Ben's Ramblings

After some thought, I decided it would be useful to document some of the projects i’m actively working on for this site. One of such projects is a real time black list (RBL) for the Rizon IRC Network. The network consists of 20~ servers holding around 15 – 17 thousand users.

Why is this important? Because IRC is such a old and simple  text based chat protocol. It is often abused by hackers, script kiddies and other malicious reasons to abuse people’s personal computers which have been compromised and turned into drones. They are then often used to disrupt the chat of others, or even denial of service attacks.

First the setup, after talking with some other RBL projects, dronebl.org and proxybl.org, I decided on a mix of MySQL and rbldnsd.

Rizon has several methods of detecting compromised hosts, drones, open proxies or other types malicious users. Each time a user is detected which matches one of our rulesets, his or her IP address is added to our ban list, normally for a 3 day period. While 3 days is useful, we wanted to pool the knowledge we had gained of the IP’s which were bad.

No small task, but I decided to spin up one of Rackspace’s new Cloud Servers to Debian (5.0). Tasks before me include:

• installation of mysql, rbldnsd, and lighttpd, my web server choice.
• setup of DNS records to create my blacklist & domain acquisition
• creation of php scripts to allow our services to add hosts & comments
• creation of scripts to dump the mysql database into a zone format for rbldnsd
• creation of informational website as well as a check & removal system for users who have cleaned up their problem.
• meet with the different Rizon developers depending on service and agree on a protocol for blacklist adds.

more to come…. as I get things implemented.

I finally got done configuring my laptop the way I want it, and impressively VMware Fusion lets me full screen VM’s per each of OSX 10.5 spaces. With 4gb and a dual core processor, my macbook is holding its own. Ubuntu 9.04 (xfce4), Windows XP, and Windows 7 (RC) for those unfamiliar.

Its been awhile since i’ve setup a PPTP server in linux but the overhead of server 2003 for under 10 users is hard to justify the cost. I’ve compiled a short how-to for reference. This is based off Ubuntu 8.10 but would most likely work for any flavor of both Ubuntu or Debian.

Install software…

aptitude install pptpd

Get your ip address

ifconfig – get eth0 ip address

First Config File

sudo nano -w /etc/pptpd.conf

what is -w? it turns off automatic line wrapping

Edit the following information:

localip      192.168.0.5 (this address should be the IP address of your server [inet addr] when you type ifconfig, see above )

remoteip   192.168.0.241-246 (this will provide you with 6 working IPs (aka a /29))

Get your DNS Servers

cat /etc/resolve.conf  ( your looking for the numbers after the word nameserver )

Second Config File

sudo nano -w /etc/ppp/options

Edit the following information:

ms-dns  18.70.0.160 (replace information from /etc/resolve, copy only the IP)

ms-dns  18.71.0.151

Third Config File

sudo nano -w /etc/sysctrl.conf

fine the line that says:

#net.ipv4.conf.default.forwarding=1

remove the #

This will allow the kernel to foward packets to your VPN clients

Final Config File

sudo nano -w /etc/ppp/chap-secrets

Format:

username service password ip

(* will allow any IP address to conncet)

alice pptpd secret-password-here  *

bob pptpd secret-password-here *

Lastly, reboot.

When your machine comes back up, you may need to /etc/init.d/pptpd start