Read from HSecurity at here. (PDF here)
Major issues regarding CA model: browser, CA, and domain owners are disconnected during SSL certificate validation process.
- End user (browser) cannot determine if a certificate was created legitimately.
- The domain owners does not know if a fraud certificate was created on its behalf.
Proposed Solution:
- Every publicly visible certificate should be published in a publicly auditable certificate log
- Every certificate issued must have an audit proof
- Web server must send the audit proof to browsers and browsers must valid the audit proof
- Domain owners should monitor the publicly auditable certificate log
- Installation
1. Download and install Python/ActivePython
2. Download Django and unpack it. Use a symbolic link “Django” to point to Django-version folder to simplify future upgrade.
3. Run “python setup.py install” to install Django to Python/lib/site-packages folder.
4. “import django” to test
- Manage Django projects
1 2 3 4 | # Create new application $ django-admin.py startproject myproj # Test new application at http://127.0.0.1:8080 $ python manage.py runserver [port] |
- Manage Database Connection
1. Update myproj/settings.py and set up database server connection.
2. Run ‘python manage.py syncdb’ to setup database. Assign a super user and password.
- Manage Django applications within a project
1 2 3 4 5 | # Create new application $ python manage.py startapp myapp1 # After define models in models.py for the application, display the SQL and syncdb $ python manage.py sql myapp1 $ python manage.py syncdb |
- Make Database Modifications
1 2 3 4 | # Install South from http://south.aeracode.org/ # After modifying models.py with new fields for a table , run $ python manage.py schemamigration myapp1 --add-field Table_name.Field_name $ python manage.py migrate myapp1 |
The following example list all users with Lync enabled. The catch is to include -IncludedProperties “Extended Attribute” when searching.
1 2 | PS> Add-PSSnapin Quest.ActiveRoles.ADManagement PS> Get-QADUser -SizeLimit 0 -IncludedProperties "msRTCSIP-UserEnabled" | where {$_."msRTCSIP-UserEnabled" -eq "True”} |
Click to view on Center for Internet Security
1. There is a change management in place.
2. There is an active and shared repository of hardware, software, accounts, permissions, tickets, etc.
3. There is an open and shared Knowledge base with full-text search function.
4. Accounts and some file systems on heterogeneous systems are integrated together.
5. Mature system Development and version control.
6. Fully email and ticket driven.
7. IT Security have support from top-down.
- Generate self-signed ROOT CA
3 4 5 | $ openssl genrsa -aes256 -out server.key 2048 $ openssl req -new -key server.key -out server.csr $ openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt |
- Generate client certificate
3 4 5 6 7 8 9 10 11 12 | # Generate client key file. Give no password or a password to protect private key $ openssl genrsa -aes256 -out user.key [ -passout pass:PASSWORD | -nodes ] 2048 # Remove password for shared password if required $ openssl rsa -in user.key -out user_nopass.key # Generate CSR $ openssl req -new -key user.key -out user.csr [ -passin pass:PASSWORD ] [ -config user.txt ] # Combination of above steps $ openssl req -out user1.csr -new -newkey rsa:2048 -keyout user1.key -config user1.txt [ -aes256 | -nodes] [ -passout pass:PASSWORD ] # Use root CA to issue the certificate. NOTE: the option is case-sensitive. $ openssl x509 -req -days 365 -in user.csr -CA server.crt -CAkey server.key [ -set_serial 01 ] -out user1.crt [ -passin pass:PASSWORD ] -CAserial file.srl </code> |
- Convert between certificate formats
3 4 5 6 7 8 | # Convert DEM certs to different formats $ openssl x509 -inform der -in user.crt -out user.pem # Convert PEM to DEM $ openssl x509 -outform der -in user.pem -out user.der # Convert PEM to PKCS#12 $ openssl pkcs12 -export -out user.pfx -inkey user.key -in user.crt -certfile server.crt |
- Setup Id tag: Add $Id$ to the header of the file first.
$ svn propset svn:keywords "Id" filename - Set HeadURL tag: add $HeadURL” to the header of the file first.
$ svn propset svn:keywords "HeadURL" filename - Set multiple keywords
$ svn propset svn:keywords "Id HeadURL" filename - Check out a repository
$ svn co file:///opt/svnroot/systems/REPO_NAME LOCAL_FOLDER - Export
$ sudo svnadmin dump /path/to/repository > repository-name.dmp - Import
$ cd /path/to/new-repository $ svnadmin create repository-name $ svnadmin load repository-name< repository-name.dmp
- Install Cygwin installer. Make sure vim, sshd and rsync are included.
- Run “ssh-host-config” to configure SSHd,
- Should privilege separation be used? yes
- new local account ‘sshd’? yes
- Do you want to install sshd as a service? yes
- Enter the value of CYGWIN for the daemon: ntsec
- The script plans to use ‘cyg_server. Do you want to use a different name? no
- Create new privileged user account ‘cyg_server’? yes
- Please enter password: use a long random password
- Run “cyglsa-config”, say “Yes” and reboot the server. “CYGWIN sshd” service should be started automatically.
- Note: When creating cyg_server on domain controller, the account will be created as domain account.
$ sudo env EDITOR=vi crontab -e
$ cat file.txt | sed "s/don't/do not/" | tr -cs '[:lower:][:upper:]' '[\n*]' | tr '[:upper:]' '[:lower:]' | sort | uniq -c | sort -nr
