Linux

# get fields in some way
  $field_1 = $FORM{ 'field_1' };
  ...
# process text fields
  $field_1 =~ s/$single_quote/\\'/g;
  $field_1 =~ s/$double_quote/\\'/g;
  ...
# update
  $rv = $dbh -> do ( qq | UPDATE table SET
                          field_1 = '$field_1',
                          field_2 = '$field_2',
                          ...
                          field_n = '$field_n' 
                          WHERE clause | );
  if ( $rv == "0E0" )
     {
       print STDOUT qq |<b>No records affected.</b><br>|;
     }
  else
     {
       print STDOUT qq |<font face=courier size=4>|;
       print STDOUT qq |<br>Number of affected records: $rv.|;
     }

• install Linux with the box disconnected from the net to avoid intrusions at installation time
• check last patches at www.redhat.com/support (and use another box to download them; use "rpm -Uvh" to install patches)
• comment all unuseful services in /etc/inetd.conf to avoid /usr/sbin/inetd running them; check the remaining active services with grep -v "^#" /etc/inetd.conf; restart /usr/sbin/inetd with killall -HUP inetd
• prevent unuseful scripts from being started by the init process in /etc/rc.d/rc3.d by replacing the capital S with a small s. Script you can start when needed: S60lpd (printing services daemon), S85httpd (HTTP service daemon).
• use /etc/shadow password file by typing pwconv at the command prompt
• remove all unused accounts from /etc/passwd

• periodically visit cert and ciac to inform yourself about current and common exploits
• turn off any unused communication port; leave only httpd and ssh ports opened
• don't use bind, wu-ftp etc.
• periodically check logs to determine if your box is being probed
• protect your log files by firewalling port 514 UDP

• start KDE
• select control panel
• select wu-ftpd configurator
• set any element in each tab of the window
• in the last tab you can allow/deny access to normal users defined in passwd (I discourage you enabling FTP to users defined in passwd because their password will be sent unencrypted over the connection, with all the possible consequences)
• select File, Save, and then exit (note: all the settings are saved into the /etc/ftpaccess configuration file. Other configuration files ftp* in the /etc/ directory appear not to be strictly required.)
• restart xinetd issuing the following command: service xinetd restart

In the /etc/cron.weekly directory of the web server create a script sitesave.sh with the following lines:

 
cd /ftp_user_dir
tar -czf sitebackup.tar.gz /home/httpd/*
mysqldump databasename > /ftp_user_dir/databasename.sql

 
cd /backupdir
/usr/local/bin/wget -m ftp://ftp_username:ftp_password@xxx.xxx.xxx.xxx/

Please note that wget operates in FTP mode, and you need an FTP-registered-user to accomplish the task. Its username and password are respectively ftp_username and ftp_password, and ftp_user_dir is the default directory where the FTP-registered-user is switched into at logon. xxx.xxx.xxx.xxx, finally, is the IP address of the web server. You can substitute it with its domain name www.foobar.com.

The backup tarball (togheter with the database dump) remains into the /backupdir of the backup server in the hope it will never be necessary to restore it.

.

You can query the HOSTNAME of your server by typing hostname at the command prompt. You can also experiment by temporarily changing the hostame. To temporarily change it type hostname www.foobar.org at the command prompt. It will override the /etc/sysconfig/network HOSTNAME current setting. This latter will be restored at the next boot.

Also /usr/sbin/sendmail wants no firewalling rules to stop packets in transit to/from port number 25 (the smtp port).

Check rock solid firewalling rules using ipchains to see how to let port 25 usable from a smpt client.

sendmail daemon is not required to stay up when calling /usr/sbin/sendmail from within your Perl script.

Simple instructions to send a mail from a Perl script are the following:

 
open ( MAIL, "|/usr/sbin/sendmail -t" );
print MAIL <<EndMail;
To: somebody\@foobar.org
From: do-not-reply\@mydomain.org
Subject: odds & sodds

Hi. This is a mail message.

EndMail
close ( MAIL );

Options Indexes FollowSymLinks

Finding accounts with no password:
awk -F: '$2 == "" { print $1, "has no password" }' /etc/shadow

Finding Superuser Accounts:
awk -F: '$3 == 0 { print $1, "is a superuser!" }' /etc/passwd

Checking for Suspicious Account Use:

To print the entire login history:
last [username]

To print failed login attempts:
lastb [username]

Testing Your Search Path
perl -e 'print "PATH contains insecure relative directory \"$_\"\n" foreach grep ! m[^/], split /:/, $ENV{"PATH"}, -1;'

Finding setuid (or setgid) Programs
find / -xdev -type f -perm +ug=s -print

find / -xdev -type f -perm +ug=s -print0 | \
perl -0ne 'chomp;
open(FILE, $_);
read(FILE, $magic, 2);
print $_, "\n" if $magic eq "#!";
close(FILE)'

Securing Device Special Files
find / -xdev \( -type b -o -type c \) -ls
find /dev -type f ! -name MAKEDEV -print

Finding Writable Files
find / -xdev -perm +o=w ! \( -type d -perm +o=t \) ! -type l -print

logwatch --range All --detail High --output html-embed --save (nome del file di output)

mount -t vfat /dev/sdb1 /mnt/pendrive
umount /mnt/pendrive 
(get off /mnt/pendrive before issuing umount)

MX toolbox