RPi Home Mail Server Project

It has been a while since I last updated my blog. I am quite happy to write another article regarding my latest project: my own mail server based on my Raspberry Pi.

The reason is quite simple: since Google, Microsoft, or whatever provider, considers that it has the right to read my emails, the only way to "revoke" this right is by discontinuing the use of those providers' services. However, bear in mind that putting an email server into your internal network poses a great risk and you should be aware of the means how to mitigate those risks (implement DMZ, VLANs, buying firewalls, etc.). Those means cost money of course.

After a research regarding the most appropriate software for home -and RPi- use, I chose Citadel. I haven't tested it yet under extreme circumstances.

In order to configure Citadel you can use this very useful tutorial:
http://www.ducky-pond.com/posts/2012/Jul/installing-citadel-on-rpi/

Citadel offers integration with ClamAV, an open source antivirus and Spamassasin, an open source antispam software.

ClamAV

Unfortunately Citadel website offers only a high-level configuration guide for both ClamAV and SpamAssassin. As a consequence we have to dive a little bit deeper in order to make them work together.

We can install ClamAV by issuing the following commands:

> apt-get install clamav-daemon
> apt-get install clamav

Make sure you have included the following lines on /etc/clamav/clamd.conf:

TCPSocket 3310
TCPAddr 127.0.0.1

Make sure clamAV deamon is running:
/etc/init.d/clamav-daemon start

Then, add the localhost address on Citadel's administration page as mentioned on the guide.

SpamAssassin

Installing SpamAssassin by issuing the following commands:
> apt-get install spampd
> apt-get install spamassassin

Make sure you reconfigure the listening address and port for spamassassin (I have searched for a conf file but I didn't find it. So I include the following workaround.)

Edit /etc/init.d/spampd script and locate the following lines:

[ -n "${LISTENPORT}" ] && ARGS="${ARGS} --port=${LISTENPORT}"
[ -n "${LISTENHOST}" ] && ARGS="${ARGS} --host=${LISTENHOST}"


Alter them according to the following ones:

[ -n "${LISTENPORT}" ] && ARGS="${ARGS} --port=783"
[ -n "${LISTENHOST}" ] && ARGS="${ARGS} --host=127.0.0.1"

Spamassassin must listen on port 783 in order to cooperate with Citadel.

Now the only thing to do is to configure accordingly your domain name and MX records in order to send and receive emails.

Last but not least, consider implementing PGP keys in order to communicate safely. Bear in mind that the email service is plaintext, anyone suitably positioned on the Internet (ISPs, network administrators, etc.) can intercept and read your emails.

Enjoy your email service!

Why you should not buy an iPhone 5

Following Apple's announcement of new iOS, I think this is the most suitable time to publish this post; a post explaining why you should not buy an iPhone 5!
Although I am a fan (was?) of Apple devices, I own an iPhone 5 for two months and I have already regretted the purchase I made. Because there is no hope with Apple's support, even if you have spent a fortune for buying this "device", I prefer sharing my experience rather than contacting Apple.

Below I sum up the main reasons why you should not buy an iPhone 5:

• Scratches

iPhone 5 is more fragile than a bohemian vase. I had iPhone 4 for 2 years, it had some "deep" dives to the ground but no scratches. On the other hand, iPhone 5 looks like somebody hit it with a hammer...

• "No service"

Another innovation by Apple. While we are in 2013, we have bought smartphones (iPhone I mean) that can do everything, but, they cannot place or receive a call. While I am not doing anything, even with my 3G connectivity OFF, iPhone drops the connection with the carrier. So simple. And I am asking: if I bring this to Apple's support attention, will they respond? And why will they? Many other people with the same issue, they haven't received any help.

• Wifi

It's the longest issue of iPhone, I think, since its birth? Either disconnects, or does not connect at all, wifi could be considered as a missing functionality since you cannot rely on it. Maybe Apple's marketing has done a great job in order to get promoted by carriers and promote the use of 3G instead of wifi.

• Regional Settings

I decided to switch my phone to english language and keep the greek regional settings (for example km instead of mi). But, you cannot do that! Even if you choose english language with regional settings based on the metric system, you WILL get the British metric system. Simply, there is no sense.

So if you decide to buy an iPhone 5 after this post, and numerous others, good luck! :D

Luring the Bots for Fun!

Project Introduction

These days I am hosting a custom honeypot which is based on Metasploitable VM. Unfortunately I didn't have the time to build a new one, so I based it on Metasploitable VM. Initially, I wanted to capture all the wordlists hosted on the machines that would target me. Secondly, I wanted to make a statistical analysis of the regions which attack the most. Obviously, a honeypot situated in Greece wouldn't be a good statistical sample, however after a month of honeypot's "production" state I have gathered very interesting data which I would like to share (apart from the wordlists!).

Honeypot Services

The first service which is built in order to lure the bots is the SSH. This has given me a very interesting amount of data and wordlists of the brute force attacks. SSH service by default does not log any failed login attempts. That's why I had to download SSH source code and recompile it in a way that the SSH daemon would log any failed logon attempt. The altered source code (auth_passwd.c) can be found here.

The second service is HTTP. I wanted to lure any bots or blackhats (script kiddies to be more accurate because no one serious blackhat would like to hack a useless site!) who would try to hack a web application. I uploaded to the Apache server a PHP project I had written during my first degree, which is full of vulnerabilities (in the 3rd semester no one had made me an introduction to web application security, I admit it!). In order to log the attacks I installed and configured ModSecurity as I have described in a previous article (later I found that modsecurity can be linked with online honeypot projects! Just google it!). Unfortunately, HTTP service has not faced any attack attempt yet, so this project did not go well!...

Attacking Hosts by Region

Below there is a graph of the number of attacks and the region from which these attacks came from!

I am sure that you had imagined that China would win the race easily!

Conclusion

In the near future I am looking to add more services to my honeypot, so stay tuned for future posts!
And remember: The bots are out there! (like X-Files motto? :p)

Kali Linux on Raspberry Pi

I finally found some time and installed Kali linux, the Backtrack successor, on my Raspberry Pi!
Here is the screenshot:

Below, I will provide the high level steps in order to install and configure the Kali Linux on your RP! 

"Ingredients" :p

• Raspberry Pi, 256MB RAM
• 16GB SD card Class 10

High level steps:

1. Download kali linux image from here.
2. Write on SD following the instructions provided by kali website or by Raspberry Pi website.
3. Change your root password. Note that SSH is enabled by default, so theoretically you will not need to plug in a HDMI monitor.
4. Expand the partition to fill all the SD card space. Because I am a little bit lazy, I used the raspi-config script with success!

Kali seems to run flawlessly up to this time. The following weeks I am going to test more features of Kali and see how I can take advantage of the flexibility provided by Raspberry Pi!

So stay tuned! :)

Building a pentest Lab

Introduction

For education purposes, a penetration test lab is always necessary. I needed this for a relevant project, so I think it could be useful for colleagues and generally for security researchers to publish my experience in building a penetration test lab. I have used vulnerable Linux images which are publicly available over the Internet. However, the main subject of this post is how to build a vulnerable Windows machine (it would be not too difficult if I had decided to leave it unpatched! :p).

Last but not least, I will go through the common cliche and suggest you run all this vulnerable software in NAT mode; don't leave these security holes running in your local network with Internet access!

Prerequisites

First of all, we will need a virtualization software. I have used VMware player which is free and covers my needs for this post. The images used are the following:

• Backtrack 5 R3, available here.
• Metasploitable v2, available here.
• OWASP Broken Web Applications image, available here.
• Windows XP SP3 (should be installed from scratch)

What else? Topology!

Below you can see the network topology of my pentest lab. I have taken the liberty to watermark my pictures in order to protect myself from plagiarists.

Building Vulnerable Windows machine

First of all we will need a Windows XP machine. It could be fully patched or not; we will not focus on Windows vulnerabilities thus on vulnerabilities on software installed on a Windows machine.

Below is the software and the relevant exploit I used in order to build this vulnerable Windows machine:

• Java 7 update 2, exploitable by this metasploit exploit.
• Hacme bank vulnerable web application, available here.
• Easyftp server vulnerable versions <=1.7.0.11 and earlier, exploitable by multiple metasploit exploits (use search easyftp under the msfconsole)

Regarding the other VMs on my topology, there are plenty of good articles exploiting the vulnerabilities residing on them.

Conclusion - TBC

I realise that this list is short, but I will come back with updates as my goal is to create a vulnerable Windows machine which is very close to reality and educative at the same time.

 

Links

• A very good repository for old, possibly vulnerable, versions of various software: http://www.oldapps.com
• How to install Hacme bank instructions: http://www.pingtrip.com/weblog/2008/09/installing-hacme-bank-on-xp-pro
• Metasploit exploits: http://www.metasploit.com/modules/
• Exploits Database by Offensive Security http://www.exploit-db.com

Me, My Raspberry Pi and I

In this post, I would like to share my raspberry experiment. I don't want to write another post of "How to do <this> with raspberry pi", but instead, share my experience. First of all:

What is Raspberry Pi?

From Raspberry Pi's FAQ:

The Raspberry Pi is a credit-card sized computer that plugs into your TV and a keyboard. It’s a capable little PC which can be used for many of the things that your desktop PC does, like spreadsheets, word-processing and games. It also plays high-definition video. We want to see it being used by kids all over the world to learn programming.

Raspberry Pi and I

I totally agree with the FAQ's definition! And I would recommend to all parents who are PC "aware" to buy a RP for their children!

My history with RP was quite long! I had been thinking of buying a RP a long time ago. But, I have a drawback (apart from my noumerous advantages of my character! :P); if I want something badly, I want it at the same time! Therefore, I wanted to buy a RP and didn't want to wait about 3 weeks, so I ordered from ebay. Unfortunately, I had bad luck. I ordered Friday and Saturday (as far as I can remember), it was announced that RP new releases would come with 512MB RAM instead of 256MB. All customers who had order from the authorized resellers they would get the 512MB version without any extra cost. But I had ordered from ebay!... So, no luck!... Nevertheless, I didn't get disappointed.

My "Project Plan"

My experiment with RP was to create a RP to host the following:

• VPN server
• Torrent downloader
• TOR proxy
• Syslog
• Dropbox uploader
• File Server
• (I hope the list will grow!)

Getting Started

I will skip the first steps because they are well documented at RP's site here!

Initially I had an SD with 8GB RAM but unfortunatelly it was declared dead.... So, I bought a 16GB SD, class 10! :)

First steps

I will start from the classics. Change the default password and throught raspi-config, extend file system to occupy the whole SD card and enable SSH. You will need it some time!

One of the classic security basics is to change your password! Through raspi-config, change the timezone and the keyboard. Another way to do this is to edit XKBLAYOUT and set it to "us" at /etc/default/keyboard.

Update your RP

In order to keep my RP distro up to date I used RPi update. You can get it by doing the following:

> sudo apt-get install git-core

> https://github.com/Hexxeh/rpi-update

Copy it to a cron directory, according to your needs (I have copied to the cron.weekly for example).

VPN Server

I have set up a VPN server in order to get connected to website & services over unsecured WIFIs. I have used this useful guide to set it up!

Torrent Box

I use bittornado client. Generally, you can use apt-get command and install your preferable torrent client software. Here you can find a guide for installing trasmission on your RP!

TOR Proxy

TOR project is an open network which you can use in order to tunnel your requests through many proxies all over the Internet. The purpose of the project is to provide its user anonymity. Here you can find information regarding TOR project.

The installation on my RP was quite simple. Issue the command:

apt-get install tor

and your RP is hosting your TOR proxy. Now you must alter your proxy settings on your browser in order to route all your requests through the TOR software. A very nice firefox add-on is QuickProxy!

Syslog

I also use syslog service of my RP to gather all logs from my network devices. You have to un-comment the following lines from /etc/rsyslog.conf:

$ModLoad imudp

$UDPServerRun 514

and instruct the network devices to use your RP as a syslog server!

Dropbox uploader

One of my first thoughts with RP was to upload files to dropbox through RP in order to take advantage of RP's low consumption. Moreover, it won't be necessary to have my macbook powered on in order to upload large files!

I found a useful script which uploads files to Dropbox with a Bash script. It's very useful and easy to install and use! You can find it here.

File Server

My RP is always ON! So why not share some files? For example some photos? So, I created a user, installed samba and voilá; my photos are shared on my home network. I used the following sequence:

#Install samba
> apt-get install samba samba-common-bin
#Created a user
> adduser <username>
#Set user samba password
smbpasswd -a <username>
#Added the following lines in /etc/samba/smb.conf:
[Photos]
comment = Photos Folder
path = <path here>
writable = no
guest ok = no
#Restart Samba Service
> /etc/init.d/samba restart

Now, the path entered in Samba.conf file is being shared over the network!

Iptables 

Last but not least, you need to setup a firewall. Iptables is a fine solution. If your RP is exposed to the Internet, it would be wiser if you configure your iptables. Here is some of fine guided I have used to write my iptables:

http://www.cyberciti.biz/tips/linux-iptables-examples.html

http://www.garron.me/linux/iptables-manual.html

http://www.thegeekstuff.com/2011/06/iptables-rules-examples/ 

Sum-up

My adventure with the RP does not end here. I experiment a lot with my RP and currently I am working on the project Kali Linux on RP, so stay tuned!

Further Reading

1. Raspberry Pi FAQ
2. Buy Raspberry Pi from Farnell or RS.
3. RPi Tutorials list.

Intellectual Property and Code of Ethics 001

As you may have noticed, I have watermarked every picture embedded in my blog posts. I had a recent plagiarism incident where my whole post was copied and integrated to somebody's blog and there was no citation to it apart from a link at the end of this blog post.

I would like to mention in this post that the information I write to my blog is free for everyone to share. But, the initial source of this information should be mentioned following the academic ethics. I am sure that the majority of infosec professionals had an academic education and therefore written some kind of dissertation according to some official rule set. For example in my MSc we have the following rules.

After a long search over the Internet I found a document under the name "Data Citation Best Practice Discussion Document" which can be found here.
It is a nice reference for all of us who do use references in our blog posts and we don't copy them without respecting the work of our colleague.

I am free to discuss this subject and of course, eager to hear any different point of view.