Cara Power UP dan Starting Server SUN Oracle T5240

Kali ini saya akan sedikit share tahapan untuk menghidupkan server SUN Oracle T5240 ketika kita melakukan power up pertama kali.

1. Pasang kabel power dan kabel yang lain yang dibutuhkan seperti kabel network dan management

2. Pertama kali kabel power dicolokan ke server, maka server tidak akan langsung kelihatan UP di led indikator di depannya, tunggu sekitar 5 menit.

3. Pasang kabel console ke laptop agar bisa dilihat proses booting nya

4. Setelah led indikator menyala hijau berkedip, maka tinggal tekan tombol power sampai UP, Tunggu agak lama seperti proses dibawah ini :

U-Boot 1.1.1

custom Sun Microsystems U-Boot 1.3 (Dec 11 2012 - 22:35:24) r77080

CPU:   MPC885ZPnn at 133 MHz: 8 kB I-Cache 8 kB D-Cache FEC present
Board: SPARC885
       Watchdog enabled
I2C:   ready
DRAM:
trying 128 MBytes
(128 MB SDRAM) 128 MB
Memory Tests: DA A1 A2 00 FF 55 AA T2 T3 T4
POST memory PASSED
FLASH: 32 MB
In:    serial
Out:   serial
Err:   serial
Net:   FEC ETHERNET
POST i2c  c  d 18 20 23 2a 2b 2d 2e 30 40 42 43 44 45 46 51 53 54 56 68 6a 6b 70 71 72 73 PASSED
POST cpu PASSED
POST ethernet PASSED
Booting linux in 5 seconds...
## Booting image at fe080000 ...
   Image Name:   Linux-2.4.22
   Image Type:   PowerPC Linux Kernel Image (gzip compressed)
   Data Size:    814559 Bytes = 795.5 kB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
do_bootm_linux():
  argv[0]=bootm
  argv[1]=0xfe080000
## Current stack ends at 0x07D38B60 => set upper limit to 0x00800000
No initrd
## cmdline at 0x007FFF00 ... 0x007FFF80
memstart    = 0x00000000
memsize     = 0x08000000
flashstart  = 0xFE000000
flashsize   = 0x02000000
flashoffset = 0x0004C000
sramstart   = 0x00000000
sramsize    = 0x00000000
EnvAddr     = 0x7FFEFB78
EnvSize     = 0xCF5054A1
banksize    = 0x02000000
banks       = 0x00000001
bankwidth   = 0x00000001
sectorsize  = 0x00020000
sectorcount = 0x00000100
booted      = 0xFE080000
boottype    = 0x00000000
primary     = 0xFFFFFFFF
pritype     = 0x00000000
secondary   = 0xFFFFFFFF
sectype     = 0x00000000
image0      = 0xFE000000
image1      = 0xFF000000
maximage    = 0x01000000
immr_base   = 0xF0000000
bootflags   = 0x00000001
intfreq     =    133 MHz
busfreq     = 66.500 MHz
ethaddr     = 00:21:28:58:48:85
IP addr     = 0.0.0.0
baudrate    =   9600 bps
## Transferring control to Linux (at address 00000000) ...
## parameters(007ffe80,00000000,00000000,007fff00,007fff80)
Linux version 2.4.22 (cboland@sanpen-rh5-0) (gcc version 3.3.4) #2 Tue Dec 11 22:31:54 PST 2012 r77773
On node 0 totalpages: 32768
zone(0): 32768 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock4 rootfstype=squashfs ro mtdparts=phys:384K(u1),128k(e1),1536K(k1),14M(r1),384K(u2),128K(e2),1536K(k2),14M(r2)
Calibrating delay loop... 132.71 BogoMIPS
Memory: 127624k available (1412k kernel code, 416k data, 68k init, 0k highmem)
Dentry cache hash table entries: 16384 (order: 5, 131072 bytes)
Inode cache hash table entries: 8192 (order: 4, 65536 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 8192 (order: 3, 32768 bytes)
Page-cache hash table entries: 32768 (order: 5, 131072 bytes)
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Journalled Block Device driver loaded
squashfs: version 3.0 (2006/03/15) Phillip Lougher
JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
CPM UART driver version 0.03
ttyS00 at 0x0100 is apty: 256 Unix98 ptys configured
Generic RTC Driver v1.07
eth0: FEC ENET Version 0.2, FEC irq 3, MII irq 6, addr 00:21:28:58:48:85
RAMDISK driver initialized: 16 RAM disks of 18432K size 1024 blocksize
eth0: Phy @ 0x0, type DM9161 (0x0181b881)
loop: loaded (max 8 devices)
physmap flash device: 2000000 at fe000000
 Amd/Fujitsu Extended Query Table v1.3 at 0x0040
number of CFI chips: 1
Using command line partition definition
Creating 8 MTD partitions on "Physically mapped flash":
mtdblock1: 0x00000000-0x00060000 : "u1"
mtdblock2: 0x00060000-0x00080000 : "e1"
mtdblock3: 0x00080000-0x00200000 : "k1"
mtdblock4: 0x00200000-0x01000000 : "r1"
mtdblock5: 0x01000000-0x01060000 : "u2"
mtdblock6: 0x01060000-0x01080000 : "e2"
mtdblock7: 0x01080000-0x01200000 : "k2"
mtdblock8: 0x01200000-0x02000000 : "r2"
i2c-core.o: i2c core module version 2.6.1 (20010830)
i2c-dev.o: i2c /dev entries driver module version 2.6.1 (20010830)
i2c-rpx.o: i2c MPC8xx module version 2.6.1 (20010830)
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 1024 buckets, 8Kbytes
TCP: Hash tables configured (established 8192 bind 16384)
ip_conntrack version 2.1 (1024 buckets, 8192 max) - 292 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team
ipt_recent v0.3.1: Stephen Frost .  http://snowman.net/projects/ipt_recent/
arp_tables: (C) 2002 David S. Miller
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
802.1Q VLAN Support v1.8 Ben Greear
All bugs added by David S. Miller
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 68k init
modprobe: modprobe: Can't open dependencies file /lib/modules/2.4.22/modules.dep (No such file or directory)
Creating /var tmpfs
Creating directories in /var...done.
Creating /var/log tmpfs...done.
Activating swap.
Calculating module dependencies... done.
Loading modules...
    fpga
Warning: loading /lib/modules/2.4.22/misc/fpga/fpga.o will taint the kernel: non-GPL license - Proprietary
  See http://www.tux.org/lkml/#export-tainted for information about tainted modules
Platform ID      : 2
Minor revision   : 4
Major revision   : 5
FPGA power status : 0xd20008: 80 0xd20009: f4
  (SYS_POK_EN  !DC_POK  !POK_VMEM_CPU1  !POK_VMEM_CPU0  !POK_CORE_CPU1  !POK_CORE_CPU0  !POK_PSU1  !POK_PSU0  POK_VMEMWING_CPU1  !VMEMWING_CPU1_PRESENT  POK_VMEMWING_CPU0  !VMEMWING_CPU0_PRESENT  !POK_OIO )
BR2: 0xf2000000/0x1000000/0xf2000401/0xff0001fc
FPGA init OK: base f2000000, size 1000000 (major 120)
Module fpga loaded, with warnings
    fpga_flash
Warning: loading /lib/modules/2.4.22/misc/fpga_flash/fpga_flash.o will taint the kernel: no license
  See http://www.tux.org/lkml/#export-tainted for information about tainted modules
Module fpga_flash loaded, with warnings
    immap
Warning: loading /lib/modules/2.4.22/misc/immap/immap.o will taint the kernel: no license
  See http://www.tux.org/lkml/#export-tainted for information about tainted modules
Module immap loaded, with warnings
All modules loaded.
Checking all file systems...
fsck (busybox 1.9.0, 2012-12-11 22:35:50 PST)
Setting kernel variables ...
kernel.core_pattern = /coredump/%h.%e.core
kernel.core_uses_pid = 1
net.ipv4.ip_local_port_range = 3100 7075
... done.
Mounting local filesystems...
Identifying DOC Device Type(G3/G4/H3) ...



Warning: /lib/modules/2.4.22/misc/tffs/tffs_h3.o symbol for parameter prio not found
Warning: loading /lib/modules/2.4.22/misc/tffs/tffs_h3.o will taint the kernel: non-GPL license - Proprietary
  See http://www.tux.org/lkml/#export-tainted for information about tainted modules
tffs: TrueFFS driver 7100.76
tffs: will not use IRQ
tffs: Looking for G4/P4 MDOC Devices while assuming IF_CFG=16.
tffs: Looking for G4/P4 MDOC Devices while assuming IF_CFG=8.
tffs: Flow: G4_docWindowBaseAddress Exit (NOT FOUND).
tffs: Looking for G3/P3 MDOC Devices while assuming IF_CFG=16.
tffs: Looking for G3/P3 MDOC Devices while assuming IF_CFG=8.
tffs: Looking for H1 DOC at address 0xcd14e000
tffs: DOCH found
tffs: Socket 0 in addr 0xf4000000
tffs: Device 0x0: size 0x1db00000 HW sector 0x200 (recommended 0x1000)
tffs: use major device number 100
Partition check:
 tffsa: tffsa1 tffsa2 tffsa3
tffs:     disk partition: dev_number=0x6401, 65534 sectors, start_sector=1
tffs:     disk partition: dev_number=0x6402, 65536 sectors, start_sector=65535
tffs:     disk partition: dev_number=0x6403, 112000 sectors, start_sector=131071
Module tffs_h3 loaded, with warnings
Loaded TFFS kernel module /lib/modules/2.4.22/misc/tffs/tffs_h3.o
kjournald starting.  Commit interval 5 seconds
EXT3 FS 2.4-0.9.19, 19 August 2002 on tffs(100,1), internal journal
EXT3-fs: recovery complete.
EXT3-fs: mounted filesystem with ordered data mode.
kjournald starting.  Commit interval 5 seconds
EXT3 FS 2.4-0.9.19, 19 August 2002 on loop(7,0), internal journal
EXT3-fs: recovery complete.
EXT3-fs: mounted filesystem with ordered data mode.
kjournald starting.  Commit interval 5 seconds
EXT3 FS 2.4-0.9.19, 19 August 2002 on loop(7,1), internal journal
EXT3-fs: mounted filesystem with ordered data mode.
kjournald starting.  Commit interval 5 seconds
EXT3 FS 2.4-0.9.19, 19 August 2002 on loop(7,2), internal journal
EXT3-fs: recovery complete.
EXT3-fs: mounted filesystem with ordered data mode.
kjournald starting.  Commit interval 5 seconds
EXT3 FS 2.4-0.9.19, 19 August 2002 on loop(7,3), internal journal
EXT3-fs: mounted filesystem with ordered data mode.
kjournald starting.  Commit interval 5 seconds
EXT3 FS 2.4-0.9.19, 19 August 2002 on loop(7,4), internal journal
EXT3-fs: mounted filesystem with ordered data mode.
kjournald starting.  Commit interval 5 seconds
EXT3 FS 2.4-0.9.19, 19 August 2002 on tffs(100,3), internal journal
EXT3-fs: recovery complete.
EXT3-fs: mounted filesystem with ordered data mode.
Mounted all disk partitions.

Checking configuration files state ...
Image date:  Tue Dec 11 23:58:28 PST 2012       Image revision: 77080
Conf date:   Tue Dec 11 23:58:28 PST 2012       Conf revision:  77080
Configuration files state good after upgrade.
Loaded IFC configuration file.

FRU probing time 7 sec
Created links for vbsc
Running ldconfig...done

Setting the System Clock using the Hardware Clock as reference...
System Clock set. Local time: Fri Oct 20 19:02:57 GMT 2017

Setting up networking...done.
Hostname: ORACLESP-FML095107M.
Setting up IP spoofing protection: rp_filter.
Configuring IPv6...done
Configuring network interfaces...eth0: config: auto-negotiation on, 100FDX, 100HDX, 10FDX, 10HDX.
done.
Starting portmap daemon: portmap.
Initializing random number generator...done.
Starting vbsc daemon:   Done
Incrementing bootcount ... done (10)
populating memstore vars from disk
/dev/fpga open OK
INIT: Entering runlevel: 3
Preparsing sensor.xml...
Starting system log daemon: syslogd and klogd.
Starting capidirect daemon:   Done
Starting Boot Timer.
Starting user mgmt upgrade program: usrmgt_upgrade.
Starting the Health Monitor Daemon...
Starting portmap daemon: portmap.
Starting capidirectd: Done.
Starting Network Interface Plugging Daemon: eth0.
Starting IPMI Stack...... Done.
SSH RSA Host Key Files already exist. Skipping key creation ...
SSH DSA Host Key Files already exist. Skipping key creation ...
Starting sshd.
Starting BBR daemon...
bbrd started after 1 seconds.
Starting periodic command scheduler: cron.
Starting Serial Server :seriald .
Starting Servicetags discoverer: stdiscoverer.
Starting Servicetags listener: stlistener.

ORACLESP-FML095107M login: root
Password: changeme
Waiting for daemons to initialize...

Daemons ready

Oracle(R) Integrated Lights Out Manager

Version 3.0.12.4.y r77080

Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.

Warning: password is set to factory default.

->

Ketikan :

-> start /SYS

Are you sure you want to start /SYS (y/n)? y
Starting /SYS

Kemudian ketik :

-> start /SP/console
Are you sure you want to start /SP/console (y/n)? y

Serial console started.  To stop, type #.
0:0:0>
0:0:0>POST 4.33.6 2012/03/14 08:38
0:0:0>
0:0:0>Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved.
0:0:0>POST enabling CMP 0 threads: ffffffff.ffffffff
0:0:0>POST enabling CMP 1 threads: ffffffff.ffffffff
0:0:0>VBSC mode is: 00000000.00000001
0:0:0>VBSC level is: 00000000.00000000
0:0:0>VBSC selecting Normal mode, MIN Testing.
0:0:0>VBSC setting verbosity level 2
1:0:0>NODE 1 present
0:0:0>Test Memory....Done
0:0:0>Setup POST Mailbox ....Done
0:0:0>Master CPU Tests Basic....Done
0:0:0>Init MMU.....
0:0:0>L2 Tests....Done
0:0:0>Extended CPU Tests....Done
0:0:0>Scrub Memory....Done
0:0:0>Extended Memory Tests....Done
0:0:0>SPU CWQ Tests...Done
0:0:0>MAU Tests...Done
0:0:0>NCU Setup and PIU link train....Done
0:0:0>Neptune Interface Port 0 Tests ..Done
0:0:0>Neptune Interface Port 1 Tests ..Done
0:0:0>Neptune Interface Port 2 Tests ..Done
0:0:0>Neptune Interface Port 3 Tests ..Done
2017-10-20 19:11:38.796 0:0:0>INFO:
2017-10-20 19:11:38.848 0:0:0>  POST Passed all devices.
2017-10-20 19:11:38.903 0:0:0>POST:     Return to VBSC.
2017-10-20 19:11:38.957 0:0:0>Master set ACK for vbsc runpost command and spin...
ChassisSerialNumber FML095107M


T5240, No Keyboard
Copyright (c) 1998, 2012, Oracle and/or its affiliates. All rights reserved.
OpenBoot 4.33.6.b, 32544 MB memory available, Serial #89671804.
Ethernet address 0:21:28:58:48:7c, Host ID: 8558487c.



Boot device: rootdisk  File and args:
SunOS Release 5.10 Version Generic_141444-09 64-bit
Copyright 1983-2009 Sun Microsystems, Inc.  All rights reserved.
Use is subject to license terms.
NOTICE: nxge1: xcvr addr:0x1c - link is down
NOTICE: nxge2: xcvr addr:0x1b - link is down
Hostname: tamblingan
NOTICE: nxge1: xcvr addr:0x1c - link is up 1000 Mbps full duplex
NOTICE: nxge2: xcvr addr:0x1b - link is up 1000 Mbps full duplex
/dev/md/rdsk/d6 is clean
/dev/md/rdsk/d3 is clean
/dev/md/rdsk/d5 is clean
/dev/md/rdsk/d4 is clean
Reading ZFS config: done.

5. Setelah Operating System nya UP, maka tinggal masukan user dan password root OS Solaris nya :

Server OS console login: root
password : xxxxxxxx



Semoga bermanfaat untuk pembaca semua.

Dony Ramansyah
site : http://donyramansyah.net
blog : dony-ramansyah.blogspot.com
email : dony.ramansyah[at]gmail.com
Registered linux user : ID 40017

Cara Mengaktifkan Dynamic Lock Pada Windows 10

Dynamic Lock memiliki fungsi untuk melakukan penguncian layar pada OS Windows 10 secara otomatis dengan perangkat bluetooth

Jadi misalnya laptop kita sudah terkoneksi via bluetooth dengan smartphone android, maka ketika kita meninggalkan meja dan laptop, pastinya handphone akan kita bawa bersama kita (kita kantongin). Nah ketika koneksi bluetooth nya terputus antara laptop dan handphone, maka OS Windows 10 kita akan otomatis layar nya terkunci (ke lock password).

Cara mengaktifkan dyanamic lock nya adalah :

1. Pairing via bluetooth antara laptop dengan handphone kita

Di laptop windows 10, cari Settings > Devices > Bluetooth & other devices, pastikan bluetooth di laptop dan windows nya aktif serta dapat di temukan (jangan di hide)


Lalu klik Next, tap the "+" button untuk Add Bluetooth or other device.

Nanti akan muncul angka untuk pin pairing bluetooth nya. Klik Accept aja untuk pairing.

2. Aktifan dynamic lock nya

Ketik aja di search pada sebelah menu start, login atau sign-in option, lalu aktifkan dynamic lock nya

Bagaimana cara kerja dynamic lock nya :

- Laptop akan tetap unlock sampai koneksi bluetooth antara laptop dan handphone putus
- Laptop akan masih tetap unlock selama 30 detik setelah putus koneksi bletooth nya
- Setelah 30 detik baru laptop windows 10 akan ke lock layar nya.

Semoga bermanfaat untuk pembaca semua.

Dony Ramansyah
site : http://donyramansyah.net
blog : dony-ramansyah.blogspot.com
email : dony.ramansyah[at]gmail.com
Registered linux user : ID 40017

Menjalankan Android di Windows 10 dengan NOX

Kali ini saya ingin sedikit share bagaimana agar kita dapat menjalankan OS Android yang biasanya ada di handphone, kini berjalan di atas OS Windows yang ada di Laptop.

Pertama pastikan ya laptop / PC nya memiliki spesifikasi yang bagus, yah minimal i5 dan ram 4 GB lah. Emulator nya menggunakan program NOX

Cara nya adalah :

1. Download dulu program emulator android nya di : https://id.bignox.com/

2. Kemudian setelah selesai di download file nya, lanjutkan dengan install file exe nya.

3. Nanti akan muncul menu nya di start menu, dan jalankan program nox nya :

Untuk melakukan navigasi semua menggunakan mouse dan menu nya ada di paling kanan.

Disini kita bisa lihat android nya masih kitkat :

Dan kita juga mendapat internal storage 32GB dan RAM 1GB :

Disini kita bisa masukan account gmail kita dan melakukan instalasi program android dari playstore seperti biasanya.



Semoga bermanfaat untuk pembaca semua.

Dony Ramansyah
site : http://donyramansyah.net
blog : dony-ramansyah.blogspot.com
email : dony.ramansyah[at]gmail.com
Registered linux user : ID 40017

Menjaga file access.log agar tidak membuat diskfull di Linux Centos 7

Bagi server linux centos 7 yang menjalankan service webserver (apache atau http) dan memiliki traffic kunjungan yang tinggi untuk web server nya, maka perlu di perhatikan untuk kapasitas file access.log nya agar jangan sampai membuat sisa space disk linux nya full.

Karena file ini akan terus mencatat log pengunjung yang membuka web server kita, dan jika pengunjung nya banyak setiap hari nya maka file ini juga akan semakin besar.

File access.log ini ada nya di : /var/www/vhosts/netsafe/logs/

24G     /var/www/vhosts/netsafe/logs/access.log

Disana terlihat file saya sudah sampai 24GB, untuk mengatasi nya saya hanya membuat crontab untuk mengosongkan nya secara terjadwal dan otomatis.

Cara nya tinggal saya buat saya crontab di linux centos nya seperti ini :

0 3 * * * cat /dev/null > /var/www/vhosts/netsafe/logs/access.log'

Jadi setiap jam 3 pagi akan dilakukan pengosongan file access.log nya.



Semoga bermanfaat untuk pembaca semua.

Dony Ramansyah
site : http://donyramansyah.net
blog : dony-ramansyah.blogspot.com
email : dony.ramansyah[at]gmail.com
Registered linux user : ID 40017

Cara Disable IPv6 di Linux Ubuntu 16.04 LTS

Kali ini saya akan sedikit share bagaimana cara nya disable IPv6 di Linux Ubuntu 16.04 LTS, disini saya disable karena kalau dualstack IPv6 dan IPv4 nya aktif maka akan ada kendala koneksi ke repository nya :

# ifconfig
ens160    Link encap:Ethernet  HWaddr 00:50:56:b0:67:5a
          inet addr:10.10.10.10  Bcast:10.10.10.255  Mask:255.255.255.0
          inet6 addr: 2001:e00:d:0:250:56ff:feb0:675a/64 Scope:Global
          inet6 addr: fe80::250:56ff:feb0:675a/64 Scope:Link
          inet6 addr: 2001:e00:25:2337:250:56ff:feb0:675a/64 Scope:Global

# apt-get update
0% [Connecting to id.archive.ubuntu.com (2001:67c:1360:8001::21)] [Connecting to security.ubuntu.com (2001:67c:1562::19)]

Nah seperti itu, koneksi ke repository nya masalah

Solusi nya sementara ini saya disable IPv6 nya, cara nya adalah :

1. Edit dan tambahkan pada baris terakhir dari file /etc/sysctl.conf

net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1

2. Simpan dengan cara :

# sudo sysctl -p

net.ipv4.ip_forward = 1

net.ipv6.conf.all.disable_ipv6 = 1

net.ipv6.conf.default.disable_ipv6 = 1

net.ipv6.conf.lo.disable_ipv6 = 1

Sekarang lihat lagi dengan ifconfig untuk IPv6 nya seharus nya sudah tidak aktif :

# ifconfig

ens160    Link encap:Ethernet  HWaddr 00:50:56:b0:67:5a

          inet addr:10.3.12.250  Bcast:10.3.127.255  Mask:255.255.128.0

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:159650297 errors:0 dropped:1406550 overruns:0 frame:0

Semoga bermanfaat untuk pembaca semua.

Dony Ramansyah

site : http://donyramansyah.net

blog : dony-ramansyah.blogspot.com

email : dony.ramansyah[at]gmail.com

Registered linux user : ID 40017

Melihat Proses dan Menutup Program Dari Command Line Windows

Kali ini saya mau sedikit share bagaimana nya melihat semua proses program yang sedang berjalan di OS Windows melalui command line, dengan perintah tasklist :

Nah sekarang kita bisa melihatt proses yang sedang berjalan di OS Windows, gimana kalau kita ingin menutup paksa salah satu program yang sedang berjalan tersebut? Contoh saya ingin menutup program notepad, berikut caranya :

C:> TASKKILL /F /IM notepad.exe
SUCCESS: The process "notepad.exe" with PID 6952 has been terminated.

Semoga bermanfaat untuk pembaca semua.

Dony Ramansyah
site : http://donyramansyah.net
blog : dony-ramansyah.blogspot.com
email : dony.ramansyah[at]gmail.com
Registered linux user : ID 40017

Deteksi Malware Di Linux

Deskripsi :
Linux Malware Detect (LMD) adalah pemindai malware untuk Linux yang dirilis di bawah lisensi GNU GPLv2, yang dirancang untuk menghadapi ancaman malware di OS Linux. Saat ini bisa mendeteksi lebih dari 8.883 worm malware, yang terdeteksi oleh LMD versi 1.6, Sangat bagus untuk mendeteksi rootkit atau malware di Linux yang biasanya juga ada di server hosting berbasis linux.

Beberapa Feature dari LMD :

– MD5 file hash detection for quick threat identification
– HEX based pattern matching for identifying threat variants
– statistical analysis component for detection of obfuscated threats (e.g: base64)
– integrated detection of ClamAV to use as scanner engine for improved performance
– integrated signature update feature with -u|–update
– integrated version update feature with -d|–update-ver
– scan-recent option to scan only files that have been added/changed in X days
– scan-all option for full path based scanning
– checkout option to upload suspected malware to rfxn.com for review / hashing
– full reporting system to view current and previous scan results
– quarantine queue that stores threats in a safe fashion with no permissions
– quarantine batching option to quarantine the results of a current or past scans
– quarantine restore option to restore files to original path, owner and perms
– quarantine suspend account option to Cpanel suspend or shell revoke users
– cleaner rules to attempt removal of malware injected strings
– cleaner batching option to attempt cleaning of previous scan reports
– cleaner rules to remove base64 and gzinflate(base64 injected malware
– daily cron based scanning of all changes in last 24h in user homedirs
– daily cron script compatible with stock RH style systems, Cpanel & Ensim
– kernel based inotify real time file scanning of created/modified/moved files
– kernel inotify monitor that can take path data from STDIN or FILE
– kernel inotify monitor convenience feature to monitor system users
– kernel inotify monitor can be restricted to a configurable user html root
– kernel inotify monitor with dynamic sysctl limits for optimal performance
– kernel inotify alerting through daily and/or optional weekly reports
– e-mail alert reporting after every scan execution (manual & daily)
– path, extension and signature based ignore options
– background scanner option for unattended scan operations
– verbose logging & output of all actions

LMD ini juga dapat melakukan monitoring secara realtime dengan contoh perintah di terminal seperti dibawah ini :

# maldet --monitor users
# maldet --monitor /root/monitor_paths
# maldet --monitor /home/mike,/home/ashton

Mau scan secara manual juga bisa dengan perintah :

# maldet -a /home/xxxx/

# maldet -a /home/xxxx/

Linux Malware Detect v1.6.2

            (C) 2002-2017, R-fx Networks

            (C) 2017, Ryan MacDonald

This program may be freely redistributed under the terms of the GNU GPL v2

maldet(13988): {scan} signatures loaded: 15215 (12485 MD5 | 1951 HEX | 779 YARA | 0 USER)

maldet(13988): {scan} building file list for /home/xxxx/, this might take awhile...

maldet(13988): {scan} setting nice scheduler priorities for all operations: cpunice 19 , ionice 6

maldet(13988): {scan} file list completed in 101s, found 9818 files...

maldet(13988): {scan} found clamav binary at /usr/local/cpanel/3rdparty/bin/clamdscan, using clamav scanner engine...

maldet(13988): {scan} scan of/home/xxxx/ (9818 files) in progress...

maldet(13988): {scan} processing scan results for hits: 1 hits 0 cleaned

maldet(13988): {scan} scan completed on/home/xxxx/: files 9818, malware hits 1, cleaned hits 0, time 899s

maldet(13988): {scan} scan report saved, to view run: maldet --report 170803-0910.13988

Untuk melakukan update database malware bisa dengan perintah :

# maldet -u

atau

# maldet -d

-u, --update-sigs [--force]

       Update malware detection signatures from rfxn.com

-d, --update-ver [--force]

       Update the installed version from rfxn.com

Semoga bermanfaat untuk pembaca semua.

Dony Ramansyah

site : http://donyramansyah.net

blog : dony-ramansyah.blogspot.com

email : dony.ramansyah[at]gmail.com

Registered linux user : ID 40017

CSF Merupakan firewall yang cukup bagus yang biasa dipasang di server penyedia layanan hosting, firewall ini aktif bisa melakukan blocking IP suspect secara otomatis, Untuk melakukan management firewall nya pun sangat mudah karena dilakukan dari Web GUI nya :

Namun kita harus tahu juga command line untuk csf firewall ini, dan berikut sedikit share mengenai command line untuk csf firewall :

Memasukkan daftar alamat IP ke whitelist :

Untuk mencegah IP tertentu diblokir, bahkan untuk penolakan sementara, Anda perlu mencantumkan alamat IP mereka di file csf.ignore dan csf.allow. Langkah pertama adalah mengaktifkan IGNORE_ALLOW di csf.conf. Nilai untuk IGNORE_ALLOW akan muncul sebagai "0", Anda perlu menyesuaikannya dengan "1" dan restart csf dan lfd.

Jika Anda menambahkan alamat IP ke csf.ignore, alamat IP tidak akan lagi diperiksa oleh LDF dan upaya login yang gagal tidak akan memicu penolakan sementara.

Semoga bermanfaat untuk pembaca semua.

Dony Ramansyah
site : http://donyramansyah.net
blog : dony-ramansyah.blogspot.com
email : dony.ramansyah[at]gmail.com
Registered linux user : ID 40017