Pre-reqs

Update and Upgrade Debian. Install bzip2.

apt-get update
apt-get upgrade
apt-get install bzip2

Install iRedmail

wget http://bitbucket.org/zhb/iredmail/downloads/iRedMail-0.8.7.tar.bz2 --no-check-certificate

tar xjf iRedMail-0.8.7.tar.bz2

cd iRedMail-0.8.7

bash iRedMail.sh

**NOTE – bash script will install everything including MySQL, postfix, roundcube etc.

A series of prompts will be presented. Answer as follows:

1. Welcome and thanks for use-  Click Yes
2. Specify location to store all mailboxes. Default is /var/vmail/
3. Choose backend used to store mail accounts. Please choose the one which you’re familiar with – MySQL is my preference
4. Set password of MySQL root user. MySQL is used to store data of other applications, e.g. Roundcube webmail, Policyd, Amavisd-new.
5. Add your first mail domain name : example.com – only supply domain not the FQDN at this stage
6. Set password of admin account of your first mail domain.
7. Choose optional components : [Select All and press Next…]
8. Setup will ask for iptables config and restart the firewall
9. Reboot

Login to iRedmail:

* URLs of installed web applications:
*
* – Webmail: httpS://servername.com/mail/ or httpS://x.x.x.x/mail (IP)
* – Admin Panel (iRedAdmin): httpS://servername.com/iredadmin/ or httpS://x.x.x.x/iredadmin (IP)
* + Username: postmaster@example.com (mail domain name specified), Password: **********

All of the above information is emailed to the postmaster account and shown on screen. Take note.

That should be iRedmail up and running.

Pre-req – CURL is installed on your server

curl -v -3 -X HEAD http://www.example.com

Not vulnerable – * SSL peer handshake failed, the server most likely requires a client certificate to connect

Vulnerable – * SSL 3.0 connection using SSL_NULL_WITH_NULL_NULL

Installation instructions for malwaredetect on a Debian 6 server with ISPConfig3:

Installation

Install pre-reqs:

apt-get install inotify-tools

Install maldetect:

wget http://www.rfxn.com/downloads/maldetect-current.tar.gz
tar -xzvf maldetect-current.tar.gz
cd maldetect-*
sh install.sh

Configure

Edit the main maldet script to work with Debian:

vim /usr/local/maldetect/maldet

Replace the line that starts with $nice in the main maldet script with the following:

$nice -n $inotify_nice $inotify -d -r -o $inotify_log --fromfile $inotify_fpaths $exclude --timefmt "%d %b %H:%M:%S" --format "%w%f %e %T" -m -e create,move,modify >> /dev/null 2>&1 &

Edit internals.conf – Find inotify= and change the value to /usr/bin/inotifywait:

vim /usr/local/maldetect/internals.conf

Next delete inotifywait and libinotifytools.so.0

rm -rf /usr/local/maldetect/inotify/inotifywait
rm -rf /usr/local/maldetect/inotify/libinotifytools.so.0

Now edit the cronjob:

vim /etc/cron.daily/maldet

Comment out:

• /usr/local/maldetect/maldet -d >> /dev/null 2>&1
• /usr/local/maldetect/maldet -b -r /home?/?/public_html 2 >> /dev/null 2>&1
• if [ -d “/var/www/html” ]; then
  /usr/local/maldetect/maldet -b -r /var/www/html 2
  fi
  if [ -d “/usr/local/apache/htdocs” ]; then
  /usr/local/maldetect/maldet -b -r /usr/local/apache/htdocs 2
  fi

Add this:

# Instead use ISPConfig 3 path var/www
/usr/local/maldetect/maldet -b -r /var/www

Below this:

#/usr/local/maldetect/maldet -b -r /home?/?/public_html 2 >> /dev/null 2>&1

Now configure maldetect to run daily and send report to email address of your choice:

Set toggle to 1, update subject line and enter email address:

vim /usr/local/maldetect/conf.maldet

# [ EMAIL ALERTS ]
##
# The default email alert toggle
# [0 = disabled, 1 = enabled]
email_alert=1

# The subject line for email alerts
email_subj="Malware Detect Subject Line $(hostname)"

# The destination addresses for email alerts
# [ values are comma (,) spaced ]
email_addr="you@domain.com"

**Cron should run daily with an email report. Report only sent if malware found**

Manual Scanning

Scan specific directory:

maldet -a /home/homedir/public_html/

Scan all directories using a wildcard:

maldet -a /home/?/public_html/

Simple guide to installing WPScan on Debian.

Installation

Install git to grab source code from Github:

apt-get install git

Install dependencies for wpscan:

apt-get install libcurl4-gnutls-dev libopenssl-ruby libxml2 libxml2-dev libxslt1-dev ruby-dev ruby1.9.3

Clone wpscan form Github:

git clone http://github.com/wpscanteam/wpscan.git

Change into directory and install wpscan:

cd wpscan
gem install bundler && bundle install --without test development

Scanning

Scan WordPress plugins:

ruby wpscan.rb --url http(s)://www.yoursiteurl.com --enumerate p

Scan Vulnerable plugins:

ruby wpscan.rb --url http(s)://www.yoursiteurl.com --enumerate vp

Scan themes:

ruby wpscan.rb --url http(s)://www.yoursiteurl.com --enumerate t

Scan vulnerable themes:

ruby wpscan.rb --url http(s)://www.yoursiteurl.com --enumerate vt

Scan user accounts:

ruby wpscan.rb --url http(s)://www.yoursiteurl.com --enumerate u

Scan for timthumb installations:

ruby wpscan.rb --url http(s)://www.yoursiteurl.com --enumerate tt

Update wpscan:

ruby wpscan.rb --update

Commands to install iftop on Centos:

Pre-req install of libraries:

yum -y install libpcap libpcap-devel ncurses ncurses-devel

Download and Install iftop:

wget http://www.ex-parrot.com/pdw/iftop/download/iftop-0.17.tar.gz
tar -zxvf iftop-0.17.tar.gz
cd iftop-0.17
./configure
make
make install

To make use of iftop run the command:

iftop