Zimbra Visual Log Analysis with ELK Stack

For log analysis ELK(ElasticSearch-LogStash-Kibana) stack  is a powerful tool for Zimbra Mail Server logs, you can search logs and easliy create visually appealing graphics with Kibana interface.

In this post we will analyze the logs to find out which ip addresses abusing logins or brute forcing to Zimbra mail server.

So we first assume that if a single ip interacts with at least 5 different accounts we will count it as malicious usage. You should baseline your system accordingly otherwise there will be false positive decisions.

Now let's create the pie chart that will tell us these IP addresses visually

Then choose the following index

Now we will see whole number of logs to divide pie click Split Slices
Then

1. Choose Terms as for the Aggregation 
2. Choose src_ip for the Field
3. Write top number of ip addresses you want to see in the Size section
   

Now you should see a pie chart as below.

Now we should add sub-bucket to see how many accounts these ip addresses interact.
So click Add sub-buckets, click  Split-Slices and configure the sub-bucket as below

Now you should see the following pie chart where the inner slices shows the source ip addresses and outer slices shows usernames that individual ip addresses interact.


Now lets describe what the pie chart tells us.

If you see an  inner slice sweeping one outer slice in 1 day or 1 hour period that is we can safely assume that this is not a malicious ip address.

But if you see an inner slice sweeping more than 5 outer slice than we can conclude that there is a malicious activity either brute force or logged in with multiple accounts from one ip addresses.

So to find out a brute-force we should add a filter with the string "invalid credentials".

Security Auditing with InSpec

InSpec is a tool from CHEF. With InSpec you can ,

• Audit Policies
• Check security requirements
• Conduct compliance checks

InSpec can be installed on Linux, Mac or Windows. InSpec rules are written in ruby files.

I will give you some examples from the github repo about this amazing tool.

describe package('telnetd') do
  it { should_not be_installed }
end

describe inetd_conf do
  its("telnet") { should eq nil }
end

This rule will check the system against the installation of telnet and disallow this insecure service.

To run inspec save the above code snippet to a test.rb fie and in the command prompt run the following command to conduct the test.

inspec exec test.rb

you can also test this requirements against to remote systems.

on your linux servers using ssh ,

inspec exec test.rb -t ssh://user@hostname

or on windows through WinRM

inspec exec test.rb -t winrm://Administrator@windowshost --password 'your-password'

if you are familiar with CHEF compliance check, you can also make compliance check with the following syntax

  inspec compliance SUBCOMMAND ...   # Chef Compliance commands

For example this code uses the sshd_config resource to ensure that only enterprise-compliant ciphers are used for SSH servers.

describe sshd_config do
  its('Ciphers') { should cmp('chacha20-poly1305@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr') }
end

You can see detailed tutorials in the following link 

https://www.inspec.io/tutorials/

Moodle Quiz Activity with 500 Concurrent User

We have experienced a Quiz Activity with 500 concurrent user and i want share this experience with you. Because these insights are really valuable for system administrators, that i could not find any suggestion before this Quiz Activity.  Let me write the details about the system and the quiz activity.
We have installed moodle on a virtual machine VMWare with the following configuration.

We set the vm cpu to 16 shared vcpu,  and 24GB shared RAM
Running Centos 7.0 Minimal with php5.X, apache and mariadb with 700 max_connection setting.
Quiz activity with 20 Question and 30 Minute timespan and 17 Minute attempt time limit. 2 Question per page. Question order and choices were shuffled. Auto submit open attempt setting was on.

CPU and RAM usage was crucial for us. We see maximum 12 GB ram usage which is roughly 1 GB per 50 User
We see %95 CPU usage when the quiz started.

Before quiz started i stopped cron jobs and automated course backups.