Symantec today announced the next version of Symantec Endpoint Protection. This release, version 12.1, will ship later this year. You can sign up for the beta at http://go.symantec.com/sep12beta/ .
Long in coming, this release is a major milestone. On the face of it, that statement is odd; after all, SEP is mature product and its feature set hasn't at a fundamental level, changed. It is still offers the critical elements of endpoint security, - malware protection, access control, device control, application control, firewall and IPS. It “kinda, sorta” looks like nothing has changed.
Well, don't believe it. There are countless new features in this release, and in subsequent blog posts I will dive into them. The real change, however, is under the covers and in the test results. SEP 12 is built on a powerful new stack of security technologies – which not only offer state-of-the-art protection, but which also position SEP to continue to provide great protection in a world with hundreds of millions, even billions of unique malicious programs.
Last year, Symantec identified 286 million different pieces of malware. Think about scanning each of the thousands of scanable objects on your computer for any one of 286 million malware signatures. Ok, the problem isn’t really that bad – that 286,000,000 figure represents mostly minor variants of a much smaller number of malware samples. But still, we are talking about over 10 million virus signatures.
Powered by Insight, SEP knows the reputation of up to 70% of the executables on your system – which means it need not scan those files unless they have changed. By reputation, I don’t just mean that we can identify bad files with signatures in the cloud (which, by the way, is the secret sauce behind McAfee’s Artemis/ Global Threat Intelligence technology). Insight does has something unique, well, 2 things. First, for every file we track (over 2.5 billion files), we have a security rating. Second, WE TRACK 2.5 BILLION FILES – 31 MILLION NEW FILES EVERY WEEK. Sorry for shouting, but that is a huge database. It is large enough that we can derive the context and the associations of the file – its "reputation" if you will, with great confidence. We are tracking the presence, age and security rating of nearly every executable on the internet. No-one else can do that. It is not even close.
Insight isn’t the only new security feature in SEP. The other half of the story is Sonar.
Sonar is an AI driven driven technology that tracks file behaviour in real time. Where older generations of heuristic scanners ran on file open/close/modify and on periodic scans, Sonar runs all the time – watching file behaviours and rating them on over 400 attributes.
The other big change in SEP is its enhanced support for virtualization. I look into the new virtualization technology in a later post.
You can see how effective SEP is in latest detection and performance test reports. We have posted them on the SEP Beta page - http://go.symantec.com/sep12beta/ . Take a look.
Friday, March 18, 2011
Thursday, March 17, 2011
Restrict/Limit Users using (/etc/security/)
User limitations are set in the following files:
- File: /etc/security/limits.conf :
- core - limits the core file size (KB)
- data - max data size (KB)
- fsize - maximum filesize (KB)
- memlock - max locked-in-memory address space (KB)
- nofile - max number of open files
- rss - max resident set size (KB)
- stack - max stack size (KB)
- cpu - max CPU time (MIN)
- nproc - max number of processes
- as - address space limit
- maxlogins - max number of logins for this user
- priority - the priority to run user process with
- locks - max number of file locks the user can hold
- File: /etc/security/access.conf :
Limit access by network or local console logins.
- File: /etc/security/group.conf :
Grant/restrict group device access.
- File: /etc/security/time.conf :
Restrict user access by time, day.
System Monitor Commands
Basic command line:
pstree Processes and parent-child relationships top Show top processes iostat Report CPU statistics and input/output statistics for devices and partitions. ps -auxw process status uname -a print system information cat /proc/version Display Linux kernel version in use. cat /etc/redhat-release Display Red Hat Linux Release. (also /etc/issue) uptime Tell how long the system has been running. Also number of users and system's load average. w Show who is logged on and what they are doing. /sbin/lsmod List all currently loaded kernel modules.
Same as cat /proc/modules/sbin/runlevel Displays the system's current runlevel. hostname Displays/changes the system's node name. (Must also manually change hostname setting in /etc/sysconfig/network. Command will change entry in /etc/hosts) service Red Hat/Fedora command to display status of system services.
Example: service --status-all
Help: service --help
gnome-system-monitor Operating system monitor and usage graphing. gkrellm Graphical system monitor. (Additional RPM package: gkrellm) ps3 3D load meter. Very cool 3-D graphics. xosview Operating system monitor: load, memory, swap, net, disk, ...
Monday, March 14, 2011
Activating a VG when quorum is lost
Normally, volume groups are automatically activated during system startup. Unless you intentionally deactivate a volume group using vgchange, you will probably not need to reactivate a volume group.
However, LVM does require that a "quorum" of disks in a volume group be available. During normal system operation, LVM needs a quorum of more than half of the disks in a volume group for activation. If, during run time, a disk fails and causes quorum to be lost, LVM alerts you with a message to the console, but keeps the volume group active.
If there is no other way to make a quorum available, the -q option to the vgchange command will override the quorum check.
EXAMPLE:
vgchange -a y -q n /dev/vg01
When you replace a disk that was not online when you originally activated the volume group, use the activation command again to attach the now accessible disks to the volume group.
EXAMPLE:
vgchange -a y /dev/vg01
However, LVM does require that a "quorum" of disks in a volume group be available. During normal system operation, LVM needs a quorum of more than half of the disks in a volume group for activation. If, during run time, a disk fails and causes quorum to be lost, LVM alerts you with a message to the console, but keeps the volume group active.
If there is no other way to make a quorum available, the -q option to the vgchange command will override the quorum check.
EXAMPLE:
vgchange -a y -q n /dev/vg01
When you replace a disk that was not online when you originally activated the volume group, use the activation command again to attach the now accessible disks to the volume group.
EXAMPLE:
vgchange -a y /dev/vg01
Monday, February 21, 2011
Apache on Solaris 10
The apache web server is included with solaris 10. Follow these steps to enable it.
The apache server config files are in /etc/apache2. To quickly get up and running, you can just use the sample config file by doing the following:
Check to see if apache is already running:
You will probably see the following, indicating that apache is NOT running:
Use the svcadm command to start the webserver. This will also make it automatically start if your machine reboots.
Put your html webpage(index.html) in the /var/apache2/htdocs directory. If everything went OK, you should have a functioning apache webserver.
If the svcs -p command from the above step doesn't show a STATE of online, do the followig:
You'll probably see that it's in maintenance mode:
Step 1: Create a working default apache config file
The apache server config files are in /etc/apache2. To quickly get up and running, you can just use the sample config file by doing the following:
cd /etc/apache2 cp httpd.conf-example httpd.conf
Step 2: Enable the apache/httpd service
Check to see if apache is already running:
svcs -a | grep -i http
You will probably see the following, indicating that apache is NOT running:
disabled Apr_20 svc:/network/http:apache2
Use the svcadm command to start the webserver. This will also make it automatically start if your machine reboots.
svcadm -v enable /network/http:apache2
Use the following svcs command to make sure it worked:svcs -p /network/http:apache2 STATE STIME FMRI online 15:32:44 svc:/network/http:apache2 15:32:44 28711 httpd 15:32:45 28712 httpd 15:32:45 28713 httpd 15:32:45 28714 httpd 15:32:45 28715 httpd 15:32:45 28716 httpdThis is showing that the webserver is online and working.
Step 3: Add your web content
Put your html webpage(index.html) in the /var/apache2/htdocs directory. If everything went OK, you should have a functioning apache webserver.
Debugging / Troubleshooting
If the svcs -p command from the above step doesn't show a STATE of online, do the followig:
svcs -a | grep -i http
You'll probably see that it's in maintenance mode:
maintenance 15:16:12 svc:/network/http:apache2For more detailed info run:
svcs -l httpOR
svcs -x http svc:/network/http:apache2 (Apache 2 HTTP server) State: maintenance since May 8, 2007 3:16:12 PM EDT Reason: Start method failed repeatedly, last exited with status 1. See: http://sun.com/msg/SMF-8000-KS See: httpd(8) See: /var/svc/log/network-http:apache2.log Impact: This service is not running.Note that the second to last line tells you where the log file is, so take a look at that. Once you've fixed the problem, you can restart apache with:
svcadm restart /network/http:apache2If for some reason you want to shut off apache, use this:
svcadm disable /network/http:apache2
svcs -p /network/http:apache2
STATE STIME FMRI
disabled 15:36:33 svc:/network/http:apache2
svcs -l http fmri svc:/network/http:apache2 name Apache 2 HTTP server enabled false state disabled next_state none state_time May 8, 2007 3:36:33 PM EDT logfile /var/svc/log/network-http:apache2.log restarter svc:/system/svc/restarter:default contract_id dependency require_all/error svc:/milestone/network:default (online) dependency require_all/none svc:/system/filesystem/local:default (online) dependency optional_all/error svc:/system/filesystem/autofs:default (online)
SSH on Solaris 10
To generate your keys:
ssh-keygen -t dsa
ssh-keygen -t rda
ssh-keygen -t rda
Then, save the public (NOT the private keys!) keys that you just generated.
#cat *.pub keys >> authorized_keys
The newly created authorized_keys file can then be copied to the destination system. This will allow you to log in without providing a password.
To stop and start sshd:
svcadm disable ssh
svcadm enable ssh
svcadm enable ssh
Debugging tips:
Server side debugging - Once ssh service is disabled (svcadm disable ssh), you can start manually in debug mode:
cd /usr/lib/ssh
./sshd -dd
./sshd -v will available command-line options
ssh -v will turn on client debugging
sshd config file for the entire server is in /etc/ssh/sshd_config
permissions on your home directory MUST be 750
cd /usr/lib/ssh
./sshd -dd
./sshd -v will available command-line options
ssh -v will turn on client debugging
sshd config file for the entire server is in /etc/ssh/sshd_config
permissions on your home directory MUST be 750
Monday, February 14, 2011
Friday, January 28, 2011
Reinstall GRUB using Ubuntu 9.10 livecd or higher
Here assuming the Ubuntu partition is sda7,and /boot partition is sda6 (if you have a separate /boot partition).
Boot up ubuntu from the livecd,open terminal and run:
If you miss “grub.cfg” file,use following to recreate:
Boot up ubuntu from the livecd,open terminal and run:
sudo -i mount /dev/sda7 /mnt mount /dev/sda6 /mnt/boot #skip this one if not have a separate /boot partition grub-install --root-directory=/mnt/ /dev/sda
If you miss “grub.cfg” file,use following to recreate:
mount --bind /proc /mnt/proc mount --bind /dev /mnt/dev mount --bind /sys /mnt/sys chroot /mnt update-grub umount /mnt/sys umount /mnt/dev umount /mnt/proc exit
Sunday, December 5, 2010
Boot Disk Mirroring Using Solaris Volume Manager Software
Applicable OS Version: Solaris 9 Operating System (OS), Solaris 8 OS with Solstice DiskSuite 4.2.1 Software with Patch 108693-06 (SPARC Platform Edition)
Note: I do not guarantee that this will work as it is for every one. Please tweak as needed.
The following steps might have used random controllers and targets. They might vary from host to host.
Also, it's a good idea to mirror across controllers instead of mirroring across the same controller and still having the controller as a single point of failure.
1) Important precaution:
Copy
/etc/vfstab and /etc/system before you go ahead:cp -p /etc/system /etc/system.orig."date" cp -p /etc/vfstab /etc/vfstab.orig."date"
In case
/etc/system gets messed up, we can still use the command boot -a from the OK prompt and specify by using:/etc/system.orig."date"
2) Make sure that you have an extra disk to mirror the root disk and there is no data on it.
3) Create a small slice of 25 Mbyte (10 Mbyte is also fine) for storing volume databases on the "rootdisk" and label the disk.
If you don't have any space on your root disk, create a small slice by deleting and re-adding swap space.
Make sure that there is not a lot of activity on the box while you do this.
3.1) To list your swap, use:
swap -l(It's good if you have more than one slice configured as swap.)
3.2) Execute:
swap -d swap-name ( /dev/dsk/c?ct?d?s?)
Change your partition table to incorporate a new slice by reducing the size or cylinder length of the swap partition.
3.3) Execute:
swap -a swap-name ( /dev/dsk/c?t?d?s?)
4) The VTOC (volume table of contents) on the root disk and root mirror must be the same. Copy the VTOC using
prtvtoc and fmthard.# prtvtoc /dev/rdsk/c?t?d?s2 | fmthard -s - /dev/rdsk/c?t?d?s2
5) Create metadatabases on the small slice created on rootdisk:
# metadb -f -a -c3 c?t?d?s6 (Slice 6 is my small slice here) # metadb -a -c3 c?t?d?s6 (Slice 6 on rootmirror)
6) Now we can create a mirror for each and every slice in the partition table.
For root or / partition:
# metainit -f d10 1 1 c?t?d?s?
# metainit d20 1 1 c?t?d?s?
(create a md d0 and attach one submirror)
# metainit d0 -m d10
(set up system files for root (/) metadevice, that is,
changes to /etc/system and /etc/vfstab)
# metaroot d0
# lockfs -fa (clear improper file locks on all mounted UFS file systems)
7) Naming convention for other metadisks follow. (Note for those who are new to this software: We will not do
metaroot and lockfs steps on other file systems.)The submirrors will be named
d10, d20, and so on.In
d10, 1 is the submirror number, and 0 is the slice number.If we have swap on partition/slice 1, we would do this:
# metainit -f d11 1 1 c?t?d?s1 # metainit d21 1 1 c?t?d?s1 # metainit d1 -m d11
8) Repeat for as many file systems you have on your boot disk.
9) Make changes to your
/etc/vfstab. The md entry for root will already be updated by the metaroot command.A sample copy of
/etc/vfstab looks like this:#device device mount FS fsck mount mount #to mount to fsck point type pass at boot options # fd - /dev/fd fd - no - /proc - /proc proc - no - ##/dev/dsk/c1t1d0s1 - - swap - no - /dev/md/dsk/d1 - - swap - no - /dev/md/dsk/d0 /dev/md/rdsk/d0 / ufs 1 no - ##/dev/dsk/c1t1d0s7 /dev/rdsk/c1t1d0s7 /export/home ufs 2 yes - /dev/md/dsk/d7 /dev/md/rdsk/d7 /export/home ufs 2 yes - ##/dev/dsk/c1t1d0s3 /dev/rdsk/c1t1d0s3 /opt/uc4 ufs 2 yes - /dev/md/dsk/d3 /dev/md/rdsk/d3 /opt/uc4 ufs 2 yes - swap - /tmp tmpfs - yes -
10) Configure your dump device using
dumpadm.11) Make the following entry in the
/etc/system file, in the mdd info section:set md:mirrored_root_flag=1
When the root disk becomes unavailable, the database copies stored on the root disk are also unavailable.
Solaris Volume Manager software expects more than 50 percent of the databases to be available to boot up normally or else it may complain about the insufficient number of database replicas. The preceding change is made in order for Solaris Volume Manager software to boot up with at least 50 percent of the copies.
12) Execute:
sync; sync; init 6
13) Once the system comes up, attach the other submirror:
# metattach d0 d20
(Note: It's "metattach" and not "metaattach")
# metattach d1 d21
and so on.
14) To see whether the FS syncing is done or not, do this:
metastat | grep progress
15) Determine the device path to the boot devices for both the primary and mirror:
ls -l /dev/dsk/c1t1d0s0 /dev/dsk/c1t0d0s0 lrwxrwxrwx 1 root root 43 Dec 23 17:51 /dev/dsk/c1t0d0s0 -> \ ../../devices/pci@1c,600000/scsi@2/sd@0,0:a lrwxrwxrwx 1 root root 43 Dec 23 17:51 /dev/dsk/c1t1d0s0 -> \ ../../devices/pci@1c,600000/scsi@2/sd@1,0:a # eeprom "nvramrc=devalias rootdisk /pci@1c,600000/scsi@2/disk@1,0 devalias rootmirror /pci@1c,600000/scsi@2/disk@0,0"
(Please note the change "sd" to "disk" in using
ls -l output.)# eeprom "use-nvramrc?=true"
You can also change the boot-device values so that the system tries to boot from the mirror in case one of them is not available.
# eeprom boot-device="rootdisk rootmirror net"
16) Once the syncing is complete, test your system by removing the root disk.
Recovering a Bad Sector Disk on the Solaris 9 OS
A disk can start creating trouble if sectors on it are bad. We can try to verify and repair the defective sectors. For example, the following message shows that the block 100 is defective:
WARNING: /io-unit@f,e0200000... Error for command 'read' Error Level: Retryable Requested Block 243, Error Block 100 Sense Key: Media Error Vendor ... ASC = 0x11 (unrecovered read error) ...
We can try to take corrective action by performing a surface scan analysis. First we need to unmount all slices on the defective disk and then invoke the
format utility. (Note: This example shows only s0 mounted on target 2.)# umount /dev/dsk/c0t2d0s0 # format
When we are asked to select the disk, provide the number:
Specify disk (enter its number): 1 selecting c0t2d0: [disk formatted] Warning: Current Disk has mounted partitions.
Now we should invoke the analyze menu and provide the parameters as asked:
format> analyze analyze> setup Analyze entire disk [yes]? n Enter starting block number [0, 0/0/0]: enter start block Enter ending block number [2052287, 2035/13/71]: enter end block Loop continuously [no]: y Repair defective blocks [yes]: n Stop after first error [no]: n Use random bit patterns [no]: n Enter number of blocks per transfer [126, 0/1/54]: 1 Verify media after formatting [yes]: y Enable extended messages [no]: n Restore defect list [yes]: y Create defect label [yes]: y analyze> read Ready to analyze (won't harm SunOS). This takes a long time, but is interruptible with Control-C. Continue? Y pass 0 ... pass 1 block 100, Corrected media error (hard data ecc) ... Total of 1 defective blocks repaired.
Now we have found the absolute block number of the defective block on the disk, and we will repair it.
analyze> q format> repair Enter absolute block number of defect: 100 Ready to repair defect, continue? y Repairing block 100 ...ok. format> q
Changing Hostname on RHEL
1. Change the ^HOSTNAME line in /etc/sysconfig/network
2. Change the hostname (FQDN and alias) in /etc/hosts3. Run /bin/hostname new_hostname for the hostname change to take effect immediately.
4. Run /sbin/service syslog restart for syslog to log using the new hostname.
A reboot is not required to change the system hostname.
Thursday, December 2, 2010
Understanding /proc/cpuinfo
Example:
$ uname -r
2.6.18-8.el5
2
4
cpu cores : 2
cpu cores : 2
cpu cores : 2
cpu cores : 2
"2" indicates the two physical processors are dual-core, resulting in 4 virtual processors.
If "1" was returned, the two physical processors are single-core. If the processors are single-core, and the number of virtual processors is greater than the number of physical processors, the CPUs are using hyper-threading. Hyper-threading is supported if ht is present in the CPU flags and you are using an SMP kernel.
flags : fpu vme de pse tsc msr pae mce cx8 apic mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt lm 3dnowext 3dnow pni cx16 lahf_lm cmp_legacy svm cr8legacy ts fid vid ttp tm stc
$ uname -r
2.6.18-8.el5
How many physical processors are there?
$ grep 'physical id' /proc/cpuinfo | sort | uniq | wc -l2
How many virtual processors are there?
$ grep ^processor /proc/cpuinfo | wc -l4
Are the processors dual-core (or multi-core)?
$ grep 'cpu cores' /proc/cpuinfocpu cores : 2
cpu cores : 2
cpu cores : 2
cpu cores : 2
"2" indicates the two physical processors are dual-core, resulting in 4 virtual processors.
If "1" was returned, the two physical processors are single-core. If the processors are single-core, and the number of virtual processors is greater than the number of physical processors, the CPUs are using hyper-threading. Hyper-threading is supported if ht is present in the CPU flags and you are using an SMP kernel.
Are the processors 64-bit?
A 64-bit processor will have lm ("long mode") in the flags section of cpuinfo. A 32-bit processor will not.flags : fpu vme de pse tsc msr pae mce cx8 apic mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt lm 3dnowext 3dnow pni cx16 lahf_lm cmp_legacy svm cr8legacy ts fid vid ttp tm stc
Changing IP address
The following steps may be used to change the IP address of a Solaris system.
- Change the host's IP in /etc/hosts for the change to take effect after reboot. If you are using Solaris 10, you must also change the host's IP in /etc/inet/ipnodes for the change to take effect after reboot.
- Run ifconfig interface ip_address netmask broadcast_address for the IP address change to take effect immediately. The netmask and broadcast_address should be specified if you are using variable length subnet masks (VLSM), but may be omitted otherwise.
- If you are using variable length subnet masks (VLSM), add the host's network number and subnet mask to /etc/netmasks.
- Place the host's new default gateway in /etc/defaultrouter
- Run route add default new_gateway for the new default gateway to take effect immediately.
- Run route delete default old_gateway to delete the old default gateway from the routing table.
Creating a Flash archive
1. If the root disk is encapsulated by Veritas Volume Manager (VxVM), unencapsulate it before continuing.
2. I recommend booting to single-user mode, as you generally do not want to include NFS mounts or other file systems mounted in later run levels as part of your Flash archive.
#reboot -- -s
3. Create the Flash archive.
flarcreate -n name -a author -S -c archive_name
eg: flarcreate -n "Solaris 9 image" -a "shiroy" /var/tmp/sol8.archive
Notes:
flarcreate will not determine the size of the archive beforehand when using the -S flag. Personally, I have seen flarcreate take an inordinate amount of time calculating the size of the archive.The -c flag enables archive compression via the compress command.
4. If applicable, re-encapsulate the rootdisk with the vxdiskadm command. Reboot the system for the encapsulation to take effect.
2. I recommend booting to single-user mode, as you generally do not want to include NFS mounts or other file systems mounted in later run levels as part of your Flash archive.
#reboot -- -s
3. Create the Flash archive.
flarcreate -n name -a author -S -c archive_name
eg: flarcreate -n "Solaris 9 image" -a "shiroy" /var/tmp/sol8.archive
Notes:
flarcreate will not determine the size of the archive beforehand when using the -S flag. Personally, I have seen flarcreate take an inordinate amount of time calculating the size of the archive.The -c flag enables archive compression via the compress command.
4. If applicable, re-encapsulate the rootdisk with the vxdiskadm command. Reboot the system for the encapsulation to take effect.
NixCraft – Linux Administration
Here is a great Linux Admin blog with plenty of content for the both the beginner and the advanced Linux Admin. The name of the blog is nixCraft and it has been in my RSS reader for a while, and I wanted to share with you a couple of the scripts and links that I pulled out and have used.
The first is a quick and easy MySql database backup that you can put in cron to backup your MySql database. Many open source projects use MySql and it always pays to have a backup especially when upgrading, so take a look at this post called backing up your mysql database server.
The second script is a rsync replication script that we can use between a couple of clustered web servers. The script is called resync backup replication script.
And the last example is for the beginner administrator. This post identifies a number of Unix/Linux commands and cheat sheets that was worthwhile to the new administrator.
If you are into Linux from a support or development perspective than I encourage you to take a look at the nixCraft site as I am sure that you will find something useful.
The first is a quick and easy MySql database backup that you can put in cron to backup your MySql database. Many open source projects use MySql and it always pays to have a backup especially when upgrading, so take a look at this post called backing up your mysql database server.
The second script is a rsync replication script that we can use between a couple of clustered web servers. The script is called resync backup replication script.
And the last example is for the beginner administrator. This post identifies a number of Unix/Linux commands and cheat sheets that was worthwhile to the new administrator.
If you are into Linux from a support or development perspective than I encourage you to take a look at the nixCraft site as I am sure that you will find something useful.
Friday, November 26, 2010
How can I create a disk partition on a disk that is greater than 2TB in size?
- The fdisk command only supports the legacy MBR partition table format (also known as msdos partition table)
- MBR partition table do not support disks greater than 2.1TB, and therefore fdisk is also unable to create partition tables on these devices.
- Note that some older versions of fdisk may permit a larger size to be created but the resulting partition table will be invalid.
- The parted command can create disk labels using MBR (msdos), GUID Partition Table (GPT), SUN disk labels and many more types.
- The GPT disk label overcomes many of the limitations of the DOS MBR including restrictions on the size of the disk, the size of any one partition and the overall number of partitions.
- Note that booting from a GPT labelled volume requires firmware support and this is not commonly available on non-EFI platforms (including x86 and x86_64 architectures).
Procedure:
- Use the parted tool to access the partition table of the device:
# parted /dev/sdj Using /dev/sdj Welcome to GNU Parted! Type 'help' to view a list of commands. (parted) - Once at the parted prompt, create a GPT label on the disk:
Note: This will remove any existing partition table and partitions on the device.(parted) mklabel Warning: The existing disk label on /dev/sdj will be destroyed and all data on this disk will be lost. Do you want to continue? Yes/No? Yes New disk label type? [gpt]? gpt (parted)
- Use the print command to show the size of the disk as reported by parted. We need this later:
(parted) print Model: Linux device-mapper (dm) Disk /dev/sdj: 5662310.4MB Sector size (logical/physical): 512B/512B Partition Table: gpt Number Start End Size File system Name Flags - Create a primary partition on the device. In this example, the partition will encompass the entire disk (using size from the step above):
(parted) mkpart primary 0 5662310.4MB - Unlike fdisk, you do not have to write out the partition table changes with parted. Display your new partition and quit.
(parted) print Model: Linux device-mapper (dm) Disk /dev/mapper/VolGroup00-gpttest: 5662310.4MB Sector size (logical/physical): 512B/512B Partition Table: gpt Number Start End Size File system Name Flags 1 17.4kB 5662310.4MB 5662310.4MB primary (parted) quit Information: Don't forget to update /etc/fstab, if necessary. - You can now create a filesystem on the device /dev/sdj1
Wednesday, November 17, 2010
Tuesday, April 13, 2010
Which communication ports does Symantec Endpoint Protection 11.0 use?
The Symantec Endpoint Protection Manager (SEPM) use two web servers: Internet Information Services (IIS) and Tomcat. IIS uses port 80 (or 8014) and 443 - Tomcat uses port 9090 and 8443. The communication between IIS and Tomcat uses the HTTP protocol. IIS uses port 9090 to talk to Tomcat, Tomcat uses port 80 to talk to IIS.
Client-Server Communication:
For IIS SEP uses HTTP or HTTPS between the clients or Enforcers and the server. For the client server communication it uses port 80 (or 8014) and 443 by default. In addition, the Enforcers use RADIUS to communicate in real-time with the manager console for clients authentication. This is done on UDP port 1812.
Remote Console:
9090 is used by the remote console to download .jar files and display the help pages.
8443 is used by the remote console to communicate with SEPM and the Replication Partners to replicate data.
Client-Enforcer Authentication:
The clients communicate with the Enforcer using a proprietary communication protocol. This communication uses a challenge-response to authenticate the clients. The default port for this is UDP 39,999.
Client-Server Communication:
For IIS SEP uses HTTP or HTTPS between the clients or Enforcers and the server. For the client server communication it uses port 80 (or 8014) and 443 by default. In addition, the Enforcers use RADIUS to communicate in real-time with the manager console for clients authentication. This is done on UDP port 1812.
Remote Console:
9090 is used by the remote console to download .jar files and display the help pages.
8443 is used by the remote console to communicate with SEPM and the Replication Partners to replicate data.
Client-Enforcer Authentication:
The clients communicate with the Enforcer using a proprietary communication protocol. This communication uses a challenge-response to authenticate the clients. The default port for this is UDP 39,999.
View System Logs Live
If you want to monitor the system logs in a live environment, you can use the tail command with an option -f or -F.
This will work in any Linux/UNIX environment.
To exit from the view, you can use Ctrl + C. The same option can be used with any text based files to find the updation to the file in live environment.
Usage:
# tail -f /var/log/messages
or
# tail -F /var/adm/messages
tail -f will work as long as the underlying file we’re trying to read doesn’t change. If you’re trying to read a link to a file and the original file (and thus the link) changes, tail -f will not work.
For that reason, its better to use tail -F for such files as described above … or tail -f –retry
This will work in any Linux/UNIX environment.
To exit from the view, you can use Ctrl + C. The same option can be used with any text based files to find the updation to the file in live environment.
Usage:
# tail -f /var/log/messages
or
# tail -F /var/adm/messages
tail -f will work as long as the underlying file we’re trying to read doesn’t change. If you’re trying to read a link to a file and the original file (and thus the link) changes, tail -f will not work.
For that reason, its better to use tail -F for such files as described above … or tail -f –retry
How Network Access Controls Work?
Network access control is the process of restricting the access to network resources by devices that are used by the end user. Network access controls implement a defined security policy for access which is supported by a network access server that performs the authentication and authorization. The server also restricts the data that each user can access, as well as the activities that can be performed by the end user once they gain access to the network.
How Network Access Controls Work
There are several different types of network access controls that perform different functions according to the needs of the organization and the level of security that is required for performing daily functions.
•Agent-Based Network Access Control: An agent-based network access control operates through the endpoint device (user's device) which provides a higher level of security and ensures that the end-user is complying with security policies. The unit continually operates in the background of the device to monitor security compliance and then sends periodic updates to the policy server.
•Agentless Network Access Control: An agentless network access control does not require any added installations. Instead this type of network access control assesses compliancy on both endpoints before the user is allowed to access the network. The problem with this type of network access control is that authorization is provided through the assessment of network traffic. This makes the application easier to exploit to gain unauthorized access to the network system.
•Hardware-Based Network Access Control: A hardware-based network access control works through an appliance that is installed on the network and functions in conjunction with the network traffic. This type of network access control requires changes in the infrastructure and operational practices to allow for defined access by the end user. Because implementation requires significant server configuration changes, the chances of failure are greater than other network access control systems.•Dynamic Network Access Control: Dynamic network access control is the easiest form of deployment for controlling access by end users. This is because the system does not require any software or hardware appliance installation or changes in the network configuration. Instead a dynamic network access control works on specific computers that are connected to a local area network and are considered to be trusted systems. When an unauthorized user attempts to access the network, the trusted systems will restrict access and then communicate the action to the main policy server.
The type of network access control you choose for your organization depends upon your network configuration and set up. Before choosing an option that suits your organization, it is necessary to evaluate the network configuration and the different reasons for defining access by the end users.
How Network Access Controls Work
There are several different types of network access controls that perform different functions according to the needs of the organization and the level of security that is required for performing daily functions.
•Agent-Based Network Access Control: An agent-based network access control operates through the endpoint device (user's device) which provides a higher level of security and ensures that the end-user is complying with security policies. The unit continually operates in the background of the device to monitor security compliance and then sends periodic updates to the policy server.
•Agentless Network Access Control: An agentless network access control does not require any added installations. Instead this type of network access control assesses compliancy on both endpoints before the user is allowed to access the network. The problem with this type of network access control is that authorization is provided through the assessment of network traffic. This makes the application easier to exploit to gain unauthorized access to the network system.
•Hardware-Based Network Access Control: A hardware-based network access control works through an appliance that is installed on the network and functions in conjunction with the network traffic. This type of network access control requires changes in the infrastructure and operational practices to allow for defined access by the end user. Because implementation requires significant server configuration changes, the chances of failure are greater than other network access control systems.•Dynamic Network Access Control: Dynamic network access control is the easiest form of deployment for controlling access by end users. This is because the system does not require any software or hardware appliance installation or changes in the network configuration. Instead a dynamic network access control works on specific computers that are connected to a local area network and are considered to be trusted systems. When an unauthorized user attempts to access the network, the trusted systems will restrict access and then communicate the action to the main policy server.
The type of network access control you choose for your organization depends upon your network configuration and set up. Before choosing an option that suits your organization, it is necessary to evaluate the network configuration and the different reasons for defining access by the end users.
Subscribe to:
Posts (Atom)