Linux Basics for the Aspiring Hacker: Using Start-Up Scripts « Null Byte :: WonderHowTo

Very often we have processes in Linux that we want to always run in the background at startup. These would be processes that we need to start at bootup and always be available to us.If we are running a Linux distribution with a GUI (graphical user interface) likeKaliorUbuntu, we need the X11 process to be always running. If we are using Linux as a web server, we probably always wantApacheand maybeMySQLto start up at bootup and always be running.In this tutorial, we will examine how Linux starts processes at bootup and configureSnort, the world's most widely used IDS (intrusion detection system), to start automatically when booting up so that it is available to protect our network without any user interaction.Previously:Managing Hard Drives in LinuxThe Linux Boot-Up ProcessTo start, we need to examine the Linux boot-up process. In Linux, the boot-up process begins with the BIOS (basic input/output system), then the MBR (master boot record) executes GRUB (GRand Unified Bootloader), then the kernel executes the init (initialization, or first process), and then, finally, the runlevel program is executed from/etc/rc.d.As you probably already know, Linux can be started in multiple runlevels, which are:0 - halt the system1 - single user mode (minimal services)2 - multi-user modes3 - multi-user mode4 - multi-user mode5 - multi-user mode6 - reboot the systemOur Kali, being a Debian-based Linux distribution, usually boots into runlevel 2.The Init.d ProcessInit is the very first process. It is the ancestor of all Linux processes and always has the process ID of 1. As you can see in the screenshot below, init has the PID of 1.kali > ps aux | grep initThis init process then hands over the boot-up processes to rc.d daemon.It's important to note here that different Linux distributions handle the daemon start-up process slightly differently. In general, they all use the init process as the first process, but how they hand off to the start-up scripts differs slightly. In this case, we will be looking specifically at our Kali Linux which uses the same procedure as other Debian-based Linux systems.Step 1: List the init.d DirectoryNow that we have a basic understanding of the boot-up process in Linux, let's see if we can add Snort to the boot-up process in our Kali.First, let's go to the directory/etc/init.d, the init process daemon directory (not to be confused withinetd). In this directory are all the scripts to start various processes at bootup.kali > cd /etc/init.dkali > ls -lAs you can see, these are files that can be executed by init upon bootup. Note, for example, apache2. If we go a bit further down the page, we should find rc.local.Step 2: Open rc.local with a Text EditorNow let's open rc.local in any text editor, which contains a script to start necessary processes in the background when the system boots up. I will be using Leafpad here.kali > leafpad /etc/init.d/rc.localStep 3: Install SnortNow we will see if we can use what we learned to get the Snort IDS to always start at bootup. If don't already have Snort installed, do so now. To do so, you can type:kali > apt-get install snortThe Snort package will downlaod and install. As part of the install, Snort will place a start-up script in the/etc/init.ddirectory. Let's look there and confirm.kali > ls -lAs you can see, Snort has placed a start-up script in the/etc/init.ddirectory. Now all we need to do is to execute that script each time the system starts.If you compiled Snort from source code, you may not have this script. In that case, simply create a file named "snort" and save it to the/etc/init.ddirectory. In that file, place a command to start Snort such as:/usr/sbin/snort -D -c /etc/snort/snort.conf -l /var/log/snortMake certain that this script has execute privileges (755).Step 4: Strat Snort from rc.localThere are many ways to get a script to run at start up, but probably the simplest is to use the rc.local file. As we saw above, the rc.local file contains a script to start various services upon boot. Now all we need to do is append that file with commands to start Snort.Let's open that file with Leafpad and add two lines at the end of the file to [1] make certain that the proper interface is up and in promiscuous mode (ifconfig eth0 up -arp) and [2] execute the script that the Snort package placed in the init.d directory (/etc/init.d/snort start).Now whenever your system starts, Snort will always start in the background. Let's test it. Reboot your Kali system and let's see whether Snort starts automatically.Now that our system has rebooted, let's check to see if Snort is running by typing:kali > ps aux | grep snortSuccess! Now our network is always protected by Snort whenever we start our system!Keep coming back, my neophyte hackers, as we continue to explore the inner workings of Linux to give you the skills to become a professional hacker!Next Up:Using Ship in Linux for Quick & Handy IP Address InformationFollow Null Byte onTwitter,Flipboard, andYouTubeFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image by Justin Meyers/Null Byte; Screenshots by OTW/Null ByteRelatedHow To:The Essential Skills to Becoming a Master HackerNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 21 (GRUB Bootloader)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 2 (Creating Directories & Files)Hack Like a Pro:Python Scripting for the Aspiring Hacker, Part 1Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)How To:Simplify Payload Creation with MSFPC (MSFvenom Payload Creator)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 25 (Inetd, the Super Daemon)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 6 (Networking Basics)Hack Like a Pro:Scripting for the Aspiring Hacker, Part 3 (Windows PowerShell)How to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:Metasploit for the Aspiring Hacker, Part 14 (Creating Resource Script Files)Hack Like a Pro:Perl Scripting for the Aspiring Hacker, Part 1Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 1 (Getting Started)How To:Hack a Site Knowing a Bit of HTML (hackthissite.org) Part 3Hack Like a Pro:Scripting for the Aspiring Hacker, Part 1 (BASH Basics)Hack Like a Pro:How to Use PowerSploit, Part 1 (Evading Antivirus Software)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 13 (Web Delivery for Windows)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 16 (Stdin, Stdout, & Stderror)How To:Perl for the Aspiring Hacker - Part 1 - VariablesHow To:Linux Basics for the Aspiring Hacker: Managing Hard DrivesGoodnight Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 7 - Legal HackerGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker TrainingNews:First Steps of Compiling a Program in LinuxGoodnight Byte:HackThisSite Walkthrough, Part 10 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 10 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker TrainingNews:SOPA and PIPA Blackout!Goodnight Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 5 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 7 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 1 - Legal Hacker TrainingHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterWeekend Homework:How to Become a Null Byte Contributor (3/9/2012)