2021 應用程式使用 gmail 寄信

Reference:

【2021最新版】如何使用Google SMTP寄信(兩段式驗證+應用程式密碼) - 主機架站寄信教學

登入 google 安全性設定

https://myaccount.google.com/security

Elasticsearch alert (ElastElert) 安裝

Reference:

【ELK】elastalert 日誌告警

採用docker方式安裝ElastAlert，圖形化配置告警規則

 

yum install -y python36 gcc python36-devel git
python3 -m pip install --upgrade pip
pip3 install elastalert
mkdir elastalert
cd elastalert
git clone https://github.com/Yelp/elastalert.git
cd elastalert
cp config.yaml.example config.yaml
mkdir rules

資安筆記

Bootstrap 跨站腳本漏洞

若你使用此漏洞的lib開發前台，如論壇或留言版，會讓人在貼文時可植入一段有害的程式碼，觀文者即有可能受該程式碼影響。

X-Frame-Options Header Not Set

CORS漏洞的學習與分析

主要用途是釣魚網站。

比如我架一個釣魚網站，背後資料全捉你的公開站，連post資料也去你站上捉，久而久之，當人們可以從我這站登入你網站時，我這站即可取得使用者帳密。

Fortigate 100D send syslog to linux

Reference:

How Fortigate 100D send log to Splunk 

 

Fortigate 100D網頁管理畫面沒有可以設定將 syslog 傳到外部的 log server。

必須用 putty 連上 console 下指令設定。

 

config log syslogd setting
    set status enable
    set server "192.168.1.171"
    set facility alert
    set source-ip 192.168.1.254
end

Mariadb (Mysql) enable audit log

Reference:

mariadb server audit plugin for mysql 

MariaDB Audit Plugin 

MySQL 基本操作語法

詳解MySQL四種Log機制 以日誌稽核解析追蹤事件 

MySQL Auditing With MariaDB Auditing Plugin 

mysql 几种日志

 

#login mysql
mysql -u root -p

#確認plugin目錄 (in mysql)
SHOW GLOBAL VARIABLES LIKE 'plugin_dir';
+---------------+--------------------------+
| Variable_name | Value                    |
+---------------+--------------------------+
| plugin_dir    | /usr/lib64/mysql/plugin/ |
+---------------+--------------------------+

Fortigate disable port 5060, 2000, 541

Reference:

Port 2000 and 5060 open by default (How to close)

Cannot Disable FMG-Access

 

port 5060, 2000:

 

To disable the SIP helper /  ALG i used the following code

config system settings
set default-voip-alg-mode kernel-helper-based
end

Important is that you need to configure it on all the VDOM`s

A reboot is not necessary, Clearing the sessions worked for us:

diagnose sys session filter
diagnose sys session filter dport 5060
diagnose sys session clear
diagnose sys session filter dport 2000
diagnose sys session clear

 

PS. port 2000關不掉，找時間重開機試試看。

 

port 541:

config system interface
edit <wan-interface>
unselect allowaccess fgfm
set ident-accept enable
end

Bacula 11.0.5 client setup

Reference:

Bacula Client安装配置

Windows Binaries

 

Linux client:

• yum install wget -y
• wget https://www.bacula.org/downloads/Bacula-4096-Distribution-Verification-key.asc --no-check-certificate
• rpm --import Bacula-4096-Distribution-Verification-key.asc
• vi /etc/yum.repos.d/Bacula.repo
• [Bacula-Community]
  name=CentOS - Bacula - Community
  baseurl=http://www.bacula.org/packages/[access key]/rpms/11.0.5/el7/
  enabled=1
  protect=0
  gpgcheck=1
• access key請參考 Bacula 11.0.5 install with rpm