October 2025
M T W T F S S
 12345
6789101112
13141516171819
20212223242526
2728293031  

Categories

October 2025
M T W T F S S
 12345
6789101112
13141516171819
20212223242526
2728293031  

Security Configuration Benchmark For Red Hat Enterprise Linux 5

CIS Red Hat Enterprise Linux 5 Benchmark
Introduction
Red Hat Enterprise Linux version 5 (RHEL5) is the new server-class release from Red Hat, Inc, that stabilizes SELinux, has been Common Criteria evaluated at EAL4+ and brings further stability and robustness to the enterprise level with this OS. Security hardening remains a vital element to the defense-in-depth approach for all computing elements within the enterprise.. The Center for Internet Security proudly brings the latest consensus-achieved security hardening recommendations in this Benchmark and accompanying scoring tool.
The content and intent of this Benchmark is to drive you, the reader to be more informed in regards to actions necessary for hardening and securing Red Hat Enterprise Linux systems. It is not going to provide non-security hardening information and guidance just for the sake of providing it. Some basics of a particular function might be touched upon, but this is usually for the relevance it directly provides to the security hardening actions at hand.
Please enjoy this edition of the Center for Internet Security Benchmark to harden Red Hat Enterprise Linux version 5.

 

CIS_RHEL_5.0-5.1_Benchmark_v.1.1.2

 

VPN Server With OpenVPN

Depending on your circumstances you may want to run the VPN from your home, or you may want to rent a VPS to run it from. If you’re just trying to get into your home network, an SSH tunnel might be easier; I will write something about SSH tunneling later. For the purposes of this guide, there’s no difference between using a spare machine at your house or a VPS/Dedi other than port forwarding on the router. The configuration will be based on a machine running CentOS 5, with nano as the editor. It really doesn’t matter what Linux distribution you use, or what editor. I also use wget for downloading. You can use Links, lynx, or any method you want to get the files.

OpenVPN is being used for a number of reasons:

  1. It’s extensively used privately and publicly.
  2. It’s well supported
  3. It uses OpenSSL instead of more complicated PKI certificate systems. (Don’t confuse this with a Microsoft SSTP VPN, they aren’t the same thing)
  4. This type of VPN can be tunneled through a proxy or NAT device easily.
  5. It is a very capable VPN application, allowing for a large number of configuration scenarios including site to site, client to server, client to site, and reverse connections.
Now, there is one huge drawback… It uses its own special set of protocols, and cannot be intermixed with other VPN clients or servers. An OpenVPN client cannot connect to an IPSec, PPTP, or SSTP VPN, and only OpenVPN clients can connect to OpenVPN servers. That being said, there are several third party clients available for OpenVPN, for all platforms. I will list the various options at the end of the article.

Please read the entire guide before beginning the installation.

1. Downloading and installing OpenVPN

#rpm -i openvpn-as-1.8.3-CentOS5.i386.rpm

I’m just downloading and installing one of the RPMs, but you can easily build from source if that’s your style. The package should also be in most distro software repositories as well. The basic installation is insanely simple, just download and install the package. The installation will let you know that you need to change the password using “passwd openvpn”, and that web UIs are available at https://serveraddress:943/ and https://serveraddress:943/admin for the user and admin logins respectively.

2. Configuration of the VPN Server.

If you haven’t already set the password, please do so now.

#passwd openvpn

Changing password for user openvpn

New UNIX password:

BAD PASSWORD: it is based on a dictionary word

Retype UNIX password:

passwd: all authentication tokens updated successfully

I used “password” for my password, I’d advise that you actually use a strong password.

OpenVPN is now running on your server. Everything can be configured via the web interface available at https://server:943/admin. The user name is openvpn, and the password is whatever you have set. A basic VPN is already in place using default certificates, PAM authentication, and a relatively secure client configuration.  I’m not going to cover some of the more advanced configurations here, such as site to site via an intermediary server, LDAP interoperability, or layer 2 tunneling.

If you’re having trouble reaching the VPN administration page, you’ll need to check your firewall settings. I’m not going to go through iptables commands, but you need to make sure that the bare minimum is present. The administration page provides a simple means to configure everything from client IP ranges to ciphers and authentication. The only thing you might *need* to change is the IP range.

#!/bin/bash

###### TURN ON PORT FORWARDING ########
echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -v -F;
iptables -F -t mangle
iptables -F -t nat;
iptables -v -A INPUT -i lo -j ACCEPT;

# iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j MASQUERADE
# iptables -t nat -A POSTROUTING -s 192.168.25.0/24 -o tun0 -j MASQUERADE

# iptables -A INPUT -i tun0 -j ACCEPT
# iptables -A OUTPUT -o tun0 -j ACCEPT
# iptables -A FORWARD -i tun0 -j ACCEPT
# iptables -I FORWARD -i em1 -o tun0 -j ACCEPT
# iptables -I FORWARD -i tun0 -o em1 -j ACCEPT

########### BASIC RULE SET #############
iptables -v -P INPUT DROP # Default Policy DROP
# iptables -v -A INPUT -m state –state RELATED,ESTABLISHED -j LOG –log-prefix “ACCEPT”
iptables -v -A INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT; # ACCEPT ESTABLISHED
iptables -A INPUT -p tcp -m state –state NEW –dport 80 -i em1 -j ACCEPT
iptables -A INPUT -i em1 -p tcp –dport 993 -m state –state NEW,ESTABLISHED -j ACCEPT #ALLOW SSL
iptables -A INPUT -i em1 -p tcp –dport 1194 -m state –state NEW,ESTABLISHED -j ACCEPT #ALLOW OPENVPN

########## CONNECTION LIMIT LOG/DROP ############
iptables -A INPUT -p tcp -i em1 -m state –state NEW -m recent –set
iptables -A INPUT -p tcp -i em1 -m state –state NEW -m recent –update –seconds 30 –hitcount 10 -j LOG –log-level 4 –log-prefix “LIMIT:”
iptables -A INPUT -p tcp -i em1 -m state –state NEW -m recent –update –seconds 30 –hitcount 10 -j DROP

########### DROP SPOOFED PACKETS ###############
iptables -A INPUT -s 127.0.0.0/8 ! -i lo -j LOG –log-level 4 –log-prefix “SPOOF PACKETS:”
iptables -A INPUT -s 127.0.0.0/8 ! -i lo -j DROP

########### LOG/DROP NEW CONNECTIONS ##############
# iptables -A INPUT -p tcp -m state –state NEW -j LOG # LOG NEW TCP CONNECTIONS
# iptables -A INPUT -p tcp -m state –state NEW -j DROP # BLOCK NEW TCP CONNECTIONS

######### LOG/DROP FTP SSH AND SEDMAIL ############
iptables -v -A INPUT -p tcp -s 0/0 –dport 21 -j LOG # LOG FTP ATTEMPTS
iptables -v -A INPUT -p tcp -s 0/0 –dport 21 -j REJECT –reject-with tcp-reset # RESET FTP
iptables -v -A INPUT -p tcp -s 0/0 –dport 22 -j LOG # LOG SSH ATTEMPTS
iptables -v -A INPUT -p tcp -s 0/0 –dport 22 -j DROP # BLOCK SSH
iptables -v -A INPUT -p tcp -s 0/0 –dport 25 -j LOG # LOG SENDMAIL
iptables -v -A INPUT -p tcp -s 0/0 –dport 25 -j DROP # BLOCK SENDMAIL

########### INPUT THAT IS NEEDED #################
iptables -v -A INPUT -m state -m tcp –proto tcp –dport 80 –state NEW -j ACCEPT; # HTTP
iptables -v -A INPUT -m state -m udp –proto udp –dport 53 –state NEW -j ACCEPT; # DNS
iptables -v -A INPUT -m state -m tcp –proto tcp –dport 53 –state NEW -j ACCEPT; # DNS

iptables -v -A INPUT -m state -m tcp –proto tcp –dport 22 –state NEW -j ACCEPT; # SSH

iptables -v -A INPUT -m state -m tcp –proto tcp –dport 443 –state NEW -j ACCEPT; # HTTPS

########### DENY FRAGMENT PACKETS ###############
iptables -A INPUT -i em1 -f -m limit –limit 5/m –limit-burst 7 -j LOG –log-level 4 –log-prefix “FRAG DROP:”
iptables -A INPUT -i em1 -f -j DROP

########### DROPS BAD PACKETS ###############
iptables -A INPUT -p tcp –tcp-flags ALL ALL -j DROP
iptables -A INPUT -p tcp –tcp-flags ALL NONE -j DROP
iptables -A INPUT -i em1 -p tcp –tcp-flags ALL FIN,URG,PSH -j DROP
iptables -A INPUT -i em1 -p tcp –tcp-flags ALL ALL -j DROP

iptables -A INPUT -i em1 -p tcp –tcp-flags ALL NONE -m limit –limit 5/m –limit-burst 7 -j LOG –log-level 4 –log-prefix “NULL DROP:”
iptables -A INPUT -i em1 -p tcp –tcp-flags ALL NONE -j DROP # NULL packets

iptables -A INPUT -i em1 -p tcp –tcp-flags SYN,RST SYN,RST -j DROP

iptables -A INPUT -i em1 -p tcp –tcp-flags SYN,FIN SYN,FIN -m limit –limit 5/m –limit-burst 7 -j LOG –log-level 4 –log-prefix “XMAS DROP:”
iptables -A INPUT -i em1 -p tcp –tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS

iptables -A INPUT -i em1 -p tcp –tcp-flags FIN,ACK FIN -m limit –limit 5/m –limit-burst 7 -j LOG –log-level 4 –log-prefix “FIN DROP:”
iptables -A INPUT -i em1 -p tcp –tcp-flags FIN,ACK FIN -j DROP # FIN packet scans

iptables -A INPUT -i em1 -p tcp –tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

########### LIMIT PING ATTEMPTS ###################
iptables -A INPUT -p icmp -m icmp -m limit –limit 1/second -j ACCEPT

########### BLOCK CERTAIN ICMP ###################
iptables -v -A INPUT -p icmp -j ACCEPT # ACCEPT ICMP PACKETS
iptables -v -A INPUT -p icmp –icmp-type echo-request -j DROP # BLOCK ICMP ECHO

########## BLOCK INVALID ICMP #####################
iptables -v -A INPUT -i em1 -m state -p icmp –state INVALID -j DROP # BLOCK INVALID ICMP
iptables -v -A FORWARD -i em1 -m state -p icmp –state INVALID -j DROP # BLOCK INVALID ICMP
iptables -A OUTPUT -o em1 -m state -p icmp –state INVALID -j DROP # BLOCK INVALID ICMP
iptables -A FORWARD -o em1 -m state -p icmp –state INVALID -j DROP # BLOCK INVALID ICMP

############ BLOCK STEALTH SCAN ###################
iptables -N st_scan # STEALTH SCAN CHAIN
iptables -A st_scan -p tcp –tcp-flags SYN,FIN,RST,ACK RST,ACK -j RETURN # BLOCK STEALTH SCAN
iptables -A st_scan -j LOG –log-level 4 –log-prefix “STEALTH SCAN:” # LOG STEALTH SCAN
iptables -A st_scan -j DROP # DROP STEALTH SCAN

########## PORTSCAN RULE SETUP ###################
iptables -N port-scan # BEGIN PORTSCAN RULES
iptables -A port-scan -p tcp –tcp-flags SYN,ACK,FIN,RST RST -m limit –limit 1/s -j RETURN #BLOCK PSCAN
iptables -A port-scan -j LOG –log-level 4 –log-prefix “PORT SCAN:” # LOG PORT SCAN
iptables -A port-scan -j DROP # DROP PORT SCAN

########## LOG ALL DROPPED PACKETS #################
iptables -N logdrop
iptables -A logdrop -j LOG –log-level 4 –log-prefix “DROPPED:” # LOG DROPPED PACKETS
iptables -A logdrop -j DROP

iptables -v -A INPUT -j REJECT; # REJECT EVERYTHING ELSE

######## OUTPUT FOR SERVICES NEEDED ########

iptables -v -P OUTPUT ACCEPT # Default Policy Accept
iptables -v -A OUTPUT -o lo -j ACCEPT;
iptables -v -A OUTPUT -o em1 -j ACCEPT;
iptables -v -A OUTPUT -m tcp –proto tcp –dport 80 -j ACCEPT; # HTTP
iptables -v -A OUTPUT -m tcp –proto tcp –dport 443 -j ACCEPT; # HTTPS
iptables -v -A OUTPUT -m tcp –proto tcp –dport 445 -j ACCEPT; # SMB
iptables -v -A OUTPUT -m tcp –proto tcp –dport 53 -j ACCEPT; # DNS
iptables -v -A OUTPUT -m udp –proto udp –dport 53 -j ACCEPT; # DNS
iptables -v -A OUTPUT -m tcp –proto tcp –dport 5222 -j ACCEPT; #Google Talk or Jabber
iptables -v -A OUTPUT -m tcp –proto tcp –dport 5050 -j ACCEPT; #Yahoo
iptables -v -A OUTPUT -m tcp –proto tcp –dport 6667 -j ACCEPT; #IRC
iptables -v -A OUTPUT -m tcp –proto tcp –dport 7777 -j ACCEPT; #Jabber file Transfers
iptables -A OUTPUT -o em1 -p tcp –dport 31337 –sport 31337 -j DROP # BLOCK BACKDOOR
iptables -v -A OUTPUT -j REJECT;

######### DEFAULT DROPS #######

iptables -v -P FORWARD DROP # Default Policy DROP
iptables -A FORWARD -p tcp -i em1 -m state –state NEW -m recent –set
iptables -A FORWARD -p tcp -i em1 -m state –state NEW -m recent –update –seconds 30 –hitcount 10 -j DROP
iptables -A FORWARD -p tcp –syn -m limit –limit 1/s -j ACCEPT # SYN FLOOD PROTECT
iptables -A FORWARD -p icmp –icmp-type echo-request -m limit –limit 1/s -j ACCEPT # DEATH BY PING
iptables -A FORWARD -p tcp -i em1 –dport 31337 –sport 31337 -j DROP # BLOCK BACKDOOR
iptables -v -A FORWARD -j REJECT; # DEFAULT REJECT

######### IPTABLES SAVE ##################

iptables-save > /tmp/iptables;

iptables-restore < /tmp/iptables;

/etc/init.d/iptables save

JBoss AS Clustering

Java

Download
wget http://download.oracle.com/otn-pub/java/jdk/6u33-b04/jdk-6u33-linux-i586.bin

Create a bash script to set JAVA_HOME and add Java executables to the path.

vim /etc/profile.d/java.sh

export JAVA_HOME=/opt/jdk1.6.0_26/
export PATH=$JAVA_HOME/bin:$PATH

5. Source you new script so exports take effect

source /etc/profile.d/java.sh

6. Setup Java to be used by the alternatives system (if you want, or if you have an existing install of Java on your box.

alternatives –install /usr/bin/java java /opt/jdk1.6.0_04/bin/java 2

7. Set this new alternatives as the current configuration

alternatives –config java

 

 

 

Download and Install JBoss AS:

Download packaged distribution from http://www.jboss.org/jbossas/downloads
Unpack the compressed archive into a directory of your choice. e.g. /usr/jboss

Clustering in JBoss AS:

A cluster is a set of nodes that communicate with each other and work toward a common goal.
JBoss currently provides full clustering support. Replication of HTTP sessions for web applications is also available.Can also be integrated to an external balancer.

A Cluster provide these functionalities:
  • Scalability (can we handle more users? can we add hardware to our system?)
  • Load Balancing (share the load between servers)
  • High Availability (our application has to be uptime close to 100%)
  • Fault Tolerance (High Availability and Reliability)
  • Clustering support for stateless session beans, stateful session beans, entity beans and JNDI.

 

Partitions

As previously discussed, a cluster is a set of nodes. In JBoss, a node is a JBoss server instance. Thus, to build a cluster, several JBoss instances have to be grouped in what we call a partition.
The partition is the central concept for clustering in JBoss. Partitions are the basic building block of clustering in JBoss.
On a same network, we may have different partitions. In order to differentiate them, each partition must have an individual name.

 

Simple Web Architecture:

 

 

Simple web architecture is not scalable. Additional users can only be handled by improving the performance of the server (e.g.adding additional CPUs, more memory). No fault tolerance. If the JBoss AS server goes down, the entire service becomes unavailable.

External Load Balancer Architecture:
Add one or many web servers to balance the load to multiple JBoss AS nodes typically running on separate physical servers. Additional user load can be handled by adding another server running JBoss AS. If any one of the JBoss AS nodes fail, the service is still available through other JBoss AS servers.

A cluster is defined by:

  • Multicast Address
  • Multicast Post
  • Cluster Name
  • Multicast is the protocol which allow nodes inside to a cluster to communicate without knowing each other. Communication between nodes is provided by JGroups, which is library for multicast communication.

General configuration for the following examples:
Preparing a set of servers to act as a JBoss AS cluster involves a few simple steps:
Copy the all directory and create two directory node1 and node2 as below,

 

General configuration for the following examples:
Preparing a set of servers to act as a JBoss AS cluster involves a few simple steps:
Copy the all directory and create two directory node1 and node2 as below,

$ cd /usr/jboss/server
$ cp -r all jboss1
$ cp -r all
jboss2
$ cp -r all jboss3

Requirements Of Jboss Cluster:
Cluster Name
Multicast Address
Cluster Name
ServerPeerID (its unique id for JBoss Messaging.)
In this scenario we have 3 nodes with different ports on same server. Assume the machine has the 192.168.0.101 address assigned. The 3 JBoss instances(jboss1, jboss2 & jboss3) is created under folder /app/jboss/server as jboss1, jboss2 & jboss3. The ServerPeerID for the jboss1 is 1, for jboss2 is 2 & for jboss3 is 3. We have decided to set cluster name as “TestPartition” and to use 239.255.0.10 as our multicast address.

 

 

Launch a JBoss AS Cluster:

Now just start JBoss AS cluster nodes one by one as below,
For jboss1
$JBOSS_HOME/bin/run.sh -c jboss1 -b 0.0.0.0 -g TestPartition -u 239.255.0.10 -Djboss.messaging.ServerPeerID=1 -Djboss.service.binding.set=ports-default

For jboss2
$JBOSS_HOME/bin/run.sh -c jboss2 -b 0.0.0.0 -g TestPartition -u 239.255.0.10
-Djboss.messaging.ServerPeerID=2 -Djboss.service.binding.set=ports-02

For jboss3
$JBOSS_HOME/bin/run.sh -c jboss3 -b 0.0.0.0 -g TestPartition -u 239.255.0.10
-Djboss.messaging.ServerPeerID=3 -Djboss.service.binding.set=ports-03

In above scripts
The -c switch says to use the config “-c node1”.
The -g switch sets the cluster name “-u TestPartition”.
The -u switch sets the multicast address that will be used for intra-cluster communication
“-u 239.255.0.10”.
The -b switch sets the address on which sockets will be bound “-b 0.0.0.0”.
The -Djboss.messaging.ServerPeerID from which JBoss Messaging gets its unique id “-Djboss.messaging.ServerPeerID=1”.
The -Djboss.service.binding.set switch sets the port set for instance
“-Djboss.service.binding.set=ports-default”.
Ports sets are as below.
Ports-default = 8080
Ports-01 = 8180
ports-02 = 8280
ports-03 = 8380

Thats it, You have complete your JBoss AS clustering part.

Load Balancing Using Apache & mod_jk

Apache is a well-known web server which can be extended by plugging in modules. One of these modules, mod_jk, has been specifically designed to allow the forwarding of requests from Apache to a Servlet container. Furthermore, it is also able to load-balance HTTP calls to a set of Servlet containers while maintaining sticky sessions.

Advantages of Fronting with a Web Server :
Performance: dynamic vs. static content
Scalability & High Availability: load balancing and fail over
Security: web servers are simpler and easier to protect
Stability: proven, more robust
Features: URL rewriting, fine-grained access control, etc.
Fronting with Apache HTTPD:

Steps for Fronting with Apache HTTPD:
Download & compile Apache HTTPD
Download & compile mod_jk with Apache
AJP Connector on JBoss AS already enabled
Access web apps through Apache
Mod_jk (version 1.2.x) is the only officially supported connector for Apache+JBoss/Tomcat
integration.

Steps to install mod_jk
First of all, make sure that you have Apache installed. You can download Apache directly from Apache web site at http://httpd.apache.org. Installation of mod_jk is pretty straightforward and requires no specific configuration. Installation steps are as below,

$tar -zxvf tomcat-connectors-1.2.30-src.tar.gz
$cd tomcat-connectors-1.2.30-src/native
$./configure –with-apxs=$APACHE_HOME/bin/apxs
$make
$sudo make install

Configure Apache to load mod_jk :
Include configuration file of mod_jk in $APACHE_HOME/conf/httpd.conf.
Add below line
Include conf/mod_jk.conf

Configuring mod_jk.conf:
Create <apache-dir>/conf/mod_jk.conf & configure as below.
# Load mod_jk module
LoadModule jk_module $APACHE_HOME/modules/mod_jk.so
# Where to find workers.properties
JkWorkersFile $APACHE_HOME/conf/workers.properties
# Where to find mod_jk.log file
JkLogFile /log/mod_jk.log
#Log level
JkLogLevel info
# Select the log format
JkLogStampFormat “[%a %b %d %H:%M:%S %Y]”
# JkRequestLogFormat
JkRequestLogFormat “%w %V %T”
# Add shared memory. This is needed for for load balancing to work properly
JkShmFile /log/jk.shm
# JkOptions indicates to send SSK KEY SIZE
JkOptions +ForwardKeySize +ForwardURICompat -ForwardDirectories
# Add jkstatus for managing runtime data
<Location /jkstatus/>
JkMount jkstatus
Order deny,allow
Deny from all
Allow from {HOST_IP}
</Location>
# Mount your applications
JkMountCopy All
JkMount /jmx-console jboss
JkMount /jmx-console/* jboss
JkMount /admin-console jboss
JkMount /admin-console/* jboss
JkMount /jkstatus jkstatus

Define a JBoss AS instance in $APACHE_HOME/conf/workers.properties

worker.list=jboss,jkstatus
#For Node1
worker.jboss1.type=ajp13
worker.jboss1.host=HOST_IP
worker.jboss1.port=8009
worker.jboss1.lbfactor=1
#For Node2
worker.jboss2.type=ajp13
worker.jboss2.host=HOST_IP
worker.jboss2.port=8109
worker.jboss2.lbfactor=1
#For Node3
worker.jboss3.type=ajp13
worker.jboss3.host=HOST_IP
worker.jboss3.port=8209
worker.jboss3.lbfactor=1

worker.jboss.type=lb
worker.jkstatus.type=status
worker.jboss.sticky_session=1
worker.jboss.balance_workers=jboss1,jboss2,jboss3

Configuring JBoss to work with mod_jk
Finally, we must configure the JBoss AS instances on all clustered nodes so that they can
expect requests forwarded from the mod_jk loadbalancer. On each clustered JBoss node, we have to
name the node according to the name specified in workers.properties.

$vim JBOSS_HOME/server/jboss1/deploy/jbossweb.sar/server.xml

Search for line <Engine name=”jboss.web” defaultHost=”localhost”> & add jvmRoute as below.

<Engine name=”jboss.web” defaultHost=”localhost” jvmRoute=”jboss1″>

Save & close the file. Make same changes on jboss2 & jboss3.

You also need to be sure the AJP connector in server.xml is enabled (i.e., uncommented). It is
enabled by default. Here your jboss instance is listening on ajp port (8009), you can disable http port
(8080).

<!– An AJP 1.3 Connector on port 8009 –>
<Connector protocol=”AJP/1.3″ port=”8009″ address=”${jboss.bind.address}”
redirectPort=”8443″ />

Now restart jboss1, jboss2 & jboss3.
Also restart apache server & check logs.
Access the the url for jmx-console as http://HOST_IP/jmx-console & http://HOST_IP/jkstatus

Central Syslog Server

It’s so easy if you want to have logs centrally. So you need to decide which server will be syslog server, and then do this:

1. On the server edit: /etc/sysconfig/syslog

Make the settings like:

SYSLOGD_OPTIONS=”-m 0 -r”

2. On the client edit: /etc/syslog.conf

Add this line:

*.*                                @syslog_server_ip_address

Thats all, your clients will send logs to central location, and also if you have other default configuration, they will log locally.

Open Source Alternatives for Server Software

According to a recent study by Stanford University consulting professor Jonathon Koomey, there are approximately 31.6 million servers installed around the world, including about 11.5 million in the United States. If organizations had to use only proprietary software for all of those systems, the resulting costs would be astronomical.

Fortunately, the open source community has a huge selection of server software that can lower those costs significantly. For this list, we focused on some of the top open source tools that offer alternatives to proprietary server software. We’ve organized them into categories to make browsing the list easier.
As always, if you’d like to suggest additional open source server software that you think should have been included on the list, please feel free to add it in the comments section below.

Content Management Systems

1. Joomla Replaces OpenText,Sitecore CMS, Kentico
The “world’s most popular open source CMS,” Joomla runs 2.7 percent of the websites on the Internet, including sites for Harvard University, Citibank, IHOP and the Guggenheim Museum. It provides both a repository to manage your Web content and a platform to build your own Web applications. Operating System: OS Independent

2. Drupal Replaces OpenText,Sitecore CMS, Kentico
Well-known users of this very popular CMS include the White House, the Economist, Fast Company and the World Wildlife Fund. It’s highly flexible, robust and can be used for “everything from personal blogs to enterprise applications.” Operating System: OS Independent

3. XOOPS Replaces OpenText,Sitecore CMS, Kentico
This award-winning Web content management system offers ease of use and a modular design. It’s driven by a MySQL database and includes advanced user management features. Operating System: OS Independent

4. Alfresco Replaces SharePoint, Documentum, Open Text
Alfresco combines document management, Web content management, records management and collaboration into a single package. In addition to the free community version, it also comes in paid Enterprise and Cloud versions. Operating System: Windows, Linux

5. DotNetNuke Replaces OpenText,Sitecore CMS, Kentico
Used by 700,000 websites, DotNetNuke claims to be “the leading open source Web content management system for ASP.NET.” It comes in a free community edition and paid professional editions; in addition, more than 10,000 modules and skins are also available for purchase. Operating System: Windows

6. Get Simple Replaces OpenText,Sitecore CMS, Kentico
Downloaded more than 60,000 times, this CMS is growing in popularity, particularly among SMBs. As you might guess from the name, its claim to fame is its simplicity and intuitive interface. Operating System: Linux

7. Liferay Replaces SharePoint, WebSphere
Liferay includes content and document management, Web publishing, shared workspaces, collaboration, social networking and identity management capabilities. It advertises itself as simpler than WebSphere and more flexible than Sharepoint. It’s also available in a commercially supported enterprise edition. Operating System: OS Independent

8. Magnolia Replaces SharePoint, OpenText,Sitecore CMS, Kentico
Boasting Fortune 500 and government users in more than 100 countries, Magnolia was designed to make it easy for business users to enter and edit Web content. Commercially supported versions are available with prices that vary based on the SLA. Operating System: Windows, Linux

9. WebGUI Replaces OpenText,Sitecore CMS, Kentico
WebGUI calls itself an “all-in-one CMS,” and it offers both Web content management and a Web application development platform. In order to help users learn the software, the site offers a video tutorial and weekly training webinars. Operating System: Windows, Linux/Unix, OS X

10. Owl Intranet Knowledgebase Replaces: Interspire Knowledge Manager
Owl lets you create a knowledgebase or FAQ site. It’s available in both a regular version and an “ultralite” version that does not use a database. Operating System: Windows, Linux

Databases

11. MySQL Replaces Microsoft SQL Server
The “world’s most popular open source database,” Oracle-owned MySQL boasts high performance, high reliability and ease of use. In addition to the free community version, it’s available in paid standard, enterprise and cluster carrier grade versions. Operating System: Windows, Linux, OS X

12. PostgreSQL Replaces Microsoft SQL Server
PostgreSQL calls itself “the world’s most advanced open source database.” Key features include Multi-Version Concurrency Control (MVCC), point-in-time recovery, online/hot backups, asynchronous replication, nested transactions (savepoints) and write ahead logging for fault tolerance. Operating System: Windows, Linux, OS X

13. Firebird Replaces Microsoft SQL Server
Under development since 1981, Firebird is a mature RDBMS that boasts excellent concurrency, scalability and performance. Notable features include multi-generation architecture, high compatibility with ANSI SQL, logging and monitoring capabilities, online backup, full text search and more. Operating System: Windows, Linux, Unix, OS X, Solaris

E-Commerce

14. Magento Replaces Big Commerce, Volusion, Yahoo Merchant
Magento is the e-commerce platform of choice for more than 100,000 merchants, including Dockers, Ford, the North Face, Samsung, Oneida and others. In addition to the free community version, it also comes in paid professional and enterprise versions, and it’s also available as a turn-key hosted solution for small businesses. Operating System: Windows, Linux, OS X

15. PrestaShop Replaces Big Commerce, Volusion, Yahoo Merchant
Award-winning PrestaShop is used by more than 95,000 Internet sites around the world. Commercial support and training are available, but prices are given in Euros. Operating System: Windows, Linux, OS X

16. Zen Cart Replaces Big Commerce, Volusion, Yahoo Merchant
Designed in part by ecommerce shop owners, Zen Cart is very user friendly, and the Web site offers simple instructions that begin with the basics: “Get a server.” It includes features like multiple payment methods, multiple shipping options, a newsletter manager, coupons, quantity discounts and more. Operating System: OS Independent

Mail Server

17. Zimbra Replaces Microsoft Exchange
Now owned by VMware, Zimbra offers a flexible but simple mail server with a low total cost of ownership. In addition to the free community version, it’s also available in paid appliance and network editions, and a desktop e-mail client is available as well. Operating System: Linux, Unix, OS X

18. Citadel Replaces Microsoft Exchange
This turn-key mail server supports e-mail, group calendars, contacts, IM, a wiki and more, all accessible through a Web interface. It’s also available on a hosted basis. Operating System: Linux

19. Postfix Replaces Microsoft Exchange
Estimates suggest that around 20 percent of all mail servers use Posftix, making it the most popular currently. Postfix was originally created by IBM Research as a better alternative to Sendmail, and it has also been known as “IBM Secure Mailer” and “VMailer.” Operating System: Linux, Unix, OS X, Solaris

20. Sendmail Replaces Microsoft Exchange
Although its popularity has declined in recent years, Sendmail still accounts for about 16 percent of the mail servers in use. Supported hard appliances and virtual appliances are also available under the brand name Sentrion. Operating System: Linux

21. Exim Replaces Microsoft Exchange
Developed at the University of Cambridge, Exim is a highly configurable mail transport agent. It can handle thousands of e-mails per hour, but if queues are exceptionally large, it does not perform as well as some of the other options on the list. Operating System: Linux, Unix

File Transfer

22. FileZilla Replaces CuteFTP, FTP Commander
FileZilla allows you to set up your own FTP server on a Windows machine. It supports FTP, FTPS and SFTP, and the same project also offers a cross-platform FTP client. Operating System: Windows

Operating System

23. Ubuntu Server Replaces Windows Server
Now one of the most popular flavors of Linux, Ubuntu has a reputation for being easy to use and manage. It comes with built-in KVM virtualization capabilities, and it works with Ubuntu Enterprise Cloud to allow you to create a private cloud.

24. Red Hat Enterprise Linux Server Replaces Windows Server
One of the most well-known enterprise distributions of Linux, Red Hat is known for its reliability, scalability and security. It includes integrated virtualization, the LAMP stack, the Eclipse IDE, and advanced management tools. Note that Red Hat requires a commercial support package.

25. SUSE Enterprise Linux Server Replaces Windows Server
Used by more than 13,000 businesses around the world, SUSE counts the London Stock Exchange, Office Depot, Sony and Walgreens among its high-profile users. In addition to the standard version, it also comes in System z, desktop, SAP, JeOS and other versions. As with Red Hat, SUSE requires commercial support; if you prefer an unsupported, free version, try openSUSE (below).

26. openSUSE Replaces Windows Server
For those who don’t want commercial support, the free openSUSE also comes in a server version. However, it does not have as many features and options as the commercial version.

27. Mandriva Enterprise Server Replaces Windows Server
Mandriva calls itself the “simple, high-performance, accessible Linux server.” It provides Web, messaging, files, printing, virtualization and directory services. Note that the enterprise server version of Mandriva requires a fee.

28. Illumos/OpenIndiana Replaces Oracle Solaris
When Oracle discontinued development of OpenSolaris, some of the developers who had been working on the project forked it to the Illumos project, where development and bug fixes continue. If you are looking for a free version of Solaris, this is the option for you. To download the software, visit the OpenIndiana page above.

Security

29. ASSP Replaces GFI Mail Essentials, Barracuda Spam and Virus Firewall, Abaca Email Protection Gateway
Short for “Anti-Spam SMTP Proxy,” ASSP stops spam at your mail server. Key features include easy browser-based setup, support for most mail servers, automatic whitelisting, virus scanning through ClamAV, Bayesian filters, community-based gray-listing and more. Operating System: OS Independent

30. Devil-Linux Replaces Barricuda NG Firewall, Check Point Appliances
This Linux distribution functions as both a network firewall and an application server. It also includes many open source network and sever monitoring tools. Operating System: Linux

31. P3Scan Replaces GFI Mail Essentials, Barracuda Spam and Virus Firewall, Abaca Email Protection Gateway
This transparent proxy server works with Clam AV and other anti-virus software to scan incoming and outgoing e-mail for viruses, worms, trojans, spam and harmful attachments. Operating System: Linux

Small Business Server

32.Zentyal Replaces Windows Small Business Server
With Zentyal, you get a gateway, an infrastructure manager, a unified threat manager, an office server and/ or a unified communication server all in one package. Professional support, training and add-ons are also available on the site. Operating System: Linux

33.SME Server Replaces Windows Small Business Server
Based on the CentOS distribution of Linux, SME offers file and print sharing, mail server, network firewall, remote access, a Web application server and more. It boasts thousands of users, good security and user-friendly setup and operation. Operating System: Linux

Server Log File Monitoring and Analysis

34. AWStats Replaces Sawmill, TriGeo
AWStats uses the log files from your Web, streaming, FTP or mail server to create easy-to-read graphical reports. It runs from the command line or as a CGI. Operating System: Windows, Linux, OS X

35. Analog Replaces Sawmill, TriGeo
The self-proclaimed “most popular logfile analyzer in the world,” Analog quickly generates usage statistics for Web servers. It can be used in conjunction with Report Magic to create more attractive graphs. Note that this project has not been updated in a while, but it is still used to analyze traffic on many servers. Operating System: Windows, Linux, OS X

36. Webalizer Replaces Sawmill, TriGeo
Like AWStats and Analyzer, Webalyzer analyzes the statistics from Web servers. By default, it creates yearly and monthly usage reports which can be viewed from any browser. Operating System: Windows, Linux, OS X

37. Snare Replaces LogLogic, SenSage Log Management
The Snare project encompasses a number of different tools and agents, all of which assist in the filtering, collection and monitoring of server log files. Commercial support and the proprietary Snare Server are also available on the same site. Operating System: Windows, Linux, OS X, others

Storage

38. FreeNAS Replaces Isilon products, IPDATA appliances, Netgear ReadyNAS
Based on BSD, this app allows you to create network attached storage for sharing files across Windows, OS X, Linux and Unix-like systems. Key features include a Web-based interface, the Zettabyte File System, snapshots, thin provisioning and more. Operating System: FreeBSD.

39. Gluster Replaces Isilon products, IPDATA appliances, Netgear ReadyNAS
Very recently acquired by Red Hat, Gluster offers open source file systems for public and private cloud-based storage. Used with commodity hardware, the Gluster file system can create network storage solutions that scale out to 72 brontobytes. (The number of bytes in a brontobyte is a one followed by 27 zeros.) Operating System: Linux

40. Openfiler Replaces IPDATA appliances, Netgear ReadyNAS
Downloaded more than 250,000 times, Openfiler offers both file-based Network Attached Storage and block-based Storage Area Networking. Key features include volume-based partitioning, iSCSI (target and initiator), scheduled snapshots, resource quota, and a unified interface for share management. Operating System: Linux

Virtualization

41. Xen Replaces VMware products, Microsoft Hyper-V
Used by many commercial cloud services, the Xen hypervisor is included in most Linux distributions and is also available as an appliance. Many commercial virtualization products, including the Citrix XenServer, are built on top of Xen. Operating System: Windows, Linux, Solaris, others

42. VirtualBox Replaces VMware products, Microsoft Hyper-V
VirtualBox offers virtualization for x86 and AMD64/Intel64 servers and desktops. Pre-built VirtualBox appliances are available for download from Oracle. Operating System: Windows, Linux, OS X, Solaris, others

43. OpenVZ Replaces VMware products, Microsoft Hyper-V
OpenVZ takes a different approach to virtualization: unlike VMware, VirtualBox and many other virtualization solutions which use VMs, OpenVZ offers container-based virtualization through VEs or VPSs. Commercial products based on OpenVZ are sold as Parallels Virtuozzo Containers. Operating System: Linux

44. KVM Replaces VMware products, Microsoft Hyper-V
Short for “Kernel-based Virtual Machine,” KVM allows users to run multiple Linux or Windows virtual machines on a single server. Like Xen, it’s included in many Linux distributions. Operating System: Windows, Linux

Web Servers

45. Apache HTTP Server Replaces Microsoft IIS, Oracle iPlanet Web Server
Used by 63 percent of all websites, Apache has been the most popular Web server for more than a decade. It prides itself on being secure, efficient and extensible. Operating System: Windows, Linux, OS X

46. Nginx Replaces Microsoft IIS, Oracle iPlanet Web Server
Nginx (pronounced “engine X”) is both an HTTP and a mail proxy server. Currently powering about 8 percent of all websites, it’s the third most popular Web server. Operating System: Windows, Linux, OS X

47. Apache Tomcat Replaces Microsoft IIS, Oracle iPlanet Web Server
Often used alongside the Apache HTTP server, Tomcat offers a “pure Java” HTTP web server for running Java code. Well-known websites that use Tomcat include Walmart, E*Trade, The Weather Channel and many others. Operating System: Operating System: Windows, Linux, OS X

48. XAMPP Replaces Microsoft IIS, Oracle iPlanet Web Server
Most of them time when you want to install the Apache Web server, you’ll also need other tools, like MySQL, PHP and Perl. This group of downloads bundles together all of those tools—along with a variety of other open source software that’s helpful for running a Web server—in an easy-to-deploy package customized for each of the major operating systems. Operating System: Windows, Linux, OS X, Solaris

49. WampServer Replaces Microsoft IIS, Oracle iPlanet Web Server
This is another project that bundles together Apache, MySQL and PHP into an easy-to-install package. However, this one only supports Windows. Operating System: Windows

50. AppServ Replaces Microsoft IIS, Oracle iPlanet Web Server
The goal of the App Serv project is simple: allow users to set up a Web server with Apache, MySQL and PHP in one minute or less. Note that this project originated in Thailand so some of the English documentation reads a little strange. Operating System: Windows, Linux

Wiki/Collaboration

51. DokuWiki Replaces: Confluence, SamePage
If you just need a simple wiki, DokuWiki is easy-to-use, standards compliant and doesn’t require a separate database. Commercial support is available through a variety of third-party companies. Operating System: OS Independent

52. MediaWiki Replaces: Confluence, SamePage
Best known as Wikipedia’s software, MediaWiki can handle extremely large projects with terabytes of data and thousands of hits per second. It’s extremely customizable and is fairly simple for end users to learn. Operating System: Windows, Linux/Unix, OS X

53. MindTouch Core Replaces: Sharepoint, IBM Lotus
Althought it’s a little tough to find the open source version of MindTouch on the company’s website, the source code for the core wiki program is still available for a free download. According to the website, it’s been ranked the number one open source collaboration tool. The company offers several other products based on the open source engine. Operating System: Windows, Linux

54. TikiWiki Replaces: Confluence, SamePage
More than just a wiki, TikiWiki also offers support for forums, blogs, image galleries, map servers, RSS feeds, bug trackers and more. It has been downloaded more than 900,000 times and currently powers tens of thousands of websites. Operating System: OS Independent

Mod_rewrite

Turn Mod_Rewrite On

Mod_rewrite is used through your .htaccess file. Place the following code at the beginning of your .htaccess file to turn mod_rewrite on:

RewriteEngine on

(Don’t forget that .htaccess commands are case-sensitive.) This code needs to be entered at the beginning of any .htaccess file using mod_rewrite.
The Basic Mod_Rewrite Layout

The basic format for a mod_rewrite command is:

RewriteRule Pattern Substitution [Flag(s)]

URLs are Always Relative

The URL you redirect to is always relative to the directory in which your .htaccess file is placed.
So if it’s in the root directory, URLs are all in relation to the root directory; if it’s in a sudirectory, URLs are in relation to that particular subdirectory.
A Basic Redirect

If you just want to create a simple 301 redirect from one URL to another, then use the following code:

RewriteRule ^fileone.html$ filetwo.html

This is a very basic rule that means any requests for fileone.html will be sent to filetwo.html.
Require no “www”

This bit of code will make it so visitors to your site don’t need to type in the “www” bit of your website address.
view plaincopy to clipboardprint?

RewriteCond %{HTTP_HOST} !^rmohan\.com$ [NC]
RewriteRule ^(.*)$ http://rmohan.com/$1 [R=301,L]

Block a Specific IP Address

If you want to block someone coming from a specific IP address from accessing your website, you can use the following code:
view plaincopy to clipboardprint?

RewriteCond %{REMOTE_ADDR} ^(A\.B\.C\.D)$
RewriteRule ^/* http://www.rmohan.com/sorry.html [L]

Replace the A\.B\.C\.D with the IP address you want to block (don’t forget to leave the “\” before each dot, which escapes the character).
Block Specific User Agents

If you want to block a group of IP addresses using the same User Agent (bot), the following code with do it:

RewriteCond %{HTTP_USER_AGENT} UserAgent
RewriteRule .* – [F,L]

Just replace the “UserAgent” bit with whatever user agent you want to block. You can also block more than one at a time by replacing the top line in that code with something like this:

RewriteCond %{HTTP_USER_AGENT} UserAgentA [OR]
RewriteCond %{HTTP_USER_AGENT} UserAgentB

You can put as many user agents in as you want, just make sure you end each line with [OR] (with the exception of the last line, of course).

Let’s say all the pages on your site other than your home page are formatted as follows, with query strings instead of page names:

http://www.rmohan.com/home.html?rmohan=12345abcd

Those aren’t very pretty, and on top of that, search engines will show a bunch of duplicated “home” pages. If you want to get rid of the query string in your page URLs, use the following code:
view plaincopy to clipboardprint?

RewriteCond %{QUERY_STRING} rmohan=
RewriteRule (.*) http://www.rmohan.com/$1? [R=301]

This not only gets rid of the query string, but also the preceding question mark.
Set up a Default Image

Using a default, backup image in case of broken images can make your site look more professional.
Use the following code to redirect to a default image for any image whose file cannot be found.
view plaincopy to clipboardprint?

RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^images/.*\.jpg$ /images/default.jpg [L]

Of course, you can change the “.jpg” bit to whatever file type you’re using.
Make sure you have an image called “default.jpg” or change that to whatever your default image filename is.

Prevent Hotlinking

The last thing most website owners want is other sites stealing their content or worse—hotlinking to their images and stealing their bandwidth.
Here’s a simple bit of code that prevents it:
view plaincopy to clipboardprint?

RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?rmohan.com/ .*$ [NC]
RewriteRule \.(gif|jpg|swf|flv|png)$ /feed/ [R=302,L]

Redirect to a Maintenance Page

If you need to take your entire site offline for a bit and redirect to a maintenance page (or some other page), use the following code:

RedirectMatch 302 ^/ /maintenancepage.html

Change the “maintenancepage.html” bit to wherever your maintenance page file is located.
Redirect Multiple rmohans to a Single rmohan

If you have multiple rmohans pointing to your site, it’s possible you could take a hit in the search engines for having duplicate content.
Use the following code to redirect visitors from two rmohans to just one:
view plaincopy to clipboardprint?

RewriteCond %{HTTP_HOST} ^www.rmohan.com$ [NC,OR]
RewriteCond %{HTTP_HOST} ^rmohan.com$ [NC,OR]
RewriteCond %{HTTP_HOST} ^www.rmohan.com$ [NC]
RewriteRule ^(.*)$ http://rmohan.com/$1 [R=301,L]

Remember the Filesystem Always Takes Precedence

The filesystem on your server will always take precedence over the rewritten URL. For rmohan, if you have a directory named “services” and within that directory is a file called “design.html”, you can’t have the URL redirect to “http://rmohan.com/services”. What happens is that Apache goes into the “services” directory and doesn’t see the rewrite instructions.

To fix this, simply rename your directory (adding an underscore to the beginning or end is a simple way to do that).

check it yourself using these simple step.

Step1. Create a blank text file using notepad or any other editor.
Step2. Put <?php phpinfo(); ?> in the file.
Step3. Save as ‘info.php’ [on windows Save as “info.php” (with double quotes)].
Step4. Upload the file to your web server’s root or any other folder.
Step5. Call the file in the url – http://your-rmohan.com/info.php and check if you see mod_rewrite in ‘Apache loaded modules’ section.
If NOT, then please contact your hosting provider and request them to install/enable mod_rewrite.

Note: If you have access to your httpd.conf file, you may check for mod_rewrite in that file as well. And also your httpd.conf must be configured to allow Fileinfo override. Contact your hosting provider for any server related issues.

Next thing you would do is check your .htaccess file. Make a backup of your existing .htaccess file so that in case because of your changes if web server does not serve your site, you can always restore the backup copy.
rmohans of mod_rewrite

1. Description – Your current pages are called using index.php with parameter of url i.e
http://www.rmohan.com/index.php?url=category
and instead of this URL, you want a nice and easy to read URL like http://www.rmohan.com/category
Solution – Put the following lines in your .htaccess file.

RewriteEngine on
RewriteRule ^([^/\.]+)/?$ /index.php?url=$1 [L]

Note: If your file already contains a line ‘RewriteEngine on’ then you don’t need to put it again unless it was set to off before you putting in your lines.

2. Description – Your current URL is
http://www.rmohan.com/index.php?cat=category&subcat=subcategory
which you would like to see as
http://www.rmohan.com/category/subcategory
Solution – Put the below lines in your .htaccess file

RewriteEngine on
RewriteRule ^([^/\.]+)/([^/\.]+)/?$ /index.php?cat=$1&subcat=$2 [L]

3. Description – You want to have many sub categories or categories like
http://www.rmohan.com/category/subcat1/subcat2/subcat3/subcat4/subcat5/
which you would to rewrite to
http://www.rmohan.com/index.php?cat=category&subcat1=subcat1&subcat2=subcat2 and so on …
Solution – See below lines..

rmohan.com/category –> index.php?cat=category
RewriteRule ^([^/\.]+)/?$ /index.php?cat=$1 [L]

rmohan.com/category/subcategory/ –> index.php?cat=category&subcat=subcategory
RewriteRule ^([^/\.]+)/([^/\.]+)/?$ /index.php?cat=$1&subcat=$2 [L]

rmohan.com/p1/p2/p3/ –> index.php?a=p1&b=p2&c=p3
RewriteRule ^([^/\.]+)/([^/\.]+)/([^/\.]+)/?$ /index.php?a=$1&b=$2&c=$3 [L]

rmohan.com/p1/p2/p3/p4 –> index.php?a=p1&b=p2&c=p3&d=p4
RewriteRule ^([^/\.]+)/([^/\.]+)/([^/\.]+)/([^/\.]+)/?$ /index.php?a=$1&b=$2&c=$3&d=$4 [L]

4. Description – Your URL has a folder and you would like rewriting for that folder. The URL looks like this http://rmohan.com/folder/index.php?url=name which you want to see as http://rmohan.com/folder/name/
Solution – Place the following lines in your .htaccess file

RewriteEngine on
RewriteRule ^folder/([^/\.]+)/?$ folder/index.php?url=$1 [L]

5. Description – Your actual URL is http://rmohan.com/index.php?page=hello which you want to see as http://rmohan.com/hello.htm
Solution – Place the following lines in your .htaccess file

RewriteEngine on
RewriteRule ^([^/\.]+).htm$ index.php?page=$1 [L]

6. Description – Your URL is http://rmohan.com/folder/index.php?page=hello which you want to see as http://rmohan.com/folder/hello.htm
Solution – Place the following lines in your .htaccess file

RewriteEngine on
RewriteRule ^folder/([^/\.]+).htm$ folder/index.php?page=$1 [L]

Force redirect the NON www version to www. version by HTACCESS

ou want to force the www in your domain name (and you don’t have subdomains), as for example our website is http://rmohan.com and we want our visitors when type http://rmohan.com in their browsers address bar they will be redirected to http://www.rmohan.com ( www. added to URL).

You will need Apache’s {HTTP_HOST} variable to see if the www. is already there and, if not, redirect.

RewriteEngine on
RewriteCond %{HTTP_HOST} !^www\.rmohan\.com$ [NC]
RewriteRule .? http://www.rmohan.com%{REQUEST_URI} [R=301,L]

Explanation :
{HTTP_HOST} is the Apache variable, which always starts with %.

The RewriteCond %{HTTP_HOST} !^www\.rmohan\.com$ [NC] means when the HTTP_HOST or domain name typed is not www.rmohan.com then a redirection happens by the following statement.
RewriteRule .? http://www.rmohan.com%{REQUEST_URI} [R=301,L]

%{HTTP_HOST} !^www\.rmohan\.com$ [NC] means
%{HTTP_HOST} NOT (!) STARTS WITH (^) www.rmohan.com ENDS WITH ($)
that is %{HTTP_HOST} not equal to www.rmohan.com or that means %{HTTP_HOST} doesnot match with www\.rmohan\.com

Here \ is an ESCAPE CHARACTER, . is used by HTACCESS and have a regular expression meaning, so when you need to use . in a regular expr statement you need to write \ before it as \., e.g thanks. should be written as thanks\.

NC means NO CASE, that is uppercase or lowercase letters doesnot matter. This is because domain name is not case sensitive.

Now the RewriteRule statement in HTACCESS
RewriteRule .? http://www.rmohan.com%{REQUEST_URI} [R=301,L]

The RewriteRule says to match zero or one of anything then redirect to http://www.example.com with the original {REQUEST_URI}. The R=301 tells the browser (and search engines) that this is a permanent redirection and the Last flag tells mod_rewrite that you’ve completed your redirection.

 

For example normal website name is http://www.rmohan.com, and you want to redirect all mobile visitors based on mobile devices then add below code in your .htaccess file.

RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} “android|blackberry|ipad|iphone|ipod|iemobile|opera mobile|palmos|webos|googlebot-mobile” [NC]
RewriteRule .* http://www.rmohan.com/ [R]

Note: Replace www.rmohan.com with your domain name.

The htaccess code works by examining a special string, called HTTP header “User-Agent” which the browser send. For exampe iPad sends a User-Agent header similar to this one

User-Agent: Mozilla/5.0 (iPad; U; CPU OS 4_3_1 like Mac OS X; en-us) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8G4 Safari/6531.21.10

What if we want to redirect users to mobile site and in the same time give them an ability to switch back to the full site version. then add below rules to .htaccess file.

// This code for redirecting user to the mobile site unless there is a cookie //
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} “android|blackberry|ipad|iphone|ipod|iemobile|opera mobile|palmos|webos|googlebot-mobile” [NC]
RewriteCond %{HTTP_COOKIE} !^.*mobilesite=no.*$
RewriteRule ^.*$ https://m.rmohan.com [R=301]

RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} “android|blackberry|ipad|iphone|ipod|iemobile|opera mobile|palmos|webos|googlebot-mobile” [NC]
RewriteCond %{HTTP_COOKIE} !^.*mobilesite.*$
RewriteRule ^.*$ https://m.rmohan.com [R=301,CO=mobilesite:yes:.rmohan.com:60]

In the above rule cookie expiration time is set to 60 minutes, during this time user will access non mobile site version. Please don’t forget to replace domain names.

But what if user is requested a non-mobile site, then add below rules to give full version of website.

RewriteEngine On
RewriteCond %{REQUEST_URI} ^.*fullversion.*$
RewriteRule ^.*$ https://rmohan.com [R,L,CO=mobilesite:no:.rmohan.com:60]

 

Manipulating the Query String in Apache Rewrite

 

The query string is the part of the URL that follows the question mark (?). It is often used to pass parameters to CGI scripts or other dynamic pages. It is typically available in the QUERY_STRING environment variable.

The typical URL-manipulation directives such as , Redirect, Alias, and RewriteRule cannot directly access the query string. But mod_rewrite can be used to add, remove, or modify the query string. The trick is to use a RewriteCond to match against the %{QUERY_STRING} variable and, if necessary, the [QSA] flag to append to an existing query string.

Some examples follow. These examples all assume that they are placed in the main server configuration file. If they are placed in a section or .htaccess file, the RewriteRule will need to be modified accordingly. Also, these examples can all be transformed from internal alias to external redirects by adding the [R] flag to the RewriteRule.

Be cautious when dealing with complex query strings, since the order of the variables is often arbitrary.

 

Access control by Query String

Deny access to http://example.com/page?var=val if var=val contains the string foo.

 

RewriteCond %{QUERY_STRING} foo
RewriteRule ^/page - [F]

 

Removing the Query String

Delete the query string entirely.

 

RewriteRule ^/page /page?

 

Adding to the Query String

Keep the existing query string using the Query String Append flag, but add var=val to the end.

 

RewriteRule ^/page /page?var=val [QSA]

 

Rewriting For Certain Query Strings

Rewrite URLs like http://example.com/page1?var=val to http://example.com/page2?var=val but don’t rewrite if val isn’t present.

 

RewriteCond %{QUERY_STRING} val
RewriteRule ^/page1 /page2

Note that you don’t need to use the Query String Append flag if you won’t modify the query string in the RewriteRule; it is left as-is in the URL by default.

 

Modifying the Query String

Change any single instance of val in the query string to other_val when accessing /path. Note that %1 and %2 are back-references to the matched part of the regular expression in the previous RewriteCond.

 

RewriteCond %{QUERY_STRING} ^(.*)val(.*)$
RewriteRule /path /path?%1other_val%2

 

Making the Query String Part of the Path

Take a URL of the form http://example.com/path?var=val and transform it into http://example.com/path/var/val. Note that this particular example will work only for a single var=val pair containing only letters, numbers, and the underscore character.

 

RewriteCond %{QUERY_STRING} ^(\w+)=(\w+)$
RewriteRule ^/path /path/%1/%2?

 

Making the Path Part of the Query String

Essentially the reverse of the above recipe. But this example, on the other hand, will work for any valid three level URL. http://example.com/path/var/val will be transformed into http://example.com/path?var=val.

 

RewriteRule ^/path/([^/]+)/([^/]+) /path?$1=$2

These days, on-line services. Blog and wiki services also need to port 80, so 80 to Apache management, then 8080 Tomcat behind apache connection.

The main Apache + Tomcat There are three ways: mod_jk, mod_proxy and ajp_proxy. mod_jk more specific method of Tomcat through AJP protocol connection Tomcat, mod_proxy is more than can be connected to the Tomcat, as long as the application HTTP reverse proxy. ajp_proxy not very clear, specific, see here.

I encountered three different configurations before and after. First build a test service, service structures on one machine within the network and outside the network machine’s 8080 port mapping network port 80 access. Port due to external exposure only be mapped to a 80-port, natural Apache push up. Using mod_proxy reverse proxy configuration. Then the above requirements to build two running instances, he opened it the two Tomcat, with a duplicate proxy. One in 18,080, one at 28080.
? View Code CONF

ProxyPass / app http://localhost:18080/app
ProxyPassReverse / app http://localhost:18080/app
ProxyPass / app2 http://localhost:28080/app2
ProxyPassReverse / app2 http://localhost:28080/app2

The second environment is not Apache + Tomcat, but IIS + Tomcat. Not familiar with IIS, within a period of time scratching their head. IIS, I did not find practical mod_proxy components, in particular the use of the ISAPI mod_proxy. Another major change in demand, this request for service support SaaS our service SaaS domain name to distinguish the different tenants. Users such as visit through abc.example.com and def.example.com, although the use of the same application, but to operate in a different tenant space.
Possible solution is to use the ISAPI Rewrite. The ISAPI Rewrite fact Proxy functionality, but that is fee-based version. The free Lite version only URL Rewrite function. I had to completely give up the intention of the proxy, redirect the user to do. Such as access http://abc.example.com the user will be redirected to http://abc.exmaple.com:8080/app. Wiki and blog access, as an exception in the configuration file. The following is the configuration file:
? View Code CONF

RewriteCond% {HTTP: Host} example \. Com $
RewriteCond% {HTTP: Host}! Www \. Example \. Com $
RewriteCond% {HTTP: Host}! Wiki \. Example \. Com $
RewriteCond% {HTTP: Host}! Blog \. Example \. Com $
RewriteRule app / (. *) Http://% {HTTP: Host} \: 8080/app / $ 1 [NC, R = 301]
RewriteCond% {HTTP: Host} example \. Com $
RewriteCond% {HTTP: Host}! Www \. Example \. Com $
RewriteCond% {HTTP: Host}! Wiki \. Example \. Com $
RewriteCond% {HTTP: Host}! Blog \. Example \. Com $
RewriteRule (. *) Http://% {HTTP: Host} \: 8080/app [NC, R = 301]
RewriteCond% {HTTP: Host} www \. Example \. Com $
RewriteRule ^ / $ http://% {HTTP: Host} / app / index.htm [NC, R = 301]
RewriteCond% {HTTP: Host} wiki \. Example \. Com $
RewriteRule ^ / (. *) $ Http://www.example.com/wiki/ $ 1
RewriteCond% {HTTP: Host} blog \. Example \. Com $
RewriteRule ^ / (. *) $ Http://www.example.com/blog/ $ 1

Third, after the fight, the server’s port 80 so that in the Apache. I intend to cut back to the first time the mod_proxy configuration, but found a fatal problem: Request ri Host content has been mod_proxy modified become configure the localhost in the file does not reflect real user request abc.example.com or the def.example.com. Moreover, the system is also required to support real-time add tenants that add new *. Example.com access not reboot the system.
mod_proxy any background HTTP service to do a reverse proxy, yet the pan-domain access to stand in the door. In addition, I finally understand why Tomcat test server access log source 127.0.0.1 – source Apache the proxy.
mod_jk configuration, although you still need to enter the Tomcat Host, but it seems AJP agreement retains the front desk domain name (daemon obtained through request.getServerName ()). The IP address of the client have been successfully recorded. Interested students can see the AJP 1.3 protocol reference. mod_jk configuration is not posted the concrete can see the beginning of the introduction proxy_ajp that link.

 Multi-domain apache configuration

Apache configure multiple domain names, generally two methods, virtual hosts and use mod_rewrite URL redirect or pseudo-chain ~
Virtual Host Configuration last simple add method in the httpd.conf file, for example:

<VirtualHost Www.ll19.com>
DocumentRoot usr/local/www/ll19
ServerName www.ll19.com
# ErrorLog logs / minidx.com-error_log
# CustomLog logs / minidx.com-access_log common
</ VirtualHost>
 
<VirtualHost Www.baidu.com>
DocumentRoot usr / local / www / baidu
ServerName www.baidu.com
</ VirtualHost>

So when access to the relevant domain name will jump to the corresponding directory the virtual host biggest drawback consumption performance, and seems to be used to host static files and APACHE connections and load balancing background mod_jk conflict, so personal do not recommend using the virtual host to manage the domain name.
Using mod_rewrite to redirect the domain name or pseudo-chain:

Mod_rewrite support, you first need to open the search in the httpd.conf file:

# LoadModule rewrite_module modules / mod_rewrite.so

Remove the # sign, open mod_rewrite, continue to search for change AllowOverride None to AllowOverride All, Open htaccess support. Note that AllowOverride can be set for each directory, there should be the apache DocumentRoot root path settings to AllowOverride All:

<Directory “/var/www/html”>
    AllowOverride All
</ Directory>

After the establishment. Htaccess file is placed under the DocumentRoot to manage the domain name by writing. Htaccess:

Domain name 301 redirect htaccess set:

RewriteEngine On
RewriteBase /
 
RewriteCond% {HTTP_HOST} ^ www.test.net.cn [NC, OR]
RewriteCond% {HTTP_HOST} ^ test.net.cn [NC]
RewriteRule ^ (. *) $ Http://www.test.com/test.html $ 1 [R = 301, L]
 
RewriteCond% {HTTP_HOST} ^ www.test.net [NC, OR]
RewriteCond% {HTTP_HOST} ^ test.net [NC]
RewriteRule ^ (. *) $ Http://www.test.com/test1.html $ 1 [R = 301, L]

Access www.test.net.cn, or test.net.cn the beginning of the domain name will jump to the beginning of http://www.test.com/test.html, www.test.net or test.net domain name will jump Go to http://www.test.com/test1.html.

Note that some of the symbols and parameters:

^ Www.test.net.cn to www.test.net.cn as at the beginning, and all languages! Behalf No, that,! ^ Www.test.net.cn said not to www.test.net.cn the beginning .

Of mod_rewrite legal template prefix, said “non” mean, this description does not meet certain matching conditions are very convenient, or as a last resort a default rule. Use! Can not be grouped wildcard in the template, not do backreferences.

R mandatory external redirect, can be followed on behalf of 301 or 302 jumps.

L indicates that the current rule is the last rule, stop the rewrite rules analyzed. (If any) satisfy the conditions

OR or mean domain on the the case both www.test.net.cn or test.net.cn the beginning.

NC is not case-sensitive.

$ N reference the RewriteRule template match string.

For example, in the previous example http://www.test.com/test.html $ 1, my personal test results:

Access http://www.test.net.cn/132 will jump to http://www.test.com/test.html132

This is a useful parameter, if removed $ 1 no matter http://www.test.net.cn the beginning of the address behind the link is, will ultimately turn to: http://www.test.com/test.html

Drawback is redirected to the domain name can not be preserved, it is not recommended, so the best way or the domain name pseudo-link set, writing is also very simple, remove the R = 301 is rewritten to the current server address path to:

Options + FollowSymLinks
 
RewriteCond% {HTTP_HOST} ^ www.test.net.cn [NC, OR]
RewriteCond% {HTTP_HOST} ^ test.net.cn [NC]
RewriteRule ^ (. *) $ / Test / cn / $ 1 [L]
 
RewriteCond% {HTTP_HOST} ^ www.test.net [NC, OR]
RewriteCond% {HTTP_HOST} ^ test.net [NC]
RewriteRule ^ (. *) $ / Test / net / $ 1 [L]

Access will jump to www.test.net.cn/ ** the corresponding localhot / test / cn / ** and related domain www.test.net.cn the will be retained.

Attachment: RewriteRule Parameter Detailed]

1) R mandatory external redirect, can be followed on behalf of 301 or 302 jumps.
2) F disabled URL, Back to 403HTTP status code.
3) G URL is GONE, Back to 410HTTP status code.
4) P is mandatory to use a proxy forwarding.
5) L indicates that the current rule is the last rule, stop the analysis after the rules rewrite.
6) N rewriting process again from the beginning of the first rule to run.
7) C is associated with the next rule.
8) T = MIME-type (force MIME type) the mandatory MIME type.
9) NS used to not only internal sub-request.
10) NC are not case sensitive.
11) QSA additional request string.
12) NE is not output escaping special characters.

There are many more things that you can do with mod_rewrite. As and when I discover more, I will keep updating this page.

Please feel free to post your usage of mod_rewrite

 

 

.htaccess – Authentication from File and LDAP or other sources at the same time

.htaccess – Authentication from File and LDAP or other sources at the same time

Sometimes you may need to authenticate a user against different credentials stores, like standard files (.htpasswd), databases, ldap, …
With Apache, you can use these more authentication sources by defining them in the AuthBasicProvider property.

The configuration bellow will authenticate a user first against a file (.htpasswd) and then against an LDAP accounts.

AuthName ‘Enter your Username and Password:’
AuthType Basic

# Authenticate against file and then against ldap
AuthBasicProvider file ldap

# auth file
AuthUserFile /var/www/.htpasswd

# LDAP auth fallback to other auth mechanisms
AuthzLDAPAuthoritative off
AuthLDAPURL ldap://10.0.0.1:6361/ou=web,dc=top?cn?sub?(objectClass=*)

# File auth
Require valid-user
# LDAP auth
Require ldap-attribute objectClass=simpleSecurityObject

You can use it in your Apache’s configuration and in the .htaccess as well.

.htaccess – Redirect to SSL (HTTPS) before Basic Authentication

.htaccess – Redirect to SSL (HTTPS) before Basic Authentication

 

I prefer running a site in HTTP only mode when there are no confidential information transferred (username, password, credit card number, etc.). It saves some of the CPU time because there is no need to do data encryption. But I strongly recommend to use HTTPS mode for confidential information exchange between a web browser and a web server.

I was facing a situation where I had to authenticate a user on a Apache web server, which provided HTTP as well as HTTPS connection. By default a web application running on that server was accessed only by HTTP. I had no access to the Apache’s configuration (no root access), what would not be a problem, if I wanted to do just a .htaccess and a .htpasswd based basic HTTP authentication without anything else. It’s pretty easy then. Just create a .htaccess file, with contents like this:

AuthName ‘Enter your Username and Password:’
AuthType Basic
AuthUserFile /var/www/myweb/.htpasswd
Require valid-user

and a .htpasswd file (man htpasswd) which will contain usernames and particular passwords.

Then put the .htaccess file into a directory which you want to be protected by username/password.

You can even customize it by adding a FileMatch property to require credentials validation only when accessing some files:

AuthName ‘Enter your Username and Password:’
AuthType Basic
AuthUserFile /var/www/myweb/.htpasswd
Require valid-user
<FilesMatch “(attach|edit|manage|rename|save|upload|mail|logon|.*auth).*”>
Require valid-user
</FilesMatch>

As I said above, I preffer HTTPS connection when confidential information are transfered over an IP network (in this case username and password). So the thing I wanted to do, was first to redirect a web browser to the HTTPS site and just then request the credentials. This was a point where I’ve got into a botleneck. If an authentication procedure is defined for a directory or a file, the authentication has higher priority then a redir command (mod_rewrite – redir). So the user is first authenticated, then moved to the HTTPS site and then authenticated once again. The problem is that the first athetincation is transferred in HTTP cleartext which is definitelly not secure.

AuthName ‘Enter your Username and Password:’
AuthType Basic
AuthUserFile /var/www/myweb/.htpasswd
Require valid-user
<FilesMatch “(attach|edit|manage|rename|save|upload|mail|logon|.*auth).*”>
RewriteEngine on
RewriteCond %{HTTPS} !=on    # If the connection is not HTTPS then apply the next Rewrite rule
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI}  [R,L]
Require valid-user
</FilesMatch>

After some hours spent with configuration and RTFM, I found a hack which is maybe not the ideal solution, but it’s pretty good and it’s working.

There is an Apache configuration command which can be used in .htaccess as well. If the “SSLRequireSSL” command is specified for a directory or a file and it’s accessed with a connection which is not SSL secured (HTTPS), it will generate a 403 error code and an error message will be sent to a web broswer. The “SSLRequireSSL” command has higher priority then the authentication itself, so it will generate this error code always when the connection is not SSL secured.
So far it looks good, the problem is that a user will just see an error page and he is still not automatically redirected to the HTTPS connection. A workaround is a bit tricky. You can define your own custom error documents, which are displayed when an error code is thrown. You have definitely seen these fancy custom error documents for the 404 – Page Not Found error code.

So the workaround was to use the ErrorDocument property in the .htaccess file. A custom page defined in ErrorDocument is called when the error code is thrown. The page itself gets information about the original request, so you can write a custom error page in some server side scripting language and generate some “special” events. I created a perl cgi script (there was no PHP support for that site) which redirects a browser to the HTTPS site which is exactly what I wanted in the beginning. So here is the .htaccess file:

AuthName ‘Enter your Username and Password:’
AuthType Basic
AuthUserFile /var/www/myweb/.htpasswd
Require valid-user
<FilesMatch “(attach|edit|manage|rename|save|upload|mail|logon|.*auth).*”>
SSLRequireSSL
ErrorDocument 403 /bin/move.pl
Require valid-user
</FilesMatch>

and the move.pl file goes here:

#!/usr/bin/perl -T
use CGI qw(:standard);

$path = “https://$ENV{‘SERVER_NAME’}$ENV{‘REQUEST_URI’}”;
if ( $ENV{‘SERVER_PORT’} == 80) {
print “Status: 302 Moved\n”;
print “Location: $path\n\n”;
}
else {
print “Content-type: text/html\n\n”;
print “How did you get here???”;
}

With this combination, if the files defined in the FilesMatch directive are accessed with the HTTP only connection, an 403 error code is thrown by the SSLRequireSSL, which is handled by the ErrorDocument property. The /bin/move.pl cgi perl script is called which will then redirect a web browser to the HTTPS site. Furthermore, if the files defined in the FilesMatch directive are accessed with the HTTPS connection, a user is requested to authenticate himself with his username/password.

It’s maybe not the best solution, but it’s working, and it’s enough to have .htaccess definitions enabled.

Enjoy!

free -m

free -m

Use 'free -m' utility to get REAL memory usage.

[u...@server /]# free -m
             total       used       free     shared    buffers     cached
Mem:          3876       3557        319          0        212       1083
-/+ buffers/cache:       2261       1615
Swap:            0          0          0
That means I have 3876MB total used memory. 2261MB of it is allocated and needed. 
1083MB is cached (mostly filesystem) and total free memory is 1615MB.
If you want, you can clear linux cache (but it doesn't do any good. Because since it's not cached anymore,
it will be read from disk which is a lot slower (and well, cached again). 
It might be good only if you just read something really big..and
know that you will never need to get it again and need room for something else to cache.
The cache itself is working automagically throwing out older items and caching new items). 
just to experiment use this command:
|sync; echo 3 > /proc/sys/vm/drop_caches

|To clear cache. Beware that it might bump your load average for a sec.

Tcpdump

Tcpdump is one of the best network analysis-tools ever for information security professionals. Tcpdump is for everyone for hackers and people who have less of TCP/IP understanding. Many prefer to use higher-level analysis tools such Wireshark, but I believe it is a mistake. With tcpdump you can decode layers 2-7 of OSI model. The first layer represent only electrical signals and 000-zeros and 111-ones.

Options

Below are some tcpdump options (with useful examples) that will help you working with the tool. They’re very easy to forget and/or confuse with other types of filters, i.e. ethereal, so hopefully this article can serve as a reference for you, as it does me:)

The first of these is -n, which requests that names are not resolved, resulting in the IPs themselves.
The second is -X, which displays both hex and ascii content within the packet.
The final one is -S, which changes the display of sequence numbers to absolute rather than relative.

-i any : Listen on all interfaces just to see if you’re seeing any traffic.
-n : Don’t resolve hostnames.
-nn : Don’t resolve hostnames or port names.
-X : Show the packet’s contents in both hex and ASCII.
-XX : Same as -X, but also shows the ethernet header.
-v, -vv, -vvv : Increase the amount of packet information you get back.
-c : Only get x number of packets and then stop.
-S : Print absolute sequence numbers.
-e : Get the ethernet header as well.
-q : Show less protocol information.
-E : Decrypt IPSEC traffic by providing an encryption key.
-s : Set the snaplength, i.e. the amount of data that is being captured in bytes
-c : Only capture x number of packets, e.g. ‘tcpdump -c 3?

1. Basic communication // see the basics without many options

1
tcpdump -nS

2. Basic communication (very verbose) // see a good amount of traffic, with verbosity and no name help

1
tcpdump -nnvvS

3. A deeper look at the traffic // adds -X for payload but doesn’t grab any more of the packet

1
tcpdump -nnvvXS

4. Heavy packet viewing // the final “s” increases the snaplength, grabbing the whole packet

1
tcpdump -nnvvXSs 1514

 

Expressions
* host // look for traffic based on IP address (also works with hostname if you’re not using -n)

1
tcpdump host 192.168.1.1

* src, dst // find traffic from only a source or destination (eliminates one side of a host conversation)

1
2
tcpdump src 192.168.1.1
tcpdump dst 10.1.100.3

* net // capture an entire network using CIDR notation

1
tcpdump net 1.2.3.0/24

* proto // works for tcp, udp, and icmp. Note that you don’t have to type proto

1
tcpdump icmp

* port // see only traffic to or from a certain port

1
tcpdump port 3389

* src, dst port // filter based on the source or destination port

1
2
tcpdump src port 1025
tcpdump dst port 389

* src/dst, port, protocol // combine all three

1
2
tcpdump src port 1025 and tcp
tcpdump udp and src port 53

* Port Ranges // see traffic to any port in a range

1
tcpdump portrange 21-23

* Packet Size Filter // only see packets below or above a certain size (in bytes)

1
2
tcpdump less 32
tcpdump greater 128

[ You can use the symbols for less than, greater than, and less than or equal / greater than or equal signs as well. ]
// filtering for size using symbols

1
2
tcpdump > 32
tcpdump <= 128

 

Writing to a File
Capture all Port 80 traffic to a file:

1
tcpdump -i eth1 port 80 -w http_traffic

Read Captured Traffic back into tcpdump:

1
tcpdump -r http_traffic

You can use it for “screen” and later for graphical wireshark analyzes.

 

Getting Creative

Expressions are very nice, but the real magic of tcpdump comes from the ability to combine them in creative ways in order to isolate exactly what you’re looking for. There are three ways to do combination:

1. AND
and or &&
2. OR
or or ||
3. EXCEPT
not or !

Traffic that’s from 192.168.1.1 AND destined for ports 3389 or 22

1
tcpdump 'src 192.168.1.1 and (dst port 3389 or 22)'

Advanced
Show me all URG packets:

1
tcpdump 'tcp[13] & 32 != 0'

Show me all ACK packets:

1
tcpdump 'tcp[13] & 16 != 0'

Show me all PSH packets:

1
tcpdump 'tcp[13] & 8 != 0'

Show me all RST packets:

1
tcpdump 'tcp[13] & 4 != 0'

Show me all SYN packets:

1
tcpdump 'tcp[13] & 2 != 0'

Show me all FIN packets:

1
tcpdump 'tcp[13] & 1 != 0'

Show me all SYN-ACK packets:

1
tcpdump 'tcp[13] = 18'

Show all traffic with both SYN and RST flags set: (that should never happen)

1
tcpdump 'tcp[13] = 6'

Show all traffic with the “evil bit” set:

1
tcpdump 'ip[6] & 128 != 0'

Display all IPv6 Traffic:

1
tcpdump ip6