modify the file data/CRMEntity.php
line:
$upload_status = move_uploaded_file($filetmp_name,$upload_file_path.$current_id.”_”.$binFile);
to:
$upload_status = move_uploaded_file($filetmp_name,$upload_file_path.$current_id.”_”.iconv(“UTF-8”, “gb2312”,$binFile));
NAMES.DIRECTORY_PATH=(HOSTNAME,TNSNAMES)
TRACE_LEVEL_CLIENT=support
1. https://plaso.readthedocs.io/en/latest/
Server and workstation operating system logs
• Application logs (e.g.,web server,database server)
• Security tool logs (e.g., anti-virus, change detection, intrusion detection/prevention system)
• Outbound proxy logs and end-user application logs
• Remember to consider other, non-log sources for security events.
User logon/logo! events Successful logon 528, 540;
failed logon 529-537, 539; logo! 538, 551, etc
User account changes Created 624; enabled 626;
changed 642; disabled 629; deleted 630
Password changes To self: 628; to others: 627
Service started or stopped 7035, 7036, etc.
Object access denied 560, 567, etc
(if auditing enabled)
Successful user login “Accepted password”, “Accepted publickey”, “session opened”
Failed user login “authentication failure”, “failed password”
User log-off “session closed”
User account change “password changed”, “new user”, “delete user” or deletion
Sudo actions “sudo: … COMMAND=…” “FAILED su”
Service failure “failed” or “failure”
refrence: https://www.sans.org/brochure/course/log-management-in-depth/6
Before:
OpenSSH_4.3p2, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
Prepare:
1.1 downoad file:
https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.4.2.tar.gz
http://mirror.aarnet.edu.au/pub/OpenBSD/OpenSSH/portable/openssh-8.8p1.tar.gz
http://prdownloads.sourceforge.net/libpng/zlib-1.2.11.tar.gz?download
1.2 compile from source:
tar -xzvf zlib-1.2.11.tar.gzcd zlib-1.2.11 ./configure --prefix=/usr/local/zlib-12.11 --disable-asm make && make installcdlibressl-3.4.2./configure--prefix=/usr/localmake && makeinstallvim /etc/ld.so.conf.d/local.conf/usr/local/lib
tar zxvf openssh-8.8p1.tar.gz
cd openssh-8.8p1
./configure –prefix=/usr/local/openssh-8.8p1 –sysconfdir=/etc/ssh –with-ssl-dir=/usr/local/ –with-zlib=/usr/local/zlib-1.2.11/ –with-pam
make && make install
1.4 setup start script
cp redhat/sshd.init /etc/init.d/sshd
vi /etc/init.d/sshd
SSHD=/usr/local/openssh-8.8p1/sbin/sshd
/usr/local/openssh-8.8p1/bin/ssh-keygen -A
chkconfig –add sshd
chkconfig sshd on
chkconfig –list sshd
service sshd restart
vim /etc/profile
export PATH=/usr/local/openssh-8.8p1/bin:/usr/local/openssh-8.8p1/sbin:$PATH
service sshd restart
1.5 update sssd
yum install sssd sssd-tools
vi /etc/sssd/sssd.conf
[sssd]
config_file_version = 2
services = nss, pam
domains = LDAP
[nss]
[pam]
[domain/LDAP]
ldap_id_use_start_tls = False
ldap_schema = ad
ldap_default_authtok_type = obfuscated_password
cache_credentials = False
id_provider = ldap
auth_provider = ldap
ldap_default_bind_dn = test
ldap_uri = ldap://192.168.100.1
ldap_user_object_class = user
ldap_user_name = sAMAccountName
ldap_group_object_class = group
ldap_group_name = cn
override_gid = 513
ldap_idmap_range_min = 100000
#ldap_user_principal=userPrincipalName
override_homedir = /home/%u
default_shell = /bin/bash
1.5.1 setup bind user and crendentinal
sss_obfuscate -d LDAP
1.5.2 enable sssd
authconfig –enablesssd –enablesssdauth –enablemkhomedir –enablepamaccess –update
1.6 Windows 2012 R2 setup
1.6.1 promote OS to Active domain
1.6.2 install certificate service
import com.jcraft.jsch.Channel;
import com.jcraft.jsch.JSch;
import com.jcraft.jsch.JSchException;
import com.jcraft.jsch.Session;
import java.io.*;
public class PrintUDisk extends JSch implements TestInterface, Runnable {
int size = 1000;
PrintUDisk(){
size=33;
}
public int getFreeSize() {
return size;
}
public Session getSession() throws JSchException {
Session s = super.getSession(USER,HOST,PORT);
s.setConfig("StrictHostKeyChecking","no");
s.setPassword(PASS);
return s;
}
public String uptime() throws JSchException, IOException {
Session s = this.getSession();
s.connect(3000);
Channel c = s.openChannel("shell");
PipedInputStream pipIn = new PipedInputStream();
PipedOutputStream pipOut = new PipedOutputStream(pipIn);
FileOutputStream fileOut = new FileOutputStream( file, true);
c.setInputStream(pipIn);
c.setOutputStream(fileOut);
// c.setInputStream(System.in);
// c.setInputStream(new FilterInputStream(System.in) {
// public int read(byte[] b, int off, int len) throws IOException {
// return in.read(b, off, (len > 1024 ? 1024 : len));
// }
// });
c.connect();
pipOut.write("sudo su\n".getBytes());
pipOut.write("uptime\n".getBytes());
pipOut.write("exit\n".getBytes());
c.disconnect();
s.disconnect();
return "done";
}
@Override
public void name() {
}
@Override
public void type() {
}
@Override
public void run() {
while (size>0) {
System.out.println(Thread.currentThread().getName() + ": " + size);
try {
Process exec = Runtime.getRuntime().exec("ping www.163.com");
InputStream ret = exec.getInputStream();
System.out.println(new String(ret.readAllBytes(),"GB2312"));
size--;
} catch (IOException e) { e.printStackTrace();}
}
}
import com.jcraft.jsch.JSch;
import java.util.ArrayList;
public class TestObject {
JSch jsch;
public static void main(String[] args) {
String s[] = {"a","z"};
System.out.println(s[1]);
PrintUDisk pu = new PrintUDisk();
Thread th = new Thread(pu,"th");
Thread th1 = new Thread(pu,"th1");
th.start();
th1.start();
}
}