How to obtain a digital certificate for free

About digital certificates

A digital or SSL certificate consists of two encryption keys, one public and one private, a very common use for digital certificates is to encrypt data exchanges in between a user Internet browser and any e-commerce website but it can also be used to sign documents, encrypt and digitally sign email messages and identify yourself online. Once a digital certificate has been installed in your Internet browser or email client, it is easier to use than encryption software, many users are not even aware they are using it, if the SSL certificate is personalized a password might be asked before using it.

Typical digital certificates will contain a serial number, signature algorithm, issuing authority, valid from and expiry date, public key and a hashed number to guarantee that the key has not been tampered with.

Places to obtain a free digital certificate

CAcert: To be issued an SSL X.509 standard certificate you are asked you to join the CAcert community filling in an online form, in between others you can use CAcert certificates to secure websites, digitally signing or encrypting emails and files.

GetaCert: Not a Certificate Authority (CA), GetaCert appears to be a website using OpenSSL to create a digital certificates online, they can be issued for use with email and websites, all of their certificates are valid for 10 years and wildcards are supported.

StartSSL: Issuing free Class 1 (for individuals) SSL certificates valid for one year, renewable after expiration, security is as good as StartSSL paid for digital certificates but with some limitations like no wildcards allowed and it doesn’t hold identification details.

If you only need a digital certificate to sign and encrypt email you can get Comodo email SSL certificate.

Types of basic digital certificates

• Personal certificate: It works as a digital ID guaranteeing that the person is not someone else, a personal certificate can be used to identify yourself over the Internet with a company or Government agency, digitally sign an email message or a PDF file, a password will normally be asked when carrying out these tasks, using the something you have and something you know security model.

Diagram digital certificate encryption

• Server certificate: It identifies a user when establishing a connection before transmitting any information, email and Usenet servers use a server certificate when authentication takes place via SSL.

• Software certificate: It verifies software before installing it in your computer by checking the code digital signature making sure the program has not been replaced by malware having been signed by a genuine developer, useful when downloading software from the Internet.

Unrecognised digital certificates warnings

All Internet browsers come with digital certificates installed, these are issued by certification authorities like VeriSign or GeoTrust, when the browser comes across a website using a digital certificate which public key is not found in the browser you will get a not recognised certificate warning, this does not mean the site is not safe, it only means one of the key pairs has not been stored in the browser.

It is impossible to have every single company SSL certificate stored in the browser, when you get this kind of warning you should check the digital certificate making sure it is not a man in the middle attack by looking at its properties, when satisfied that everything looks correct, install it, after that you will not get any more security warnings when visiting that site.

Digital certificate security warning

When you install software you could find Windows warning you that the driver has not been digitally signed, Microsoft charges a huge amount for this ‘”privilege” and not all developers can’t afford it, it doesn’t necessarily mean the software is dangerous, it only means it has not been approved by Microsoft.

How to make your own SSL certificate

An alternative to companies issuing free SSL certificates is to create your own Certificate Authority or self-signed digital certificate using OpenSSL, an open source implementation of SSL and TLS, any decent Linux distribution will come with OpenSSL installed, you will need some basic Unix knowledge, go to the command line generate an RSA private key, generate a Certificate Signing Request (CSR) and generate a self-signed certificate, for the necessary commands to do this type man openssl at the Linux command prompt.

You can use OpenSSL and other Unix utilities in Windows using Cygwin, a Unix framework for Windows, it is beyond the scope of this article to explain how Cygwin works.

Tq http://www.hacker10.com/

How to Generate An SSL Certificate For Your Website

If you run a website which you need to serve via SSL, then this article is for you. The procedure for making your website SSL ready is quite simple. It involves -

1. Generating a private key.
2. Generating a Certificate Signing Request (CSR).
3. Getting the CSR signed by a certificate authority - Verisign, Go Daddy, Thawt etc. (Be ready to shell out some money here).
4. Uploading the private key, the CSR, and the certificate to your website.
5. Configuring the SSL version of your site. And finally ...
6. Enabling the SSL for your website.

ScoutApp has a nice article that explains the above steps in detail. Check it out.

Tq http://linuxhelp.blogspot.com

How to Setting Up a SNMP Server and Cacti in Ubuntu

What is net-snmp ?

Simple Network Management Protocol (SNMP) is a widely used protocol for monitoring the health and welfare of network equipment (eg. routers), computer equipment and even devices like UPSs. Net-SNMP is a suite of applications used to implement SNMP v1, SNMP v2c and SNMP v3 using both IPv4 and IPv6.

Cacti on the other hand is a frontend to the RRDTool with SNMP support. It collects and keep data in a MySQL database and display them through a PHP web frontend.

SNMPD

SNMPD is the service running SNMP on a managed entity. SNMP comes in 3 versions. Version 1, the one we are going to use here is not secured, therefore we are going to make sure that only localhost is going to be able to access it.

People opening the service to the outside should make sure that trusted hosts can access the service either though the use of iptables or through the use of /etc/hosts.allow.

Installing The SNMP Server

The only package which is required on the server site is snmpd, the SNMP daemon.

To install it type:

$ sudo apt-get install snmpd

snmpd is now installed but we still have to tweak it a little bit to make it work as we want.

Configuring SNMPD

The first thing we want to make sure is that snmpd is only going to wait for connections on localhost. To do this, edit file /etc/default/snmpd and make sure those values are set:

SNMPDRUN=yes

SNMPDOPTS='-Lsd -Lf /dev/null -u snmp -I -smux -p /var/run/snmpd.pid 127.0.0.1'

If you want your server to listen on all interfaces, remove the 127.0.0.1 bit.

This setting will make sure that the service will be started and that the service is going to bind to localhost.

Finally, we are going to configure snmpd in such a way that it will only return datas to trusted host for a specific community.

Edit /etc/snmp/snmpd.conf and make sure that com2sec it only set to:

com2sec readonly localhost mycommunity

If you want a remote machine to be able to gather information for the community mycommunity, make sure you replace localhost by mynetwork, where mynetwork can be of the form: 1.1.1.1 or 1.1.0.0/16.

Checking SNMP Configuration:

We are going to use the snmpwalk utility to verify that the server is working as wanted.

Here we want snmp to reply only to localhost for the community mycommunity.

From localhost

# Restart snmpd to load de new config #####

$ sudo /etc/init.d/snmpd restart


# Test the SNMP Server #####

$ sudo apt-get install snmp

$ snmpwalk -Os -c mycommunity -v 1 localhost system

Should return a lot of output and:

snmpwalk -Os -c public -v 1 localhost system

Timeout: No Response from localhost

If the second command returns result, it might be because you did not comment the line starting with com2sec.

Installing Cacti

Cacti displays system statistics through a PHP/MySQL web interface.

To gather informations, it runs a script which is going to poll the servers you registered in cacti: /usr/share/cacti/site/poller.php.

So, let's get started an install cacti.

Installing Cacti Packages And Dependencies

# apt-get install mysql-server apache2 libapache2-mod-php5 php5-mysql php5-cli php5-snmp
# apt-get install cacti

Note: because I am using php5, I had to install all the required php5-xx packages before I installed cacti. If you don't install those first, cacti will fall back to apache2 with php4.

While installing cacti, you are going to be asked a few question, answer as follow:

configuring libphp-adodb
-> press ok
configuring cacti
configure database for cacti with dbconfig-common
-> press yes
password of your database's administrative user
-> mysql root password (empty by default, fill accordingly)
mysql application password for cacti
-> give the password you would like cacti to connect to mysql with
webserver type
-> Apache2

Now, cacti is installed, let's configure it:

Configuring Cacti

Now, cacti is installed as well as its database. We still need through a few configuration screens before we can start adding servers to monitor.

Let's go to http://your-manager-server.ip/cacti/

• Click next to the first screen
• Select new install and check that the found informations are correct
• Check that everything is [FOUND]
• Click Finish

Finally, you should be landing on the login page. Log in with username: admin and password: admin. The next screen will force you to change your password.

On the first login, the default account is admin with password admin

Voila, our manager is up and running, the last step is to create new Devices (adding new hosts to our manager).

Enjoy ubuntu.... ;)

Tq http://www.debuntu.org

How to Setup a DNS Server in Ubuntu Server 10.04

• Ubuntu Server 10.04, the DNS server – 10.1.1.2 (hostname=dns)
• Ubuntu Server 10.04, the WEB server – 10.1.1.10 (hostname=web)

Instructions

1. Install the DNS server, we need to install Bind 9.

sudo apt-get install bind9

2. Configure Bind. We need to touch 5 files.

We will edit 3 files.

• /etc/bind/named.conf.local
• /etc/bind/named.conf.options
• /etc/resolv.conf

We will create 2 files.

• /etc/bind/zones/mydomain.com.db
• /etc/bind/zones/rev.1.1.10.in-addr.arpa

Domain zone – kunkun.my

sudo vi /etc/bind/named.conf.local

# Domain zone

zone "kunkun.my" {

type master;

file "/etc/bind/zones/kunkun.my.db";

};

# Reverse DNS

zone "1.1.10.in-addr.arpa" {

type master;

file "/etc/bind/zones/rev.1.1.10.in-addr.arpa";

};

Save file. Exit.

We just created a new domain. Please note: later we will create two files named mydomain.com.db and rev.1.1.10.in-addr.arpa files. Also, notice the reverse IP address sequence in the reverse DNS section.

Add the DNS servers from your ISP. You can place the primary and secondary DNS servers here separated by semicolons.

sudo vi /etc/bind/named.conf.options

We need to modify the named.conf global options to allow our internal clients to query the nameserver.

Modify the existing global options block to the following:




acl kunkun-lan { 10.1.1.0/24; 127.0/8; };

options { directory "/var/cache/bind";

allow-query { kunkun-lan; };

forwarders { 202.188.0.133; 202.188.1.5; }; # ISP primary/secondary

forward-only; # Rely completely on ISP for cache misses

};




The acl statement above sets up a range of IP addresses we can reference throughout the named.conf file. The allow-query specifies IP addresses of hosts that can query our nameserver. The forwarders statement tells our nameserver to forward any unresolvable queries to our upstream nameservers. The forward-only statement restricts our nameserver to only rely on our ISP nameservers and not contact other nameservers to find information that our ISP can not provide. It's very rare for a primary and secondary ISP nameserver to be down at the same time but you can comment forward-only if you want your nameserver to try the root nameservers when the upstream ISP nameservers cannot resolve a hostname.

Save file. Exit.

Modify the resolv.conf file found in /etc and place the IP address of our DNS server which is set to 10.1.1.2.

sudo vi /etc/resolv.conf

search kunkun.my

nameserver 10.1.1.2

Define the zones.

sudo mkdir /etc/bind/zones sudo vi /etc/bind/zones/kunkun.my.db

$TTL 3D

@ IN SOA dns.kunkun.my. root.kunkun.my. (

2

28800

3600

604800

38400 );

kunkun.my. IN NS dns.kunkun.my.

web IN A 10.1.1.10

www IN CNAME web.kunkun.my.

dns IN A 10.1.1.2

• The TTL or time to live is set for 3 days
• The dns.kunkun.my nameserver is defined
• An alias of www is assigned to ubuntudesktop using CNAME

Create a “rev.1.1.10.in-addr.arpa” file for reverse lookup.

sudo vi /etc/bind/zones/rev.1.1.10.in-addr.arpa

$TTL 3D

@ IN SOA dns.kunkun.my. root.kunkun.my. (

2

28800

604800

604800

86400 )

IN NS dns.kunkun.my.

10 IN PTR web.kunkun.my.




Restart Bind to activate our latest changes.

sudo /etc/init.d/bind9 restart




4. Test our new domain and DNS entries.

Dig

dig kunkun.my

dig -x 10.1.1.10

Nslookup

nslookup web

Enjoy ubuntu... ;)