Archive forJune, 2007

VI Editor

Introduction
The VI editor is a screen-based editor used by many Unix users. The VI editor has powerful features to aid programmers, but many beginning users avoid using VI because the different features overwhelm them. This tutorial is written to help beginning users get accustomed to using the VI editor, but also contains sections relevant to regular users of VI as well. Examples are provided, and the best way to learn is to try these examples, and think of your own examples as well… There’s no better way than to experience things yourself.

EX Commands

Conventions
In this tutorial, the following convention will be used:

^X denotes a control character. For example, if you see: ^d in the tutorial, that means you hold down the control key and then type the corresponding letter. For this example, you would hold down the control key and then type d.

Before You Begin
The VI editor uses the full screen, so it needs to know what kind of terminal you have. When you log in, wiliki should ask you what terminal you have. The prompt looks like this:

TERM = (vt100)

If you know your terminal is a vt100 (or an emulator that can do vt100), just hit return for the terminal type when you log in. If you have an hp terminal, type “hp” for the terminal type and hit return. If you are not sure what kind of terminal you have, ask a lab monitor, or have someone help you set the correct terminal type.

If you make an error when you log in and type the wrong terminal type, don’t panic and log out. You can type the following commands to fix the settings:

First, tell your shell what type of terminal you have. (If you’re not sure what your shell is, type this command to see what shell you have: echo $SHELL.) For the examples given, the terminal type is “vt100″. Substitute it with whatever terminal type you have. For C shell (/bin/csh), the command is this:

set term=vt100

For Bourne Shell (/bin/sh) or Korn Shell (/bin/ksh), the commands are the following:

export TERM
TERM=vt100

Next, reset your terminal with this command:

tset

Now that the terminal type is (hopefully) correctly set, you are ready to get started with VI.

Starting the VI Editor
The VI editor lets a user create new files or edit existing files. The command to start the VI editor is vi, followed by the filename. For example to edit a file called temporary, you would type vi temporary and then return. You can start VI without a filename, but when you want to save your work, you will have to tell VI which filename to save it into later.

When you start VI for the first time, you will see a screen filled with tildes (A tilde looks like this: ~) on the left side of the screen. Any blank lines beyond the end of the file are shown this way. At the bottom of your screen, the filename should be shown, if you specified an existing file, and the size of the file will be shown as well, like this:

“filename” 21 lines, 385 characters

If the file you specified does not exist, then it will tell you that it is a new file, like this:

“newfile” [New file]

If you started VI without a filename, the bottom line of the screen will just be blank when VI starts. If the screen does not show you these expected results, your terminal type may be set wrong. Just type :q and return to get out of VI, and fix your terminal type. If you don’t know how, ask a lab monitor.

Getting Out of VI
Now that you know how to get into VI, it would be a good idea to know how to get out of it. The VI editor has two modes and in order to get out of VI, you have to be in command mode. Hit the key labeled “Escape” or “Esc” (If your terminal does not have such a key, then try ^[, or control-[.) to get into command mode. If you were already in the command mode when you hit "Escape", don't worry. It might beep, but you will still be in the command mode.

The command to quit out of VI is :q. Once in command mode, type colon, and 'q', followed by return. If your file has been modified in any way, the editor will warn you of this, and not let you quit. To ignore this message, the command to quit out of VI without saving is :q!. This lets you exit VI without saving any of the changes.

Of course, normally in an editor, you would want to save the changes you have made. The command to save the contents of the editor is :w. You can combine the above command with the quit command, or :wq. You can specify a different file name to save to by specifying the name after the :w. For example, if you wanted to save the file you were working as another filename called filename2, you would type: w filename2 and return.

Another way to save your changes and exit out of VI is the ZZ command. When in command mode, type ZZ and it will do the equivalent of :wq. If any changes were made to the file, it will be saved. This is the easiest way to leave the editor, with only two keystrokes.

The Two Modes of VI
The first thing most users learn about the VI editor is that it has two modes: command and insert. The command mode allows the entry of commands to manipulate text. These commands are usually one or two characters long, and can be entered with few keystrokes. The insert mode puts anything typed on the keyboard into the current file.

VI starts out in command mode. There are several commands that put the VI editor into insert mode. The most commonly used commands to get into insert mode are a and i. These two commands are described below. Once you are in insert mode, you get out of it by hitting the escape key. If your terminal does not have an escape key, ^[ should work (control-[). You can hit escape two times in a row and VI would definitely be in command mode. Hitting escape while you are already in command mode doesn't take the editor out of command mode. It may beep to tell you that you are already in that mode.

How to Type Commands in Command Mode
The command mode commands are normally in this format: (Optional arguments are given in the brackets)

[count] command [where]
Most commands are one character long, including those which use control characters. The commands described in this section are those which are used most commonly the VI editor.

The count is entered as a number beginning with any character from 1 to 9. For example, the x command deletes a character under the cursor. If you type 23x while in command mode, it will delete 23 characters.

Some commands use an optional where parameter, where you can specify how many lines or how much of the document the command affects, the where parameter can also be any command that moves the cursor.

Some Simple VI Commands
Here is a simple set of commands to get a beginning VI user started. There are many other convenient commands, which will be discussed in later sections.

a
enter insert mode, the characters typed in will be inserted after the current cursor position. If you specify a count, all the text that had been inserted will be repeated that many times.
h
move the cursor to the left one character position.
i
enter insert mode, the characters typed in will be inserted before the current cursor position. If you specify a count, all the text that had been inserted will be repeated that many times.
j
move the cursor down one line.
k
move the cursor up one line.
l
move the cursor to the right one character position.
r
replace one character under the cursor. Specify count to replace a number of characters
u
undo the last change to the file. Typing u again will re-do the change.
x
delete character under the cursor. Count specifies how many characters to delete. The characters will be deleted after the cursor.

Text Buffers in VI
The VI editor has 36 buffers for storing pieces of text, and also a general purpose buffer. Any time a block of text is deleted or yanked from the file, it gets placed into the general purpose buffer. Most users of VI rarely use the other buffers, and can get along without the other buffers. The block of text is also stored in another buffer as well, if it is specified. The buffer is specified using the ” command. After typing “, a letter or digit specifying the buffer must be entered. For example, the command: “mdd uses the buffer m, and the last two characters stand for delete current line. Similarly, text can be pasted in with the p or P command. “mp pastes the contents of buffer m after the current cursor position. For any of the commands used in the next two sections, these buffers can be specified for temporary storage of words or paragraphs.

Cutting and Yanking
The command commonly used command for cutting is d. This command deletes text from the file. The command is preceded by an optional count and followed by a movement specification. If you double the command by typing dd, it deletes the current line. Here are some combinations of these:

d^
deletes from current cursor position to the beginning of the line.
d$
deletes from current cursor position to the end of the line.
dw
deletes from current cursor position to the end of the word.
3dd
deletes three lines from current cursor position downwards.

There is also the y command which operates similarly to the d command which take text from the file without deleting the text.

Pasting
The commands to paste are p and P. The only differ in the position relative to the cursor where they paste. p pastes the specified or general buffer after the cursor position, while P pastes the specified or general buffer before the cursor position. Specifying count before the paste command pastes text the specified number of times.

Indenting Your Code and Checking
The VI editor has features to help programmers format their code neatly. There is a variable that to set up the indentation for each level of nesting in code. In order to set it up, see the customization section of this tutorial. For example, the command to set the shift width to 4 characters is :set sw=4.

The following commands indent your lines or remove the indentation, and can be specified with count:

<<
Shifts the current line to the left by one shift width.
>>
Shifts the current line to the right by one shift width.

The VI editor also has a helpful feature which checks your source code for any hanging parentheses or braces. The % command will look for the left parenthesis or brace corresponding to a particular right parenthesis or brace and vice versa. Place the cursor onto a parenthesis or brace and type % to move the cursor to the corresponding parenthesis or brace. This is useful to check for unclosed parentheses or braces. If a parenthesis or brace exists without a matching parenthesis or brace, VI will beep at you to indicate that no matching symbol was found.

Word and Character Searching
The VI editor has two kinds of searches: string and character. For a string search, the / and ? commands are used. When you start these commands, the command just typed will be shown on the bottom line, where you type the particular string to look for. These two commands differ only in the direction where the search takes place. The / command searches forwards (downwards) in the file, while the ? command searches backwards (upwards) in the file. The n and N commands repeat the previous search command in the same or opposite direction, respectively. Some characters have special meanings to VI, so they must be preceded by a backslash (\) to be included as part of the search expression.

Special characters:

^
Beginning of the line. (At the beginning of a search expression.)
.
Matches a single character.
*
Matches zero or more of the previous character.
$
End of the line (At the end of the search expression.)
[
Starts a set of matching, or non-matching expressions... For example: /f[iae]t matches either of these: fit fat fet In this form, it matches anything except these: /a[^bcd] will not match any of these, but anything with an a and another letter: ab ac ad
<
Put in an expression escaped with the backslash to find the ending or beginning of a word. For example: /\ should find only word the, but not words like these: there and other.
>
See the ‘<' character description above.

The character search searches within one line to find a character entered after the command. The f and F commands search for a character on the current line only. f searches forwards and F searches backwards and the cursor moves to the position of the found character.

The t and T commands search for a character on the current line only, but for t, the cursor moves to the position before the character, and T searches the line backwards to the position after the character.

These two sets of commands can be repeated using the ; or , command, where ; repeats the last character search command in the same direction, while , repeats the command in the reverse direction.

Settings for VI (and EX)
You can customize the way VI behaves upon start up. There are several edit options which are available using the :set command, these are the VI and EX editor options available on Wiliki: (You can get this list by typing :set all and then return in command mode)

noautoindent magic noshowmatch
autoprint mesg noshowmode
noautowrite nomodelines noslowopen
nobeautify nonumber tabstop=8
directory=/tmp nonovice taglength=0
nodoubleescape nooptimize tags=tags /usr/lib/tags
noedcompatible paragraphs=IPLPPPQPP LIpplpipnpbp term=xterm
noerrorbells prompt noterse
noexrc noreadonly timeout
flash redraw timeoutlen=500
hardtabs=8 remap ttytype=xterm
noignorecase report=5 warn
keyboardedit scroll=11 window=23
keyboardedit! sections=NHSHH HUuhsh+c wrapscan
nolisp shell=/bin/csh wrapmargin=0
nolist shiftwidth=8 nowriteany

Some of these options have values set with the equals sign '=' in it, while others are either set or not set. (These on or off type of options are called Boolean, and have "no" in front of them to indicate that they are not set.) The options shown here are the options that are set without any customization. Descriptions of some of these are given below, with an abbreviation. For example, the command set autoindent, you can type :set autoindent or :set ai. To unset it, you can type :set noautoindent or :set noai.

autoindent (ai)
This option sets the editor so that lines following an indented line will have the same indentation as the previous line. If you want to back over this indentation, you can type ^D at the very first character position. This ^D works in the insert mode, and not in command mode. Also, the width of the indentations can be set with shiftwidth, explained below.
exrc
The .exrc file in the current directory is read during startup. This has to be set either in the environment variable EXINIT or in the .exrc file in your home directory.
mesg
Turn off messages if this option is unset using :set nomesg, so that nobody can bother you while using the editor.
number (nu)
Displays lines with line numbers on the left side.
shiftwidth (sw)
This option takes a value, and determines the width of a software tabstop. (The software tabstop is used for the << and >> commands.) For example, you would set a shift width of 4 with this command: :set sw=4.
showmode (smd)
This option is used to show the actual mode of the editor that you are in. If you are in insert mode, the bottom line of the screen will say INPUT MODE.
warn
This option warns you if you have modified the file, but haven’t saved it yet.
window (wi)
This option sets up the number of lines on the window that VI uses. For example, to set the VI editor to use only 12 lines of your screen (because your modem is slow) you would use this: :set wi=12.
wrapscan (ws)
This option affects the behavior of the word search. If wrapscan is set, if the word is not found at the bottom of the file, it will try to search for it at the beginning.
wrapmargin (wm)
If this option has a value greater than zero, the editor will automatically “word wrap”. That is, if you get to within that many spaces of the left margin, the word will wrap to the next line, without having to type return. For example, to set the wrap margin to two characters, you would type this: :set wm=2.

Abbreviations and Mapping Keys to Other Keys
One EX editor command that is useful in the VI editor is the abbreviate command. This lets you set up abbreviations for specific strings. The command looks like this: :ab string thing to substitute for. For example, if you had to type the name, “Humuhumunukunukuapua`a” but you didn’t want to type the whole name, you could use an abbreviation for it. For this example, the command is entered like this:
:ab 9u Humuhumunukunukuapua`a
Now, whenever you type 9u as a separate word, VI will type in the entire word(s) specified. If you typed in 9university, it will not substitute the word.

To remove a previously defined abbreviation, the command is unabbreviate. To remove the previous example, the command would be “:una 9u” To get your listing of abbreviations, simply just type :ab without any definitions.

Another EX editor command that is useful for customization is the mapping command. There are two kinds of mapping commands. One for command mode, and the other for insert mode. These two commands are :map and :map! respectively. The mapping works similarly to the abbreviation, and you give it a key sequence and give it another key sequence to substitute it with. (The substituted key sequences are usually VI commands.)

The EXINIT Environment Variable and the .exrc file
There are two ways to customize the VI editor. If you create a file called .exrc in your home directory, all the commands in there will be read when VI starts up. The other method is to set an environment variable called EXINIT. The options will be set in your shell’s setup file. If you use /bin/csh (C-Shell), the command is as follows, and is put in the .cshrc file:

setenv EXINIT ‘…’

If you use /bin/sh or /bin/ksh, the command is as follows, and is put into the .profile file:

export EXINIT
EXINIT=’…’

Don’t put in … as the example says. In this space put the commands that you want to set up. For example, if you want to have auto indent, line numbering, and the wrap margin of three characters, then the setenv command (for C shell) looks like this:

setenv EXINIT ’set ai nu wm=3′

If you want to put more than one command in the setenv EXINIT thing, separate the commands with a vertical bar (|). For example, to map the ‘g’ command to the ‘G’ character in command mode, the command is :map g G, and combined with the above command, you get this:

setenv EXINIT ’set ai nu wm=3|map g G’

If you want to create the file called .exrc, you can put exactly the same things in the file as shown in the quotes after the EXINIT.

Recovering Your Work When Something Goes Wrong with Your Terminal
The VI editor edits a temporary copy of your file, and after the editing is complete, or when you tell it to save, it puts the contents of the temporary copy into the original file. If something goes wrong while you are editing your file, the VI editor will attempt to save whatever work you had in progress, and store it for later recovery. (Note: If VI dies while you were working on any file, it sends you an email message on how to recover it. The -r option stands for recovery. If you were editing the file vitalinfo, and you accidentally got logged out, then the -r option of the ‘vi’ editor should help. The command would look somewhat like this: vi -r vitalinfo After using the -r option once, though, you MUST save what you have recovered to the actual file… The -r option only works once per failed VI session.

Warning About Using VI on the Workstations
There are two things to be aware of when using the workstations: Editing the same file many times at once, and changing the size of the screen.

Because VI edits a copy of your original file and saves the contents of that copy into the original file, if you are logged on more than once and are editing the same file more than once using VI, if you save on one window and then you save on the other window, the changes made to the file on the first save would be overwritten. Make sure that you only run one copy of VI per file.

If you use a terminal program from a workstation, you can change the size of the screen by dragging the sides of the window. If the size is not working properly, the command to type is this:

eval `resize`

If that doesn’t work the command would be this:

eval `/usr/bin/X11/resize`

If the size is wrong, the editor will not operate correctly. If you have any problems with the screen size, ask the monitors in the computer lab for help setting the sizes correctly.

Summary of VI commands
This list is a summary of VI commands, categorized by function. There may be other commands available, so check the on-line manual on VI. For easy reference, you can save this file as text and delete any commands you don’t think you would use and print out the resulting shorter file.

Cutting and Pasting/Deleting text


Specify a buffer to be used any of the commands using buffers. Follow the ” with a letter or a number, which corresponds to a buffer.
D
Delete to the end of the line from the current cursor position.
P
Paste the specified buffer before the current cursor position or line. If no buffer is specified (with the ” command.) then ‘P’ uses the general buffer.
X
Delete the character before the cursor.
Y
Yank the current line into the specified buffer. If no buffer is specified, then the general buffer is used.
d
Delete until where. “dd” deletes the current line. A count deletes that many lines. Whatever is deleted is placed into the buffer specified with the ” command. If no buffer is specified, then the general buffer is used.
p
Paste the specified buffer after the current cursor position or line. If no buffer is specified (with the ” command.) then ‘p’ uses the general buffer.
x
Delete character under the cursor. A count tells how many characters to delete. The characters will be deleted after the cursor.
y
Yank until , putting the result into a buffer. “yy” yanks the current line. a count yanks that many lines. The buffer can be specified with the ” command. If no buffer is specified, then the general buffer is used.

Inserting New Text

A
Append at the end of the current line.
I
Insert from the beginning of a line.
O
(letter oh) Enter insert mode in a new line above the current cursor position.
a
Enter insert mode, the characters typed in will be inserted after the current cursor position. A count inserts all the text that had been inserted that many times.
i
Enter insert mode, the characters typed in will be inserted before the current cursor position. A count inserts all the text that had been inserted that many times.
o
Enter insert mode in a new line below the current cursor position.

Moving the Cursor Within the File

^B
Scroll backwards one page. A count scrolls that many pages.
^D
Scroll forwards half a window. A count scrolls that many lines.
^F
Scroll forwards one page. A count scrolls that many pages.
^H
Move the cursor one space to the left. A count moves that many spaces.
^J
Move the cursor down one line in the same column. A count moves that many lines down.
^M
Move to the first character on the next line.
^N
Move the cursor down one line in the same column. A count moves that many lines down.
^P
Move the cursor up one line in the same column. A count moves that many lines up.
^U
Scroll backwards half a window. A count scrolls that many lines.
$
Move the cursor to the end of the current line. A count moves to the end of the following lines.
%
Move the cursor to the matching parenthesis or brace.
^
Move the cursor to the first non-whitespace character.
(
Move the cursor to the beginning of a sentence.
)
Move the cursor to the beginning of the next sentence.
{
Move the cursor to the preceding paragraph.
}
Move the cursor to the next paragraph.
|
Move the cursor to the column specified by the count.
+
Move the cursor to the first non-whitespace character in the next line.
-
Move the cursor to the first non-whitespace character in the previous line.
_
Move the cursor to the first non-whitespace character in the current line.
0
(Zero) Move the cursor to the first column of the current line.
B
Move the cursor back one word, skipping over punctuation.
E
Move forward to the end of a word, skipping over punctuation.
G
Go to the line number specified as the count. If no count is given, then go to the end of the file.
H
Move the cursor to the first non-whitespace character on the top of the screen.
L
Move the cursor to the first non-whitespace character on the bottom of the screen.
M
Move the cursor to the first non-whitespace character on the middle of the screen.
W
Move forward to the beginning of a word, skipping over punctuation.
b
Move the cursor back one word. If the cursor is in the middle of a word, move the cursor to the first character of that word.
e
Move the cursor forward one word. If the cursor is in the middle of a word, move the cursor to the last character of that word.
h
Move the cursor to the left one character position.
j
Move the cursor down one line.
k
Move the cursor up one line.
l
Move the cursor to the right one character position.
w
Move the cursor forward one word. If the cursor is in the middle of a word, move the cursor to the first character of the next word.

Moving the Cursor Around the Screen

^E
Scroll forwards one line. A count scrolls that many lines.
^Y
Scroll backwards one line. A count scrolls that many lines.
z
Redraw the screen with the following options. “z” puts the current line on the top of the screen; “z.” puts the current line on the center of the screen; and “z-” puts the current line on the bottom of the screen. If you specify a count before the ‘z’ command, it changes the current line to the line specified. For example, “16z.” puts line 16 on the center of the screen.

Replacing Text

C
Change to the end of the line from the current cursor position.
R
Replace characters on the screen with a set of characters entered, ending with the Escape key.
S
Change an entire line.
c
Change until . “cc” changes the current line. A count changes that many lines.
r
Replace one character under the cursor. Specify a count to replace a number of characters.
s
Substitute one character under the cursor, and go into insert mode. Specify a count to substitute a number of characters. A dollar sign ($) will be put at the last character to be substituted.

Searching for Text or Characters

,
Repeat the last f, F, t or T command in the reverse direction.
/
Search the file downwards for the string specified after the /.
;
Repeat the last f, F, t or T command.
?
Search the file upwards for the string specified after the ?.
F
Search the current line backwards for the character specified after the ‘F’ command. If found, move the cursor to the position.
N
Repeat the last search given by ‘/’ or ‘?’, except in the reverse direction.
T
Search the current line backwards for the character specified after the ‘T’ command, and move to the column after the if it’s found.
f
Search the current line for the character specified after the ‘f’ command. If found, move the cursor to the position.
n
Repeat last search given by ‘/’ or ‘?’.
t
Search the current line for the character specified after the ‘t’ command, and move to the column before the character if it’s found.

Manipulating Character/Line Formatting

~
Switch the case of the character under the cursor.
<
Shift the lines up to where to the left by one shiftwidth. "<<" shifts the current line to the left, and can be specified with a count.
>
Shift the lines up to where to the right by one shiftwidth. “>>” shifts the current line to the right, and can be specified with a count.
J
Join the current line with the next one. A count joins that many lines.

Saving and Quitting

^\
Quit out of “VI” mode and go into “EX” mode. The EX editor is the line editor VI is build upon. The EX command to get back into VI is “:vi”.
Q
Quit out of “VI” mode and go into “EX” mode. The ex editor is a line-by-line editor. The EX command to get back into VI is “:vi”.
ZZ
Exit the editor, saving if any changes were made.

Miscellany

^G
Show the current filename and the status.
^L
Clear and redraw the screen.
^R
Redraw the screen removing false lines.
^[
Escape key. Cancels partially formed command.
^^
Go back to the last file edited.
!
Execute a shell. If a is specified, the program which is executed using ! uses the specified line(s) as standard input, and will replace those lines with the standard output of the program executed. "!!" executes a program using the current line as input. For example, "!4jsort" will take five lines from the current cursor position and execute sort. After typing the command, there will be a single exclamation point where you can type the command in.
&
Repeat the previous ":s" command.
.
Repeat the last command that modified the file.
:
Begin typing an EX editor command. The command is executed once the user types return. (See section below.)
@
Type the command stored in the specified buffer.
U
Restore the current line to the state it was in before the cursor entered the line.
m
Mark the current position with the character specified after the 'm' command.
u
Undo the last change to the file. Typing 'u' again will re-do the change.

EX Commands
The VI editor is built upon another editor, called EX. The EX editor only edits by line. From the VI editor you use the : command to start entering an EX command. This list given here is not complete, but the commands given are the more commonly used. If more than one line is to be modified by certain commands (such as ":s" and ":w" ) the range must be specified before the command. For example, to substitute lines 3 through 15, the command is ":3,15s/from/this/g".

:ab string strings
Abbreviation. If a word is typed in VI corresponding to string1, the editor automatically inserts the corresponding words. For example, the abbreviation ":ab usa United States of America" would insert the words, "United States of America" whenever the word "usa" is typed in.
:map keys new_seq
Mapping. This lets you map a key or a sequence of keys to another key or a sequence of keys.
:q
Quit VI. If there have been changes made, the editor will issue a warning message.
:q!
Quit VI without saving changes.
:s/pattern/to_pattern/options
Substitute. This substitutes the specified pattern with the string in the to_pattern. Without options, it only substitutes the first occurence of the pattern. If a 'g' is specified, then all occurences are substituted. For example, the command ":1,$s/Dwayne/Dwight/g" substitutes all occurences of "Dwayne" to "Dwight".
:set [all]
Sets some customizing options to VI and EX. The “:set all” command gives all the possible options. (See the section on customizing VI for some options.)
:una string
Removes the abbreviation previously defined by “:ab”.
:unm keys
Removes the remove mapping defined by “:map”.
:vi filename
Starts editing a new file. If changes have not been saved, the editor will give you a warning.
:w
Write out the current file.
:w filename
Write the buffer to the filename specified.
:w >> filename
Append the contents of the buffer to the filename.
:wq
Write the buffer and quit.

Comments off

IP Subnet Cheat Sheet

255.255.255.255 11111111.11111111.11111111.11111111 /32 Host (single address)

255.255.255.254 11111111.11111111.11111111.11111110 /31 Unuseable
255.255.255.252 11111111.11111111.11111111.11111100 /30 2 useable
255.255.255.248 11111111.11111111.11111111.11111000 /29 6 useable
255.255.255.240 11111111.11111111.11111111.11110000 /28 14 useable
255.255.255.224 11111111.11111111.11111111.11100000 /27 30 useable
255.255.255.192 11111111.11111111.11111111.11000000 /26 62 useable
255.255.255.128 11111111.11111111.11111111.10000000 /25 126 useable
255.255.255.0 11111111.11111111.11111111.00000000 /24 “Class C” 254 useable

255.255.254.0 11111111.11111111.11111110.00000000 /23 2 Class C
255.255.252.0 11111111.11111111.11111100.00000000 /22 4 Class C
255.255.248.0 11111111.11111111.11111000.00000000 /21 8 Class C
255.255.240.0 11111111.11111111.11110000.00000000 /20 16 Class C
255.255.224.0 11111111.11111111.11100000.00000000 /19 32 Class C
255.255.192.0 11111111.11111111.11000000.00000000 /18 64 Class C
255.255.128.0 11111111.11111111.10000000.00000000 /17 128 Class C
255.255.0.0 11111111.11111111.00000000.00000000 /16 “Class B”

255.254.0.0 11111111.11111110.00000000.00000000 /15
255.252.0.0 11111111.11111100.00000000.00000000 /14
255.248.0.0 11111111.11111000.00000000.00000000 /13
255.240.0.0 11111111.11110000.00000000.00000000 /12
255.224.0.0 11111111.11100000.00000000.00000000 /11
255.192.0.0 11111111.11000000.00000000.00000000 /10
255.128.0.0 11111111.10000000.00000000.00000000 /9
255.0.0.0 11111111.00000000.00000000.00000000 /8 “Class A”

254.0.0.0 11111110.00000000.00000000.00000000 /7
252.0.0.0 11111100.00000000.00000000.00000000 /6
248.0.0.0 11111000.00000000.00000000.00000000 /5
240.0.0.0 11110000.00000000.00000000.00000000 /4
224.0.0.0 11100000.00000000.00000000.00000000 /3
192.0.0.0 11000000.00000000.00000000.00000000 /2
128.0.0.0 10000000.00000000.00000000.00000000 /1
0.0.0.0 00000000.00000000.00000000.00000000 /0 IP space

# 255.255.255.0 1 Class C
# 255.255.254.0 2 Class Cs
# 255.255.252.0 4 Class Cs
# 255.255.248.0 8 Class Cs
# 255.255.240.0 16 Class Cs
# 255.255.224.0 32 Class Cs
# 255.255.192.0 64 Class Cs
# 255.255.128.0 128 Class Cs
# 255.255.0.0 1 Class B

Comments off

ARIN Templates

Use REALLOCATE for customer so they can REASSIGN

Template: ARIN-REALLOCATE-4.0
** As of September 2006
** Detailed instructions are located below the template.

01. Downstream Org ID:
** IF DOWNSTREAM ORG ID IS PROVIDED SKIP TO LINE 20.

02. Org Name:
03. Org Address:
03. Org Address:
04. Org City:
05. Org State/Province:
06. Org Postal Code:
07. Org Country Code:
08. Org POC Handle:
** IF POC HANDLE IS PROVIDED SKIP TO LINE 20.

09. Org POC Contact Type (P or R):
10. Org POC Last Name or Role Account:
11. Org POC First Name:
12. Org POC Company Name:
13. Org POC Address:
13. Org POC Address:
14. Org POC City:
15. Org POC State/Province:
16. Org POC Postal Code:
17. Org POC Country Code:
18. Org POC Office Phone Number:
19. Org POC E-mail Address:

** NETWORK SECTION
20. IP Address and Prefix or Range:
21. Network Name:
22. Hostname of DNS Reverse Mapping Nameserver:
22. Hostname of DNS Reverse Mapping Nameserver:

** OPTIONAL RESOURCE CONTACT
23. Net POC Handle:
** IF POC HANDLE IS PROVIDED SKIP TO LINE 35.

24. Net POC Contact Type (P or R):
25. Net POC Last Name or Role Account:
26. Net POC First Name:
27. Net POC Company Name:
28. Net POC Address:
28. Net POC Address:
29. Net POC City:
30. Net POC State/Province:
31. Net POC Postal Code:
32. Net POC Country Code:
33. Net POC Office Phone Number:
34. Net POC E-mail Address:

** OTHER OPTIONAL FIELDS
35. Public Comments:
36. Additional Information:

END OF TEMPLATE

################

Use NETMOD to remove or modify and entry:

Template: ARIN-NET-MOD-4.0
** As of September 2006
** Detailed instructions are located below the template.

01. Registration Action (M or R):
02. IP Address and Prefix or Range:
03. Network Name:
04. Hostname of DNS Reverse Mapping Nameserver:
04. Hostname of DNS Reverse Mapping Nameserver:
05. Tech POC Handle:
06. Abuse POC Handle:
07. NOC POC Handle:
08. Public Comments:
09. Additional Information:

END OF TEMPLATE

SUBJECT: NETMOD

######################

REASSIGN DETAIL to assign customers nameserver to the IP range

Template: ARIN-REASSIGN-DETAILED-4.0
** As of September 2006
** Detailed instructions are located below the template.

01. Downstream Org ID:
** IF DOWNSTREAM ORG ID IS PROVIDED SKIP TO LINE 20.

02. Org Name:
03. Org Address:
03. Org Address:
04. Org City:
05. Org State/Province:
06. Org Postal Code:
07. Org Country Code:
08. Org POC Handle:
** IF POC HANDLE IS PROVIDED SKIP TO LINE 20.

09. Org POC Contact Type (P or R):
10. Org POC Last Name or Role Account:
11. Org POC First Name:
12. Org POC Company Name:
13. Org POC Address:
13. Org POC Address:
14. Org POC City:
15. Org POC State/Province:
16. Org POC Postal Code:
17. Org POC Country Code:
18. Org POC Office Phone Number:
19. Org POC E-mail Address:

** NETWORK SECTION
20. IP Address and Prefix or Range:
21. Network Name:
22. Hostname of DNS Reverse Mapping Nameserver:
22. Hostname of DNS Reverse Mapping Nameserver:

** OPTIONAL RESOURCE CONTACT SECTION
23. Net POC Handle:
** IF POC HANDLE IS PROVIDED SKIP TO LINE 35.

24. Net POC Contact Type (P or R):
25. Net POC Last Name or Role Account:
26. Net POC First Name:
27. Net POC Company Name:
28. Net POC Address:
28. Net POC Address:
29. Net POC City:
30. Net POC State/Province:
31. Net POC Postal Code:
32. Net POC Country Code:
33. Net POC Office Phone Number:
34. Net POC E-mail Address:

** OTHER OPTIONAL FIELDS
35. Public Comments:
36. Additional Information:

END OF TEMPLATE

Comments off

Secure It.. Work in progress…

NUMBER ONE RULE: KEEP SYSTEM UP TO DATE!!!

IPTABLES (ADD BASIC SCRIPT HERE)

WORK ON limit Usage of su – sudo

Use hard passwords..

If account doesn’t need shell use /bin/false
# chsh -s /bin/false username

Set system limits to prevent fork bombs..
PREVENT THIS SIMPLE BOMB: :(){ :|:& }; :

/etc/security/limits.conf
Add:
@users soft nproc 100
@users hard nproc 150

SSH:
Change port to stop automated probes to port 22
Stop root log in..
Don’t allow passwordless account logins…

/etc/hosts.allow
sshd : 127.0.0.1 : allow
sshd : IP address here : allow
sshd : IP address here : allow
sshd : ALL : deny
(Do IPTABLES CONFIG TOO – 1=NONE 2=1 Theory)

MYSQL:
Allow local usage only…(When possible)
If open access change port to stop automated probes / attacks?
Redirect probe to a honeypot?
Rename main root account? (Make sure this won’t hurt anything but automated script kiddies)
ADD MORE MEASURES HERE

FTP:
Disable anonymous FTP

Comments off

SpamAssassin – ClamAV – Procmail

This document describes how to install SpamAssassin (for filtering SPAM) and ClamAV (for filtering viruses, trojans, worms, etc.) and how to invoke them by using procmail recipes. It is suitable for scenarios where Sendmail or Postfix deliver emails to local users. It should work (maybe with slight changes concerning paths etc.) on all *nix operating systems. I tested it on Debian Woody so far.

In the end you will have a system where Sendmail or Postfix deliver emails to a local user; the emails are passed to procmail which invokes SpamAssassin and ClamAV in order to filter the emails before they arrive in the user’s inbox. However, the installation of Sendmail and Postfix are not covered in this document.

This howto is meant as a practical guide; it does not cover the theoretical backgrounds. They are treated in a lot of other documents in the web.

This document comes without warranty of any kind!

1 Install SpamAssassin

There are multiple ways of installing SpamAssassin. I will describe three of them here:

1. Installation using the Perl Shell

Login to your command line as root and run the following command to start the Perl shell:

perl -MCPAN -e shell

If you run the Perl shell for the first time you will be asked some questions. In most cases the default answers are ok.

Please note: If you run a firewall on your system you might have to turn it off while working on the Perl shell in order for the Perl shell to be able to fetch the needed modules without a big delay. You can switch it on afterwards.

The big advantage of the Perl shell compared to the two other methods described here is that it cares about dependencies when installing new modules. I.e., if it turns out that a prerequisite Perl module is missing when you install another module the Perl shell asks you if it should install the prerequisite module for you. You should answer that question with “Yes”.

Run the following commands to install SpamAssassin and some other needed modules:

install HTML::Parser
install DB_File
install Net::DNS (when prompted to enable tests, choose no)
install Digest::SHA1
install Mail::SpamAssassin
q (to leave the Perl shell)

If a module is already installed on your system you will get a message similar to this one:

HTML::Parser is up to date.

Successful installation of a module looks like this:

/usr/bin/make install — OK

2. Installation from the Sources

(Please note: The prerequisite Perl modules (at least HTML::Parser) have to be installed before you compile SpamAssassin from the sources. If they are not, install them by using one of the other two methods described here, or get the sources from http://www.cpan.org and compile them. This is similar to the steps described here for SpamAssassin.)

cd /tmp
wget http://www.mirror.ac.uk/sites/spamassassin.taint.org/spamassassin.org
/released/Mail-SpamAssassin-2.63.tar.gz (1 line)
tar xvfz Mail-SpamAssassin-2.63.tar.gz
cd Mail-SpamAssassin-2.63
perl Makefile.PL
make
make install

3. Installation using Webmin

If you have webmin (http://www.webmin.com) installed on your system you can use it to install Perl Modules. Login to webmin, go to Others -> Perl Modules, and install SpamAssassin:

If you get error messages this is mostly due to the fact that some prerequisite modules are missing on your system. Install them (at least HTML::Parser is required), and then try to install the module again you wanted to install first.

SpamAssassin will be installed to /usr/local/share/spamassassin/.

2 Install ClamAV

cd /tmp
groupadd clamav
useradd -g clamav -s /bin/false -c “Clam AntiVirus” clamav
wget http://heanet.dl.sourceforge.net/sourceforge/clamav/clamav-0.67.tar.gz
tar xvfz clamav-0.67.tar.gz
cd clamav-0.67
./configure –sysconfdir=/etc

(Please note: ./configure –help gives a list of all configuration options available.)

make
su -c “make install”

If you run

clamd

now you will get an error message:

ERROR: Please edit the example config file /etc/clamav.conf.

You must at least remove the Example directive. My /etc/clamav.conf looks like this:

##
## Example config file for the Clam AV daemon
## Please read the clamav.conf(5) manual before editing this file.
##

# Comment or remove the line below.
#Example

# Uncomment this option to enable logging.
# LogFile must be writable for the user running the daemon.
# Full path is required.
#LogFile /tmp/clamd.log

# By default the log file is locked for writing – the lock protects against
# running clamd multiple times (if want to run another clamd, please
# copy the configuration file, change the LogFile variable, and run
# the daemon with –config-file option). That’s why you shouldn’t uncomment
# this option.
#LogFileUnlock

# Maximal size of the log file. Default is 1 Mb.
# Value of 0 disables the limit.
# You may use ‘M’ or ‘m’ for megabytes (1M = 1m = 1048576 bytes)
# and ‘K’ or ‘k’ for kilobytes (1K = 1k = 1024 bytes). To specify the size
# in bytes just don’t use modifiers.
#LogFileMaxSize 2M

# Log time with an each message.
#LogTime

# Use system logger (can work together with LogFile).
#LogSyslog

# Enable verbose logging.
#LogVerbose

# This option allows you to save the process identifier of the listening
# daemon (main thread).
#PidFile /var/run/clamd.pid

# Path to a directory containing .db files.
# Default is the hardcoded directory (mostly /usr/local/share/clamav,
# it depends on installation options).
#DatabaseDirectory /var/lib/clamav

# The daemon works in local or network mode. Currently the local mode is
# recommended for security reasons.

# Path to the local socket. The daemon doesn’t change the mode of the
# created file (portability reasons). You may want to create it in a directory
# which is only accessible for a user running daemon.
LocalSocket /tmp/clamd

# Remove stale socket after unclean shutdown.
#FixStaleSocket

# TCP port address.
#TCPSocket 3310

# TCP address.
# By default we bind to INADDR_ANY, probably not wise.
# Enable the following to provide some degree of protection
# from the outside world.
#TCPAddr 127.0.0.1

# Maximum length the queue of pending connections may grow to.
# Default is 15.
#MaxConnectionQueueLength 30

# When activated, input stream (see STREAM command) will be saved to disk before
# scanning – this allows scanning within archives.
#StreamSaveToDisk

# Close the connection if this limit is exceeded.
#StreamMaxLength 10M

# Maximal number of a threads running at the same time.
# Default is 5, and it should be sufficient for a typical workstation.
# You may need to increase threads number for a server machine.
#MaxThreads 10

# Thread (scanner – single task) will be stopped after this time (seconds).
# Default is 180. Value of 0 disables the timeout. SECURITY HINT: Increase the
# timeout instead of disabling it.
#ThreadTimeout 500

# Maximal depth the directories are scanned at.
MaxDirectoryRecursion 15

# Follow a directory symlinks.
# SECURITY HINT: You should have enabled directory recursion limit to
# avoid potential problems.
#FollowDirectorySymlinks

# Follow regular file symlinks.
#FollowFileSymlinks

# Do internal checks (eg. check the integrity of the database structures)
# By default clamd checks itself every 3600 seconds (1 hour).
#SelfCheck 600

# Execute a command when virus is found. In the command string %v and %f will
# be replaced by the virus name and the infected file name respectively.
#
# SECURITY WARNING: Make sure the virus event command cannot be exploited,
# eg. by using some special file name when %f is used.
# Always use a full path to the command.
# Never delete/move files with this directive !
#VirusEvent /usr/local/bin/send_sms 123456789 “VIRUS ALERT: %f: %v”

# Run as selected user (clamd must be started by root).
# By default it doesn’t drop privileges.
User clamav

# Initialize the supplementary group access (for all groups in /etc/group
# user is added in. clamd must be started by root).
#AllowSupplementaryGroups

# Don’t fork into background. Useful in debugging.
#Foreground

# Enable debug messages in libclamav.
#Debug

##
## Mail support
##

# Uncomment this option if you are planning to scan mail files.
ScanMail

##
## Archive support
##

# Comment this line to disable scanning of the archives.
ScanArchive

# By default the built-in RAR unpacker is disabled by default because the code
# terribly leaks, however it’s probably a good idea to enable it.
#ScanRAR

# Options below protect your system against Denial of Service attacks
# with archive bombs.

# Files in archives larger than this limit won’t be scanned.
# Value of 0 disables the limit.
# WARNING: Due to the unrarlib implementation, whole files (one by one) in RAR
# archives are decompressed to the memory. That’s why never disable
# this limit (but you may increase it of course!)
ArchiveMaxFileSize 10M

# Archives are scanned recursively – e.g. if Zip archive contains RAR file,
# the RAR file will be decompressed, too (but only if recursion limit is set
# at least to 1). With this option you may set the recursion level.
# Value of 0 disables the limit.
ArchiveMaxRecursion 5

# Number of files to be scanned within archive.
# Value of 0 disables the limit.
ArchiveMaxFiles 1000

# Use slower decompression algorithm which uses less memory. This option
# affects bzip2 decompressor only.
#ArchiveLimitMemoryUsage

##
## Clamuko settings
## WARNING: This is experimental software. It is very likely it will hang
## up your system !!!
##

# Enable Clamuko. Dazuko (/dev/dazuko) must be configured and running.
#ClamukoScanOnLine

# Set access mask for Clamuko.
ClamukoScanOnOpen
ClamukoScanOnClose
ClamukoScanOnExec

# Set the include paths (all files in them will be scanned). You can have
# multiple ClamukoIncludePath options, but each directory must be added
# in a seperate option. All subdirectories are scanned, too.
ClamukoIncludePath /home
#ClamukoIncludePath /students

# Set the exclude paths. All subdirectories are also excluded.
#ClamukoExcludePath /home/guru

# Limit the file size to be scanned (probably you don’t want to scan your movie
# files ;))
# Value of 0 disables the limit. 1 Mb should be fine.
ClamukoMaxFileSize 1M

# Enable archive support. It uses the limits from clamd section.
# (This option doesn’t depend on ScanArchive, you can have archive support
# in clamd disabled).
# ClamukoScanArchive

Now we have to create an init script for ClamAV (/etc/init.d/clamd):

#!/bin/bash

TMPDIR=/tmp
PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/X11R6/bin

case “$1″ in
start)
echo “Starting ClamAV…”
if [ -S /tmp/clamd ]; then
echo “ClamAV is already running!”
else
/usr/local/bin/freshclam -d -c 10 –datadir=/usr/local/share/clamav
/usr/local/sbin/clamd
fi
echo “ClamAV is now up and running!”
;;
stop)
echo “Shutting down ClamAV…”
array=(`ps ax | grep -iw ‘/usr/local/bin/freshclam’ | grep -iv ‘grep’ \
| awk ‘{print $1}’ | cut -f1 -d/ | tr ‘\n’ ‘ ‘`)
element_count=${#array[@]}
index=0
while [ "$index" -lt "$element_count" ]
do
kill -9 ${array[$index]}
let “index = $index + 1″
done
array=(`ps ax | grep -iw ‘/usr/local/sbin/clamd’ | grep -iv ‘grep’ \
| awk ‘{print $1}’ | cut -f1 -d/ | tr ‘\n’ ‘ ‘`)
element_count=${#array[@]}
index=0
while [ "$index" -lt "$element_count" ]
do
kill -9 ${array[$index]}
let “index = $index + 1″
done
if [ -S /tmp/clamd ]; then
rm -f /tmp/clamd
fi
echo “ClamAV stopped!”
;;
restart)
$0 stop && sleep 3
$0 start
;;
*)
echo “Usage: $0 {start|stop|restart}”
exit 1
esac
exit 0

chmod 755 /etc/init.d/clamd

Now we start ClamAV:

/etc/init.d/clamd start

If you run

ps aux

you will now notice some clamd processes (which use the socket /tmp/clamd) and a freshclam process which is responsible for getting the newest virus signature updates. They are located under /usr/local/share/clamav. The command

/usr/local/bin/freshclam -d -c 10 –datadir=/usr/local/share/clamav

in our clamd init script makes sure that freshclam checks for new signatures 10 times per day.

In order to start ClamAV at boot time do the following:

ln -s /etc/init.d/clamd /etc/rc2.d/S20clamd
ln -s /etc/init.d/clamd /etc/rc3.d/S20clamd
ln -s /etc/init.d/clamd /etc/rc4.d/S20clamd
ln -s /etc/init.d/clamd /etc/rc5.d/S20clamd
ln -s /etc/init.d/clamd /etc/rc0.d/K20clamd
ln -s /etc/init.d/clamd /etc/rc1.d/K20clamd
ln -s /etc/init.d/clamd /etc/rc6.d/K20clamd

3 Install trashscan

trashscan is a shell script that makes the connection between procmail and ClamAV (i.e., when an email arrives, procmail is invoked which itself invokes trashscan in order to have the mail scanned for viruses by ClamAV). It comes with ClamAV.

cd /tmp/clamav-0.67/contrib/trashscan
tar xvfz trashscan-0.08.tar.gz
cd trashscan-0.08
cp -pf trashscan /usr/local/sbin/

Now we have to adjust some variables in the “Settinx” section of /usr/local/sbin/trashscan. My settings are as follows:

#!/bin/bash
#
# TrashScan v0.08; Scan email for viruses
# ZapCoded by Trashware; 13.10.2002
# Email: trashware@gmx.de
# Web: http://trashware.mirrorz.com
#
PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/bin:/usr/local/sbin
# ————————————— Begin Settinx —————————————- #
SCANDIR=$HOME/tmp # Temp directory for virus scans.
# Security: Don’t define public
# accessible directories here !!!
# $HOME/tmp should be fine.
#DECODER=metamail # Decoder: “metamail” or “uudeview”
#DECODPRG=metamail # Absolute path to decoder: metamail
DECODER=uudeview # Decoder: “metamail” or “uudeview”
DECODPRG=/usr/local/bin/uudeview # Absolute path to decoder: uudeview
VSCANPRG=/usr/local/bin/clamscan # Absolute path to the virus scanner
VSCANOPT=”–quiet –tempdir=$HOME/tmp –recursive –max-files=500 \
–max-space=30M –unzip=/usr/bin/unzip –unrar=/usr/bin/unrar \
–unarj=/usr/bin/unarj –zoo=/usr/bin/zoo –lha=/usr/bin/lha \
–jar=/usr/bin/unzip –tar=/bin/tar –tgz=/bin/tar” # Parameters for the virus scanner.
# Security: Don’t choose public
# accessible directories for the
# –tempdir definition !!!
# –tempdir=$HOME/tmp should be fine.
VSCANVEX=1 # Exitcode of the virus scanner if a
# virus was found
VSCANSUSP=mail.virus # File to store suspicious mail (see
# procmail.trashscan)
FORMAIL=formail # Absolute path to formail
PROCMAIL=procmail # Absolute path to procmail
SENDMAIL=sendmail # Absolute path to sendmail
CAT=cat # Absolute path to cat
GREP=grep # Absolute path to grep
LOGGER=logger # Absolute path to logger
LOGPRIO=mail.warn # Log level for logger
MKDIR=mkdir # Absolute path to mkdir
RM=rm # Absolute path to rm
SED=sed # Absolute path to sed
ALERTRCVR=virusadmin@example.com # Receiver of virus alert messages
ALERTSNDR=virusadmin@example.com # Sender of virus alert messages
ALERTCTCT=virusadmin@example.com # Person to contact (appears in the
# mail body of the virus alert)
# —————————————- End Settinx —————————————- #

Please note that I set the PATH variable at the beginning of the script:

PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/bin:/usr/local/sbin

This allows me not to specify the absolute path of most of the programs needed by trashscan (e.g. formail, procmail, sendmail) as long as they are in the PATH.

VSCANOPT specifies the paths to some programs needed to unpack files in various compression formats (if an email comes with a compressed attachment, e.g. zip, tar.gz). You do not need all the programs there, but I recommend that you have at least unzip and tar installed (if you have not, use http://www.rpmfind.net to search for unzip and tar if you use an rpm based distribution, and install the appropriate packages with

rpm -ivh name-of-package.rpm

If you use Debian, all you have to do is

apt-get install unzip tar

).

Be sure to specify the correct email address of the person that will receive a notification if a virus is found.

4 Install uudeview

trashscan needs a program to decode email messages. In the trashscan settings above I specified that trashscan should use uudeview which we will install now.

cd /tmp
wget http://www.fpx.de/fp/Software/UUDeview/download/uudeview-0.5.19.tar.gz
tar xvfz uudeview-0.5.19.tar.gz
cd uudeview-0.5.19
./configure
make
make install

5 Configure Procmail

procmail is normally installed on most distributions by default so I will not cover procmail installation here. Run

which procmail

to find out where your procmail is located (in my case it is /usr/bin/procmail).

I will now show how to configure procmail for the user testuser who has his homedir under /home/www/web1/user/testuser. Be sure that none of the directories in this path (/home, /home/www, /home/www/web1, /home/www/web1/user, /home/www/web1/user/testuser) is group- or world-writable. They should have the permissions rwxr-xr-x (or 755). Otherwise procmail could refuse to work properly!

First we have to create the file /home/www/web1/user/testuser/.forward so that procmail will be invoked when a mail for testuser arrives. It has the following contents:

“|/usr/bin/procmail -f-”

chown testuser /home/www/web1/user/testuser/.forward
chmod 600 /home/www/web1/user/testuser/.forward

Now we create the file /home/www/web1/user/testuser/.procmailrc. This is the file where procmail will look for recipes (i.e., commands to run). For reasons of clearness we simply include our main recipes in this file:

## MAILDIR=$HOME/Maildir/
## DEFAULT=$MAILDIR

INCLUDERC=/home/www/web1/user/testuser/.antivirus.rc
INCLUDERC=/home/www/web1/user/testuser/.html-trap.rc
INCLUDERC=/home/www/web1/user/testuser/.spamassassin.rc

(Please note: Uncomment the first two lines if you use Maildir for your emails, i.e., your emails are stored under /home/www/web1/user/testuser/Maildir/ instead of /var/spool/mail.)

Our first recipe is /home/www/web1/user/testuser/.antivirus.rc:

#
# procmail configuration for TrashScan: ZapCoded by Trashware; 13.10.2002
#

# [ ... ]

# ————————————————————————————- #
# Virus scan section … #
# ————————————————————————————- #

# 1. Run TrashScan
:0
* multipart
* !^X-Virus-Scan:
| /usr/local/sbin/trashscan

# 2. Filter tagged virus mails
:0:
* ^X-Virus-Scan: Suspicious
/dev/null

/home/www/web1/user/testuser/.html-trap.rc is discussed below so our second recipe is /home/www/web1/user/testuser/.spamassassin.rc:

# SpamAssassin sample procmailrc
#
# Pipe the mail through spamassassin (replace ’spamassassin’ with ’spamc’
# if you use the spamc/spamd combination)
# The condition line ensures that only messages smaller than 250 kB
# (250 * 1024 = 256000 bytes) are processed by SpamAssassin. Most spam
# isn’t bigger than a few k and working with big messages can bring
# SpamAssassin to its knees.
:0fw
* < 256000
| /usr/local/bin/spamassassin --prefs-file=/home/www/web1/user/testuser/.user_prefs

# All mail tagged as spam (eg. with a score higher than the set threshold)
# is moved to "/dev/null".
#:0:
#* ^X-Spam-Status: Yes
#/dev/null

# Work around procmail bug: any output on stderr will cause the "F" in "From"
# to be dropped. This will re-add it.
:0
* ^^rom[ ]
{
LOG="*** Dropped F off From_ header! Fixing up. "

:0 fhw
| sed -e '1s/^/F/'
}

This will cause all emails to be accepted, even SPAM (which will be marked as SPAM and can be sorted out by the user's email client). This strategy is recommended in the first stage until you are sure that SpamAssassin identifies your emails correctly. If you want to delete SPAM take this .spamassassin.rc instead:

# SpamAssassin sample procmailrc
#
# Pipe the mail through spamassassin (replace 'spamassassin' with 'spamc'
# if you use the spamc/spamd combination)
# The condition line ensures that only messages smaller than 250 kB
# (250 * 1024 = 256000 bytes) are processed by SpamAssassin. Most spam
# isn't bigger than a few k and working with big messages can bring
# SpamAssassin to its knees.
:0fw
* < 256000
| /usr/local/bin/spamassassin --prefs-file=/home/www/web1/user/testuser/.user_prefs

# All mail tagged as spam (eg. with a score higher than the set threshold)
# is moved to "/dev/null".
:0:
* ^X-Spam-Status: Yes
/dev/null

# Work around procmail bug: any output on stderr will cause the "F" in "From"
# to be dropped. This will re-add it.
:0
* ^^rom[ ]
{
LOG="*** Dropped F off From_ header! Fixing up. "

:0 fhw
| sed -e '1s/^/F/'
}

Next we create the file /home/www/web1/user/testuser/.user_prefs which will contain testuser's SpamAssassin settings:

# SpamAssassin user preferences file. See 'perldoc Mail::SpamAssassin::Conf'
# for details of what can be tweaked.
#*
#* Note: this file is not read by SpamAssassin until copied into the user
#* directory. At runtime, if a user has no preferences in their home directory
#* already, it will be copied for them, allowing them to perform personalised
#* customisation. If you want to make changes to the site-wide defaults,
#* create a file in /etc/spamassassin or /etc/mail/spamassassin instead.
###########################################################################

# How many hits before a mail is considered spam.
required_hits 5.0

rewrite_subject 1
subject_tag ***SPAM***

SpamAssassin runs a number of tests on each email in order to determine whether it is SPAM or not. Each test assigns a certain amount fo points to that email (if the test is positive). The points will be added. required_hits is the amount of points above which the email is considered as SPAM. 5.0 is a reasonable value to start with.

If rewrite_subject is 1 the subject of the email will be tagged with the value of subject_tag if the email is considered as SPAM so that the email can be sorted by testuser's email client if he chose the appropriate .spamassassin.rc above.

6 Configure the Email Sanitizer

The Email Sanitizer (http://www.impsec.org/email-tools/procmail-security.html) is a set of procmail recipes that form a sort of content filter. E.g., it can deactivate malicious javascript code in HTML emails and rename suspicious attachments (e.g. example.exe is renamed to example.12345DEFANGED-exe so that it cannot be opened by a simple double-click under Windows. It has to be saved to the disk first and then be renamed consciously. So the recipient is forced to think about if he should open the attachment.).

cd /tmp
wget http://www.impsec.org/email-tools/html-trap.procmail.gz
gunzip html-trap.procmail.gz
echo 'PATH="/usr/bin:$PATH:/usr/local/bin"' > /home/www/web1/user/testuser/.html-trap.rc
echo ‘SHELL=/bin/sh’ >> /home/www/web1/user/testuser/.html-trap.rc
cat html-trap.procmail >> /home/www/web1/user/testuser/.html-trap.rc

7 Test your Configuration

You can now test your configuration by sending .exe attachments, sample SPAM and sample viruses (if you have some) to testuser.

Look at the header of received emails. It should contain the following lines:

X-Security: MIME headers sanitized on server1.example.com See http://www.impsec.org/email-tools/sanitizer-intro.html for details. $Revision: 1.140 $Date: 2004-02-11 20:47:43-08

X-Virus-Scan: Scanned by TrashScan v0.08 running on server1.example.com

X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on server1.example.com

Links

SpamAssassin: http://www.spamassassin.org/

ClamAV: http://www.clamav.net/

Procmail: http://www.procmail.org/

Email Sanitizer: http://www.impsec.org/email-tools/procmail-security.html

2nd) I sent a message to this user and the server returned the mail as such:
—– The following addresses had permanent fatal errors —–|/usr/bin/procmail -f- (reason: Service unavailable) —– Transcript of session follows —–smrsh: “procmail.-f-” not available for sendmail programs (stat failed)554 5.0.0 Service unavailable

You have to tell Sendmail that it’s allowed to use procmail. You do it like that:

cd /etc/smrsh
ln -s /usr/bin/procmail procmail

Comments off

Disk Space Monitor

#!/bin/sh

warninglimit=500000
lowlimit=250000

filesystems=”/export/data /export/home /”

for fs in $filesystems
do
size=`df -k $fs|grep $fs|awk ‘{ print $4; }’`
if [ $size -le $lowlimit ]
then
mailx -s “URGENT: Low disk space for $fs ($size)”
break
fi
if [ $size -le $warninglimit ]
then
mailx -s “WARNING: Low disk space for $fs ($size)”
fi
done

Comments off

ARIN : NETWORK MODIFICATION

Template: ARIN-NET-MOD-4.0
** As of September 2006
** Detailed instructions are located below the template.

01. Registration Action (M or R):
02. IP Address and Prefix or Range:
03. Network Name:
04. Hostname of DNS Reverse Mapping Nameserver:
04. Hostname of DNS Reverse Mapping Nameserver:
05. Tech POC Handle:
06. Abuse POC Handle:
07. NOC POC Handle:
08. Public Comments:
09. Additional Information:

END OF TEMPLATE

If you would like assistance completing this template, please do
not hesitate to contact ARIN’s Registration Services Help Desk
at +1 (703) 227-0660. We’ll be glad to help you!

—————————–CUT HERE —————————

TEMPLATE INSTRUCTIONS:

Please copy and paste the text-based template into the body of an
e-mail and send to hostmaster@arin.net with the subject line, “NETWORK
MODIFICATION”.

Please ensure your e-mail client sends ARIN the message as plain
ASCII text, not as HTML.

Please do not attach the template.

IMPORTANT NOTE: Do not remove or modify the template header, i.e.
the line beginning with “Template:” or the footer, i.e. “END OF
TEMPLATE”. Both are required for processing.

01. This template allows you to modify information for an existing
network, remove a downstream network, or return a network
to ARIN. The registration action is required. Valid values are:
M for Modify
R for Remove/Return

02. Indicate the network to be modified or returned. Valid values
are:
10.0.0.0/24
10.0.0.0 – 10.0.0.255

You cannot modify or return multiple discontiguous networks
with this template. Please submit a separate Network Modification
template for each distinct contiguous network registration.

03. If you do not wish to modify the network name, this field should
be left blank. If you wish to modify the network name, supply a
short name consisting of a combination of up to 50 letters and/or
numbers. You may use a dash (-) as part of the network name, but
no other special characters, such as periods or underscores.

04. Provide fully-qualified host names for the servers that will be
providing in-addr.arpa name services. DO NOT LIST IP ADDRESSES.

Networks should provide at least two (but not more than
thirteen) distinct nameservers for providing address-to-name
mapping for hosts in the network. To specify more than two,
duplicate field 04. for each additional server. Do not list
multiple servers on a single line.

05. Indicate the ARIN POC handle of a contact responsible for the
technical aspects of maintaining the IP address space. The
technical POC may make modifications to the allocated block.

Please note your Org ID already has a Technical POC which will,
by default, appear on the resource registration record.

06. Indicate the ARIN POC handle of a contact responsible for
handling operational aspects of the acceptable or appropriate
uses of the allocated network. The abuse POC may not make
modifications to the allocated network registration.

Please note your Org ID may already have an Abuse POC which will,
by default, appear on the resource registration record.

07. Indicate the ARIN POC handle for your NOC. The NOC POC may
not make modifications to the allocated network registration.

Please note your Org ID may already have an NOC POC which will,
by default, appear on the resource registration record.

08. If there are any comments you would like publicly displayed in
ARIN WHOIS regarding this registration, detail them here.

Suggested comments are:
Public Comments: http://www.example.net
Public Comments: Standard NOC hours are 7am to 11pm EST

09. Use this section to provide additional information to ARIN.
If you are attaching any supporting documentation to your
e-mail, please indicate this here

Comments off

How can I configure TCP/IP settings from the Command Prompt?

In order to configure TCP/IP settings such as the IP address, Subnet Mask, Default Gateway, DNS and WINS addresses and many other options you can use Netsh.exe.

Netsh.exe is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh.exe also provides a scripting feature that allows you to run a group of commands in batch mode against a specified computer. Netsh.exe can also save a configuration script in a text file for archival purposes or to help you configure other servers.

Netsh.exe is available on Windows 2000, Windows XP and Windows Server 2003.

You can use the Netsh.exe tool to perform the following tasks:

Configure interfaces
Configure routing protocols
Configure filters
Configure routes
Configure remote access behavior for Windows-based remote access routers that are running the Routing and Remote Access Server (RRAS) Service
Display the configuration of a currently running router on any computer
Use the scripting feature to run a collection of commands in batch mode against a specified router.
What can we do with Netsh.exe?
With Netsh.exe you can easily view your TCP/IP settings. Type the following command in a Command Prompt window (CMD.EXE):

netsh interface ip show config

With Netsh.exe, you can easily configure your computer’s IP address and other TCP/IP related settings. For example:

The following command configures the interface named Local Area Connection with the static IP address 192.168.0.100, the subnet mask of 255.255.255.0, and a default gateway of 192.168.0.1:

netsh interface ip set address name=”Local Area Connection” static 192.168.0.100 255.255.255.0 192.168.0.1 1

(The above line is one long line, copy paste it as one line)

Netsh.exe can be also useful in certain scenarios such as when you have a portable computer that needs to be relocated between 2 or more office locations, while still maintaining a specific and static IP address configuration. With Netsh.exe, you can easily save and restore the appropriate network configuration.

First, connect your portable computer to location #1, and then manually configure the required settings (such as the IP address, Subnet Mask, Default Gateway, DNS and WINS addresses).

Now, you need to export your current IP settings to a text file. Use the following command:

netsh -c interface dump > c:\location1.txt

When you reach location #2, do the same thing, only keep the new settings to a different file:

netsh -c interface dump > c:\location2.txt

You can go on with any other location you may need, but we’ll keep it simple and only use 2 examples.

Now, whenever you need to quickly import your IP settings and change them between location #1 and location #2, just enter the following command in a Command Prompt window (CMD.EXE):

netsh -f c:\location1.txt

or

netsh -f c:\location2.txt

and so on.

You can also use the global EXEC switch instead of -F:

netsh exec c:\location2.txt

Netsh.exe can also be used to configure your NIC to automatically obtain an IP address from a DHCP server:

netsh interface ip set address “Local Area Connection” dhcp

Would you like to configure DNS and WINS addresses from the Command Prompt? You can. See this example for DNS:

netsh interface ip set dns “Local Area Connection” static 192.168.0.200

and this one for WINS:

netsh interface ip set wins “Local Area Connection” static 192.168.0.200

Or, if you want, you can configure your NIC to dynamically obtain it’s DNS settings:

netsh interface ip set dns “Local Area Connection” dhcp

As you now see, Netsh.exe has many features you might find useful, and that goes beyond saying even without looking into the other valuable options that exist in the command.

Comments off

How-to make Ethernet cable

We need everyone to know how to make cables.

This is how the color pattern goes:

Standard cable (Both ends wired same):

1. Green White
2. Green
3. Orange White
4. Blue
5. Blue White
6. Orange
7. Brown White
8. Brown

Insert wires with “clip” pointed away from you.

To make a cross over cable do one end as above and other end as follows:

1. Orange White
2. Orange
3. Green White
4. Blue
5. Blue White
6. Green
7. Brown White
8. Brown

Insert wires with “clip” pointed away from you.

Comments off

Cisco Commands

Cisco Router Show Commands

View version information: show version
View current configuration (DRAM): show running-config
View startup configuration (NVRAM): show startup-config
Show IOS file and flash space: show flash
Shows all logs that the router has in its memory: show log
View the interface status of interface e0: show interface e0
Overview all interfaces on the router: show ip interfaces brief
View type of serial cable on s0: show controller s 0 (note the space between the ’s’ and the ‘0′)
Display a summary of connected cdp devices: show cdp neighbor
Display detailed information on all devices: show cdp entry *
Display current routing protocols: show ip protocols
Display IP routing table: show ip route
Display access lists, this includes the number of displayed matches: show access-lists
Check the router can see the ISDN switch: show isdn status
Check a Frame Relay PVC connections: show frame-relay pvc
show lmi traffic stats: show frame-relay lmi
Display the frame inverse ARP table: show frame-relay map

Cisco Router Basic Operations

Enter privileged mode: enable
Return to user mode from privileged: disable
Exit Router: logout exit quit
Recall last command: up arrow or
Recall next command: down arrow or
Suspend or abort: and and 6 then x
Refresh screen output:
Compleat Command: TAB

Cisco Router Copy Commands

Save the current configuration from DRAM to NVRAM: copy running-config startup-config
Merge NVRAM configuration to DRAM: copy startup-config running-config
Copy DRAM configuration to a TFTP server: copy runing-config tftp
Merge TFTP configuration with current router configuration held in DRAM: copy tftp runing-config
Backup the IOS onto a TFTP server: copy flash tftp
Upgrade the router IOS from a TFTP server: copy tftp flash

Cisco Router Debug Commands

Enable debug for RIP: debug ip rip
Enable summary IGRP debug information: debug ip igrp events
Enable detailed IGRP debug information: debug ip igrp transactions
Debug IPX RIP: debug ipx routing activity
Debug IPX SAP: debug IPX SAP
Enable debug for CHAP or PAP: debug ppp authentication
Switch all debugging off: no debug all – undebug all

Comments off

« Previous entries