Cache

Setting up a website to use Cloudflare on a VM hosted on Vultr and Namecheap

March 13, 2018 by Simon 1 Comment

This guide will show how you can set up a website to use Cloudflare on a VM hosted on Vultr and Namecheap

I have a number of guides on moving hasting away form CPanel, Setting up VM’s on AWS, Vultr or Digital Ocean along with installing and managing WordPress from the command line. This post will show how to let Cloudflare handle the DNS for the domain.

Snip from here “Cloudflare’s enterprise-class web application firewall (WAF) protects your Internet property from common vulnerabilities like SQL injection attacks, cross-site scripting, and cross-site forgery requests with no changes to your existing infrastructure.”

Cloudflare Benefits (Free Plan)

DDoS Attack Protection (Huge network to absorb attacks DDoS attacks over 600Gbps are no problem for our 15 Tbps networks)
Global CDN
Shared SSL certificate (I disabled this and opted to use my own)
Access to audit logs
3 page rules (maximum)

View paid plan options here.

Cloudflare CDN map

Cloudflare CDN says it can load assets up to 2x faster, 60% less bandwidth from your servers by delivering assets from 127 data centres.

Setup

You will need to sign up at cloudflare.com

After you create an account you will be prompted to add a siteCloudflare will pull your public DNS records to import.

You will be prompted to select a plan (I selected free)

Verify DNS settings to import.

You will now be asked to change your DNS nameservers with your domain reseller

TIP: If you have an SSL cert (e.g Lets Encrypt) already setup head to the crypto section and select ” Full (Strict)” to prevent ERR_TOO_MANY_REDIRECTS errors.

Cloudflare UI

I asked Twitter if they could kindly load my site so I could see if Cloudflare dashboard/stats were loading.

Could I kindly ask if you are reading this that you visit https://t.co/9x5TFARLCt, I am writing a @Cloudflare blog post and need to screenshot stats. Thanks in advance

— Simon Fearby (Developer) (@FearbySoftware) March 13, 2018

The Cloudflare CTO responded. 🙂

Sure thing 🙂

— John Graham-Cumming (@jgrahamc) March 13, 2018

Confirm Cloudflare link to a domain from the OSX Comand line

host -t NS fearby.com
fearby.com name server dane.ns.cloudflare.com.
fearby.com name server nora.ns.cloudflare.com.

host -t NS fearby.com

fearby.com name server dane.ns.cloudflare.com.

fearby.com name server nora.ns.cloudflare.com.

Caching Rule

I set up the following caching rule to cache everything for 8 hours instead of WordPress pages

“fearby.com.com/wp-*” Cache level: Bypass

“fearby.com.com/wp-admin/post.php*” Cache level: Bypass

“fearby.com/*” Cache Everything, Edge Cache TTL: 8 Hours

Cache Results

Cache appears to be sitting at 50% after 12 hours. having cache os dynamic pages out there is ok unless I need to fix a typo, then I need to login to Cloudflare and clear the cache manually (or wait 8 hours)

Performance after a few hours

DNS times in gtmetrix have now fallen to a sub 200ms (Y Slow is now a respectable A, it was a C before). I just need to wait for caching and minification to kick in.

webpagetest.org results are awesome

See here: https://www.webpagetest.org/result/180314_PB_7660dfbe65d56b94a60d7a604ca250b3/

Load Time: 1.80s
First Byte 0.176s
Start Render 1.200s

Google Page Speed Insights Report

Mobile: 78/100

Desktop: 87/100

Check with https://developers.google.com/speed/pagespeed/insights/

Update 24th March 2018 Attacked?

I noticed a spike in and traffic (incoming and threats) on the 24th of March 2018.

I logged into Cloudflare on my mobile device and turned on Under Attack Mode.

Cloudflare was now adding a delay screen in the middle of my initial page load. Read more here. A few hours after the Attach started it was over.

After the Attack

I looked at the bandwidth and found no increase in traffic from my initial host VM. Nice.

Thanks, Cloudflare.

Cloudflare Pros

Enabling Attack mode was simple.
Soaked up an attack.
Free Tier
Many Reports
Option to force HTTPS over HTTP
Option to ban/challenge suspicious IP’s and set challenge timeframes.
Ability to setup IP firewall rules and Application Firewalls.
User-agent blocking
Lockdown URL’s to IP’s (pro feature)
Option to minify Javascript, CSS and HTML
Option to accelerate mobile links
Brotli compression on assets served.
Optio to enable BETA Rocket loader for Javascript performance tweaks.
Run Javascript service workers from the 120+ CDN’s
Page/URL rules o perform custom actions (redirects, skip cache, Encryption etc)
HTTP/2 on, IPV6 ON
Option to setup load balancing/failover
CTO of Cloudflare responded in Twitter 🙂
Option to enable rate limiting (charged at 10,000 hits for $0.05c)
Option to block countries (pro feature)
Option to install apps in Cloudflare like(Goole Analytics,

Cloudflare Cons

No more logging into NameCheap to perform DNS management (I now goto Cloudflare, Namecheap are awesome).
Cloudflare Support was slow/confusing (I ended up figuring out the redirect problem myself).
Some sort of verify Cloudflare Setup/DNS/CDN access would be nice. After I set this up my gtmetrix load times were the same and I was not sure if DNS needs to replicate? Changing minify settings in Cloudflare did not seem to happen.
WordPress draft posts are being cached even though page riles block wp-admin page caching.
Would be nice to have ad automatic Under Attack mode
Now all sub-domains were transferred in the setup ( id did not know for weeks)

Cloudflare status

Check out https://www.cloudflarestatus.com/ for status updates.

Don’t forget to install the CloudFlare Plugin for WordPress if you use WordPress.

More Reading

Check out my OWASP Zap and Kali Linux self-application Penetration testing posts.

I hope this guide helps someone.

Ask a question or recommend an article

Revision History

v1.8 host Command from the OSX CLI

v1.7 Subdomain error

v1.6 Cloudflare Attack

v1.5 WordPress Plugin

v1.4 More Reading

v1.3 added WAF snip

v1.2 Added Google Page Speed Insights and webpage rest results

v1.1 Added Y-Slow

v1.0 Initial post

Improving the speed of WordPress

September 22, 2017 by Simon 9 Comments

This post shows my never ending quest to speed up WordPress for free.

I have used to use WP Total Cache in the past but decided to check out what other recommended, I found this post 6 Best WordPress Caching Plugins Compared. Some WordPress Caching Plugins.

What plugin do I use?

Benchmark (No Caching Plugin)

I tested my site before installing a caching plugin with https://www.webpagetest.org/ and my site was loading in 21s (loading over 141 files).

My site loaded in a terrible 21.3 seconds. My blog is hosted on Jumba (Net Registry) on and Ultimate plan for $25 a month.

My site seems to deliver 70% images so I wonder if a page caching plugin can help?

I do run the EWWW Image Optimizer plugin to automatically compress images when I upload them to my site. Read my blog post on the EWWW Image Optimizer here. I do keep images at a high quality to capture all details.

WP Fastest Cache Plugin

I have decided to try the WP Fastest Cache because it’s source was updated 4 hours ago compared to WP Super Cahches update 5 months ago. Both these plugins offer similar GT Metrix performance improvements and WP Fastest Cache has been tested on WordPress v4.8.

Installing WP Fastest Cache

I looked for the WP Fastest Cache Plugin on the WP plugin directory but it was not there.

I downloaded the latest version WP Fastest Cache from https://wordpress.org/plugins/wp-fastest-cache/

I upload the WP Faster Cache plugin to my site.

I Activated the plugin.

WP Fastest Cache plugin is now installed 🙂

It appears to have auto cached/indexed my site?

Now it’s time to run the same benchmark and see if the site is faster (with the same settings (Singapore chrome))?

1 of 3 test are under way.

WP Fastest Cache Results

Wow WP Fastest Cache loaded my site 2 seconds slower (Try 1 = 23 seconds, Try 2 = 21 seconds and Try 3 = 28 Seconds).

This could have been because of weekend traffic or hosting issues but this was not what I expected.

I disabled the WP Fastest Cache plugin and ran the benchmarks again and it was still 23 seconds (weekend traffic?). I re enabled WP Fastest Cache and re ran the test but no improvement.

My bad I think I needed to manually configure the WP Faster Cache plugin by opening the new WP Faster Cache menu on the left-hand side of the WP admin dashboard.

There I enabled caching options in the WP Faster Cache options.

I ran https://www.webpagetest.org tests again and got 16s, 18s and 16s seconds results in three tests and an A on compressed images. It appears you need to manually configure the WP Total Cache plugin after installing it (I missed this step).

I disable WP Fastest Cache and tried the WP Super Cache plugin and the test results were 29s, 24s, 24s (slower than WP Faster Cache). then tried W3 Total cache and the results were ()

I tried the W3 Total Cache plugin and the results were (30s, 16s 26s).

I Tried Autoptimize and it was tested at 45s.

It looks like WP Faster Cache is the fastest, ill turn it back on until try setup a CDN.

Fast Forward to Sept 2017

Since writing this post I have moved away from a shared C-Panel host and have moved my domain to a self-managed Vultr server closer to me, I have moved my email to Google G-Suite. I have learned how to deploy and manage WordPress by command line tools. I have set up servers on Digital Ocean before but the servers are located in Singapore and not Sydney and latency and scalability was poor. SSL will make sites slower and servers far away will just compound the issues.

Re enabling the WP Fastest Cache Plugin

I tried reinstalling the WP Fastest Cache plugin and for me, the plugin just slows down my site by 6 seconds.

I opened my NGINX config and got my NGINX user

sudo nano /etc/nginx/nginx.conf

1	sudo nano /etc/nginx/nginx.conf

My user is: www-data

I enabled the WP Fastest Cache plugin and ensured the WP Fastest Cache has ownership and access to the cache folder.

sudo chown www-data:www-data /www/wp-content/plugins/cache
sudo chown www-data:www-data /www//wp-content/plugins/cache/all
sudo chmod 755 /www/wp-content/plugins/cache *
sudo chmod 755 /www/wp-content/plugins/cache/all *

sudo chown www-data:www-data /www/wp-content/plugins/cache

sudo chown www-data:www-data /www//wp-content/plugins/cache/all

sudo chmod 755 /www/wp-content/plugins/cache *

sudo chmod 755 /www/wp-content/plugins/cache/all *

Below are the settings I use.

installing the WP-Optimize Plugin

I recommend setting up WP-Optimize plugin as it will optimize your database and keep things fast, it only saves me a second on my load times but this helps.

WP-Optimize will allow for to review database optimizations

Setting up Nginx GZip Compression

I set up my Nginx config to include

gzip on;
gzip_disable "msie6";

gzip_vary on;
gzip_proxied any;
gzip_comp_level 6;
gzip_buffers 16 8k;
gzip_http_version 1.1;
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

gzip on;

gzip_disable "msie6";

gzip_vary on;

gzip_proxied any;

gzip_comp_level 6;

gzip_buffers 16 8k;

gzip_http_version 1.1;

gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

I set the minimum size to gzip too

gzip_min_length 20;

1	gzip_min_length 20;

Benchmark with G-Zip, Caching and WP Fastest Cache

With WP Fastest Cache I now load my site in 13.9 seconds from Singapore. Time to disable WP Fastest cache plugin as it does not seem to be helping without linking to a CDN.

Setting up Browser Caching

I also setup browser caching by editing in NginX.

sudo nano /etc/nginx/sites-available/default

1	sudo nano /etc/nginx/sites-available/default

Added

location ~*  \.(jpg|jpeg|png|gif|ico|svg|js|css)$ {
        expires 365d;
}

location ~* \.(jpg|jpeg|png|gif|ico|svg|js|css)$ {

expires 365d;

}

Not sure if caching CSS and JS will cause problems in future?

Benchmark with G-Zip, Caching and without WP Fastest Cache (Singapore)

I re-ran the tests and got 10.9 seconds and got a B for cached content. When in Started on C-Panel I was getting near 30s

Benchmark with G-Zip, Caching and without WP Fastest Cache (Sydney)

I have always benchmarked from Singapore (as Sydney was not an option when I started) but now it is. Out f curiosity is my website load time in Sydney?

8.2 seconds. Distance does affect performance.

Google Speed Insights

Google has an awesome tools to help you increase your benchmark mobile and desktop website speeds and reccomend focus areas to resolve problems: https://developers.google.com/speed/pagespeed/insights/

Mobile Speed Score

Desktop Speed Score

Tips

I was getting SVG files failing compassion tests so I added the following under allowed mime types under “http gzip_types” in /etc/nginx/nginx.conf

image/svg+xml text/html+svg

1	image/svg+xml text/html+svg

Minifying JS and CSS

This needs to be done and 50% of my site files appears to be CSS and JS related.

It looks like 30%~40 of your sites google speed index is related to minified/combined JS/CSS.

I installed the Fast Velocity Minify WordPress plugin.

I ran this to install it from the command line

cd /www/wp-content/plugins#
sudo wget https://downloads.wordpress.org/plugin/fast-velocity-minify.2.2.1.zip
--2017-09-23 19:51:46--  https://downloads.wordpress.org/plugin/fast-velocity-minify.2.2.1.zip
Resolving downloads.wordpress.org (downloads.wordpress.org)... 66.155.40.187, 66.155.40.203, 66.155.40.188, ...
Connecting to downloads.wordpress.org (downloads.wordpress.org)|66.155.40.187|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 821621 (802K) [application/octet-stream]
Saving to: ‘fast-velocity-minify.2.2.1.zip’

fast-velocity-minify.2.2.1.zip 100%[=================================================>] 802.36K   830KB/s    in 1.0s

2017-09-23 19:51:47 (830 KB/s) - ‘fast-velocity-minify.2.2.1.zip’ saved [821621/821621]

cd /www/wp-content/plugins#

sudo wget https://downloads.wordpress.org/plugin/fast-velocity-minify.2.2.1.zip

--2017-09-23 19:51:46-- https://downloads.wordpress.org/plugin/fast-velocity-minify.2.2.1.zip

Resolving downloads.wordpress.org (downloads.wordpress.org)... 66.155.40.187, 66.155.40.203, 66.155.40.188, ...

Connecting to downloads.wordpress.org (downloads.wordpress.org)|66.155.40.187|:443... connected.

HTTP request sent, awaiting response... 200 OK

Length: 821621 (802K) [application/octet-stream]

Saving to: ‘fast-velocity-minify.2.2.1.zip’

fast-velocity-minify.2.2.1.zip 100%[=================================================>] 802.36K 830KB/s in 1.0s

2017-09-23 19:51:47 (830 KB/s) - ‘fast-velocity-minify.2.2.1.zip’ saved [821621/821621]

Unzip

sudo unzip merge-minify-refresh.zip

1	sudo unzip merge-minify-refresh.zip

I activated the plugin and set some settings

Verified minify logs

Google Page Insights can now see the minifies, css, js and html

Google Page Insights – Possible Optimizations

And Google Ad Words and Google Analytics appear to be holding back Google Page Insight scores

I am getting a few false positives with plugins javascript but that can be resolved another day.

Pingdom (Melbourne results)

3.2 seconds, a few false positives though.

I was going to test with https://www.webpagetest.org/ (from Singapore) but the service kept stalling and had too many tests before me (even from Sydney).

Address First Byte Time (todo)

If I look at the first-byte load results in the waterfall view my site is taking many seconds to deliver the first byte, this lowers the performance scores about 20%. I need to setup a CDN and or configure NGINX following this guide based on this manual configuration entry (I tried some of the Nginx settings but it appears I need to compile some performance settings into Nginx).

CDN (todo)

I am sure a Content Delivery Network (CDN) will help with the whole page deliver and first-byte times but I am trying to milk as much free as possible and limit future costs. A CDN will trigger higher monthly costs (any CDN providers want to donate a temporary pro plan for review purposes).

Misc Speed Articles

Yoast has a good site speed article here: https://yoast.com/site-speed-tools-suggestions/
Nginx has a good guide on Nginx performance here: https://www.nginx.com/blog/10-tips-for-10x-application-performance/
Google PageSpeed tips: https://developers.google.com/speed/docs/insights/rules

Configuring Ubuntu for Performance

Preventing applications swapping for disk (read more here)

sudo nano /etc/sysctl.conf

1	sudo nano /etc/sysctl.conf

I added this memory related setting.

vm.swappiness = 1

1	vm.swappiness = 1

This will all but prevent applications writing to disk (swap) when they are not active. I had free memory on my VM so I may as well use it.

I will monitor the free ram after reboot and play with php memory settings.

Setup Lazyload for images in posts

cd /www/wp-content/plugins/
sudo wget https://downloads.wordpress.org/plugin/bj-lazy-load.zip
unzip bj-lazy-load.zip
# activate the plugin

cd /www/wp-content/plugins/

sudo wget https://downloads.wordpress.org/plugin/bj-lazy-load.zip

unzip bj-lazy-load.zip

# activate the plugin

Lazyload Plugin Settings

Placeholder Image ( Image: https://fearby.com/wp-content/uploads/2017/09/placeholder.jpg )

Web Performance Test from Sydney

8.4 seconds ( Score Card F A A A C, was F F F A F ). I was getting up to 28 second load times with Net Registry C Panel servers.

Static Content is cached but Googe Ad Sence, Google Analytics, and some plugins do block the score. The front page does have some features content that has to be loaded and can’t be minified or cached much.

It is obvious I need to work in the initial websitee load (DNS, CDN or SSL), there sis 3 seconds I can save here.

Configuring PHP for Performance

todo: PHP base config.

todo: PHP caching.

Conclusion

I was expecting WP Fastest Cache to deliver faster speeds but in reality but I am getting 4 seconds faster in WordPress. I was going to configure MaxCDN but they are to expensive. Fast Velocity Minify Plugin is working a treat 🙂

I ended up ditching the shared CPanel hosted domain and setup my own server for WordPress. My site seems a lot faster now. A friend set up CloudFlare with great success, more soon. I blogged about my server setup here.

Adding browser cache and compressing and moving away from CPanel to a self-managed server helped.

The only things to try now is to use a CDN and speed up the delivery of my site and improve the First Byte Time.

Donate and make this blog better

Ask a question or recommend an article

Revision History

v1.932 added lazy load information (24th Sep 2017)

v1.952 added small changes (23rd Sep 2017)

etc

Securing Ubuntu in the cloud

August 9, 2017 by Simon 18 Comments

It is easy to deploy servers to the cloud within a few minutes, you can have a cloud-based server that you (or others can use). ubuntu has a great guide on setting up basic security issues but what do you need to do.

If you do not secure your server expect it to be hacked into. Below are tips on securing your cloud server.

First, read more on scanning your server with Lynis security scan.

Always use up to date software

Always use update software, malicious users can detect what software you use with sites like shodan.io (or use port scan tools) and then look for weaknesses from well-published lists (e.g WordPress, Windows, MySQL, node, LifeRay, Oracle etc). People can even use Google to search for login pages or sites with passwords in HTML (yes that simple). Once a system is identified by a malicious user they can send automated bots to break into your site (trying millions of passwords a day) or use tools to bypass existing defences (Security researcher Troy Hunt found out it’s child’s play).

Portscan sites like https://mxtoolbox.com/SuperTool.aspx?action=scan are good for knowing what you have exposed.

You can also use local programs like nmap to view open ports

Instal nmap

sudo apt-get install nmap

1	sudo apt-get install nmap

Find open ports

nmap -v -sT localhost

Starting Nmap 7.01 ( https://nmap.org ) at 2017-08-08 23:57 AEST
Initiating Connect Scan at 23:57
Scanning localhost (127.0.0.1) [1000 ports]
Discovered open port 80/tcp on 127.0.0.1
Discovered open port 3306/tcp on 127.0.0.1
Discovered open port 22/tcp on 127.0.0.1
Discovered open port 9101/tcp on 127.0.0.1
Discovered open port 9102/tcp on 127.0.0.1
Discovered open port 9103/tcp on 127.0.0.1
Completed Connect Scan at 23:57, 0.05s elapsed (1000 total ports)
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00020s latency).
Not shown: 994 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
3306/tcp open  mysql
9101/tcp open  jetdirect
9102/tcp open  jetdirect
9103/tcp open  jetdirect

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.17 seconds
           Raw packets sent: 0 (0B) | Rcvd: 0 (0B)

nmap -v -sT localhost

Starting Nmap 7.01 ( https://nmap.org ) at 2017-08-08 23:57 AEST

Initiating Connect Scan at 23:57

Scanning localhost (127.0.0.1) [1000 ports]

Discovered open port 80/tcp on 127.0.0.1

Discovered open port 3306/tcp on 127.0.0.1

Discovered open port 22/tcp on 127.0.0.1

Discovered open port 9101/tcp on 127.0.0.1

Discovered open port 9102/tcp on 127.0.0.1

Discovered open port 9103/tcp on 127.0.0.1

Completed Connect Scan at 23:57, 0.05s elapsed (1000 total ports)

Nmap scan report for localhost (127.0.0.1)

Host is up (0.00020s latency).

Not shown: 994 closed ports

PORT STATE SERVICE

22/tcp open ssh

80/tcp open http

3306/tcp open mysql

9101/tcp open jetdirect

9102/tcp open jetdirect

9103/tcp open jetdirect

Read data files from: /usr/bin/../share/nmap

Nmap done: 1 IP address (1 host up) scanned in 0.17 seconds

Raw packets sent: 0 (0B) | Rcvd: 0 (0B)

Limit ssh connections

Read more on setting permissions here.

Chmod help can be found here.

Install Fail2Ban

I used this guide on installing Fail2Ban.

apt-get install fail2ban

1	apt-get install fail2ban

Check Fail2Ban often and add blocks to the firewall of known bad IPs

fail2ban-client status

1	fail2ban-client status

Best practices

Ubuntu has a guide on basic security setup here.

Startup Processes

It is a good idea to review startup processes from time to time.

sudo apt-get install rcconf
sudo rcconf

1 2	sudo apt-get install rcconf sudo rcconf

Accounts

Read up on the concept of least privilege access for apps and services here.
Read up on chmod permissions.

Updates

Do update your operating system often.

sudo apt-get update
sudo apt-get upgrade

1 2	sudo apt-get update sudo apt-get upgrade

Minimal software

Only install what software you need

Exploits and Keeping up to date

Do keep up to date with exploits and vulnerabilities

Follow 0xDUDE on twitter.
Read the GDI.Foundation page.
Visit the Exploit Database
Vulnerability & Exploit Database
Subscribe to the Security Now podcast.

Secure your applications

NodeJS: Enable logging in applications you install or develop.

Ban repeat Login attempts with FailBan

Fail2Ban config

sudo nano /etc/fail2ban/jail.conf

1	sudo nano /etc/fail2ban/jail.conf

[sshd]

enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 3

[sshd]

enabled = true

port = ssh

filter = sshd

logpath = /var/log/auth.log

maxretry = 3

Hosts File Hardening

sudo nano /etc/host.conf

1	sudo nano /etc/host.conf

Add

order bind,hosts
nospoof on

1 2	order bind,hosts nospoof on

Add a whitelist with your ip on /etc/fail2ban/jail.conf (see this)

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not                          
# ban a host which matches an address in this list. Several addresses can be                             
# defined using space separator.
                                                                         
ignoreip = 127.0.0.1 192.168.1.0/24 8.8.8.8

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not

# ban a host which matches an address in this list. Several addresses can be

# defined using space separator.

ignoreip = 127.0.0.1 192.168.1.0/24 8.8.8.8

Restart the service

sudo service fail2ban restart
sudo service fail2ban status

1 2	sudo service fail2ban restart sudo service fail2ban status

Intrusion detection (logging) systems

Tripwire will not block or prevent intrusions but it will log and give you a heads up with risks and things of concern

Install Tripwire.

sudo apt-get install tiger tripwire

1	sudo apt-get install tiger tripwire

Running Tripwire

sudo tiger

1	sudo tiger

This will scan your system for issues of note

sudo tiger
Tiger UN*X security checking system
   Developed by Texas A&M University, 1994
   Updated by the Advanced Research Corporation, 1999-2002
   Further updated by Javier Fernandez-Sanguino, 2001-2015
   Contributions by Francisco Manuel Garcia Claramonte, 2009-2010
   Covered by the GNU General Public License (GPL)

Configuring...

Will try to check using config for 'x86_64' running Linux 4.4.0-89-generic...
--CONFIG-- [con005c] Using configuration files for Linux 4.4.0-89-generic. Using
           configuration files for generic Linux 4.
Tiger security scripts *** 3.2.3, 2008.09.10.09.30 ***
20:42> Beginning security report for simon.
20:42> Starting file systems scans in background...
20:42> Checking password files...
20:42> Checking group files...
20:42> Checking user accounts...
20:42> Checking .rhosts files...
20:42> Checking .netrc files...
20:42> Checking ttytab, securetty, and login configuration files...
20:42> Checking PATH settings...
20:42> Checking anonymous ftp setup...
20:42> Checking mail aliases...
20:42> Checking cron entries...
20:42> Checking 'services' configuration...
20:42> Checking NFS export entries...
20:42> Checking permissions and ownership of system files...
--CONFIG-- [con010c] Filesystem 'fuse.lxcfs' used by 'lxcfs' is not recognised as a valid filesystem
20:42> Checking for indications of break-in...
--CONFIG-- [con010c] Filesystem 'fuse.lxcfs' used by 'lxcfs' is not recognised as a valid filesystem
20:42> Performing rootkit checks...
20:42> Performing system specific checks...
20:46> Performing root directory checks...
20:46> Checking for secure backup devices...
20:46> Checking for the presence of log files...
20:46> Checking for the setting of user's umask...
20:46> Checking for listening processes...
20:46> Checking SSHD's configuration...
20:46> Checking the printers control file...
20:46> Checking ftpusers configuration...
20:46> Checking NTP configuration...
20:46> Waiting for filesystems scans to complete...
20:46> Filesystems scans completed...
20:46> Performing check of embedded pathnames...
20:47> Security report completed for simon.
Security report is in `/var/log/tiger/security.report.simon.170809-20:42'.

sudo tiger

Tiger UN*X security checking system

Developed by Texas A&M University, 1994

Updated by the Advanced Research Corporation, 1999-2002

Further updated by Javier Fernandez-Sanguino, 2001-2015

Contributions by Francisco Manuel Garcia Claramonte, 2009-2010

Covered by the GNU General Public License (GPL)

Configuring...

Will try to check using config for 'x86_64' running Linux 4.4.0-89-generic...

--CONFIG-- [con005c] Using configuration files for Linux 4.4.0-89-generic. Using

configuration files for generic Linux 4.

Tiger security scripts *** 3.2.3, 2008.09.10.09.30 ***

20:42> Beginning security report for simon.

20:42> Starting file systems scans in background...

20:42> Checking password files...

20:42> Checking group files...

20:42> Checking user accounts...

20:42> Checking .rhosts files...

20:42> Checking .netrc files...

20:42> Checking ttytab, securetty, and login configuration files...

20:42> Checking PATH settings...

20:42> Checking anonymous ftp setup...

20:42> Checking mail aliases...

20:42> Checking cron entries...

20:42> Checking 'services' configuration...

20:42> Checking NFS export entries...

20:42> Checking permissions and ownership of system files...

--CONFIG-- [con010c] Filesystem 'fuse.lxcfs' used by 'lxcfs' is not recognised as a valid filesystem

20:42> Checking for indications of break-in...

--CONFIG-- [con010c] Filesystem 'fuse.lxcfs' used by 'lxcfs' is not recognised as a valid filesystem

20:42> Performing rootkit checks...

20:42> Performing system specific checks...

20:46> Performing root directory checks...

20:46> Checking for secure backup devices...

20:46> Checking for the presence of log files...

20:46> Checking for the setting of user's umask...

20:46> Checking for listening processes...

20:46> Checking SSHD's configuration...

20:46> Checking the printers control file...

20:46> Checking ftpusers configuration...

20:46> Checking NTP configuration...

20:46> Waiting for filesystems scans to complete...

20:46> Filesystems scans completed...

20:46> Performing check of embedded pathnames...

20:47> Security report completed for simon.

Security report is in `/var/log/tiger/security.report.simon.170809-20:42'.

My Output.

sudo nano /var/log/tiger/security.report.username.170809-18:42

Security scripts *** 3.2.3, 2008.09.10.09.30 ***
Wed Aug  9 18:42:24 AEST 2017
20:42> Beginning security report for username (x86_64 Linux 4.4.0-89-generic).

# Performing check of passwd files...
# Checking entries from /etc/passwd.
--WARN-- [pass014w] Login (bob) is disabled, but has a valid shell.
--WARN-- [pass014w] Login (root) is disabled, but has a valid shell.
--WARN-- [pass015w] Login ID sync does not have a valid shell (/bin/sync).
--WARN-- [pass012w] Home directory /nonexistent exists multiple times (3) in
         /etc/passwd.
--WARN-- [pass012w] Home directory /run/systemd exists multiple times (2) in
         /etc/passwd.
--WARN-- [pass006w] Integrity of password files questionable (/usr/sbin/pwck
         -r).

# Performing check of group files...

# Performing check of user accounts...
# Checking accounts from /etc/passwd.
--WARN-- [acc021w] Login ID dnsmasq appears to be a dormant account.
--WARN-- [acc022w] Login ID nobody home directory (/nonexistent) is not
         accessible.

# Performing check of /etc/hosts.equiv and .rhosts files...

# Checking accounts from /etc/passwd...

# Performing check of .netrc files...

# Checking accounts from /etc/passwd...

# Performing common access checks for root (in /etc/default/login, /securetty, and /etc/ttytab...
--WARN-- [root001w] Remote root login allowed in /etc/ssh/sshd_config

# Performing check of PATH components...
--WARN-- [path009w] /etc/profile does not export an initial setting for PATH.
# Only checking user 'root'

# Performing check of anonymous FTP...

# Performing checks of mail aliases...
# Checking aliases from /etc/aliases.

# Performing check of `cron' entries...
--WARN-- [cron005w] Use of cron is not restricted

# Performing check of 'services' ...
# Checking services from /etc/services.
--WARN-- [inet003w] The port for service ssmtp is also assigned to service
         urd.
--WARN-- [inet003w] The port for service pipe-server is also assigned to
         service search.

# Performing NFS exports check...

# Performing check of system file permissions...
--ALERT-- [perm023a] /bin/su is setuid to `root'.
--ALERT-- [perm023a] /usr/bin/at is setuid to `daemon'.
--ALERT-- [perm024a] /usr/bin/at is setgid to `daemon'.
--WARN-- [perm001w] The owner of /usr/bin/at should be root (owned by daemon).
--WARN-- [perm002w] The group owner of /usr/bin/at should be root.
--ALERT-- [perm023a] /usr/bin/passwd is setuid to `root'.
--ALERT-- [perm024a] /usr/bin/wall is setgid to `tty'.

# Checking for known intrusion signs...
# Testing for promiscuous interfaces with /bin/ip
# Testing for backdoors in inetd.conf

# Performing check of files in system mail spool...

# Performing check for rookits...
# Running chkrootkit (/usr/sbin/chkrootkit) to perform further checks...
--WARN-- [rootkit004w] Chkrootkit has detected a possible rootkit installation
Possible Linux/Ebury - Operation Windigo installetd

# Performing system specific checks...
# Performing checks for Linux/4...

# Checking boot loader file permissions...
--WARN-- [boot02] The configuration file /boot/grub/menu.lst has group
         permissions. Should be 0600
--FAIL-- [boot02] The configuration file /boot/grub/menu.lst has world
         permissions. Should be 0600
--WARN-- [boot06] The Grub bootloader does not have a password configured.

# Checking for vulnerabilities in inittab configuration...

# Checking for correct umask settings for init scripts...
--WARN-- [misc021w] There are no umask entries in /etc/init.d/rcS

# Checking Logins not used on the system ...

# Checking network configuration
--FAIL-- [lin013f] The system is not protected against Syn flooding attacks
--WARN-- [lin017w] The system is not configured to log suspicious (martian)
         packets

# Verifying system specific password checks...

# Checking OS release...
--WARN-- [osv004w] Unreleased Debian GNU/Linux version `stretch/sid'

# Checking installed packages vs Debian Security Advisories...

# Checking md5sums of installed files

# Checking installed files against packages...
--WARN-- [lin001w] File `/lib/modules/4.4.0-87-generic/modules.dep' does not
         belong to any package.
--WARN-- [lin001w] File `/lib/modules/4.4.0-87-generic/modules.alias.bin' does
         not belong to any package.
--WARN-- [lin001w] File `/lib/modules/4.4.0-87-generic/modules.devname' does
         not belong to any package.
--WARN-- [lin001w] File `/lib/modules/4.4.0-87-generic/modules.softdep' does
         not belong to any package.
--WARN-- [lin001w] File `/lib/modules/4.4.0-87-generic/modules.alias' does not
         belong to any package.
--WARN-- [lin001w] File `/lib/modules/4.4.0-87-generic/modules.symbols.bin'
         does not belong to any package.
--WARN-- [lin001w] File `/lib/modules/4.4.0-87-generic/modules.builtin.bin'
         does not belong to any package.
--WARN-- [lin001w] File `/lib/modules/4.4.0-87-generic/modules.symbols' does
         not belong to any package.
--WARN-- [lin001w] File `/lib/modules/4.4.0-87-generic/modules.dep.bin' does
         not belong to any package.
--WARN-- [lin001w] File `/lib/modules/4.4.0-89-generic/modules.dep' does not
         belong to any package.
--WARN-- [lin001w] File `/lib/modules/4.4.0-89-generic/modules.alias.bin' does
         not belong to any package.
--WARN-- [lin001w] File `/lib/modules/4.4.0-89-generic/modules.devname' does
         not belong to any package.
--WARN-- [lin001w] File `/lib/modules/4.4.0-89-generic/modules.softdep' does
         not belong to any package.
--WARN-- [lin001w] File `/lib/modules/4.4.0-89-generic/modules.alias' does not
         belong to any package.
--WARN-- [lin001w] File `/lib/modules/4.4.0-89-generic/modules.symbols.bin'
         does not belong to any package.
--WARN-- [lin001w] File `/lib/modules/4.4.0-89-generic/modules.builtin.bin'
         does not belong to any package.
--WARN-- [lin001w] File `/lib/modules/4.4.0-89-generic/modules.symbols' does
         not belong to any package.
--WARN-- [lin001w] File `/lib/modules/4.4.0-89-generic/modules.dep.bin' does
         not belong to any package.
--WARN-- [lin001w] File `/lib/udev/hwdb.bin' does not belong to any package.

# Performing check of root directory...

# Checking device permissions...
--WARN-- [dev003w] The directory /dev/block resides in a device directory.
--WARN-- [dev003w] The directory /dev/char resides in a device directory.
--WARN-- [dev003w] The directory /dev/cpu resides in a device directory.
--FAIL-- [dev002f] /dev/fuse has world permissions
--WARN-- [dev003w] The directory /dev/hugepages resides in a device directory.
--FAIL-- [dev002f] /dev/kmsg has world permissions
--WARN-- [dev003w] The directory /dev/lightnvm resides in a device directory.
--WARN-- [dev003w] The directory /dev/mqueue resides in a device directory.
--FAIL-- [dev002f] /dev/rfkill has world permissions
--WARN-- [dev003w] The directory /dev/vfio resides in a device directory.

# Checking for existence of log files...
--FAIL-- [logf005f] Log file /var/log/btmp permission should be 660
--FAIL-- [logf007f] Log file /var/log/messages does not exist

# Checking for correct umask settings for user login shells...
--WARN-- [misc021w] There is no umask definition for the dash shell
--WARN-- [misc021w] There is no umask definition for the bash shell

# Checking symbolic links...

# Performing check of embedded pathnames...
20:47> Security report completed for username.

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

sudo nano /var/log/tiger/security.report.username.170809-18:42

Security scripts *** 3.2.3, 2008.09.10.09.30 ***

Wed Aug 9 18:42:24 AEST 2017

20:42> Beginning security report for username (x86_64 Linux 4.4.0-89-generic).

# Performing check of passwd files...

# Checking entries from /etc/passwd.

--WARN-- [pass014w] Login (bob) is disabled, but has a valid shell.

--WARN-- [pass014w] Login (root) is disabled, but has a valid shell.

--WARN-- [pass015w] Login ID sync does not have a valid shell (/bin/sync).

--WARN-- [pass012w] Home directory /nonexistent exists multiple times (3) in

/etc/passwd.

--WARN-- [pass012w] Home directory /run/systemd exists multiple times (2) in

/etc/passwd.

--WARN-- [pass006w] Integrity of password files questionable (/usr/sbin/pwck

-r).

# Performing check of group files...

# Performing check of user accounts...

# Checking accounts from /etc/passwd.

--WARN-- [acc021w] Login ID dnsmasq appears to be a dormant account.

--WARN-- [acc022w] Login ID nobody home directory (/nonexistent) is not

accessible.

# Performing check of /etc/hosts.equiv and .rhosts files...

# Checking accounts from /etc/passwd...

# Performing check of .netrc files...

# Checking accounts from /etc/passwd...

# Performing common access checks for root (in /etc/default/login, /securetty, and /etc/ttytab...

--WARN-- [root001w] Remote root login allowed in /etc/ssh/sshd_config

# Performing check of PATH components...

--WARN-- [path009w] /etc/profile does not export an initial setting for PATH.

# Only checking user 'root'

# Performing check of anonymous FTP...

# Performing checks of mail aliases...

# Checking aliases from /etc/aliases.

# Performing check of `cron' entries...

--WARN-- [cron005w] Use of cron is not restricted

# Performing check of 'services' ...

# Checking services from /etc/services.

--WARN-- [inet003w] The port for service ssmtp is also assigned to service

urd.

--WARN-- [inet003w] The port for service pipe-server is also assigned to

service search.

# Performing NFS exports check...

# Performing check of system file permissions...

--ALERT-- [perm023a] /bin/su is setuid to `root'.

--ALERT-- [perm023a] /usr/bin/at is setuid to `daemon'.

--ALERT-- [perm024a] /usr/bin/at is setgid to `daemon'.

--WARN-- [perm001w] The owner of /usr/bin/at should be root (owned by daemon).

--WARN-- [perm002w] The group owner of /usr/bin/at should be root.

--ALERT-- [perm023a] /usr/bin/passwd is setuid to `root'.

--ALERT-- [perm024a] /usr/bin/wall is setgid to `tty'.

# Checking for known intrusion signs...

# Testing for promiscuous interfaces with /bin/ip

# Testing for backdoors in inetd.conf

# Performing check of files in system mail spool...

# Performing check for rookits...

# Running chkrootkit (/usr/sbin/chkrootkit) to perform further checks...

--WARN-- [rootkit004w] Chkrootkit has detected a possible rootkit installation

Possible Linux/Ebury - Operation Windigo installetd

# Performing system specific checks...

# Performing checks for Linux/4...

# Checking boot loader file permissions...

--WARN-- [boot02] The configuration file /boot/grub/menu.lst has group

permissions. Should be 0600

--FAIL-- [boot02] The configuration file /boot/grub/menu.lst has world

permissions. Should be 0600

--WARN-- [boot06] The Grub bootloader does not have a password configured.

# Checking for vulnerabilities in inittab configuration...

# Checking for correct umask settings for init scripts...

--WARN-- [misc021w] There are no umask entries in /etc/init.d/rcS

# Checking Logins not used on the system ...

# Checking network configuration

--FAIL-- [lin013f] The system is not protected against Syn flooding attacks

--WARN-- [lin017w] The system is not configured to log suspicious (martian)

packets

# Verifying system specific password checks...

# Checking OS release...

--WARN-- [osv004w] Unreleased Debian GNU/Linux version `stretch/sid'

# Checking installed packages vs Debian Security Advisories...

# Checking md5sums of installed files

# Checking installed files against packages...

--WARN-- [lin001w] File `/lib/modules/4.4.0-87-generic/modules.dep' does not

belong to any package.

--WARN-- [lin001w] File `/lib/modules/4.4.0-87-generic/modules.alias.bin' does

not belong to any package.

--WARN-- [lin001w] File `/lib/modules/4.4.0-87-generic/modules.devname' does

not belong to any package.

--WARN-- [lin001w] File `/lib/modules/4.4.0-87-generic/modules.softdep' does

not belong to any package.

--WARN-- [lin001w] File `/lib/modules/4.4.0-87-generic/modules.alias' does not

belong to any package.

--WARN-- [lin001w] File `/lib/modules/4.4.0-87-generic/modules.symbols.bin'

does not belong to any package.

--WARN-- [lin001w] File `/lib/modules/4.4.0-87-generic/modules.builtin.bin'

does not belong to any package.

--WARN-- [lin001w] File `/lib/modules/4.4.0-87-generic/modules.symbols' does

not belong to any package.

--WARN-- [lin001w] File `/lib/modules/4.4.0-87-generic/modules.dep.bin' does

not belong to any package.

--WARN-- [lin001w] File `/lib/modules/4.4.0-89-generic/modules.dep' does not

belong to any package.

--WARN-- [lin001w] File `/lib/modules/4.4.0-89-generic/modules.alias.bin' does

not belong to any package.

--WARN-- [lin001w] File `/lib/modules/4.4.0-89-generic/modules.devname' does

not belong to any package.

--WARN-- [lin001w] File `/lib/modules/4.4.0-89-generic/modules.softdep' does

not belong to any package.

--WARN-- [lin001w] File `/lib/modules/4.4.0-89-generic/modules.alias' does not

belong to any package.

--WARN-- [lin001w] File `/lib/modules/4.4.0-89-generic/modules.symbols.bin'

does not belong to any package.

--WARN-- [lin001w] File `/lib/modules/4.4.0-89-generic/modules.builtin.bin'

does not belong to any package.

--WARN-- [lin001w] File `/lib/modules/4.4.0-89-generic/modules.symbols' does

not belong to any package.

--WARN-- [lin001w] File `/lib/modules/4.4.0-89-generic/modules.dep.bin' does

not belong to any package.

--WARN-- [lin001w] File `/lib/udev/hwdb.bin' does not belong to any package.

# Performing check of root directory...

# Checking device permissions...

--WARN-- [dev003w] The directory /dev/block resides in a device directory.

--WARN-- [dev003w] The directory /dev/char resides in a device directory.

--WARN-- [dev003w] The directory /dev/cpu resides in a device directory.

--FAIL-- [dev002f] /dev/fuse has world permissions

--WARN-- [dev003w] The directory /dev/hugepages resides in a device directory.

--FAIL-- [dev002f] /dev/kmsg has world permissions

--WARN-- [dev003w] The directory /dev/lightnvm resides in a device directory.

--WARN-- [dev003w] The directory /dev/mqueue resides in a device directory.

--FAIL-- [dev002f] /dev/rfkill has world permissions

--WARN-- [dev003w] The directory /dev/vfio resides in a device directory.

# Checking for existence of log files...

--FAIL-- [logf005f] Log file /var/log/btmp permission should be 660

--FAIL-- [logf007f] Log file /var/log/messages does not exist

# Checking for correct umask settings for user login shells...

--WARN-- [misc021w] There is no umask definition for the dash shell

--WARN-- [misc021w] There is no umask definition for the bash shell

# Checking symbolic links...

# Performing check of embedded pathnames...

20:47> Security report completed for username.

Type	Protocol	Port Range	Source	Comment
HTTP	TCP	80	0.0.0.0/0	Opens a web server port for later
All ICMP	ALL	N/A	0.0.0.0/0	Allows you to ping
All traffic	ALL	All	0.0.0.0/0	Not advisable long term but OK for testing today.
SSH	TCP	22	0.0.0.0/0	Not advisable, try and limit this to known IP’s only.
HTTPS	TCP	443	0.0.0.0/0	Opens a secure web server port for later

Development Blog

Coding for fun since 1996, Learn by doing and sharing.

Cache

Setting up a website to use Cloudflare on a VM hosted on Vultr and Namecheap

Improving the speed of WordPress

Popular

Security

Code

Tech

Wordpress

General

Main navigation

Cache

Footer

Popular

Security

Code

Tech

Wordpress

General