Detect Portscans

psad is great:
http://www.cyberciti.biz/faq/linux-detect-port-scan-attacks/

Hide Apache version from HEAD response

put

ServerTokens ProductOnly
ServerSignature Off

at the bottom of you apache2.conf and restart

source: http://www.debianadmin.com/apache-tipshide-apache-information-php-software-version.html

Spammer / Exploit-Scanner.. Secure your Apache..

Tired of Lines like that in your server-logs?

[Sun Nov 13 15:21:25 2011] [error] [client 174.133.29.34] File does not exist: /var/www/Comments
[Sun Nov 13 15:22:31 2011] [error] [client 174.133.29.34] File does not exist: /var/www/u20944
[Sun Nov 13 15:23:06 2011] [error] [client 174.133.29.34] File does not exist: /var/www/aarticle
[Sun Nov 13 15:23:20 2011] [error] [client 174.133.29.34] File does not exist: /var/www/remaxmi
[Sun Nov 13 15:23:44 2011] [error] [client 174.133.29.34] File does not exist: /var/www/author
[Sun Nov 13 15:23:44 2011] [error] [client 174.133.29.34] File does not exist: /var/www/category
[Sun Nov 13 15:23:51 2011] [error] [client 174.133.29.34] File does not exist: /var/www/gc
[Sun Nov 13 15:26:44 2011] [error] [client 174.133.29.34] File does not exist: /var/www/medicine
[Sun Nov 13 15:28:00 2011] [error] [client 174.133.29.34] File does not exist: /var/www/tag

Then install fail2ban

ensure you have /etc/fail2ban/filter.d/apache-nohome.conf

open /etc/fail2ban/jail.conf

insert 

[apache-nohome]
enabled = true
port    = http,https
filter  = apache-nohome
logpath = /var/log/apache*/*error.log
maxretry = 5

because the regexp wont match, you need to edit /etc/fail2ban/filter.d/apache-nohome.conf

and change the wrong regexp: failregex = [[]client <HOST>[]] File does not exist: .*/~.*

to this correct one:

 failregex = [[]client (?P<host>\S*)[]] File does not exist:

then restart fail2ban 

/etc/init.d/fail2ban restart

ensure the apache jail is running..:

fail2ban-client status

and watch the bastards getting banned:

cat /var/log/fail2ban.log

fail2ban-client status apache-nohome

source of correct regexp:

http://www.kauderwwwelsch.de/2011-04-01/fail2ban-die-phpmyadmin-sucher-bannen/

Rails / Passenger / Apache / proxy_http

If you are using proxy_http to serve some Rails applications,
be sure you dont have ProxyRequests On
and you're restricting the access to localhost

<Proxy *>
        AddDefaultCharset off
        Order deny,allow
        Allow from 127.0.0.1
</Proxy>

If you leave ProxyRequests On,

your box will be hijacked by spammers very quickly.

You can test if your server is running as "spammer-friendly" proxy,

connect to your server with telnet and fire GET request.

telnet yourserver.com 80
GET http://www.google.com

 If your server delivers google.com, you did it wrong and your server is an public Proxy and heaven for spammer. If your server responds with your own site, everything is fine.

kill all pids of programm

for i in $(ps -ef | grep tinyproxy | cut -d' ' -f5); do $(kill $i); done

 will kill all pids of tinyproxy

kill some processes

for i in $(seq 4082 4090); do $(kill $i); done

kills from pid 4082 to 4090

git server

http://progit.org/book/de/ch4-8.html
http://thelucid.com/2008/12/02/git-setting-up-a-remote-repository-and-doing-an-initial-push/

apache dump loaded modules

apache2ctl -t -D DUMP_MODULES

bash history-search-backward

recht praktisch..

zur ~/.bashrc hinzufügen:

bind '"\e[A"':history-search-backward
bind '"\e[B"':history-search-forward

add-apt-repository fehlt (solved)

aptitude install python-software-properties

adding jdk /etc/profiles or ~/.bashrc

export JAVA_HOME=/opt/jdk/jdk1.6.0_25
export PATH=$JAVA_HOME/bin:$PATH

Edit /etc/default/bootlogd to:

BOOTLOGD_ENABLE=Yes

nice and simple

commands:
- which
- whereis
- whatis

iteration

for i in `seq 1 1337`
do
 echo $i
done

remove sound from avi

mencoder -ovc copy -nosound video.avi -o video_nosound.avi

convert ogv to avi

mencoder foo.ogv -o foo.avi -oac mp3lame -lameopts fast:preset=standard -ovc lavc -lavcopts vcodec=mpeg4:vbitrate=4000

export firefox cookies from sqlite to textfile

sqlite3 -separator ' ' cookies.sqlite 'select * from moz_cookies' > cookies.txt