].&lt;/p&gt; &lt;p&gt;[1] O &lt;a href=&quot;http://www.ossec.net/doc/manual/rules-decoders/create-custom.html&quot;&gt;decoder&lt;/a&gt; é responsável por interpretar os logs de várias ferramentas e juntamente com as regras realizar alguma ação.&lt;/p&gt; &lt;p&gt;Primeiro remova a seguinte regra (linhas 2240-2257) do arquivo &lt;em&gt;&lt;strong&gt;/var/ossec/etc/decoder.xml&lt;/strong&gt;&lt;/em&gt;&lt;/p&gt; &lt;p&gt; &lt;/p&gt;&lt;p class=&quot;c3&quot;&gt;&lt;span&gt;&lt;/span&gt;&lt;/p&gt; &lt;table class=&quot;c1&quot;&gt; &lt;tr&gt; &lt;td class=&quot;c2&quot;&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;<!– Portsentry –&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;&amp;lt;decoder name=&quot;portsentry&quot;&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;program_name&amp;gt;^portsentry&amp;lt;/program_name&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;&amp;lt;/decoder&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0 c4&quot;&gt;&lt;span&gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;&amp;lt;decoder name=&quot;portsentry-attackalert&quot;&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;parent&amp;gt;portsentry&amp;lt;/parent&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;prematch&amp;gt;attackalert: Connect from host: &amp;lt;/prematch&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;regex offset=&quot;after_prematch&quot;&amp;gt;(\S+)/\S+ to (\S+) port: (\d+)$&amp;lt;/regex&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;order&amp;gt;srcip,protocol,dstport&amp;lt;/order&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;&amp;lt;/decoder&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0 c4&quot;&gt;&lt;span&gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;&amp;lt;decoder name=&quot;portsentry-blocked&quot;&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;parent&amp;gt;portsentry&amp;lt;/parent&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;prematch&amp;gt;is already blocked. Ignoring$&amp;lt;/prematch&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;regex&amp;gt;Host: (\S+) is&amp;lt;/regex&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;order&amp;gt;srcip&amp;lt;/order&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;&amp;lt;/decoder&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;/td&gt; &lt;/tr&gt; &lt;/table&gt; &lt;p class=&quot;c3&quot;&gt;&lt;span&gt;&lt;/span&gt;&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;p&gt;Adicione a seguinte regra no final do arquivo &lt;em&gt;&lt;strong&gt;/var/ossec/etc/decoder.xml&lt;/strong&gt;&lt;/em&gt;, antes da tag &lt;strong&gt;EOF&lt;/strong&gt;&lt;/p&gt; &lt;p&gt; &lt;/p&gt;&lt;p class=&quot;c3&quot;&gt;&lt;span&gt;&lt;/span&gt;&lt;/p&gt; &lt;table class=&quot;c1&quot;&gt; &lt;tr&gt; &lt;td class=&quot;c4&quot;&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;&amp;lt;decoder name=&quot;portsentry&quot;&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt; &amp;lt;program_name&amp;gt;^portsentry&amp;lt;/program_name&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;&amp;lt;/decoder&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;&amp;lt;decoder name=&quot;portsentry-attackalert&quot;&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;   &amp;lt;parent&amp;gt;portsentry&amp;lt;/parent&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;   &amp;lt;prematch&amp;gt;attackalert: TCP SYN/Normal scan from host: &amp;lt;/prematch&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;   &amp;lt;regex offset=&quot;after_prematch&quot;&amp;gt;(\S+)/\S+ to (\S+) port: (\d+)$&amp;lt;/regex&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;   &amp;lt;order&amp;gt;srcip,protocol,dstport&amp;lt;/order&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;&amp;lt;/decoder&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;&amp;lt;decoder name=&quot;portsentry-blocked&quot;&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;   &amp;lt;parent&amp;gt;portsentry&amp;lt;/parent&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;   &amp;lt;prematch&amp;gt;is already blocked Ignoring$&amp;lt;/prematch&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;   &amp;lt;regex&amp;gt;Host: (\S+)/\S+ is&amp;lt;/regex&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;   &amp;lt;order&amp;gt;srcip&amp;lt;/order&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;&amp;lt;/decoder&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;&amp;lt;decoder name=&quot;portsentry-scan&quot;&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;parent&amp;gt;portsentry&amp;lt;/parent&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;prematch&amp;gt;^attackalert: &amp;lt;/prematch&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;regex offset=&quot;after_prematch&quot;&amp;gt;scan from host: (\S+)/\S+ to \S+ port: (\d+)$&amp;lt;/regex&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;order&amp;gt;srcip, dstport&amp;lt;/order&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;&amp;lt;/decoder&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;&amp;lt;decoder name=&quot;portsentry-host&quot;&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;parent&amp;gt;portsentry&amp;lt;/parent&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;prematch offset=&quot;after_parent&quot;&amp;gt;^attackalert: Host: &amp;lt;/prematch&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;regex offset=&quot;after_prematch&quot;&amp;gt;^(\S+)/\S+ &amp;lt;/regex&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt; &amp;lt;order&amp;gt;srcip&amp;lt;/order&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;&amp;lt;/decoder&amp;gt; &lt;/span&gt;&lt;/p&gt; &lt;/td&gt; &lt;/tr&gt; &lt;/table&gt; &lt;p class=&quot;c1&quot;&gt;&lt;span&gt;&lt;/span&gt;&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;p&gt;Apartir dai o OSSEC passará a interpretar os logs gerados pelo Postsentry. Agora adicione as seguintes linhas no final do arquivo &lt;em&gt;&lt;strong&gt;/var/ossec/rules/local_rules.xml&lt;/strong&gt;&lt;/em&gt;, antes da tag &lt;strong&gt;EOF&lt;/strong&gt;&lt;br /&gt; &lt;/p&gt;&lt;p class=&quot;c3&quot;&gt;&lt;span&gt;&amp;lt;group name=&quot;syslog,portsentry,&quot;&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c1&quot;&gt;&lt;span&gt;  &amp;lt;rule id=&quot;160000&quot; level=&quot;0&quot; noalert=&quot;1&quot;&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;    &amp;lt;decoded_as&amp;gt;portsentry&amp;lt;/decoded_as&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;    &amp;lt;description&amp;gt;Grouping for the PortSentry rules&amp;lt;/description&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;/rule&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;rule id=&quot;160002&quot; level=&quot;3&quot;&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;    &amp;lt;if_sid&amp;gt;160000&amp;lt;/if_sid&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;    &amp;lt;match&amp;gt;attackalert:&amp;lt;/match&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;    &amp;lt;description&amp;gt;Connection from a host.&amp;lt;/description&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;/rule&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;rule id=&quot;160003&quot; level=&quot;8&quot; frequency=&quot;4&quot; timeframe=&quot;180&quot; ignore=&quot;60&quot;&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;    &amp;lt;if_matched_sid&amp;gt;160002&amp;lt;/if_matched_sid&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;    &amp;lt;description&amp;gt;Repeated connections from the same host.&amp;lt;/description&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;    &amp;lt;same_source_ip/&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;    &amp;lt;group&amp;gt;recon,&amp;lt;/group&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;/rule&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;rule id=&quot;160004&quot; level=&quot;10&quot; frequency=&quot;8&quot; timeframe=&quot;180&quot; ignore=&quot;60&quot;&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;   &amp;lt;if_matched_sid&amp;gt;160002&amp;lt;/if_matched_sid&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;    &amp;lt;description&amp;gt;Host is still scanning&amp;lt;/description&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;    &amp;lt;same_source_ip /&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;    &amp;lt;group&amp;gt;recon,&amp;lt;/group&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;  &amp;lt;/rule&amp;gt;&lt;/span&gt;&lt;/p&gt; &lt;p class=&quot;c0&quot;&gt;&lt;span&gt;&amp;lt;/group&amp;gt; &lt;/span&gt;&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;p&gt;Reinicie o OSSEC&lt;/p&gt; &lt;blockquote&gt;&lt;p&gt; invoke-rc.d ossec restart &lt;/p&gt;&lt;/blockquote&gt; &lt;p&gt;Após reiniciar o OSSEC qualquer tentativa de varredura usando NMAP ou qualquer outro portscan será bloqueada. Recomendo a utilização de um firewall local, segue o exemplo de um script bastante efetivo.&lt;/p&gt; &lt;blockquote&gt;&lt;p&gt; #!/bin/sh&lt;/p&gt; &lt;p&gt;SYSCTL=”/sbin/sysctl -w”&lt;/p&gt; &lt;p&gt;IPT=”/sbin/iptables”&lt;br /&gt; IPTS=”/sbin/iptables-save”&lt;br /&gt; IPTR=”/sbin/iptables-restore”&lt;/p&gt; &lt;p&gt;INET_IFACE=”eth0″&lt;/p&gt; &lt;p&gt;LO_IFACE=”lo”&lt;br /&gt; LO_IP=”127.0.0.1″&lt;/p&gt; &lt;p&gt;# Save and Restore arguments handled here&lt;br /&gt; if [ &quot;$1&quot; = &quot;save&quot; ]&lt;br /&gt; then&lt;br /&gt; echo -n “Saving firewall to /etc/sysconfig/iptables … ”&lt;br /&gt; $IPTS &amp;gt; /etc/sysconfig/iptables&lt;br /&gt; echo “done”&lt;br /&gt; exit 0&lt;br /&gt; elif [ &quot;$1&quot; = &quot;restore&quot; ]&lt;br /&gt; then&lt;br /&gt; echo -n “Restoring firewall from /etc/sysconfig/iptables … ”&lt;br /&gt; $IPTR &amp;lt; /etc/sysconfig/iptables&lt;br /&gt; echo &quot;done&quot;&lt;br /&gt; exit 0&lt;br /&gt; fi&lt;/p&gt; &lt;p&gt;echo &quot;Loading kernel modules ...&quot;&lt;/p&gt; &lt;p&gt;# This enables SYN flood protection.&lt;br /&gt; if [ &quot;$SYSCTL&quot; = &quot;&quot; ]&lt;br /&gt; then&lt;br /&gt; echo &quot;1&quot; &amp;gt; /proc/sys/net/ipv4/tcp_syncookies&lt;br /&gt; else&lt;br /&gt; $SYSCTL net.ipv4.tcp_syncookies=”1″&lt;br /&gt; fi&lt;/p&gt; &lt;p&gt;# This enables source validation by reversed path according to RFC1812.&lt;br /&gt; if [ &quot;$SYSCTL&quot; = &quot;&quot; ]&lt;br /&gt; then&lt;br /&gt; echo “1″ &amp;gt; /proc/sys/net/ipv4/conf/all/rp_filter&lt;br /&gt; else&lt;br /&gt; $SYSCTL net.ipv4.conf.all.rp_filter=”1″&lt;br /&gt; fi&lt;/p&gt; &lt;p&gt;# This kernel parameter instructs the kernel to ignore all ICMP&lt;br /&gt; if [ &quot;$SYSCTL&quot; = &quot;&quot; ]&lt;br /&gt; then&lt;br /&gt; echo “1″ &amp;gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts&lt;br /&gt; else&lt;br /&gt; $SYSCTL net.ipv4.icmp_echo_ignore_broadcasts=”1″&lt;br /&gt; fi&lt;/p&gt; &lt;p&gt;# This option can be used to accept or refuse source routed packets.&lt;br /&gt; if [ &quot;$SYSCTL&quot; = &quot;&quot; ]&lt;br /&gt; then&lt;br /&gt; echo “0″ &amp;gt; /proc/sys/net/ipv4/conf/all/accept_source_route&lt;br /&gt; else&lt;br /&gt; $SYSCTL net.ipv4.conf.all.accept_source_route=”0″&lt;/p&gt; &lt;p&gt;fi&lt;/p&gt; &lt;p&gt;# However, we’ll ensure the secure_redirects option is on instead.&lt;br /&gt; if [ &quot;$SYSCTL&quot; = &quot;&quot; ]&lt;br /&gt; then&lt;br /&gt; echo “1″ &amp;gt; /proc/sys/net/ipv4/conf/all/secure_redirects&lt;br /&gt; else&lt;br /&gt; $SYSCTL net.ipv4.conf.all.secure_redirects=”1″&lt;br /&gt; fi&lt;/p&gt; &lt;p&gt;# This option logs packets from impossible addresses.&lt;br /&gt; if [ &quot;$SYSCTL&quot; = &quot;&quot; ]&lt;br /&gt; then&lt;br /&gt; echo “1″ &amp;gt; /proc/sys/net/ipv4/conf/all/log_martians&lt;br /&gt; else&lt;br /&gt; $SYSCTL net.ipv4.conf.all.log_martians=”1″&lt;br /&gt; fi&lt;/p&gt; &lt;p&gt;echo “Flushing Tables …”&lt;/p&gt; &lt;p&gt;# Reset Default Policies&lt;br /&gt; $IPT -P INPUT ACCEPT&lt;br /&gt; $IPT -P FORWARD ACCEPT&lt;br /&gt; $IPT -P OUTPUT ACCEPT&lt;/p&gt; &lt;p&gt;# Flush all rules&lt;br /&gt; $IPT -F&lt;/p&gt; &lt;p&gt;# Erase all non-default chains&lt;br /&gt; $IPT -X&lt;/p&gt; &lt;p&gt;if [ &quot;$1&quot; = &quot;stop&quot; ]&lt;br /&gt; then&lt;br /&gt; echo “Firewall completely flushed! Now running with no firewall.”&lt;br /&gt; exit 0&lt;br /&gt; fi&lt;/p&gt; &lt;p&gt;$IPT -P INPUT DROP&lt;br /&gt; $IPT -P OUTPUT DROP&lt;br /&gt; $IPT -P FORWARD DROP&lt;/p&gt; &lt;p&gt;echo “Create and populate custom rule chains …”&lt;/p&gt; &lt;p&gt;# Create a chain to filter INVALID packets&lt;/p&gt; &lt;p&gt;$IPT -N bad_packets&lt;/p&gt; &lt;p&gt;# Create another chain to filter bad tcp packets&lt;/p&gt; &lt;p&gt;$IPT -N bad_tcp_packets&lt;/p&gt; &lt;p&gt;# Create separate chains for icmp, tcp (incoming and outgoing),&lt;br /&gt; # and incoming udp packets.&lt;/p&gt; &lt;p&gt;$IPT -N icmp_packets&lt;/p&gt; &lt;p&gt;# Used for UDP packets inbound from the Internet&lt;br /&gt; $IPT -N udp_inbound&lt;/p&gt; &lt;p&gt;# Used to block outbound UDP services from internal network&lt;br /&gt; $IPT -N udp_outbound&lt;/p&gt; &lt;p&gt;# Used to allow inbound services if desired&lt;br /&gt; $IPT -N tcp_inbound&lt;/p&gt; &lt;p&gt;# Used to block outbound services from internal network&lt;br /&gt; $IPT -N tcp_outbound&lt;/p&gt; &lt;p&gt;# Drop INVALID packets immediately&lt;br /&gt; $IPT -A bad_packets -p ALL -m state –state INVALID -j LOG –log-prefix ‘fp=bad_packets:1 a=DROP’ –log-level 4&lt;/p&gt; &lt;p&gt;$IPT -A bad_packets -p ALL -m state –state INVALID -j DROP&lt;/p&gt; &lt;p&gt;# Then check the tcp packets for additional problems&lt;br /&gt; $IPT -A bad_packets -p tcp -j bad_tcp_packets&lt;/p&gt; &lt;p&gt;# All good, so return&lt;br /&gt; $IPT -A bad_packets -p ALL -j RETURN&lt;/p&gt; &lt;p&gt;# bad_tcp_packets chain&lt;/p&gt; &lt;p&gt;$IPT -A bad_tcp_packets -p tcp ! –syn -m state –state NEW -j LOG –log-prefix ‘fp=bad_tcp_packets:1 a=DROP’ –log-level 4&lt;br /&gt; $IPT -A bad_tcp_packets -p tcp ! –syn -m state –state NEW -j DROP&lt;/p&gt; &lt;p&gt;$IPT -A bad_tcp_packets -p tcp –tcp-flags ALL NONE -j LOG –log-prefix ‘fp=bad_tcp_packets:2 a=DROP’ –log-level 4&lt;br /&gt; $IPT -A bad_tcp_packets -p tcp –tcp-flags ALL NONE -j DROP&lt;/p&gt; &lt;p&gt;$IPT -A bad_tcp_packets -p tcp –tcp-flags ALL ALL -j LOG –log-prefix ‘fp=bad_tcp_packets:3 a=DROP’ –log-level 4&lt;br /&gt; $IPT -A bad_tcp_packets -p tcp –tcp-flags ALL ALL -j DROP&lt;/p&gt; &lt;p&gt;$IPT -A bad_tcp_packets -p tcp –tcp-flags ALL FIN,URG,PSH -j LOG –log-prefix ‘fp=bad_tcp_packets:4 a=DROP’ –log-level 4&lt;br /&gt; $IPT -A bad_tcp_packets -p tcp –tcp-flags ALL FIN,URG,PSH -j DROP&lt;/p&gt; &lt;p&gt;$IPT -A bad_tcp_packets -p tcp –tcp-flags ALL SYN,RST,ACK,FIN,URG -j LOG –log-prefix ‘fp=bad_tcp_packets:5 a=DROP’ –log-level 4&lt;br /&gt; $IPT -A bad_tcp_packets -p tcp –tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP&lt;/p&gt; &lt;p&gt;$IPT -A bad_tcp_packets -p tcp –tcp-flags SYN,RST SYN,RST -j LOG –log-prefix ‘fp=bad_tcp_packets:6 a=DROP’ –log-level 4&lt;br /&gt; $IPT -A bad_tcp_packets -p tcp –tcp-flags SYN,RST SYN,RST -j DROP&lt;/p&gt; &lt;p&gt;$IPT -A bad_tcp_packets -p tcp –tcp-flags SYN,FIN SYN,FIN -j LOG –log-prefix ‘fp=bad_tcp_packets:7 a=DROP’ –log-level 4&lt;br /&gt; $IPT -A bad_tcp_packets -p tcp –tcp-flags SYN,FIN SYN,FIN -j DROP&lt;/p&gt; &lt;p&gt;# All good, so return&lt;br /&gt; $IPT -A bad_tcp_packets -p tcp -j RETURN&lt;/p&gt; &lt;p&gt;# icmp_packets chain&lt;/p&gt; &lt;p&gt;$IPT -A icmp_packets –fragment -p ICMP -j LOG –log-prefix ‘fp=icmp_packets:1 a=DROP’ –log-level 4&lt;br /&gt; $IPT -A icmp_packets –fragment -p ICMP -j DROP&lt;/p&gt; &lt;p&gt;$IPT -A icmp_packets -p ICMP -s 0/0 –icmp-type 8 -j DROP&lt;/p&gt; &lt;p&gt;# Time Exceeded&lt;br /&gt; $IPT -A icmp_packets -p ICMP -s 0/0 –icmp-type 11 -j ACCEPT&lt;/p&gt; &lt;p&gt;# Not matched, so return so it will be logged&lt;br /&gt; $IPT -A icmp_packets -p ICMP -j RETURN&lt;/p&gt; &lt;p&gt;# Drop netbios calls&lt;br /&gt; $IPT -A udp_inbound -p UDP -s 0/0 –destination-port 137 -j DROP&lt;br /&gt; $IPT -A udp_inbound -p UDP -s 0/0 –destination-port 138 -j DROP&lt;/p&gt; &lt;p&gt;# Not matched, so return for logging&lt;br /&gt; $IPT -A udp_inbound -p UDP -j RETURN&lt;/p&gt; &lt;p&gt;# No match, so ACCEPT&lt;br /&gt; $IPT -A udp_outbound -p UDP -s 0/0 -j ACCEPT&lt;/p&gt; &lt;p&gt;# Web Server&lt;/p&gt; &lt;p&gt;# HTTP&lt;br /&gt; $IPT -A tcp_inbound -p TCP -s 0/0 –destination-port 80 -j ACCEPT&lt;/p&gt; &lt;p&gt;# HTTPS (Secure Web Server)&lt;br /&gt; $IPT -A tcp_inbound -p TCP -s 0/0 –destination-port 443 -j ACCEPT&lt;/p&gt; &lt;p&gt;# sshd&lt;br /&gt; $IPT -A tcp_inbound -p TCP -s 0/0 –destination-port 22 -j ACCEPT&lt;/p&gt; &lt;p&gt;# Not matched, so return so it will be logged&lt;br /&gt; $IPT -A tcp_inbound -p TCP -j RETURN&lt;/p&gt; &lt;p&gt;# No match, so ACCEPT&lt;br /&gt; $IPT -A tcp_outbound -p TCP -s 0/0 -j ACCEPT&lt;/p&gt; &lt;p&gt;echo “Process INPUT chain …”&lt;/p&gt; &lt;p&gt;# Allow all on localhost interface&lt;br /&gt; $IPT -A INPUT -p ALL -i $LO_IFACE -j ACCEPT&lt;/p&gt; &lt;p&gt;# Drop bad packets&lt;br /&gt; $IPT -A INPUT -p ALL -j bad_packets&lt;/p&gt; &lt;p&gt;# Accept Established Connections&lt;br /&gt; $IPT -A INPUT -p ALL -i $INET_IFACE -m state –state ESTABLISHED,RELATED -j ACCEPT&lt;/p&gt; &lt;p&gt;# Route the rest to the appropriate user chain&lt;br /&gt; $IPT -A INPUT -p TCP -i $INET_IFACE -j tcp_inbound&lt;br /&gt; $IPT -A INPUT -p UDP -i $INET_IFACE -j udp_inbound&lt;br /&gt; $IPT -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets&lt;/p&gt; &lt;p&gt;# Drop without logging broadcasts that get this far.&lt;br /&gt; $IPT -A INPUT -m pkttype –pkt-type broadcast -j DROP&lt;/p&gt; &lt;p&gt;# Log packets that still don’t match&lt;br /&gt; $IPT -A INPUT -j LOG –log-prefix “fp=INPUT:99 a=DROP ”&lt;/p&gt; &lt;p&gt;echo “Process FORWARD chain …”&lt;/p&gt; &lt;p&gt;echo “Process OUTPUT chain …”&lt;/p&gt; &lt;p&gt;$IPT -A OUTPUT -m state -p icmp –state INVALID -j DROP&lt;/p&gt; &lt;p&gt;# Localhost&lt;br /&gt; $IPT -A OUTPUT -p ALL -s $LO_IP -j ACCEPT&lt;br /&gt; $IPT -A OUTPUT -p ALL -o $LO_IFACE -j ACCEPT&lt;/p&gt; &lt;p&gt;# To internet&lt;br /&gt; $IPT -A OUTPUT -p ALL -o $INET_IFACE -j ACCEPT&lt;/p&gt; &lt;p&gt;# Log packets that still don’t match&lt;br /&gt; $IPT -A OUTPUT -j LOG –log-prefix ‘fp=OUTPUT:99 a=DROP’ –log-level 4&lt;/p&gt; &lt;p&gt;echo “Load rules for mangle table …” &lt;/p&gt;&lt;/blockquote&gt; &lt;p&gt;&lt;strong&gt;Referências&lt;/strong&gt;&lt;/p&gt; &lt;p&gt;&lt;a href=&quot;http://svn.fedecarg.com/repo/Shell%20Scripts/ssh/iptables.sh&quot;&gt;Firewall Script&lt;/a&gt;&lt;/p&gt; &lt;p&gt;&lt;a href=&quot;http://groups.google.com/group/ossec-list/browse_thread/thread/c75a97559a43c389&quot;&gt;Portsentry decoders and rules issues&lt;/a&gt; &lt;/p&gt; &lt;div&gt;&lt;h3&gt;See:&lt;/h3&gt;&lt;ul&gt;&lt;li&gt;&lt;a href=&quot;http://blog.alexos.com.br/?p=2650&amp;amp;lang=pt-br&quot; class=&quot;crp_title&quot;&gt;Ossec HIDS – Bloqueando o ZmEu bot e outros Web scanners&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href=&quot;http://blog.alexos.com.br/?p=2180&amp;amp;lang=pt-br&quot; class=&quot;crp_title&quot;&gt;Nessus Viewer&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href=&quot;http://blog.alexos.com.br/?p=1644&amp;amp;lang=pt-br&quot; class=&quot;crp_title&quot;&gt;Beta-Testing: Ossec 2.4 Beta&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href=&quot;http://blog.alexos.com.br/?p=1345&amp;amp;lang=pt-br&quot; class=&quot;crp_title&quot;&gt;Habilitando o MSA ( submission ) no Postfix&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href=&quot;http://blog.alexos.com.br/?p=2157&amp;amp;lang=pt-br&quot; class=&quot;crp_title&quot;&gt; H3ll0 2k11&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/div&gt;

Rafael Gomes: Novidade da versão 1.9.7 do Zabbix

Calma! Ela ainda não foi lançada, mas já temos uma novidade que podemos esperar para essa nova versão.

Quem nunca teve problemas ao utilizar o calendário do Zabbix? Ele não tem botão de “aplicar” correto? você tinha que clicar fora para fechar o popup. Seus problemas acabaram, agora foi adicionado um botão para corrigir essa deficiência.

Pode parecer uma mudança pequena, mas que faz toda diferença para quem atua no dia a dia.

Esperemos então mais novidades dessa nova versão!

Fonte : Zabbix.com