Check if your ubuntu linux is affected by openssl heart bleed bug

The heart bleed bug affects openssl 1.0.1 built before 7 April 2014.

• Check your openssl version and build time using the following command:

  openssl version -a

  If the version is 1.0.1 and build time is before 7 April 2014 (exclude 7 April 2014), your openssl is affected.
• To patch your openssl, simply run the following commands to upgrade your openssl:

  sudo apt-get update
  sudo apt-get install openssl libssl1.0.0

multicast ip address 224.0.0.251 port 5353

To enable Bonjour/mDNS, you need to allow traffic from multicast ip 224.0.0.251 on port 5353.

Enable simple iptables firewall on Debian 7 Wheezy

• Install iptables-persistent:

  sudo apt-get install iptables-persistent

• Edit /etc/iptables/rules.v4 and /etc/iptables/rules.v6

  # /etc/iptables/rules.v4
  *filter :INPUT ACCEPT [0:0]
  :FORWARD ACCEPT [0:0]
  :OUTPUT ACCEPT [0:0]
  :RH-Firewall-1-INPUT - [0:0]
  -A INPUT -j RH-Firewall-1-INPUT
  -A FORWARD -j RH-Firewall-1-INPUT
  -A RH-Firewall-1-INPUT -i lo -j ACCEPT
  -A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
  # ESP protocol
  -A RH-Firewall-1-INPUT -p 50 -j ACCEPT
  # AH protocol
  -A RH-Firewall-1-INPUT -p 51 -j ACCEPT
  # multicast Bonjour/mDNS
  -A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
  # cups printing
  -A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
  -A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
  -A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
  -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
  COMMIT 
  

  # /etc/iptables/rules.v6
  *filter :INPUT ACCEPT [0:0]
  :FORWARD ACCEPT [0:0]
  :OUTPUT ACCEPT [0:0]
  :RH-Firewall-1-INPUT - [0:0]
  -A INPUT -j RH-Firewall-1-INPUT
  -A FORWARD -j RH-Firewall-1-INPUT
  -A RH-Firewall-1-INPUT -i lo -j ACCEPT
  -A RH-Firewall-1-INPUT -p icmpv6 -j ACCEPT
  # ESP protocol
  -A RH-Firewall-1-INPUT -p 50 -j ACCEPT
  # AH protocol
  -A RH-Firewall-1-INPUT -p 51 -j ACCEPT
  # multicast Bonjour/mDNS
  -A RH-Firewall-1-INPUT -p udp --dport 5353 -d ff02::fb -j ACCEPT
  # cups printing
  -A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT 
  -A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
  -A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  -A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT
  -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-adm-prohibited
  COMMIT 
  

See also

• Linux IPv6 HOWTO
• CentOS / RHEL IPv6 ip6tables Firewall Configuration
• Debian Firewall (IPv4 & IPv6)

Ubuntu 12.04 Precise LTS: Install and secure Apache 2 web server

1. Install apache2:

   sudo apt-get install apache2

2. Hide the Apache Version number, and other sensitive information:

   sudo vi /etc/apache2/conf.d/security

   ServerTokens Prod
   ServerSignature Off
   

3. Turn off directory browsing:

   sudo vi /etc/apache2/sites-available/default

   <Directory /var/www/>
       Options -Indexes FollowSymLinks MultiViews
       AllowOverride None
       Order allow,deny
       allow from all
   </Directory>
   

4. Follow this guide to install ModSecurity.
5. Follow this guide to install ModEvasive.

Ubuntu 12.04 Precise LTS: Install ModEvasive for Apache 2 web server

1. sudo apt-get install libapache2-mod-evasive

2. sudo mkdir /var/log/mod_evasive; sudo chown -R www-data:www-data /var/log/mod_evasive

3. sudo vi /etc/apache2/mods-available/mod-evasive.conf

   <ifmodule mod_evasive20.c>
      DOSHashTableSize 3097
      DOSPageCount  2
      DOSSiteCount  50
      DOSPageInterval 1
      DOSSiteInterval  1
      DOSBlockingPeriod  10
      DOSLogDir   /var/log/mod_evasive
      DOSEmailNotify  EMAIL@DOMAIN.com
      DOSWhitelist   127.0.0.1
   </ifmodule>

4. sudo a2enmod mod-evasive; sudo /etc/init.d/apache2 restart

check if your computer infected with DNSChanger malware

• What is DNSChanger?
• DNSChanger is a class of malicious software (malware) that changes a user's Domain Name System (DNS) settings, enabling criminals to direct unsuspecting internet users to fraudulent websites and otherwise interfere with access to internet services. It has been associated with 'click fraud', the installation of additional malware and other malicious activities.
• Detect it: go to http://dns-ok.gov.au/ it will show you if your computer is infected.
• Fix it: go to http://www.dcwg.org/fix/ read and find the removal tool for you.