Display X app on another Linux computer with su or sudo

Imagine you have a Linux server (server) without X server installed (or running) and you need to execute some application in graphical environment. If you also have another Linux computer with X server running (laptop), then here are the steps how to do it:

Note: On server you will need this package for X authentication: xorg-x11-xauth

1) connect from laptop with GUI to the server with enabled X11 forwarding:

laptop$ ssh -X user@server_IP

2) when connecting for a firs time, notice:
/usr/bin/xauth: creating new authority file /home/user/.Xauthority

3) you can run any X application on server and you will see X output on your laptop
server$ echo $DISPLAY
localhost:10.0
server$ xclock

4) if you su or sudo to different user, you can't run X application, because you don't have /home/user/.Xauthority file with correct session details

server$ xclock

...
debug2: X11 connection uses different authentication protocol.
X11 connection rejected because of wrong authentication.
debug2: X11 rejected 1 i0/o0
debug2: channel 1: read failed
...

5) connect as normal user again and export your X session details:
laptop$ ssh -X user@server_IP
server$ xauth list
server/unix:11 MIT-MAGIC-COOKIE-1 6ead87db0aa40e02d948eb1634855706

6) now su or sudo to different user and import your session settings:
server$ xauth add <paste the list line here>


7) notice the message:
xauth: creating new authority file /root/.Xauthority

8) now you can run X application again:
server$ xclock

Reset Snare password

Based on my investigation and Snare knowledge level - the Snare Webpage password is located in registry:

You can use this script to change Snare password into: Snr12pas

@echo off
echo
echo changing snare password to Snr12pas
echo ****************
echo Please exit (ctrl+c) now if you do NOT want to go ahead!
echo ****************
pause
echo
echo making backup of existing password in registry into c:\Program Files\Snare\pass_backup.reg
echo
Reg export "HKLM\Software\InterSect Alliance\AuditService\Remote" "c:\Program Files\Snare\pass_backup.reg"
echo
echo backup done, pres enter for the password reset
pause
echo
echo resetting password
echo
reg add "HKLM\Software\InterSect Alliance\AuditService\Remote" /v AccessKeySet /t REG_SZ /d 42f0134b89d7c6f32155ac6eab2125ee /f
reg add "HKLM\Software\InterSect Alliance\AuditService\Remote" /v AccessKeySetSnare1 /t REG_SZ /d 142fd8d4998c9e9fe70e371e4aa658f8 /f
reg add "HKLM\Software\InterSect Alliance\AuditService\Remote" /v AccessKeySetSnare2 /t REG_SZ /d f6987883c4f54c235082142168b0a3db /f
reg add "HKLM\Software\InterSect Alliance\AuditService\Remote" /v AccessKeySetSnare3 /t REG_SZ /d f99d180b53b5eacd1e32ca929876417d /f
net stop snare
net start snare
echo
echo done!

grep regular expressions -OR-

To match word1 or word2 use this regexp:


word1|word2

for characters you have 2 options:
a|b
[ab]


In grep you either use:
grep "word1\|word2"
or
grep -E "word1|word2"


If you want to match 2 different word in grep:
grep -e "word1" -e "word2"


To match either word1 or word2 at the beginning of line and exclude word3 use this:
grep "\(^word1\)\|\(^word2\).*[^word3].*$"

which is (almost) the same as:
grep -e "^word1" -e "^word2" -v word3

Special characters in Vi editor

# to display special characters in Vi:
:set list

# to insert special ^C character type:
<ctrl>+v and then <ctrl>+c

#to hide special characters:
:set nolist

Microsoft SQL Report Builder - Hyperlink in textbox

This will create a hyperlink in table's cell or in any text box:

:

sudo basics

1) config is in /etc/sudoers

2) edit it with visudo command, which can check syntax

3) basic configuration line:

user ALL=(ALL) ALL

1st ALL means on any computer - hostname
2nd =(ALL) means as any user - sudo -u user
3rd ALL means any command

This should always be there, to allow root run everything:
root ALL=(ALL) ALL

Example:

adam earth=(xena) /bin/kill

adam can run /bin/kill command only on computer hostname "earth" and only if logged as xena:
adam runs: sudo -u xena /bin/kill


4) user groups
till now we had users
groups are:
%group_name ALL=(ALL) ALL


5) Aliases:
User_Alias ADMINS=adam, xena
Cmnd_Alias COMMAND1=/bin/kill

now let's use it

ADMINS ALL=(ALL) COMMAND1


6) no password:
%admins_group ALL=(ALL) NOPASSWD: ALL


7) negation - allow all commands apart some:

Cmnd_Alias PASSWD_ROOT=/sbin/passwd root

user1 ALL=(ALL) !PASSWD_ROOT


8) (default) logfile:
/var/log/sudo.log

Linux iptables - open some ports to allow some traffic

1) in RH/CentOS is good to run this command :
$  system-config-securitylevel

2) it creates  basic iptables structure in /etc/sysconfig/iptables:
[root@CentOS log]# cat /etc/sysconfig/iptables
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
[root@CentOS log]#

3)  and also creates new chain called  RH-Firewall-1-INPUT which is inserted in INPUT and FORWARD existing chains:

[root@CentOS log]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain RH-Firewall-1-INPUT (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp any
ACCEPT esp -- anywhere anywhere
ACCEPT ah -- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns
ACCEPT udp -- anywhere anywhere udp dpt:ipp
ACCEPT tcp -- anywhere anywhere tcp dpt:ipp
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
[root@CentOS log]#



4) Imagine that some connection is blocked by FW, for example remote syslog messages (=syslog events sent from other host (/etc/syslog.cong: user.* @IP) to this host which acts as syslog server (/etc/sysconfig/syslog.conf: -r))
To catch this traffic into log for analysis is good to insert following rule
after all ACCEPT rules
and
in front of first REJECT or DROP rule, so it will print all not ACCEPTED and not DROPPED or REJECTED packets into /var/log/messages from where we can easily setup new rule to allow this traffic:

[root@CentOS log]# cat /etc/sysconfig/iptables
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -i eth0 --sport 67:68 --dport 67:68 -j DROP
-A RH-Firewall-1-INPUT -p udp -i eth0 --sport 67:68 --dport 67:68 -j DROP
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j LOG
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
[root@CentOS log]#
(of course "service iptables restart" after each edit of config file)

5)lets send test syslog message from remote host:
[root@XENtest2 ~]# logger -i -t user "test" 

6) And here is the taken traffic:
[root@CentOS log]# tail -f /var/log/messages
Jul 4 15:54:39 CentOS kernel: IN=eth0 OUT= MAC=00:0c:29:52:d2:58:00:16:3e:6f:99:86:08:00 SRC=192.168.0.128 DST=192.168.0.1 LEN=50 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=514 DPT=514 LEN=30

7) Lets setup iptable rule (more general - just based on protocol UDP and source and destination port 514)

[root@CentOS log]# cat /etc/sysconfig/iptables
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -i eth0 --sport 67:68 --dport 67:68 -j DROP
-A RH-Firewall-1-INPUT -p udp -i eth0 --sport 67:68 --dport 67:68 -j DROP
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --sport 514 --dport 514 -j ACCEPT
-A RH-Firewall-1-INPUT -j LOG
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
[root@CentOS log]#


8) and here it is, syslog message appears on syslog server:
[root@CentOS ~]# tail -f /var/log/messages
Jul 4 16:02:07 192.168.0.128 user[5369]: test