Script to do directory backups

It is usual to carry an external hard disk drive. As a portable device, it is prone to damage, can be stolen or corrupted by a virus. It is a good idea to have a backup of the contents of the portable HD in a laptop. I created a script written in BASH that helps me with this task.
The script does the following:

• identifies the source directory (the original content)
• identifies the destination directory (the place where you want to store the backup file)
• the script stores the last 3 backup files. This means that, if a forth backup file is created, the script will erase the oldest backup file.
• The script is executed manually. This is because the external hard drive is not always connected. Automatic execution may lead to errors because origin directory in not mounted on the filesystem.

The script goes as follows:

#!/bin/bash -x
#date: jun 21 2010
#backup of a directory in an external hard disk into laptop hard drive

BACKUPDIR=/home/EvilCat/WDBackup       

#this is the location where I want to store the backup 

SOURCE2=/media/WD\ Passport/My\ Documents/   

#this is the directory i want to do the backup

BACKUPFILE=backup.`date +%F_%R`.tgz           

#this is going to be the name of the backup file. 

#appends to the name the date and time the file was created

COUNT=`ls $BACKUPDIR/backup.* | wc -l`       

#counts the number of backup files that have been created. 
 
THRESHOLD=3 #the number of backup files to be stored.


if [ $COUNT -le $THRESHOLD ]
then
    tar -czf $BACKUPDIR/$BACKUPFILE "$SOURCE2"
    if [ $? != 0 ]
       then 
           echo problems creating backup file
    fi
else
    OLDFILE=`ls -ltr $BACKUPDIR/back* | cut -f 8 -d " " | head -n 1`
    rm -rf "$OLDFILE"
    tar -czf $BACKUPDIR/$BACKUPFILE "$SOURCE2"

fi


The script's name is backup.sh. In order to become executable, it must have the proper permissions. Your can set the permissions by issuing chmod u+x backup.sh. The script becomes executable.

At the moment, this utility syncs only one directory. Further work will involve a GUI, a way to select several folders to be backed-up and a mechanism to detect when the hard drive is connected and initiate a backup wizard.

Duplicando una VM en VirtualBox

A veces es muy útil hacer un backup de una máquina virtual, ya sea porque no queremos tener que volver a hacer el tedioso proceso de instalar un sistema operativo o porque vamos a hacer pruebas de hacking que vayan a volverla corrupta. Tengo una VM de WIndowsXP, la cual quiero clonar.

A través de el CLI en Fedora, procedo a identificar la ubicación del Disco Duro virtual de la VM que quiero clonar y ejecuto:

[evilcat@luiskr .VirtualBox]$ VBoxManage clonevdi HardDisks/WinXP.vdi HardDisks/WinXP_Real.vdi
VirtualBox Command Line Management Interface Version 2.2.4
(C) 2005-2009 Sun Microsystems, Inc.
All rights reserved.

0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%
Clone hard disk created in format 'VDI'. UUID: 3e617b00-ac56-44cb-ae45-c3271dcfc1e7
[evilcat@luiskr .VirtualBox]$

Esto permite que VirtualBox duplique el disco duro y le asigne un nuevo UUID (el identificador del disco duro, el cual ya puede ser importado a otra máquina virtual.
Es necesario entonces, ejecutar el wizard de creación de nueva máquina virtual y especificarle que use el disco duro recién clonado.

CompTIA Security+ Video Mentor: A Review

As a Security+ Certified person, it is really good to take a look at this new release from PEARSON.
When you take a look at the table of contents, you may see that the booklet covers all the necessary knowledge that a person should know in order to take the certification exam. Contents include:

Lesson 1, about Asymmetric Algorithms, shows the basic concepts and protocols in a clear language. Labs make use of GNU software as Linux and Backtrack. Also, Windows will be necessary: it is important to get to know several OS because security involves multivendor environments.

Lesson 2 covers Steganography, I think it is a good briefing about this subject. Anyway, I would suggest further reading to the hungry minds that would like to get a deeper understanding about this. Nonetheless, the exposed material is clear and deep enough for the exam purposes. I must confess steganography lab is very fun.

Lesson 3 is about Sniffers and protocol analysers. I believe, according to my experience, that this is a very important skill to develop if you work in a security-related business. This lesson shows the most popular programs and its usage.

Lesson 4 teaches about PKI and certificates. This section is very illustrative, because in the lab activity you can practice the concepts and create your own CA and do several operations with it.

Leson 5 shows TCP/IP. Briefly explains the OSI & TCP/IP model, how encapsulation works, three-way-handshake, ports and IPv6. The language used is very clear and understandable. Lab activities are great and lets the reader have a deeper understanding of the concepts exposed in the pdf.

Lesson 6 is about passwords: types, policies & management, attacks and mistakes that we do about them. It is an interesting reading because you have to deal with passwords everyday, you will notice that the password that you use for your e-mail account is not the safest and does not convey with the basic requirements a password should meet. Lab activities help a lot with this.

As a summary, I would like to recommend this product. I think this would be very helpful if you wish to learn and pass the certification exam. I liked it very much because it shows concepts and labs are comprehensive and helps you to increase your knowledge.

If you want to buy this product, you can follow this link to Amazon:

Setting up a personal SOHO firewall

I want to create a firewall for my laptop. As you may recall from the previous post, I have a Dell Inspiron 11z, running Fedora 12 64bits. I will use IPtables for this purpose.
A firewall must be configured according to the needs of the home/company. In my case, my network habits involve the following:

• Torrent downloading
• Chat (MSN and GTalk)
• Host a SSH server
• Host SMB server
• Access to SSH in other machines
  

As a network security guy, I have ill concerns about the heath and intrusiveness of my equipment, so I like to include some items in order to guarantee that it is safe:

• Must not send echo-replies, but be able to ping other host
• must not send port-unreachable and host-unreachable messages so services are hidden.

You must remember that functionality is important, so the rules should not be so tight that is difficult to use the equipment and use the services.

The configuration script goes as follows:

#!/bin/bash

#purpose: soho firewall

#pending june 3: do not send mesages to dmesg

#pending june 4: execute at boot


IPTABLES="/sbin/iptables"

# Flush all rules
$IPTABLES -F

# Set default policies
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP

# Incoming external traffic##
$IPTABLES -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT ## ICMP
$IPTABLES -A INPUT -p udp --sport domain -j ACCEPT ## DNS
$IPTABLES -A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT ## Accept al ESTABLISH incoming traffic
$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT ## Accept SSH
$IPTABLES -A INPUT -p tcp --dport 5901 -j ACCEPT ## Accep VNC
$IPTABLES -A INPUT -p tcp --destination-port 6881 -j ACCEPT ## Accept bittorrent
$IPTABLES -A INPUT -j LOG --log-prefix="BAD INPUT: " --log-level 4 ## Log all dropped incoming traffic

# Outgoing external traffic
$IPTABLES -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT ## Accept ICMP Request
$IPTABLES -A OUTPUT -p icmp --icmp-type host-unreachable -j DROP ## Block ICMP host unreachable
$IPTABLES -A OUTPUT -p udp --dport domain -j ACCEPT ## Accept DNS responses
$IPTABLES -A OUTPUT -p icmp --icmp-type port-unreachable -j DROP ## BLOCK ICMP PORT UNREACHABLE
$IPTABLES -A OUTPUT -p tcp --source-port 6881:6999 -j ACCEPT ## Allow bittorrent traffic to internet
$IPTABLES -A OUTPUT -p tcp -j ACCEPT ## accept all outgoing traffic
$IPTABLES -A OUTPUT -j LOG --log-prefix="BAD_OUTPUT: " --log-level 4 ## log all dropped outgoing traffic


# internal traffic rules
## Accept all internal input traffic
#$IPTABLES -A INPUT -j ACCEPT
## Accept all internal output traffic
#$IPTABLES -A OUTPUT -j ACCEPT

# forwarding packets rules
$IPTABLES -P FORWARD ACCEPT


As you may notice, this scrpt is under development. Among the pending tasks, I must finde a way to execute the script at boot time and avoif syslog messages to go to dmesg and iptables.log, a file I created in the rsyslog.conf file:

kern.warning /var/log/iptables.log

Also, I must define an internal forwarding policy to allow Virtual Machines access services and a tighter Outgoing traffic policies.

Testing the firewall is the next step. I used Backtrack to do so. First of all, I have to execute the script on my machine:



Then I go tho the VM with Bachtrack 4 installed so I can test.


You may notice that services exposed are the ones that are necessary.

Impressions? suggestions? What do you think about it? Your feedback is appreciated.