pressed.cfg by morsa

En el post anterior subi como hacer un booteable desatendido e debian lenny, aca les subo el contenido del archivo pressed.cfg:


#### Contenidos por morsa
# Locale, setear idioma y pais
d-i debian-installer/locale string es_AR

# Teclado en español, si se quiere en ingles cambiar "es" por "us"
#d-i console-tools/archs select at
d-i console-keymaps-at/keymap select es
# Ejemplo para arquitectura diferente
#d-i console-keymaps-usb/keymap select mac-usb-us

### Red
# netcfg dejara elegir una iface.
# Omitir mostrar una lista si hay mas de una iface
d-i netcfg/choose_interface select auto

# Para poner una interface particular
#d-i netcfg/choose_interface select eth1

# Si tiene un server DHCP lento y el instalador tarda, permite esperarlo por tantos segundos:
#d-i netcfg/dhcp_timeout string 60

# Si prefiere configurar la red manualmente, descomentar esta linea y
# la static network configuration mas abajo.
d-i netcfg/disable_dhcp boolean true

# Si quiere preconfigurar el archivo para trabajar con ambos, con y sin DHCP
# descomente estas lineas y la de static network mas abajo.
#d-i netcfg/dhcp_failed note
#d-i netcfg/dhcp_options select Configure network manually

# Configuracion de red estatica
d-i netcfg/get_nameservers string 172.16.72.99
d-i netcfg/get_ipaddress string 172.16.72.195
d-i netcfg/get_netmask string 255.255.255.0
d-i netcfg/get_gateway string 172.16.72.1
d-i netcfg/confirm_static boolean true

# Ningun hostname ni dominio es asignado por DHCP. Sin embargo estas lineas previenen
# que aparezcan las preguntas por pantalla si habilita DHCP.
#d-i netcfg/get_hostname string unassigned-hostname
#d-i netcfg/get_domain string unassigned-domain

# Deshabilitar dialogo key WEP
d-i netcfg/wireless_wep string
# The wacky dhcp hostname that some ISPs use as a password of sorts.
#d-i netcfg/dhcp_hostname string radish

# Si tiene soft que no es free, puede configurar para la red u otro HW
# configure the installer to always try to load it, without prompting. Or
# change to false to disable asking.
#d-i hw-detect/load_firmware boolean true

### Consola de Red
# Use la siguiente configuracion si usted desea hacer uso de network-console
# Componente para instalacion remota SSH. Solamente funciona si usted instala
# los paquetes manualmente.
d-i anna/choose_modules string network-console
d-i network-console/password password morsamorsa
d-i network-console/password-again password morsamorsa

### Mirror settings
# If you select ftp, the mirror/country string does not need to be set.
#d-i mirror/protocol string ftp
d-i mirror/country string manual
d-i mirror/http/hostname string http.us.debian.org
d-i mirror/http/directory string /debian
d-i mirror/http/proxy string

# Suite to install.
#d-i mirror/suite string testing
# Suite to use for loading installer components (optional).
#d-i mirror/udeb/suite string testing

### Reloj y Zona horaria
# Controls whether or not the hardware clock is set to UTC.
d-i clock-setup/utc boolean true

# You may set this to any valid setting for $TZ; see the contents of
# /usr/share/zoneinfo/ for valid values.
d-i time/zone string Buenos_Aires

# Controls whether to use NTP to set the clock during the install
d-i clock-setup/ntp boolean true
# NTP server a usar.
d-i clock-setup/ntp-server string 0.debian.pool.ntp.org

### Particionado
# Si tiene espacio libre puede elegirlo, el sistema solamente eleige dicha opcion.
#d-i partman-auto/init_automatically_partition select biggest_free

# Alternatively, you can specify a disk to partition. The device name must
# be given in traditional non-devfs format.
# Note: A disk must be specified, unless the system has only one disk.
# For example, to use the first SCSI/SATA hard disk:
#d-i partman-auto/disk string /dev/sda
# In addition, you'll need to specify the method to use.
# The presently available methods are: "regular", "lvm" and "crypto"
d-i partman-auto/method string regular

# If one of the disks that are going to be automatically partitioned
# contains an old LVM configuration, the user will normally receive a
# warning. This can be preseeded away...
d-i partman-lvm/device_remove_lvm boolean true
# The same applies to pre-existing software RAID array:
d-i partman-md/device_remove_md boolean true
# And the same goes for the confirmation to write the lvm partitions.
d-i partman-lvm/confirm boolean true

# You can choose one of the three predefined partitioning recipes:
# - atomic: all files in one partition
# - home: separate /home partition
# - multi: separate /home, /usr, /var, and /tmp partitions
d-i partman-auto/choose_recipe select atomic

# Or provide a recipe of your own...
# The recipe format is documented in the file devel/partman-auto-recipe.txt.
# If you have a way to get a recipe file into the d-i environment, you can
# just point at it.
#d-i partman-auto/expert_recipe_file string /hd-media/recipe

# If not, you can put an entire recipe into the preconfiguration file in one
# (logical) line. This example creates a small /boot partition, suitable
# swap, and uses the rest of the space for the root partition:
#d-i partman-auto/expert_recipe string \
# boot-root :: \
# 40 50 100 ext3 \
# $primary{ } $bootable{ } \
# method{ format } format{ } \
# use_filesystem{ } filesystem{ ext3 } \
# mountpoint{ /boot } \
# . \
# 500 10000 1000000000 ext3 \
# method{ format } format{ } \
# use_filesystem{ } filesystem{ ext3 } \
# mountpoint{ / } \
# . \
# 64 512 300% linux-swap \
# method{ swap } format{ } \
# .

# This makes partman automatically partition without confirmation, provided
# that you told it what to do using one of the methods above.
d-i partman/confirm_write_new_label boolean true
d-i partman/choose_partition select finish
d-i partman/confirm boolean true

### Base system installation
# Select the initramfs generator used to generate the initrd for 2.6 kernels.
#d-i base-installer/kernel/linux/initramfs-generators string yaird

# The kernel image (meta) package to be installed; "none" can be used if no
# kernel is to be installed.
#d-i base-installer/kernel/image string linux-image-2.6-486

### Account setup
# Skip creation of a root account (normal user account will be able to
# use sudo).
#d-i passwd/root-login boolean false
# Alternatively, to skip creation of a normal user account.
#d-i passwd/make-user boolean false

# Root password, either in clear text
d-i passwd/root-password password morsamorsa
d-i passwd/root-password-again password morsamorsa
# or encrypted using an MD5 hash.
#d-i passwd/root-password-crypted password [MD5 hash]

# To create a normal user account.
d-i passwd/user-fullname string Hernan Tirado
d-i passwd/username string htirado
# Normal user's password, either in clear text
d-i passwd/user-password password morsamorsa
d-i passwd/user-password-again password morsamorsa
# or encrypted using an MD5 hash.
#d-i passwd/user-password-crypted password [MD5 hash]
# Create the first user with the specified UID instead of the default.
#d-i passwd/user-uid string 1010

# The user account will be added to some standard initial groups. To
# override that, use this.
#d-i passwd/user-default-groups string audio cdrom video

### Apt setup
# You can choose to install non-free and contrib software.
#d-i apt-setup/non-free boolean true
#d-i apt-setup/contrib boolean true
# Uncomment this if you don't want to use a network mirror.
d-i apt-setup/use_mirror boolean false
# Select which update services to use; define the mirrors to be used.
# Values shown below are the normal defaults.
d-i apt-setup/services-select multiselect security, volatile
d-i apt-setup/security_host string security.debian.org
d-i apt-setup/volatile_host string volatile.debian.org

# Additional repositories, local[0-9] available
#d-i apt-setup/local0/repository string \
# http://local.server/debian stable main
#d-i apt-setup/local0/comment string local server
# Enable deb-src lines
#d-i apt-setup/local0/source boolean true
# URL to the public key of the local repository; you must provide a key or
# apt will complain about the unauthenticated repository and so the
# sources.list line will be left commented out
#d-i apt-setup/local0/key string http://local.server/key

# By default the installer requires that repositories be authenticated
# using a known gpg key. This setting can be used to disable that
# authentication. Warning: Insecure, not recommended.
#d-i debian-installer/allow_unauthenticated string true

### Package selection
#tasksel tasksel/first multiselect standard, web-server
tasksel tasksel/first multiselect standard, web-server
# If the desktop task is selected, install the kde and xfce desktops
# instead of the default gnome desktop.
#tasksel tasksel/desktop multiselect kde, xfce

# Individual additional packages to install
d-i pkgsel/include string openssh-server build-essential
# Whether to upgrade packages after debootstrap.
# Allowed values: none, safe-upgrade, full-upgrade
d-i pkgsel/upgrade select full-upgrade

# Some versions of the installer can report back on what software you have
# installed, and what software you use. The default is not to report back,
# but sending reports helps the project determine what software is most
# popular and include it on CDs.
popularity-contest popularity-contest/participate boolean false

### Boot loader installation
# Grub is the default boot loader (for x86). If you want lilo installed
# instead, uncomment this:
#d-i grub-installer/skip boolean true
# To also skip installing lilo, and install no bootloader, uncomment this
# too:
#d-i lilo-installer/skip boolean true

# This is fairly safe to set, it makes grub install automatically to the MBR
# if no other operating system is detected on the machine.
d-i grub-installer/only_debian boolean true

# This one makes grub-installer install to the MBR if it also finds some other
# OS, which is less safe as it might not be able to boot that other OS.
d-i grub-installer/with_other_os boolean true

# Alternatively, if you want to install to a location other than the mbr,
# uncomment and edit these lines:
#d-i grub-installer/only_debian boolean false
#d-i grub-installer/with_other_os boolean false
#d-i grub-installer/bootdev string (hd0,0)
# To install grub to multiple disks:
#d-i grub-installer/bootdev string (hd0,0) (hd1,0) (hd2,0)

# Optional password for grub, either in clear text
d-i grub-installer/password password morsamorsa
d-i grub-installer/password-again password morsamorsa
# or encrypted using an MD5 hash, see grub-md5-crypt(8).
#d-i grub-installer/password-crypted password [MD5 hash]

### Finishing up the installation
# During installations from serial console, the regular virtual consoles
# (VT1-VT6) are normally disabled in /etc/inittab. Uncomment the next
# line to prevent this.
#d-i finish-install/keep-consoles boolean true

# Avoid that last message about the install being complete.
d-i finish-install/reboot_in_progress note

# This will prevent the installer from ejecting the CD during the reboot,
# which is useful in some situations.
#d-i cdrom-detect/eject boolean false

# This is how to make the installer shutdown when finished, but not
# reboot into the installed system.
#d-i debian-installer/exit/halt boolean true
# This will power off the machine instead of just halting it.
#d-i debian-installer/exit/poweroff boolean true

### Preseeding other packages
# Depending on what software you choose to install, or if things go wrong
# during the installation process, it's possible that other questions may
# be asked. You can preseed those too, of course. To get a list of every
# possible question that could be asked during an install, do an
# installation, and then run these commands:
# debconf-get-selections --installer > file
# debconf-get-selections >> file


#### Advanced options
### Running custom commands during the installation
# d-i preseeding is inherently not secure. Nothing in the installer checks
# for attempts at buffer overflows or other exploits of the values of a
# preconfiguration file like this one. Only use preconfiguration files from
# trusted locations! To drive that home, and because it's generally useful,
# here's a way to run any shell command you'd like inside the installer,
# automatically.

# This first command is run as early as possible, just after
# preseeding is read.
#d-i preseed/early_command string anna-install some-udeb

# This command is run just before the install finishes, but when there is
# still a usable /target directory. You can chroot to /target and use it
# directly, or use the apt-install and in-target commands to easily install
# packages and run commands in the target system.
#d-i preseed/late_command string apt-install zsh; in-target chsh -s /bin/zsh

Linux Debian 5.04 i386 unattended iso booteable

mkdir debian-504
bsdtar -C debian-504 -xf debian-504-i386-CD-1.iso
cd debian-504
chmod u+w install.386/
cp install.386/initrd.gz install.386/initrd.gz.orig
chmod u-w install.386/ install.386/initrd.gz.orig
cd ..
rm -fr debian-504-initrd
mkdir debian-504-initrd
cd debian-504-initrd/
gunzip -c ../debian-504/install.386/initrd.gz.orig | cpio -id
vim preseed.cfg
find . | cpio --create --format='newc' | gzip > ../debian-504-initrd.gz
cd debian-504
chmod u+w install.386/ install.386/initrd.gz
cp ../debian-504-initrd.gz install.386/initrd.gz
chmod u-w install.386/ install.386/initrd.gz
cd ..
mkisofs -o debian-504-i386-morsa.iso -r -J -no-emul-boot -boot-load-size 4 -b isolinux/isolinux.bin -c isolinux/boot.cat ./debian-504 2> /dev/null
cdrecord -v -eject speed=16 debian-504-i386-morsa.iso

Habilitar remotamente el Acceso por Escritorio Remoto XP o 2003

Inicio -> Ejecutar -> Regedit -> File -> Connect Network Registry -> Ingresamos nombre de la Pc o la direccion Ip.

Vamos a la key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\

Cambiamos el contenido de fDenyTSConnections de: 1 a 0.

Reiniciamos la PC remota con:

Inicio -> Ejecutar -> shutdown -i

O con:

shutdown /m \\computadora /r /f

Restringir "su - a" un grupo de usuarios:

Para restringir usuarios que escalen privilegios con su - haremos lo siguiente ..

Editamos el siguiente archivo:

# vim /etc/pam.d/su

Descomentamos la linea 15:

# auth required pam_wheel.so

Agregamos al final el grupo wheel y quedara asi:

auth required pam_wheel.so group=wheel

Ahora solamente los que formen parte del grupo wheel podran hacerse root. Agregamos el grupo:

# addgroup --system wheel

Agregamos al grupo wheel los usuarios que queremos que hagan su - :

# vim /etc/group

wheel:x:106:morsa

Si queremos agregar mas users tenemos que separarlos con "," asi:

wheel:x:106:htirado,beto

Enviar mail con telnet

#!/bin/bash
(
sleep 2
echo "EHLO dominio.com.ar"
sleep 2
echo "MAIL FROM: cuentaDesde@dominio.com.ar"
sleep 2
echo "RCPT TO: cuentaHacia@dominio.com.ar"
sleep 2
echo "DATA"
sleep 2
echo "Subject: Msj de prueba"
sleep 2
echo "Alos."
sleep 2
echo "Esto es una prueba."
sleep 2
echo "Bye."
sleep 2
echo "."
sleep 2
echo "QUIT"
sleep 2
) | telnet 192.168.1.100 25

Enviar mail adjunto desde la CLI

Instalamos biabam:

#apt-get install biabam

Ejecutamos el comando con el asunto, archivo adjunto y destinatarios:

#echo "Contenido del mail" | biabam /ruta/del/archivo/a/adjuntar -s "Asunto del mail" destinatario1@midominio.com,destinatario2@midominio.com

Restaurar conexion luego de insertar una regla erronea con iptables

Usualmente solemos agregar una regla en iptables, en la cual nos deja afuera del server. Si nuestro servidor esta alojado en otro pais y no disponemos de que nadie realice el cambio en la regla para volver acceder podemos utilizar el comando iptables-apply.

Un ejemplo de uso podria ser el siguiente:

Pensemos que queremos bloquear el acceso ssh para todos las PCs menos nuestra pc, si por casualidad nos equivocamos o ponemos mal algun filtro nos quedaremos sin acceso al server.

Guardamos las reglas de iptables en un archivo de texto:

#iptables-save > ipt.txt

Editamos dicho archivo:

#vim ipt.txt

En el INPUT denegamos el ssh, no tengamos miedo, ya que hasta que no restablezcamos no perderemos coneccion. Tengamos en cuenta que no restauraremos con el comando iptables-restore, sino que lo haremos con iptables-apply.

Dentro del ipt.txt pondremos lo siguiente dentro del la cadena INPUT:

-A INPUT -p tcp --dport 24 -j DROP

Guardamos y salimos:

:wq

Ahora indicaremos el tiempo que tendremos para que el servidor vuelva a restablecer las reglas antes que perdamos la conexion ssh. Tengamos en cuenta que si vemos un mensaje para volver validarlo, el cual pedira confirmacion, si no lo vemos perderemos la conexion. Recuerden que luego del tiempo que le ponemos mediante el parametro -t volveremos a poder conectarnos.

Ejecutamos el util comando:

#iptables-apply -t 30 ipt.txt

Vemos que se aplicaron bien las reglas y perdemos conexion a la terminal:

Applying new ruleset... done.

Luego de 30 segundos u otra cantidad que le especifiquemos con el -t volveremos a poder conectarnos.

Con itables -L veremos que volvio hacia atras el ultimo cambio que realizamos.

En cambio si hubiesemos colocado la regla correcta nos aparecera en pantalla un mensaje, al cual le indicaremos que si y aplicara los cambios sin volver a atras los cambios

Applying new ruleset... done.
Can you establish NEW connections to the machine? (y/N) y
... then my job is done. See you next time.