Common Linux misconfigurations

    Over the numerous configuration reviews and pentest engagements that have been performed, has been observed a common pattern in the configuration weaknesses in Linux systems. I believe reviewing these common weaknesses and taking them into consideration may save a lot of time and resources, and more importantly help system administrators with creating more secure environments.

The 5 Common Linux misconfiguration are:
* user home directory permissions
* getgid and setuid binaries
* world-readable and writable files/folders
* weak services in use
* default NFS mount options or insecure export options

1. user home permissions
    On most Linux distributions the default permissions for home folders is 755 which means that any user who had access to the server can see what is in other user’s home folders. Some users such as administrators or developers may have scripts or backups of files in their home folders which contain sensitive information such as user passwords and keys to services to the same or other servers on the network.

2. setgid and setuid binaries
    The set uid bit on a file is dangerous because it allows that file to run as a potentially privileged user such as root. If a file is owned by root and had the set uid bit set the file will run with the privileges of root. This means that if an attacker can find a vulnerability or unexpected uses of that file he can then perform commands on the system as the root user which means a full compromise of the server.

3. world readable and writable files/folders
    World-readable and writable files and folders introduce similar issues as loose user home permissions but throughout the system. The main cause of world readable files is the default umask used for file creation of either 0022 or 0002. As a result of this configuration weakness, files that may contain sensitive information will be readable by anyone that has access to the system. Files may also be modified by anyone on the system if they are world-writable. This can lead to an attacker modifying files or scripts to hide forensic evidence or to execute commands by modifying a script used by Administrators.

4. weak services or configurations
    Services are configured with the minimum configuration changes needed to get them up and running. It is not uncommon to find services Also, Weak and possibly default credentials and configurations when using less secure communication channels are also typical, increasing the risk and attack surface of the server. When using services the options and configuration should be reviewed to ensure that what is being deployed is secure or properly configured. It’s also not uncommon to find these services bound to multiple interfaces on the server instead of just listening locally or just on the specified interface.

5. default mount options or insecure export options
    The defaults keyword for all mounts have the following options "rw, suid, dev, exec, auto, nouser, and async". These options are weak since they allow for the honoring of the suid and guid bits that are set on externally mounted file systems via protocols such as NFS. When exporting NFS shares it is recommended that the no_root_squash option not be set. The root-squash option is the default behavior but it is commonly seen to be changed. If root-squashing in not done it allows users to create files on the exported NFS share as the root user. These weaknesses if left as defaults, can allow for root access on servers where such access is not provided for users.

    The settings identified here are areas that are commonly overlooked when configuring a Linux server. These weaknesses can be used by attackers or malicious users to gain a wealth of information or elevated privileges on a server. Hardening your system makes it more difficult for a user to compromise it, and also more difficult to use the system as means to access other systems within the environment.

Common Linux misconfigurations

Cardsharing beginners guide

1. Introduction
2. Hardware
3. Hardware installation
4. Setup your network
4.1 Fixed IP (PC)
4.2 Network setup Dreambox
4.3 Port forward router
5. Software installation Dreambox
5.1 Flash image
5.2 Install CCcam
6. Software installation (PC)
6.1 DNS Updater
6.2 Dreambox Control Center (DCC)
6.3 CCcaminfoPHP
6.3.1 Versions 0.8.2 and higher.
6.3.2 Versions before 0.8.2
7. How to find someone to share with
8. Flines and Clines the basics
9. Fake and old cards
10. Block all cards that you don’t want
11. So you want a big one

1. Introduction
I have seen many new members lately on this forum. At the same time many similar questions have been raised over and over again.
I’m writing this just to make it easier for new members to find answers for their questions about cardsharing.
I will focus on the use of a Dreambox as Sharing receivers and the CCcam protocol.
Remember that a newbie is just an inexperienced expert
ATTENTION! All this information is for test purpose and should only be used within your own household. No one except yourself is responsible for any damage this can cause or any law you might break.

2. Hardware
What hardware you’ll need is based on how your house looks like, where you want to watch TV, how big server you want to have and so on.
What we all need is a Dreambox of some kind.
A computer with internet connection.
If you have the computer in one room and the Dreambox in another room far away you will need either a long Ethernet cable or use another solution to connect your PC to your Dreambox.
I can recommend the use of 2 Homeplugs, it’s a really user friendly alternative.
Read more about Homeplugs here: HomePlug Powerline Alliance - Wikipedia, the free encyclopedia
If you want to be able to handle a large number of peers you need a pc as server, more about that later.

3. Hardware installation
Not much to say here.
Put your Dreambox in a suitable place by your TV.
Make sure you have enough space around it to let the air circulate freely and cool down the Dreambox.
Connect the cable from your satellite dish (if you use a satellite dish) to your Dreambox tuner.
Connect the network cable to the Dreambox.
Connect power cord.
Switch on.

4. Setup your network
To be able to share with another CCcam server or even many servers you need to set up an network.

4.1 Fixed IP PC
First of all you need a static ip in some way. Either you have one from your ISP or you can set one up for yourself.
Follow this link for static ip: PortForward.com - Free Help Setting up Your Router or Firewall

4.2 Network setup Dreambox
Now you are ready to setup the ip of your Dreambox.
You should have all information needed if you did step 4.1.
For example
PC ip = 192.168.1.141
Dreambox ip =192.168.1.142
subnet mask = 255.255.255.0
Default gateway = 192.168.1.1
DNS Server = 216.104.63.7
Remember to switch DHCP OFF

4.3 Port forward router
Now you need to port forward all traffic trough one port to the Dreambox ip.
Default port is 12000 but this can be changed in the config (CCcam.cfg).
For more information about port forwarding go here: PortForward.com - Free Help Setting up Your Router or Firewall

5. Software installation Dreambox
Now we need to have the software to make the Dreambox work properly.
First we flash an image to the Dreambox.

5.1 Flash image

There are different images to choose from and it’s up to you what you prefer.
But let’s chose a PLI image for this guide.
Search this site for the newest image.
When you have downloaded the newest image you need to flash it to your Dreambox.
Instructions can be found here:

7025/7025+
Dream-Multimedia-Tv GmbH

800
Dream-Multimedia-Tv GmbH

600
Dream-Multimedia-Tv GmbH

500+
Dream-Multimedia-Tv GmbH

5.2 Install CCcam
Next step is to install CCcam
Remember that this might change on newer images but the basics will probably be the same.
In the today’s most recent image:
Go to menu/plugins
Click green button
then click softcams and chose CCcam and install.
Remember to change your default cam to CCcam.

6. Software installation (PC)
There aren’t really any software that you have to install but there are some that makes everything easier.

6.1 DNS Updater
This is more or less an must have.
An DNS Updater is a software that constantly checks your public ip and links it to your static ip.
Many ISP have dynamic ip’s which means that you’ll get a public ip that will change once in a while.
It doesn’t mater if you’ll set a static ip in your PC, you’ll still have a public ip that will change.
Therefore you will use a DNS Updater to fix this problem and always link your DNS servername which you will register for to your static ip.
There are a few to chose from but I will recommend two:

DynDNS
Register here
DynDNS Services: DNS, Domain Names, EMail Routing

Download updater here
http://cdn.dyndns.com/windows/DynUpSetup.exe

or if that link does not work you will find it here
DynDNS Support

No-ip
Register for a standard free account here
No-IP™ Free - Free Dynamic DNS - DDNS

Or if you want to see all services look here
Enterprise Managed DNS and Mail Services, 100% DNS Uptime, Domain Registration No-IP™

Download updater here
Download a Free Dynamic DNS Update client for your dynamic IP

6.2 Dreambox Control Center (DCC)
You can use this to edit your CCcam.cfg.
This is pretty easy, just open the program and insert the ip for your router and Dreambox.
You can change the language to English.

6.3 CCcamInfoPHP
This is a software to get statistics and info about your peers and your server.
Now download the latest CCcamInfoPHP.

6.3.1 Versions 0.8.2 and higher.
Open CCcamInfoPHP_v0.8.2\htdocs\config.php in notpad and change the line you see below to match your server info.
If you haven’t changed your webinterface port or your Dreambox login all you have to do is type in your Dreambox ip.


Code:
$CCCamWebInfo[] = array("192.168.1.xxx","16001","root","dreambox"); // for CCcam webinterface with user and pass

Now open the file located in CCcamInfoPHP_v0.8.2\server\Apache\php.ini
Find this section

Code:
;;;;;;;;;;;;;;;;;;;; Resource Limits ;;;;;;;;;;;;;;;;;;;;and change the line:max_execution_time = 30 <---- Change this to a higher value like 60
Now you can start CCcamInfoPHP by clicking on CCcamInfoPHP v0.8.2.exe (or CCcamInfoPHP vX.X.X.exe).

6.3.2 Versions before 0.8.2
If you use a windows PC you need to install some server that can handle PHP.
WAMP server is one that does that. Download it here: http://www.en.wampserver.com/
Install WAMPserver in C:\wamp
The zipped file should include a lot of folders and files
extract CCcamInfoPHP to C:\wamp\www\
Now you should find a file in the www folder called config.php.
Open that file in a text editor like notpad.
In that file you will find this lines:


Code:
//examples of server definitions$CCCamWebInfo[] = array("IP","PORT","USER","PASS"); // for CCcam webinterface with user and pass$CCCamWebInfo[] = array("IP","PORT"); // for CCcam webinterface with different port than default and without user and pass$CCCamWebInfo[] = array("IP");
Here you should edit IP to your dreambox ip.
Port to webinterface port.
User and pass to your Dreambox username and pass.
Default Port is 16001
Default username is root
Default pass is dreambox

If you have many peers you might need to change some parameters in
Code:
\wamp\Apache2\bin\php.ini
If you don’t have that file, try this one

Code:
\wamp\bin\apache\apache2.2.6\bin\php.ini
Find this lines in that file (you can open the file in notpad).

Code:
;;;;;;;;;;;;;;;;;;;; Resource Limits ;;;;;;;;;;;;;;;;;;;;max_execution_time = max_input_time = ;max_input_nesting_level = memory_limit =
Make sure you have at least this values:

Code:
max_execution_time = 300 ; Maximum execution time of each script, in secondsmax_input_time = 60 ; Maximum amount of time each script may spend parsing request data;max_input_nesting_level = 64 ; Maximum input variable nesting levelmemory_limit = 128M ; Maximum amount of memory a script may consume (128MB)
Now all you have to do is make sure WAMP server is running and open your web browser and browse to:
http://localhost/index.php
or
http://localhost/somefolder/index.php

7. How to find someone to share with
Now you need to have someone to cardshare with.
If you don’t already have you can try to find someone in the free section here:
www.cardshare.tv
Remember to read the rules before posting.

When you have found someone to cardshare with you need to exchange C- and Flines.
Let’s go through the basic with Flines and Clines.

8. Flines and Clines the basics
The CCcam.cfg file is located in your Dreambox.
You can access it from your PC with DCC.
FTP to location:

Code:
var/etc
Right click on CCcam.cfg and chose edit.

Fline
The Fline is basically the same as creating a user account on your server.
The Fline consists of a Username and Password
In your config you have a Friend section that is the part where you should add the Flines.

Cline
The Cline is more like a connection string that you give to your peers so that they can connect to your server.
To be able to connect they need to have an account on your server (the Fline).

Here is a basic Fline
F: [username] [password] additional info
F: myfriend abc123 3 0 0 { 0:0:3 }
The part behind the password is privileges and restrictions.
3 0 0 { 0:0:3 }

This user gets all cards at a maximum of 3 hops away from us,
and get's to share them down two further levels beyond his own level.

Here is a basic Cline
C: [server] [port] [Fline username] [Fline password] additional info
C: biocide.******.org 12000 myfriend abc123 no { 0:0:3, 100:3, 100:4 }

no { 0:0:3, 100:3, 100:4 }
no = don’t receives friends emus
{ 0:0:3 = how many hops down you want to receive cards from that server, 100:3, 100:4 } = here you can block cards from that server

Summary of Clines and Flines

in your config
F: myfriend abc123 3 0 0 { 0:0:3 }
C: the Cline that were sent to you.

In your peers config
F: an Fline that match the Cline that was sent to you
C: your.server.org 12000 myfriend abc123 no { 0:0:3, 100:3, 100:4 }

There are much more you can do in the Cline and Fline but this is the basic that I think everyone should know about.

9. Fake and old cards
There are a lot of fake and old cards that are being shared and slowing down the servers, therefore you need to block all those cards.
Here is a list with old and fake cards.

10. Block all cards that you don’t want
First of all I want to say that using the method below will block all cards that you don’t choose to receive.
This also means that you will only share the cards that you decide to receive.
Remember that your peers might want cards that you don’t receive because you blocked them, and therefore they can see you as a not so interesting peer.
After every Cline you’ll add:
no { 0:0:1 } This means that you take all cards on hop1.
If you want any card on hop2 you’ll add:
no { 0:0:1, 90f:0:2, b00:0:2, anycard, anycard, anycard }
In this example I chose to get
90f:0 = "Viasat (5E/75E/1W)" on hop2
b00:0 = "Focus(1W) / C+Nordic(1W) / DigiAlb(16E) / MTV(19.2E)" on hop2
The last number is hop:
90f:0:2

11. So you want a big one
If you want to have a bigger server you’ll need a PC as server and Linux as OS.

Cardsharing beginners guide