LINUX GURU

Data Measurement Chart

2011-03-10T20:24:00.002+05:30

Data Measurement Chart
Data Measurement	Size
Bit	Single Binary Digit (1 or 0)
Byte	8 bits
Kilobyte (KB)	1,024 Bytes
Megabyte (MB)	1,024 Kilobytes
Gigabyte (GB)	1,024 Megabytes
Terabyte (TB)	1,024 Gigabytes
Petabyte (PB)	1,024 Terabytes
Exabyte (EB)	1,024 Petabytes

Connection Speed Chart
Internet Technology	Data Rate (per second)	Data Rate (per second)	Data Rate (per second)	Data Rate (per second)
28.8K Modem	28.8 Kbps	28,800 Bits	3,600 Bytes	3.5 Kilobytes
36.6K Modem	36.6 Kbps	36,600 Bits	4,575 Bytes	4.4 Kilobytes
56K Modem	56 Kbps	56,000 Bits	7,000 Bytes	6.8 Kilobytes
ISDN	128 Kbps	128,000 Bits	16,000 Bytes	15 Kilobytes
T1	1.544 Mbps	1,544,000 Bits	193,000 Bytes	188 Kilobytes
DSL	512 Kbps to 8 Mbps	8,000,000 Bits	1,000,000 Bytes	976 Kilobytes
Cable Modem	512 Kbps to 52 Mbps	53,000,000 Bits	6,625,000 Bytes	6,469 Kilobytes (6.3MB/sec)
T3	44.736 Mbps	44,736,000 Bits	5,592,000 Bytes	5,460 Kilobytes (5.3MB/sec)
Gigabit Ethernet	1 Gbps	1,000,000,000 Bits	125,000,000 Bytes	122,070 Kilobytes (119MB/sec)
OC-256	13.271 Gbps	13,271,000,000 Bits	1,658,875,000 Bytes	1,619,995 Kilobytes (1.5GB/sec)

Computer Technology Chart
Computer Technology	Data Rate (per second)	Data Rate (per second)	Data Rate (per second)	Data Rate (per second)
ADB	256 Kbps	256,000 Bits	32,000 Bytes	31.2 Kilobytes
USB	12 Mbps	12,000,000 Bits	1,500,000 Bytes	1,464 Kilobytes (1.42MB/sec)
USB 2.0	480 Mbps	480,000,000 Bits	60,000,000 Bytes	58,593 Kilobytes (57.2MB/sec)
FireWire (a.k.a. "IEEE 1394" or "i.Link")	400 Mbps	400,000,000 Bits	50,000,000 Bytes	48,828 Kilobytes (47.6MB/sec)
Ultra ATA/33 (a.k.a. Ultra DMA/33)	33 MB/sec
Ultra ATA/66 (a.k.a. Ultra DMD/66 or Fast ATA-2)	66 MB/sec
SCSI-1	5 MB/sec
SCSI-2	5-10 MB/sec
Fast SCSI-2	10-20 MB/sec
Wide SCSI-2	20 MB/sec
Fast Wide SCSI-2	20 MB/sec
Ultra SCSI-3 (8-bit)	20 MB/sec
Ultra SCSI-3 (16-bit)	40 MB/sec
Ultra-2 SCSI	40 MB/sec
Wide Ultra-2 SCSI	80 MB/sec
Ultra-3 SCSI	160 MB/sec
Serial ATA (Gen 1)	150 MB/sec	1.2 Gbps
Serial ATA (Gen 2)	300 MB/sec	2.4 Gbps
Serial ATA (Gen 3)	600 MB/sec	4.8 Gbps

Video Format Chart
Video Formats	NTSC Resolution (525 Vertical Lines)
8mm	250 Horizontal Lines
VHS	250 Horizontal Lines
VHS-C	250 Horizontal Lines
Hi8	400 Horizontal Lines
S-VHS	400 Horizontal Lines
DV	500 Horizontal Lines
DVD	500 Horizontal Lines

Audio/Video Chart
Audio/Video Technology	Data Rate (per second)	Data Rate (per second)	Data Rate (per second)	Data Rate (per second)
CD	1.4112 Mbps	1,411,200 Bits	176,400 Bytes	172 Kilobytes
DVD	10 Mbps	10,000,000 Bits	1,250,000 Bytes	1,220 Kilobytes (1.1MB/sec)
DV	30.1 Mbps	30,195,712 Bits	3,774,464 Bytes	3,686 Kilobytes (3.6MB/sec)
DLP	37 Mbps to 43 Mbps	43,000,000 Bits	5,375,000 Bytes	5,249 Kilobytes (5.2MB/sec)

Data Comparison Chart
Kilobits (Kbps)	Bits (bps)	Megabits (Mbps)	Bytes (Bps)	Kilobytes (KBps)	Megabytes (MBps)	Minutes On 650MB CD	Minutes On 4.7GB DVD
28	28,000	0.028	3,500	3.41	0.00334	3,245	24,031
30	30,000	0.03	3,750	3.66	0.00358	3,029	22,429
56	56,000	0.056	7,000	6.83	0.00668	1,622	12,015
80	80,000	0.08	10,000	9.76	0.00954	1,135	8,410
100	100,000	0.1	12,500	12.20	0.01192	908	6,728
150	150,000	0.15	18,750	18.31	0.01788	605	4,485
200	200,000	0.2	25,000	24.41	0.02384	454	3,364
300	300,000	0.3	37,500	36.62	0.03576	302	2,242
500	500,000	0.5	62,500	61.03	0.05960	181	1,345
800	800,000	0.8	100,000	97.65	0.09537	113	841
900	900,000	0.9	112,500	109.86	0.10729	100	747
1,000	1,000,000	1	125,000	122.07	0.11921	90	672
2,000	2,000,000	2	250,000	244.14	0.23842	45	336
4,000	4,000,000	4	500,000	488.28	0.47684	22	168
5,000	5,000,000	5	625,000	610.35	0.59605	18	134
10,000	10,000,000	10	1,250,000	1,220.70	1.19209	9	67
15,000	15,000,000	15	1,875,000	1,831.05	1.78814	6	44
30,000	30,000,000	30	3,750,000	3,662.10	3.57628	3	22

Tacacs Server Configuration in Debian

2011-02-07T09:09:00.002+05:30

Introduction

A TACACS server provides a centralized location for Authentication, Authorization and accounting for Cisco devices. User authentication on Cisco devices can be done in one of 2 ways; via a local database of users on the device, or by a TACACS server. The TACACS model provides additional functionality such as authorizing which commands can be run by the user as well as logging of commands and incidents. This document outlines the installation and configuration of a TACACS+ server (tac-plus) under Linux as well as a list of some of the Cisco IOS configuration commands with basic descriptions.

Server configuration

TACACS Installation

Under Debian the installation is particularly straight forward. The following command will install the tac-plus service:

#apt-get install tac-plus

/usr/sbin/tac_plus -C /etc/tac-plus/tacacs.conf -d 16

The following command shows debugging information of the tac-plus service

tail -f /var/tmp/tac-plus.log

to kill....
kill -USR1 `cat /etc/tac-plus.pid`

To restart...
/etc/init.d/tac-plus restart

Files

/var/log/tac-plus/account.log (must make this file writable)
/var/tmp/tac_plus.log (service logfile)
/etc/init.d/tac-plus (startup script)
/etc/tac-plus/tacacs.conf (users and global settings)
/usr/sbin/tac_plus (executable)

create des encrypted password: htpasswd -n debianhelp

Server Config file

/etc/tac-plus/tacacs.conf

#This user can do anything

user = admins {
    default service = permit
    login = des 70e4lCVGyWSKM
              }

#this user can only run 'show ip' and ‘show interface’ commands

user = users {
    default service = deny
    login = cleartext test
        cmd = show
                {
                permit ip
                permit interface
                deny .*
                }
            }

Router configuration

Each AAA command specified in the router describes the authentication and authorization and the order in which these methods are attempted.
Config for Cisco router

aaa new-model
#Authentication order
aaa authentication login default tacacs+ enable
aaa authentication enable default tacacs+ enable
#For ISDN connections (until tested with TACAcs+ will get to stage where use TACACS then local if unavailable)....
aaa authentication ppp RAS local
aaa authorization exec tacacs+ if-authenticated
#Must have the following 2 lines to explicitly authorize commands
#User level commands will be allowed even if tacacs server unavailable assuming user has been authenticated
aaa authorization commands 1 tacacs+ if-authenticated
{#If TACACS server is unavailable Enable level commands can only be run from a console (e.g. configire terminal, copy cmd etc) }
aaa authorization commands 15 tacacs+ if-authenticated
aaa authorization network tacacs+
#Enable passwd if tacacs server unavailable
aaa accounting exec start-stop tacacs+
aaa accounting commands 1 start-stop tacacs+
aaa accounting commands 15 start-stop tacacs+
aaa accounting network start-stop tacacs+
aaa accounting system start-stop tacacs+
enable password tester

If the tacacs server is unavailable you will be prompted with the standard Cisco login however instead of using a VTY password and an enable password you would use the 'enable' password for both login and to enable to router.

For example:

User Access Verification
Password:
As apposed to :
User Access Verification
Username:

NOTE: Username and password are case-sensitive

The following cmd allows any commands if TACACS unavailable
aaa authorization exec tacacs+ none

Building configuration...

Current configuration:
!
version 11.1
service config
no service udp-small-servers
no service tcp-small-servers
!
hostname tacacstest
!
aaa new-model
aaa authentication login default tacacs+ enable
aaa authentication enable default tacacs+ enable
aaa authentication ppp RAS local
aaa authorization exec tacacs+ if-authenticated
aaa authorization commands 1 tacacs+ if-authenticated
aaa authorization commands 15 tacacs+ if-authenticated
aaa authorization network tacacs+
aaa accounting exec start-stop tacacs+
aaa accounting commands 1 start-stop tacacs+
aaa accounting commands 15 start-stop tacacs+
aaa accounting network start-stop tacacs+
aaa accounting system start-stop tacacs+
enable secret 5 $1$y1cB$sSAl.2azaTPo9GoPO3fp0.

!
!
interface Ethernet0
ip address 192.168.100.58 255.255.255.0
no cdp enable
!
interface Serial0
no ip address
shutdown
no fair-queue
!
interface Serial1
no ip address
shutdown
no cdp enable
!
interface BRI0
no ip address
shutdown
!
no ip classless
ip route 0.0.0.0 0.0.0.0 192.168.100.5
logging buffered
tacacs-server host 172.18.1.2
tacacs-server host 192.168.100.59
!
line con 0
exec-timeout 0 0
password whatever
login authentication conmethod
line aux 0
line vty 0 4
exec-timeout 0 0
!
end

Tacacs+ Install Guide

2011-02-06T10:30:00.001+05:30

Tacacs+ Install Guide
This document try to basicly explain how to install and use tacacs+
It's not prepared very well. I am sorry for this reason.

First off all there are 4 kind of installation methods for tacacs+.These are:
1)First time rpm install
2)Binary packet(rpm) upgrade 
3)src.rpm compile and install 
4)Tarball install

So lets describe it.

1)First time install

When you want to use tacacs+ at your RPM based system. You must use this choice.
It is very easy process.Just do following things:

Get lastest tacacs+ binary rpm file from http://www.gazi.edu.tr/tacacs.
Login as a root or switch user to root.
Type;
 rpm -ivh tac_plus.xxx.i386.rpm

By this command tacacs+ must install your system.

Try to query if tacacs+ correctly install
 rpm -q tac_plus

If this command give a output like :
 tac_plus-F4.0.3.alpha-7

Viola . You succesfully installed tacacs+ :).

Otherwise if not there are some problem either system or tacacs+ packet.
 
2) Binary packet(rpm) upgrade

When you use this choice, tacacs+ rpm must installed your system before.
I haven't add any check to avoid to erase for old config files.

So please backupnecessary files before this operation.

(RPM backup old files but sometimes not)

So only just type:
 rpm -Fvh tac_plus.xxx.i386.rpm

Before upgrade tacacs+ please backup of your config files for all probable error.

3)src.rpm compile and install 

This type of installation are very complicated but i try to figure in basic way
If you want to use tacacs+ other features like db authentication etc. you must 
recompile tacacs+ rpm packet.

So first of all you must get lastest src.rpm file from my site.

Install it by command:
 rpm -ivh tac_plus.xxxx.src.rpm

By this command rpm installed tac_plus files to required location. On Redhat 
systems it's put files to /usr/src/redhat directory.

So find SPEC directory then edit tacacs.spec file

Change configure options for your requirements.

Next try to compile by typing:
 rpm -bb tacacs.spec

If the compiling is success it's write binary rpm to RPMS/i386 directory

Then go back and read stage 1 or 2.

Thats all..
 
4)Tarball install

These section is for other than RPM based systems.

For this type of installation you must get lastest tarball distro from my site 

Then unpack it by command:
 tar zxvf tac_plus_xxx.tgz

Then change directory to unpacked dir
For configure tac_plus type:
 ./configure 
If you like to add more feature like db AA or pam 
 ./configure --help   shows configure options

For compile ;
 make tac_plus

then for installing
 make install or manullay install files

Monitoring hard disk health with smartd under Linux

2011-01-18T12:32:00.002+05:30

smartd is SMART Disk Monitoring Daemon for Linux. SMART is acronym for Self-Monitoring, Analysis and Reporting Technology (SMART) system built into many ATA-3 and later ATA, IDE and SCSI-3 hard drives. The purpose of SMART is to monitor the reliability of the hard drive and predict drive failures, and to carry out different types of drive self-tests.
smartd works with following operating systems:

Linux
*BSD
Windows
Solaris etc

How do I Install smartd?

However, smartd is not installed by default. Following are distribution specific steps to install smartd:
Debian Linux:
# apt-get install smartmontools
Red hat/Fedora Linux:
# rpm –ivh kernel-utils
OR
# up2date kernel-utils
OR if you are using Fedora Linux
# yum kernel-utils
FreeBSD:
# pkg_add -r -v smartmontools
Before configuring hard disk for SMART monitoring make sure your hard disk is SMART capable:
# smartctl -i /dev/hda
Output:

smartctl version 5.34 [i686-pc-linux-gnu] Copyright (C) 2002-5 Bruce Allen
Home page is http://smartmontools.sourceforge.net/

=== START OF INFORMATION SECTION ===
Device Model:     SAMSUNG SV2002H
Serial Number:    0395J1FR904324
Firmware Version: RA100-04
User Capacity:    20,060,651,520 bytes
Device is:        In smartctl database [for details use: -P show]
ATA Version is:   6
ATA Standard is:  ATA/ATAPI-6 T13 1410D revision 1
Local Time is:    Tue May  2 15:44:09 2006 IST

SMART support is: Available - device has SMART capability.
SMART support is: Enabled

You can configure the smartd daemon by editing the file /etc/smartd.conf.

In above output the lines:
SMART support is: Available - device has SMART capability.
SMART support is: Enabled
Indicates that it is SMART capable and it is enabled.

Configure SMARTD

Debian Linux

Enable smart by editing /etc/default/smartmontools file.
Smart Configuration file: /etc/smartd.conf
Start/Stop smart: /etc/init.d/smartmontools start | stop

Red Hat Linux

Enable smart by editing /etc/smartd.conf file.
Smart Configuration file: /etc/smartd.conf
Start/Stop smart: /etc/init.d/smartd start | stop

FreeBSD

Enable smart by editing /etc/rc.conf file (add line smartd_enable=”YES").
Smart Configuration file: /etc/smartd.conf
Start/Stop smart: /usr/local/etc/rc.d/smartd.sh start | stop

Example

You can put following directives in Smart Configuration file:
(a) Send an email to alert@nixcraft.in for /dev/sdb:
/dev/sdb -m alert@nixcraft.in
(b) Read error log:
# smartctl -l error /dev/hdb
(c) Testing hard disk (short or long test):
# smartctl -t short /dev/hdb
# smartctl -t long /dev/hdb
Caution smartd is a monitoring tool not a backup solution. Always perform data backup.

Using TCP Wrappers to secure Linux

2011-01-12T10:38:00.002+05:30

TCP Wrappers can be used to GRANT or DENY access to various services on your machine to the outside network or other machines on the same network. It does this by using simple Access List Rules which are included in the two files /etc/hosts.allow and /etc/hosts.deny .

Let us consider this scenario: A remote machine remote_mc trying to connect to your local machine local_mc using ssh.

When the request from the remote_mc is received by the tcp wrapped service (SSH in this case), it takes the following basic steps:

It checks the /etc/hosts.allow file and applies the first rule specified for that service. If it finds a matching rule , it allows the connection. If no rule is found, it moves on to step 2.
It checks the /etc/hosts.deny file and if a matching rule is found, it deny's the connection.

Points to remember

Rules in hosts.allow takes precedence over rules in hosts.deny . Which means if a matching rule is found in hosts.allow file, the remote_mc is allowed access to the service even if there is a matching deny rule in hosts.deny file.
You can have only one rule per service in hosts.allow and hosts.deny file.
If there are no matching rules in either of the files or if the files don't exist, then the remote_mc is allowed access to the service.
Any changes to hosts.allow and hosts.deny file takes immediate effect.

Rule Syntax
The syntax for both hosts.allow and hosts.deny file takes the following form:

daemon : client [:option1:option2:...]

Where daemon can be a combination of ssh daemon, ftp daemon, portmap daemon and so on. Basically any service which has support for libwrap.a library compiled into it is a good candidate for utilizing the services of TCP Wrappers.

client is a comma separated list of hostnames, host IP addresses, special patterns or special wildcards which identify the hosts effected by that rule.

options is an optional action like say sending mail to the administrator when this rule is matched, log to a particular file and so on. It can be a colon separated list of actions too.

Examples of using TCP Wrappers

I want to allow SSH access to hosts in a particular domain say xyz.com and deny access to all the others. I enter the following rule in the hosts.allow file.

sshd : .xyz.com

... and in the hosts.deny file I include the rule:

sshd : ALL

The next rule denys FTP access to all the hosts in the abc.co.in domain as well as hosts in the 192.168.1.0 network.


#FILE: /etc/hosts.deny
vsftpd : 192.168.1. , .abc.co.in : spawn /bin/echo  `/bin/date` access denied >> /var/log/vsftpd.log : deny

The backslash (\) in the above rule is used to break the line and prevents the failure of the rule due to length.

spawn and deny are options. Spawn launches a shell command as a child process. In the above rule, spawn logs a message to the vsftpd log file each time the rule matches. deny is optional if you are including this rule in the hosts.deny file.

Note: The last line in the files hosts.allow and hosts.deny must be a new line character. Or else the rule will fail.

For example, you can use spawn option to send mail to the admin when ever a deny rule is matched.

Wildcards

You can use wildcards in the client section of the rule to broadly classify a set of hosts. These are the valid wildcards that can be used.

ALL - Matches everything
LOCAL - Matches any host that does not contain a dot (.) like localhost.
KNOWN - Matches any host where the hostname and host addresses are known or where the user is known.
UNKNOWN - Matches any host where the hostname or host address are unknown or where the user is unknown.
PARANOID - Matches any host where the hostname does not match the host address.

Patterns
You can also use patterns in the client section of the rule . Some examples are as follows:


ALL : .xyz.com

Matches all hosts in the xyz.com domain . Note the dot (.) at the beginning.


ALL : 123.12.

Matches all the hosts in the 123.12.0.0 network. Note the dot (.) in the end of the rule.


ALL : 192.168.0.1/255.255.255.0

IP address/Netmask can be used in the rule.


ALL : *.xyz.com

Asterisk * matches entire groups of hostnames or IP addresses.


sshd : /etc/sshd.deny

If the client list begins with a slash (/), it is treated as a filename. In the above rule, TCP wrappers looks up the file sshd.deny for all SSH connections.


sshd : ALL EXCEPT 192.168.0.15

If the above rule is included in the /etc/hosts.deny file, then it will allow ssh connection for only the machine with the IP address 192.168.0.15 and block all other connections. Here EXCEPT is an operator.

Note: If you want to restrict use of NFS and NIS then you may include a rule for portmap . Because NFS and NIS depend on portmap for their successful working. In addition, changes to portmap rules may not take effect immediately.

Suppose I want to log all connections made to SSH with a priority of emergency. See my previous post to know more on logging. I could do the following:


sshd : .xyz.com : severity emerg

Note: You can use the options allow or deny to allow or restrict on a per client basis in either of the files hosts.allow and hosts.deny


in.telnetd : 192.168.5.5 : deny
in.telnetd : 192.168.5.6 : allow

Shell Commands

As mentioned above, you can couple the rules to certain shell commands by using the following two options.

spawn - This option launches a shell command as a child process. For example, look at the following rule:


sshd : 192.168.5.5 : spawn /bin/echo `/bin/date` from %h >> /var/log/ssh.log : deny

Each time the rule is satisfied, the current date and the clients hostname %h is appended to the ssh.log file.

twist - This is an option which replaces the request with the specified command. For example, if you want to send to the client trying to connect using ssh to your machine, that they are prohibited from accessing SSH, you can use this option.


sshd : client1.xyz.com : twist /bin/echo "You are prohibited from accessing this service!!" : deny

When using spawn and twist, you can use a set of expressions. They are as follows :
%a — The client's IP address.
%A — The server's IP address.

%c — Supplies a variety of client information, such as the username and hostname, or the username and IP address.

%d — The daemon process name.
%h — The client's hostname (or IP address, if the hostname is unavailable).
%H — The server's hostname (or IP address, if the hostname is unavailable).

%n — The client's hostname. If unavailable, unknown is printed. If the client's hostname and host address do not match, paranoid is printed.

%N — The server's hostname. If unavailable, unknown is printed. If the server's hostname and host address do not match, paranoid is printed.

%p — The daemon process ID.

%s — Various types of server information, such as the daemon process and the host or IP address of the server.

%u — The client's username. If unavailable, unknown is printed.

Automatically rotating your Log Files

2011-01-12T09:43:00.000+05:30

Uncontrolled growing of log files may fill up important filesystems like /var. One, not documented features under Linux is logrotate, which belongs to the standard RedHat Linux distribution.
Logrotate is designed to ease administration of systems that generate large numbers of log files. It allows automatic rotation, compression, removal, and mailing of log files. Each log file may be handled daily, weekly, monthly, or when it grows too large. Normally, logrotate is run as a daily cron job. It will not modify a log multiple times in one day unless the criterium for that log is based on the log’s size and logrotate is being run multiple times each day, or unless the -f or -force option is used.
Any number of config files may be given on the command line. Later config files may override the options given in earlier files, so the order in which the logrotate config files are listed in is important. Normally, a single config file which includes any other config files which are needed should be used.

The configuration file for logrotate can be found in /etc/logrotate.conf
# rotate log files daily
daily

# keep 1 day of backlogs
rotate 1

# send errors to
errors martin dot zahn at akadia dot ch

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own lastlog or wtmp -- we'll rotate them here
/var/log/wtmp {
monthly
create 0664 root utmp
rotate 1
}
Included Files from /etc/logrotate.d (e.g. apache)
/var/log/httpd/akadia.log {
missingok
postrotate
    /bin/kill -HUP `cat /var/run/httpd.pid 2>/dev/null`
    2> /dev/null || true
endscript
}

/var/log/httpd/error.log {
missingok
postrotate
    /bin/kill -HUP `cat /var/run/httpd.pid 2>/dev/null`
    2> /dev/null || true
endscript
}
For more information type the following commands:
# man logrotate
# man logrotate | col -b > logrotate.txt
# man -t logrotate > logrotate.ps

Postfix -- the Sendmail Replacement

2011-01-12T09:38:00.000+05:30

Architecture

Some mail systems such as Sendmail are implemented as one large monolithic program that does everything. One large program certainly makes it easy to share data between different parts of the system. Unfortunately, one large program also makes it easy to make fatal mistakes.
Postfix is based on semi-resident, mutually-cooperating, processes that perform specific tasks for each other, without any particular parent-child relationship. Postfix is implemented as a resident master server that runs Postfix daemon processes on demand: daemon processes to send or receive network mail messages, daemon processes to deliver mail locally. Postfix is intended to be a sendmail replacement. For this reason it tries to be compatible with existing infrastructure.

Mail queues

Postfix has four different queues: maildrop, incoming, active and deferred. Locally-posted mail is deposited into the maildrop, and is copied to the incoming queue after some cleaning up. The incoming queue is for mail that is still arriving or that the queue manager hasn't looked at yet. The active queue is a limited-size queue for mail that the queue manager has opened for delivery. Mail that can't be delivered goes to the deferred queue, so that it does not get in the way of other deliveries.
The queue manager qmgr keeps information in memory about the active queue only. The active queue size is limited on purpose: the queue manager should never run out of working memory because of a peak message workload. Whenever there is space in the active queue, the queue manager lets in one message from the incoming queue and one from the deferred queue. This guarantees that new mail will get through even when there is a large backlog.

Sendmail

The sendmail program implements the Postfix to Sendmail compatibility interface. For the sake of compatibility with existing applications, some Sendmail command-line options are recognized but silently ignored.
By default, sendmail reads a message from standard input until EOF or until it reads a line with only a . character, and arranges for delivery. sendmail attempts to create a queue file in the maildrop directory. The command mailq List the mail queue. Each entry shows the queue file ID, message size, arrival time, sender, and the recipients that still need to be delivered. The command newaliases initialize the alias database.

Sending local email with the sendmail interface.

Suppose, you have the following file to_akadia .....
From:
To:
Subject: This is a Postfix Sendmail Test

This message is sent with the sendmail front end from the postfix mail system

-- Regards Martin
.... then you can send this local email in the known sendmail syntax as follows:
# cat to_akadia | /usr/sbin/sendmail -t -bm -v
sendmail: open maildrop/746D52C01F

Show the mail queue

# mailq or sendmail -bp

Initialize the alias database

# newaliases or sendmail -bi

Pickup

The pickup daemon waits for hints that new mail has been dropped into the world-writable maildrop directory, and feeds it into the cleanup daemon. This program expects to be run from the master process manager. The pickup daemon does not interact with the outside world. It daemon runs with superuser privileges so that it 1) can open a queue file with the rights of the submitting user and 2) can access the Postfix private IPC channels. Pickup does some sanity checks, in order to protect the rest of the Postfix system.

Smtpd

The SMTP server accepts network connection requests and performs zero or more SMTP transactions per connection. Each received message is piped through the cleanup daemon, and is placed into the incoming queue as one single queue file. For this mode of operation, the program expects to be run from the master process manager. Alternatively, the SMTP server takes an established connection on standard input and deposits messages directly into the maildrop queue. In this so-called stand-alone mode, the SMTP server can accept mail even while the mail system is not running.

Cleanup

The cleanup daemon implements the final processing stage for new mail. It adds missing From: and other message headers, arranges for address rewriting to the standard user@fully.qualified.domain form, and optionally extracts recipient addresses from message headers. The cleanup daemon inserts the result as a single queue file into the incoming queue, and notifies the queue manager of the arrival of new mail. The cleanup daemon can be configured to transform addresses on the basis of canonical and virtual table lookups.
On request by the cleanup daemon, the trivial-rewrite daemon rewrites addresses to the standard user@fully.qualified.domain form. The initial Postfix version does not implement a rewriting language. Implementing one would take a lot of effort, and most sites do not need it. Instead, Postfix makes extensive use of table lookups.

Qmgr

The queue manager is the heart of the Postfix mail system. It contacts the local, smtp, or pipe delivery agents, and sends a delivery request with queue file pathname information, the message sender address, the host to deliver to if the destination is remote, and one or more message recipient addresses.
The queue manager maintains a separate deferred queue for mail that cannot be delivered, so that a large mail backlog will not slow down normal queue accesses.
The queue manager maintains a small active queue with just the few messages that it has opened for delivery. The active queue acts as a limited window on the potentially much larger incoming or deferred queues. The small active queue prevents the queue manager from running out of memory under heavy load.
Optionally, the queue manager bounces mail for recipients that are listed in the relocated table. This table contains contact information for users or even entire domains that no longer exist.

Resolve

On request by the queue manager, the resolve daemon resolves destinations. By default, it only distinguishes between local and remote destinations. Additional routing information can be specified with the optional transport table.

Bounce and Defer

On request by the queue manager, the bounce or defer daemon generates non-delivery reports when mail cannot be delivered, either due to an unrecoverable error or because the destination is unreachable for an extended period of time.

Local

The local delivery agent understands UNIX-style mailboxes, sendmail-style system-wide alias databases, and sendmail-style per-user .forward files. Multiple local delivery agents can be run in parallel, but parallel delivery to the same user is usually limited. Together with the sendmail mail posting agent, the local delivery agent implements the familiar Sendmail user interface.
The local delivery agent has hooks for alternative forms of local delivery: you can configure it to deliver to mailbox files in user home directories, and you can even configure it to delegate mailbox delivery to an external command such as the popular procmail program.

Smtp

The SMTP client looks up a list of mail exchangers for the destination host, sorts the list by preference, and tries each address in turn until it finds a server that responds. On a busy Postfix system you will see several SMTP client processes running in parallel.

Pipe

The pipe mailer is the outbound interface to other mail transports (the sendmail program is the inbound interface) such as UUCP.

Basic Postfix Configuration

All of the many configuration parameters can be found in the main.cf file, located in the ./conf directory in the postfix source. You need not change every parameter, as they are set to sensible defaults. Here are the details on some of the more important parameters, which will affect the performance of Postfix the most. Please note that if you change the main.cf file after installation, you must issue the postfix reload command.
# postconf -d (Show default values)
# postconf -n (Show non default values)

Basic Parameters

queue_directory - the location of the Postfix queue as well as the root dir of the postfix daemons that run chrooted. This field should be left with the default /var/spool/postfix.

# Mail Queue
queue_directory = /usr/local/postfix/spool

daemon_directory - the location of the daemon programs such as smptd, pickup, cleanup, etc.

# Daemon Directory
daemon_directory = /usr/local/postfix/bin

mail_owner - the owner of Postfix's queue and most of the daemon processes. For this you must add a user to your machine, this has to be a user that owns no other files or processes (so using nobody here is a very bad idea for security reasons).

# Mail Owner
mail_owner = postfix

myorigin - the origin is set to $myhostname by default, which defaults to the local hostname of the machine. This should not be used unless you are running a very small site. Most people want to change myorigin to $mydomain which will default to the parent domain of the machine name (i.e. if the hostname is rabbit.akadia.com and you are using $myhostname, the origin will be rabbit.akadia.com. On the other hand if you were using $mydomain, the origin will be akadia.com.)

# My own domain name
mydomain = akadia.com
# What domain to use in outbound mail
myorigin = $mydomain

inet_interfaces - the inet_interfaces parameter defines which network interface addresses that the stmp daemon will listen on. By default this is set to all, which will listen on any active interface on the machine. This will control the delivery to users@.

# Listen to
inet_interfaces = all

mydestination - this parameter specifies the list of domains that the machine considers itself. The default of $myhostname and localhost.$mydomain should do here. Don't specify the virtual domains that are hosted on the machine here!

# What domains to receive mail for
mydestination = $myhostname, localhost.$mydomain

mailbox_command - this parameter defines the external command to use instead of local mailbox delivery. It is a completely optional parameter. If you're interested in having procmail to do your mail, this is where you set it.
mynetworks - mynetworks specifies a certain list of network addresses that are local to this machine. The list is used to distinguish lusers from strangers. The addresses go in the format of X.X.X.0/X and can be separated by a comma. By default the list of all of the networks attached to the machine is a complete class A network (X.0.0.0/8), a complete class B network (X.X.0.0/16), a complete class C network (X.X.X.0/24), and so on. You can also specify a path of a pattern file instead of listing the patterns here.

# Accept Mail only from
mynetworks = 192.168.32.32/32, 195.65.134.0/26, 127.0.0.0/8

notify_classes - You should set up a postmaster alias that points to a human person. This alias is required to exist, so that people can report mail delivery problems. The Postfix system itself also reports problems to the postmaster alias. You may not be interested in all types of trouble reports, so this reporting mechanism is configurable. The default is to report only serious problems (resource, software) to postmaster:
# Notify Errors to
notify_classes = bounce,delay,policy,protocol,
resource,software

Address Manipulation with Postfix

Although the initial Postfix release has no address rewriting language, it can do quite a bit of address manipulation via table lookup. While a message flows through the Postfix system, its addresses are mangled in the order described in this document. Unless indicated otherwise, all parameters described here are in the main.cf file. If you change parameters of a running Postfix system, don't forget to issue a postfix reload command.

Canonical address mapping

Address masquerading

Virtual address mapping

Relocated users table

Mail transport switch

Canonical address mapping

Before the cleanup daemon stores inbound mail into the incoming queue, it uses the canonical table to rewrite all addresses in message envelopes and in message headers, local or remote. The mapping is useful to replace login names by Firstname.Lastname style addresses, or to clean up invalid domains in mail addresses produced by legacy mail systems. In addition to the canonical maps which are applied to both sender and recipient addresses, you can specify canonical maps that are applied only to sender addresses or to recipient addresses. For example:

sender_canonical_maps = hash:/etc/postfix/sender_canonical
recipient_canonical_maps = hash:/etc/postfix/recipient_canonical

The sender and recipient canonical maps are applied before the common canonical maps.
Sender-specific rewriting is useful when you want to rewrite ugly sender addresses to pretty ones, and still want to be able to send mail to the those ugly address without creating a mailer loop.

You are a dial-up with the local name "zahn@saphir" and you want to convert this address to "martin dot zahn at akadia dot ch", so the ISP will accept the name. Enter the following line in /usr/local/postfix/etc/canonical:

zahn@saphir martin dot zahn at akadia dot ch
Canonical mapping is disabled by default. To enable, edit the canonical_maps parameter in the main.cf file and specify one or more lookup tables, separated by whitespace or commas. For example:

canonical_maps = hash:/usr/local/postfix/etc/canonical
Be sure to run
# postmap /usr/local/postfix/etc/canonical
# postfix reload

Important Note

For canonical address mapping the address must not be a local user as it is in Alias mapping

Address masquerading

Address masquerading is a method to hide all hosts below a domain behind their mail gateway, and to make it appear as if the mail comes from the gateway itself, instead of from individual machines.
Address masquerading is disabled by default. To enable, edit the masquerade_domains parameter in the main.cf file and specify one or more domain names separated by whitespace or commas. For example:
masquerade_domains = $mydomain, akadia.ch
In this example, addresses of the form martin.zahn@rabbit.akadia.com would be rewritten to martin dot zahn at akadia dot ch.
The masquerade_exceptions configuration parameter specifies what user names should not be subjected to address masquerading. Specify one or more user names separated by whitespace or commas. For example, masquerade_exceptions = root. By default, Postfix makes no exceptions.

Important Note

Address masquerading is applied only to message headers and envelope sender addresses, not to envelope recipients, envelope addresses can be manipulated with virtual address mapping ... see next section.

Virtual address mapping

After applying the canonical and masquerade mappings, the cleanup daemon uses the virtual table to redirect mail for all recipients, local or remote. Virtual lookups are useful to redirect mail for virtual domains to real user mailboxes, and to redirect mail for domains that no longer exist. Virtual lookups can also be used to transform Firstname.Lastname back into UNIX login names, although it seems that local aliases are a more appropriate vehicle.
virtual_alias_maps = hash:$config_directory/virtual
virtual_alias_domains = $virtual_alias_maps

Important Note

Virtual address mapping is applied only to envelope recipients; it has no effect on message headers or envelope senders, message headers and envelope sender addresses can be manipulated with address masquerading ... see previous section.

Virtual Table
The first line in the virtual table describes the virtual domain. This line is necessary to avoid
Postfix does not refuse mail for unknown virtual users.

Mail for unknown virtual users fails with "mail loops back to myself".

Postfix refuses mail for virtual domains with "user unknown".

Postfix refuses mail for virtual domains with "relay access denied".

The left part of the next lines defines the E-Mail address which should be forwarded, the right part are local users or external E-Mail addresses.
Example of /etc/postfix/virtual for individual addresses
arkum.ch              My Virtual Domain
info@arkum.ch         info@akadia.ch, martin dot zahn at akadia dot ch
zahn@arkum.ch         zahn_martin@hotmail.com
Example of /etc/postfix/virtual if all addresses should be transparently forwared
arkum.ch              My Virtual Domain
@arkum.ch             @akadia.com
The second line defines, that all E-Mail for ARKUM.CH should be forwarded to AKADIA.COM

Relocated users table

Next, the queue manager runs each recipient name through the relocated database. This table provides information on how to reach users that no longer have an account, or what to do with mail for entire domains that no longer exist. When mail is sent to an address that is listed in this table, the message is bounced with an informative message.
Lookups of relocated users are disabled by default. To enable, edit the relocated_maps parameter in the main.cf file and specify one or more lookup tables, separated by whitespace or commas.
relocated_maps = hash:/etc/postfix/relocated
Example of /etc/postfix/relocated
hans.mueller@infoline.ch Hans Mueller has left

Alias database

When mail is to be delivered locally, the local delivery agent runs each local recipient name through the aliases database. The mapping does not affect addresses in message headers. Local aliases are typically used to implement distribution lists, or to direct mail for standard aliases such as postmaster to real people. The table can also be used to map Firstname.Lastname addresses to login names. Alias lookups are enabled by default. The default configuration depends on the system environment, but it is typically one of the following:
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
The path to the alias database file is controlled via the alias_database configuration parameter. The value is system dependent. Usually it is one of the following:
Example of /etc/aliases
# Postfix User
postfix: root
# Person who should get root's mail
root: martin dot zahn at akadia dot ch

Mail transport switch (Mail Proxy, Mail Gateway)

Once the queue manager has established the destination of a message, the optional transport table controls how the message will be delivered (this table is used by the address rewriting and resolving daemon). By default, everything is sent via the smtp transport. The transport table can be used to send mail to a mail server in the HSZ, in this case we implement a mail gateway (proxy) in the DMZ.
Transport table lookups are disabled by default. To enable, edit the transport_maps parameter in the main.cf file and specify one or more lookup tables, separated by whitespace or commas.
transport_maps = hash:/etc/postfix/transport
Example of /etc/postfix/transport
arkum.ch             smtp:[192.168.32.32]
.arkum.ch            smtp:[192.168.32.32]
paragon.akadia.com   local:
localhost.akadia.com local:
The first line (arkum.ch) forwards all E-Mails user@arkum.ch the internal E-Mail server on 192.168.32.32. The second line is used to forward E-Mails for user@firewall to 192.168.32.32. Do not omit the entries that deliver mail locally, or else mail will bounce with a "mail loops to myself" condition.

Keeping out Unsolicited Commercial E-mail

Junk mail is one of the most common and annoying types of e-mail abuse. Postfix offers protection against UCE (Unsolicited Commercial E-mail) via a couple of settings in main.cf. Some caution is in order, however: there's a fine line between spam and legitimate dissemination, and it's entirely possible that even modest UCE controls will cause some legitimate (i.e., desired) mail to be dropped.
See more information here

Postfix Installation

Download

Download Source for http://www.postfix.org
# gunzip postfix-2.2.0.tar.gz
# tar xvf postfix-2.2.0.tar
# cd postfix-2.2.0
# make makefiles CCARGS='-DDEF_CONFIG_DIR=\"/usr/local/postfix/etc\"'
# For Postfix 1.1.x
# make makefiles CCARGS=-DDEF_CONFIG_DIR=
\\\\\\\"/usr/local/postfix/etc\\\\\\\"
# make
This will install Postfix in /usr/local/postfix, and therefore no conflicts with an existing sendmail configuration will happen.

Configuration

If you are replacing an existing sendmail installation with Postfix, you may need to keep the old sendmail program running for some time in order to flush the mail queue. As superuser,
execute the following commands (your sendmail, newaliases and mailq programs may be in a different place).
# mv /usr/sbin/sendmail /usr/sbin/sendmail.OFF
# mv /usr/bin/newaliases /usr/bin/newaliases.OFF
# mv /usr/bin/mailq /usr/bin/mailq.OFF
# chmod 755 /usr/sbin/sendmail.OFF /usr/bin/newaliases.OFF
/usr/bin/mailq.OFF
In order to install or upgrade Postfix
Create a user "postfix" with a unique user id and group id. Preferably, this is an account that no-one can log into. The account does not need an executable login shell, and needs no existing home directory.
postfix:*:12345:12345:postfix:/no/where:/no/shell
Make sure there is a corresponding alias in /etc/aliases
postfix: root
Create a group "postdrop" with a group id that is not used by any other user account. Not even by the postfix user account.

postdrop:*:54321:
Run the "make install" script as the super-user
# make install
install_root: [/] /
tempdir: /tmp
config_directory: /usr/local/postfix/etc
daemon_directory: /usr/local/postfix/bin
command_directory: /usr/local/postfix/sbin
queue_directory: /usr/local/postfix/spool
sendmail_path: /usr/local/postfix/sendmail/sendmail
newaliases_path: /usr/local/postfix/sendmail/newaliases
mailq_path: /usr/local/postfix/sendmail/mailq
mail_owner: postfix
setgid_group: postdrop
manpages: /usr/local/postfix/man
sample_directory: /usr/local/postfix/sample
readme_directory: /usr/local/postfix/readme
Copy /etc/aliases to /usr/local/postfix/etc
# cd /usr/local/postfix/sendmail
# ./newaliases

Important Commands

postconf mail_version	Find out what Postfix Version is installed
mailq	Show Mail Queue
postsuper -d ALL	Remove bounced mail from the queue.
postfix flush	Flush the Mail Queue
postfix check	Check Installation
telnet mail-abuse.org	Test your own Mailserver against attacks.

How to check your mailserver against attacks

The delivery of unsolicited commercial email (UCE) must be avoided on a secure mailserver. But how to check the mailserver against relaying and attacks? Abuse.org offers a public mailserver, which can be used to check the own mailserver.

Login to your mailserver

Execute: telnet mail-abuse.org

Now you can see, how your system will be attacked and how secure it is.
Escape character is '^]'.
<<< 220 SMTP service ready
>>> HELO dante.mail-abuse.org
<<< 250 Requested mail action okay, completed
:Relay test: #Test 1
>>> mail from:
<<< 250 Requested mail action okay, completed
>>> rcpt to:
<<< 554 Transaction failed
>>> rset
<<< 250 Requested mail action okay, completed
:Relay test: #Test 2
.....
.....
<<< 250 Requested mail action okay, completed
>>> QUIT
<<< 221 SMTP server closing transmission channel
Tested host banner: 220 SMTP service ready

System appeared to reject relay attempts

Typical Configurations

Postfix Mailbox Host in the DMZ

Email is saved on the Postfix Mailbox Host, located in the DMZ. All clients get their E-Mail using POP or IMAP. All clients uses the Mailbox Host as their Relay-Host. The Mailbox Host delivers E-Mail directly to the recipient using DNS and SMTP. The disadvantage of this solution is, that the Mailboxes are located in the DMZ.

postfix_root = /usr/local/postfix
config_directory = $postfix_root/etc
queue_directory = $postfix_root/spool
program_directory = $postfix_root/sbin
command_directory = $program_directory
daemon_directory = $postfix_root/bin
mail_owner = postfix
mydomain = akadia.com
myorigin = $mydomain
mydestination = $myhostname, localhost.$mydomain,
                $mydomain, akadia.ch, arkum.ch
relayhost =
masquerade_domains = $mydomain
alias_maps = hash:$config_directory/aliases
alias_database = hash:$config_directory/aliases
notify_classes = bounce,delay,policy,protocol,resource,software
mynetworks = 193.247.121.192/28, 192.168.138.0/24, 127.0.0.0/8
maps_rbl_domains = rbl.maps.vix.com
smtpd_client_restrictions =
        permit_mynetworks,
        check_client_access hash:$config_directory/access,
        reject_maps_rbl

Postfix Host inside the Intranet (on HSZ)

Email is saved on the Postfix Mailbox Host, located in the DMZ. All clients get their E-Mail using POP or IMAP. This example shows how to configure a Postfix Client in the HSZ, which delivers all Mail to the Relayhost 193.247.121.196.

postfix_root = /usr/local/postfix
config_directory = $postfix_root/etc
queue_directory = $postfix_root/spool
program_directory = $postfix_root/sbin
command_directory = $program_directory
daemon_directory = $postfix_root/bin
mail_owner = postfix
mydomain = akadia.com
myorigin = $mydomain
mydestination = $myhostname, localhost.$mydomain,
$mydomain, akadia.ch, arkum.ch
relayhost = $mydomain
masquerade_domains = $mydomain
transport_maps = hash:$config_directory/transport
alias_maps = hash:$config_directory/aliases
alias_database = hash:$config_directory/aliases
notify_classes = bounce,delay,policy,protocol,resource,software
mynetworks = 192.168.138.0/24, 127.0.0.0/8
smtpd_client_restrictions = permit_mynetworks

akadia.com             smtp:[193.247.121.196]
.akadia.com            smtp:[193.247.121.196]
akadia.ch              smtp:[193.247.121.196]
.akadia.ch             smtp:[193.247.121.196]
arkum.ch               smtp:[193.247.121.196]
.arkum.ch              smtp:[193.247.121.196]
paragon                local:
paragon.akadia.com     local:
localhost.akadia.com   local:

Postfix as a Proxy Mailhost in the DMZ

Email is saved on the Postfix Mailbox Host (192.168.138.10), located in the HSZ. The Postfix Mail-Proxy (193.247.121.196) forwards all E-Mail to the Mailbox Host in the HSZ. All clients get their E-Mail using POP or IMAP from the Mailbox Host in the HSZ. All clients use the Mail-Proxy as their Relay-Host. The Mail-Proxy delivers E-Mail directly to the recipient using DNS and SMTP. The advantage of this solution is, that the Mailboxes are located in the HSZ, therefore we suggest to use this architecture.

postfix_root = /usr/local/postfix
config_directory = $postfix_root/etc
queue_directory = $postfix_root/spool
program_directory = $postfix_root/sbin
command_directory = $program_directory
daemon_directory = $postfix_root/bin
mail_owner = postfix
mydomain = akadia.com
myorigin = $mydomain
mydestination = $myhostname, localhost.$mydomain,
$mydomain, akadia.ch, arkum.ch
relayhost =
masquerade_domains = $mydomain
transport_maps = hash:$config_directory/transport
alias_maps = hash:$config_directory/aliases
alias_database = hash:$config_directory/aliases
notify_classes = bounce,delay,policy,protocol,resource,software
mynetworks = 193.247.121.192/28, 192.168.138.0/24, 127.0.0.0/8
smtpd_client_restrictions = permit_mynetworks

akadia.com             smtp:[192.168.138.10]
.akadia.com            smtp:[192.168.138.10]
akadia.ch              smtp:[192.168.138.10]
.akadia.ch             smtp:[192.168.138.10]
arkum.ch               smtp:[192.168.138.10]
.arkum.ch              smtp:[192.168.138.10]

Postfix as a Multi Domain Mail-Host (for ISPs)

If you want to server multiple domains, then Postfix is the right tool. Use the virtual table to configure the domains.

The optional virtual table specifies redirections for local and non-local recipients or domains. The redirections are used by the cleanup daemon. The redirections are recursive. The virtual redirection is applied only to the recipient envelope address, and does not affect message headers. Think Sendmail rule set S0, if you like. Use canonical mapping to rewrite header and envelope addresses in general.

postfix_root = /usr/local/postfix
config_directory = $postfix_root/etc
queue_directory = $postfix_root/spool
program_directory = $postfix_root/sbin
command_directory = $program_directory
daemon_directory = $postfix_root/bin
mail_owner = postfix
mydomain = akadia.com
myorigin = $mydomain
mydestination = $myhostname, localhost.$mydomain, $mydomain,
$config_directory/localdomains
relayhost =
masquerade_domains = $mydomain
virtual_maps = hash:$config_directory/virtual
alias_maps = hash:$config_directory/aliases
alias_database = hash:$config_directory/aliases
notify_classes = bounce,delay,policy,protocol,resource,software
mynetworks = 193.247.121.192/28, 192.168.138.0/24, 127.0.0.0/8
smtpd_client_restrictions = permit_mynetworks

The "localdomains" file is not mapped or hashed. It uses plain text, one listing per line. It's equivalent to class w with sendmail.

akadia.com
akadia.ch
arkum.com
arkum.ch
bohl.ch
bohl.com

Typical support for a virtual domain looks like the following:

virtual.domain                  Description for the Domain
postmaster@virtual.domain       postmaster
user1@virtual.domain            address1
user2@virtual.domain            address2, address3

#
# Domain AKADIA.CH
#
akadia.ch                  Virtual Domain for Akadia
martin.zahn@akadia.ch      zahn@akadia.com,zahn@hotmail.com
info@akadia.ch             zahn@akadia.com
marianne.zahn@akadia.ch    pmz@akadia.com
#
# Forward transparently all address for ARKUM.CH to AKADIA.COM
#
arkum.ch                   Virtual Domain for Akadia
@arkum.ch                  @akadia.com
#
# Domain BOHL.CH
#
bohl.ch                    Virtual Domain for employee
info@bohl.ch               bohl@akadia.com

20 Linux Server Hardening Security Tips

2011-01-12T09:20:00.000+05:30

Securing your Linux server is important to protect your data, intellectual property, and time, from the hands of crackers (hackers). The system administrator is responsible for security Linux box. In this first part of a Linux server security series, I will provide 20 hardening tips for default installation of Linux system.

#1: Encrypt Data Communication

All data transmitted over a network is open to monitoring. Encrypt transmitted data whenever possible with password or using keys / certificates.

Use scp, ssh, rsync, or sftp for file transfer. You can also mount remote server file system or your own home directory using special sshfs and fuse tools.
GnuPG allows to encrypt and sign your data and communication, features a versatile key managment system as well as access modules for all kind of public key directories.
Fugu is a graphical frontend to the commandline Secure File Transfer application (SFTP). SFTP is similar to FTP, but unlike FTP, the entire session is encrypted, meaning no passwords are sent in cleartext form, and is thus much less vulnerable to third-party interception. Another option is FileZilla - a cross-platform client that supports FTP, FTP over SSL/TLS (FTPS), and SSH File Transfer Protocol (SFTP).
OpenVPN is a cost-effective, lightweight SSL VPN.
Lighttpd SSL (Secure Server Layer) Https Configuration And Installation
Apache SSL (Secure Server Layer) Https (mod_ssl) Configuration And Installation

#1.1: Avoid Using FTP, Telnet, And Rlogin / Rsh

Under most network configurations, user names, passwords, FTP / telnet / rsh commands and transferred files can be captured by anyone on the same network using a packet sniffer. The common solution to this problem is to use either OpenSSH , SFTP, or FTPS (FTP over SSL), which adds SSL or TLS encryption to FTP. Type the following command to delete NIS, rsh and other outdated service:
# yum erase inetd xinetd ypserv tftp-server telnet-server rsh-serve

#2: Minimize Software to Minimize Vulnerability

Do you really need all sort of web services installed? Avoid installing unnecessary software to avoid vulnerabilities in software. Use the RPM package manager such as yum or apt-get and/or dpkg to review all installed set of software packages on a system. Delete all unwanted packages.

# yum list installed

# yum list packageName

# yum remove packageName

# dpkg --list

# dpkg --info packageName

# apt-get remove packageName

#3: One Network Service Per System or VM Instance

Run different network services on separate servers or VM instance. This limits the number of other services that can be compromised. For example, if an attacker able to successfully exploit a software such as Apache flow, he / she will get an access to entire server including other services such as MySQL, e-mail server and so on. See how to install Virtualization software:

#4: Keep Linux Kernel and Software Up to Date

Applying security patches is an important part of maintaining Linux server. Linux provides all necessary tools to keep your system updated, and also allows for easy upgrades between versions. All security update should be reviewed and applied as soon as possible. Again, use the RPM package manager such as yum and/or apt-get and/or dpkg to apply all security updates.
# yum update
OR
# apt-get update && apt-get upgrade
You can configure Red hat / CentOS / Fedora Linux to send yum package update notification via email. Another option is to apply all security updates via a cron job. Under Debian / Ubuntu Linux you can use apticron to send security notifications.

#5: Use Linux Security Extensions

Linux comes with various security patches which can be used to guard against misconfigured or compromised programs. If possible use SELinux and other Linux security extensions to enforce limitations on network and other programs. For example, SELinux provides a variety of security policies for Linux kernel.

#5.1: SELinux

I strongly recommend using SELinux which provides a flexible Mandatory Access Control (MAC). Under standard Linux Discretionary Access Control (DAC), an application or process running as a user (UID or SUID) has the user's permissions to objects such as files, sockets, and other processes. Running a MAC kernel protects the system from malicious or flawed applications that can damage or destroy the system. See the official Redhat documentation which explains SELinux configuration.

#6: User Accounts and Strong Password Policy

Use the useradd / usermod commands to create and maintain user accounts. Make sure you have a good and strong password policy. For example, a good password includes at least 8 characters long and mixture of alphabets, number, special character, upper & lower alphabets etc. Most important pick a password you can remember. Use tools such as "John the ripper" to find out weak users passwords on your server. Configure pam_cracklib.so to enforce the password policy.

#6.1: Password Aging

The chage command changes the number of days between password changes and the date of the last password change. This information is used by the system to determine when a user must change his/her password. The /etc/login.defs file defines the site-specific configuration for the shadow password suite including password aging configuration. To disable password aging, enter:
chage -M 99999 userName
To get password expiration information, enter:
chage -l userName
Finally, you can also edit the /etc/shadow file in the following fields:

{userName}:{password}:{lastpasswdchanged}:{Minimum_days}:{Maximum_days}:{Warn}:{Inactive}:{Expire}:

Where,

Minimum_days: The minimum number of days required between password changes i.e. the number of days left before the user is allowed to change his/her password.
Maximum_days: The maximum number of days the password is valid (after that user is forced to change his/her password).
Warn : The number of days before password is to expire that user is warned that his/her password must be changed.
Expire : Days since Jan 1, 1970 that account is disabled i.e. an absolute date specifying when the login may no longer be used.

I recommend chage command instead of editing the /etc/shadow by hand:
# chage -M 60 -m 7 -W 7 userName
Recommend readings:

#6.2: Restricting Use of Previous Passwords

You can prevent all users from using or reuse same old passwords under Linux. The pam_unix module parameter remember can be used to configure the number of previous passwords that cannot be reused.

#6.3: Locking User Accounts After Login Failures

Under Linux you can use the faillog command to display faillog records or to set login failure limits. faillog formats the contents of the failure log from /var/log/faillog database / log file. It also can be used for maintains failure counters and limits.To see failed login attempts, enter:
faillog
To unlock an account after login failures, run:
faillog -r -u userName
Note you can use passwd command to lock and unlock accounts:

# lock account

passwd -l userName

# unlocak account

passwd -u userName

#6.4: How Do I Verify No Accounts Have Empty Passwords?

Type the following command
# awk -F: '($2 == "") {print}' /etc/shadow
Lock all empty password accounts:
# passwd -l accountName

#6.5: Make Sure No Non-Root Accounts Have UID Set To 0

Only root account have UID 0 with full permissions to access the system. Type the following command to display all accounts with UID set to 0:
# awk -F: '($3 == "0") {print}' /etc/passwd
You should only see one line as follows:

root:x:0:0:root:/root:/bin/bash

If you see other lines, delete them or make sure other accounts are authorized by you to use UID 0.

#7: Disable root Login

Never ever login as root user. You should use sudo to execute root level commands as and when required. sudo does greatly enhances the security of the system without sharing root password with other users and admins. sudo provides simple auditing and tracking features too.

#8: Physical Server Security

You must protect Linux servers physical console access. Configure the BIOS and disable the booting from external devices such as DVDs / CDs / USB pen. Set BIOS and grub boot loader password to protect these settings. All production boxes must be locked in IDCs (Internet Data Center) and all persons must pass some sort of security checks before accessing your server. See also:

9 Tips To Protect Linux Servers Physical Console Access.

#9: Disable Unwanted Services

Disable all unnecessary services and daemons (services that runs in the background). You need to remove all unwanted services from the system start-up. Type the following command to list all services which are started at boot time in run level # 3:
# chkconfig --list | grep '3:on'
To disable service, enter:

# service serviceName stop

# chkconfig serviceName off

#9.1: Find Listening Network Ports

Use the following command to list all open ports and associated programs:
netstat -tulpn
OR

nmap -sT -O localhost

nmap -sT -O server.example.com

Use iptables to close open ports or stop all unwanted network services using above service and chkconfig commands.

#9.2: See Also

update-rc.d like command on Redhat Enterprise / CentOS Linux.
Ubuntu / Debian Linux: Services Configuration Tool to Start / Stop System Services.
Get Detailed Information About Particular IP address Connections Using netstat Command.

#10: Delete X Windows

X Windows on server is not required. There is no reason to run X Windows on your dedicated mail and Apache web server. You can disable and remove X Windows to improve server security and performance. Edit /etc/inittab and set run level to 3. Finally, remove X Windows system, enter:
# yum groupremove "X Window System"

#11: Configure Iptables and TCPWrappers

Iptables is a user space application program that allows you to configure the firewall (Netfilter) provided by the Linux kernel. Use firewall to filter out traffic and allow only necessary traffic. Also use the TCPWrappers a host-based networking ACL system to filter network access to Internet. You can prevent many denial of service attacks with the help of Iptables:

#12: Linux Kernel /etc/sysctl.conf Hardening

/etc/sysctl.conf file is used to configure kernel parameters at runtime. Linux reads and applies settings from /etc/sysctl.conf at boot time. Sample /etc/sysctl.conf:

# Turn on execshield
kernel.exec-shield=1
kernel.randomize_va_space=1
# Enable IP spoofing protection
net.ipv4.conf.all.rp_filter=1
# Disable IP source routing
net.ipv4.conf.all.accept_source_route=0
# Ignoring broadcasts request
net.ipv4.icmp_echo_ignore_broadcasts=1
net.ipv4.icmp_ignore_bogus_error_messages=1
# Make sure spoofed packets get logged
net.ipv4.conf.all.log_martians = 1

#13: Separate Disk Partitions

Separation of the operating system files from user files may result into a better and secure system. Make sure the following filesystems are mounted on separate partitions:

/usr
/home
/var and /var/tmp
/tmp

Create septate partitions for Apache and FTP server roots. Edit /etc/fstab file and make sure you add the following configuration options:

noexec - Do not set execution of any binaries on this partition (prevents execution of binaries but allows scripts).
nodev - Do not allow character or special devices on this partition (prevents use of device files such as zero, sda etc).
nosuid - Do not set SUID/SGID access on this partition (prevent the setuid bit).

Sample /etc/fstab entry to to limit user access on /dev/sda5 (ftp server root directory):

/dev/sda5  /ftpdata          ext3    defaults,nosuid,nodev,noexec 1 2

#13.1: Disk Quotas

Make sure disk quota is enabled for all users. To implement disk quotas, use the following steps:

Enable quotas per file system by modifying the /etc/fstab file.
Remount the file system(s).
Create the quota database files and generate the disk usage table.
Assign quota policies.
See implementing disk quotas tutorial for further details.

#14: Turn Off IPv6

Internet Protocol version 6 (IPv6) provides a new Internet layer of the TCP/IP protocol suite that replaces Internet Protocol version 4 (IPv4) and provides many benefits. Currently there are no good tools out which are able to check a system over network for IPv6 security issues. Most Linux distro began enabling IPv6 protocol by default. Crackers can send bad traffic via IPv6 as most admins are not monitoring it. Unless network configuration requires it, disable IPv6 or configure Linux IPv6 firewall:

#15: Disable Unwanted SUID and SGID Binaries

All SUID/SGID bits enabled file can be misused when the SUID/SGID executable has a security problem or bug. All local or remote user can use such file. It is a good idea to find all such files. Use the find command as follows:

#See all set user id files:

find / -perm +4000

# See all group id files

find / -perm +2000

# Or combine both in a single command

find /  \( -perm -4000 -o -perm -2000 \) -print

find / -path -prune -o -type f -perm +6000 -ls

You need to investigate each reported file. See reported file man page for further details.

#15.1: World-Writable Files

Anyone can modify world-writable file resulting into a security issue. Use the following command to find all world writable and sticky bits set files:
find /dir -xdev -type d $ -perm -0002 -a ! -perm -1000 $ -print
You need to investigate each reported file and either set correct user and group permission or remove it.

#15.2: Noowner Files

Files not owned by any user or group can pose a security problem. Just find them with the following command which do not belong to a valid user and a valid group
find /dir -xdev $ -nouser -o -nogroup $ -print
You need to investigate each reported file and either assign it to an appropriate user and group or remove it.

#16: Use A Centralized Authentication Service

Without a centralized authentication system, user auth data becomes inconsistent, which may lead into out-of-date credentials and forgotten accounts which should have been deleted in first place. A centralized authentication service allows you maintaining central control over Linux / UNIX account and authentication data. You can keep auth data synchronized between servers. Do not use the NIS service for centralized authentication. Use OpenLDAP for clients and servers.

#16.1: Kerberos

Kerberos performs authentication as a trusted third party authentication service by using cryptographic shared secret under the assumption that packets traveling along the insecure network can be read, modified, and inserted. Kerberos builds on symmetric-key cryptography and requires a key distribution center. You can make remote login, remote copy, secure inter-system file copying and other high-risk tasks safer and more controllable using Kerberos. So, when users authenticate to network services using Kerberos, unauthorized users attempting to gather passwords by monitoring network traffic are effectively thwarted. See how to setup and use Kerberos.

#17: Logging and Auditing

You need to configure logging and auditing to collect all hacking and cracking attempts. By default syslog stores data in /var/log/ directory. This is also useful to find out software misconfiguration which may open your system to various attacks. See the following logging related articles:

Linux log file locations.
How to send logs to a remote loghost.
How do I rotate log files?.
man pages syslogd, syslog.conf and logrotate.

#17.1: Monitor Suspicious Log Messages With Logwatch / Logcheck

Read your logs using logwatch or logcheck. These tools make your log reading life easier. You get detailed reporting on unusual items in syslog via email. A sample syslog report:

################### Logwatch 7.3 (03/24/06) ####################
        Processing Initiated: Fri Oct 30 04:02:03 2009
        Date Range Processed: yesterday
                              ( 2009-Oct-29 )
                              Period is day.
      Detail Level of Output: 0
              Type of Output: unformatted
           Logfiles for Host: www-52.nixcraft.net.in
  ################################################################## 

 --------------------- Named Begin ------------------------ 

 **Unmatched Entries**
    general: info: zone XXXXXX.com/IN: Transfer started.: 3 Time(s)
    general: info: zone XXXXXX.com/IN: refresh: retry limit for master ttttttttttttttttttt#53 exceeded (source ::#0): 3 Time(s)
    general: info: zone XXXXXX.com/IN: Transfer started.: 4 Time(s)
    general: info: zone XXXXXX.com/IN: refresh: retry limit for master ttttttttttttttttttt#53 exceeded (source ::#0): 4 Time(s)

 ---------------------- Named End ------------------------- 

  --------------------- iptables firewall Begin ------------------------ 

 Logged 87 packets on interface eth0
   From 58.y.xxx.ww - 1 packet to tcp(8080)
   From 59.www.zzz.yyy - 1 packet to tcp(22)
   From 60.32.nnn.yyy - 2 packets to tcp(45633)
   From 222.xxx.ttt.zz - 5 packets to tcp(8000,8080,8800) 

 ---------------------- iptables firewall End ------------------------- 

 --------------------- SSHD Begin ------------------------ 

 Users logging in through sshd:
    root:
       123.xxx.ttt.zzz: 6 times

 ---------------------- SSHD End ------------------------- 

 --------------------- Disk Space Begin ------------------------ 

 Filesystem            Size  Used Avail Use% Mounted on
 /dev/sda3             450G  185G  241G  44% /
 /dev/sda1              99M   35M   60M  37% /boot

 ---------------------- Disk Space End ------------------------- 

 ###################### Logwatch End #########################

(Note output is truncated)

#17.2: System Accounting with auditd

The auditd is provided for system auditing. It is responsible for writing audit records to the disk. During startup, the rules in /etc/audit.rules are read by this daemon. You can open /etc/audit.rules file and make changes such as setup audit file log location and other option. With auditd you can answers the following questions:

System startup and shutdown events (reboot / halt).
Date and time of the event.
User respoisble for the event (such as trying to access /path/to/topsecret.dat file).
Type of event (edit, access, delete, write, update file & commands).
Success or failure of the event.
Records events that Modify date and time.
Find out who made changes to modify the system's network settings.
Record events that modify user/group information.
See who made changes to a file etc.

See our quick tutorial which explains enabling and using the auditd service.

#18: Secure OpenSSH Server

The SSH protocol is recommended for remote login and remote file transfer. However, ssh is open to many attacks. See how to secure OpenSSH server:

Top 20 OpenSSH Server Best Security Practices.

#19: Install And Use Intrusion Detection System

A network intrusion detection system (NIDS) is an intrusion detection system that tries to detect malicious activity such as denial of service attacks, port scans or even attempts to crack into computers by monitoring network traffic.
It is a good practice to deploy any integrity checking software before system goes online in a production environment. If possible install AIDE software before the system is connected to any network. AIDE is a host-based intrusion detection system (HIDS) it can monitor and analyses the internals of a computing system.
Snort is a software for intrusion detection which is capable of performing packet logging and real-time traffic analysis on IP networks.

#20: Protecting Files, Directories and Email

Linux offers excellent protections against unauthorized data access. File permissions and MAC prevent unauthorized access from accessing data. However, permissions set by the Linux are irrelevant if an attacker has physical access to a computer and can simply move the computer's hard drive to another system to copy and analyze the sensitive data. You can easily protect files, and partitons under Linux using the following tools:

To encrypt and decrypt files with a password, use gpg command.
Linux or UNIX password protect files with openssl and other tools.
See how to encrypting directories with ecryptfs.
TrueCrypt is free open-source disk encryption software for Windows 7/Vista/XP, Mac OS X and Linux.
Howto: Disk and partition encryption in Linux for mobile devices.
How to setup encrypted Swap on Linux.

#20.1: Securing Email Servers

You can use SSL certificates and gpg keys to secure email communication on both server and client computers:

Other Recommendation:

Backups - It cannot be stressed enough how important it is to make a backup of your Linux system. A proper offsite backup allows you to recover from cracked server i.e. an intrusion. The traditional UNIX backup programs are dump and restore are also recommended.
How to: Looking for Rootkits.
Howto: Enable ExecShield Buffer Overflows Protection.
Subscribe to Redhat or Debian Linux security mailing list or RSS feed.

Recommend readings:

Red Hat Enterprise Linux - Security Guide.
Linux security cookbook- A good collections of security recipes for new Linux admin.
Snort 2.1 Intrusion Detection, Second Edition - Good introduction to Snort and Intrusion detection under Linux.
Hardening Linux - Hardening Linux identifies many of the risks of running Linux hosts and applications and provides practical examples and methods to minimize those risks.
Linux Security HOWTO.

In the next part of this series I will discuss how to secure specific applications (such as Proxy, Mail, LAMP, Database) and a few other security tools. Did I miss something? Please add your favorite system security tool or tip in the comments.

Top 10 Open Source Web-Based Project

2011-01-12T09:18:00.000+05:30

This is an user contributed article.
Project management software is not just for managing software based project. It can be used for variety of other tasks too. The web-based software must provide tools for planning, organizing and managing resources to achieve project goals and objectives. A web-based project management software can be accessed through an intranet or WAN / LAN using a web browser. You don't have to install any other software on the system. The software can be easy of use with access control features (multi-user). I use project management software for all of our projects (for e.g. building a new cluster farm) for issue / bug-tracking, calender, gantt charts, email notification and much more.
Obviously I'm not the only user, the following open source software is used by some of the biggest research organizations and companies world wild. For example, NASA's Jet Propulsion Laboratory uses track software or open source project such as lighttpd / phpbb use redmine software to keep track of their projects.

You use the following top 10 software for personal or business use. Keep track of all your projects in one place and finish them successfully on time.

#1: Codendi

Codendi is an open-source collaborative development platform offered by Xerox. From only one interface, it gathers, all the needed tools for software development teams: management and versioning of code, bugs, requirements, documents, reporting, tests etc. It is mainly used for managing software project processes.

Download Codendi

#2: Redmine

Redmine is a flexible project management web application. Written using Ruby on Rails framework, it is cross-platform and cross-database. It includes calendar and gantt charts to aid visual representation of projects and their deadlines.

Download redmine

#3: ProjectPier

ProjectPier is a Free, Open-Source, self-hosted PHP application for managing tasks, projects and teams through an intuitive web interface. ProjectPier will help your organization communicate, collaborate and get things done Its function is similar to commercial groupware/project management products, but allows the freedom and scalability of self-hosting.

Download ProjectPier

#4: Trac

Trac is an open source, web-based project management and bug-tracking tool. Trac allows hyperlinking information between a computer bug database, revision control and wiki content. It also serves as a web interface to a version control system like Subversion, Git, Mercurial, Bazaar and Darcs.

Download Trac

#5: Project HQ

Project HQ is a collaborative open source project management tool, similar to Basecamp and activeCollab. Project HQ is built on open source technologies like Python, Pylons and SQLAlchemy and is fully database independent. Project HQ uses a structured workflow to assist you in managing your projects.

Download Project HQ

#6: Collabtive

Collabtive is a web-based project management software that is being published as Open Source software. The project was started in November 2007. It strives to provide an Open Source alternative to proprietary tools like Basecamp or ActiveCollab.

Download Collabtive

#7: eGroupWare

eGroupWare is a free open source groupware software intended for businesses from small to enterprises. Its primary functions allow users to manage contacts, appointments, projects and to-do lists.
It is used either via its native web-interface, making access platform-independent, or by using different supported groupware clients, such as Kontact, Novell Evolution, or Microsoft Outlook. It can also be used by mobile phone or PDA via SyncML.

Download eGroupWare

#8: KForge

KForge is an open-source (GPL) system for managing software and knowledge projects. It re-uses existing best-of-breed tools such as a versioned storage (subversion), a tracker (trac), and wiki (trac or moinmoin), integrating them with the system’s own facilities (projects, users, permissions etc). KForge also provides a complete web interface for project administration as well a fully-developed plugin system so that new services and features can be easily added.

Download KForge

#9: OpenGoo

It is a complete online solution focused on improving productivity, collaboration, communication and management of your teams. OpenGoo main features include document management, contact management, e-mail, project management, and time management. Text documents and presentations can be created and edited online. Files can be uploaded, organized and shared, independent of file formats.

Download OpenGoo

#10: ClockingIT

ClockingIT is a free Project Management solution, which helps your team stay focused and on top of things.

Download ClockingIT

Ed: The following two paragraphs added by Vivek Gite:

I also use project management software to keep track of how much time I spent per client and project.

My Personal Choice

redmine is my personal choice because I like to use ruby on rails and I often work with small teams. We track networking issues, data center issues, capacity planning, trouble tickets and much more using redmine. I can track multiple projects and its flexible role-based access control make sure only authorized eyes can view the details.

Top 20 OpenSSH Server Best Security Practices

2011-01-12T09:17:00.000+05:30

OpenSSH is the implementation of the SSH protocol. OpenSSH is recommended for remote login, making backups, remote file transfer via scp or sftp, and much more. SSH is perfect to keep confidentiality and integrity for data exchanged between two networks and systems. However, the main advantage is server authentication, through the use of public key cryptography. From time to time there are rumors about OpenSSH zero day exploit. Here are a few things you need to tweak in order to improve OpenSSH server security.

Default Config Files and SSH Port

/etc/ssh/sshd_config - OpenSSH server configuration file.
/etc/ssh/ssh_config - OpenSSH client configuration file.
~/.ssh/ - Users ssh configuration directory.
~/.ssh/authorized_keys or ~/.ssh/authorized_keys - Lists the public keys (RSA or DSA) that can be used to log into the user’s account
/etc/nologin - If this file exists, sshd refuses to let anyone except root log in.
/etc/hosts.allow and /etc/hosts.deny : Access controls lists that should be enforced by tcp-wrappers are defined here.
SSH default port : TCP 22

SSH Session in Action

#1: Disable OpenSSH Server

Workstations and laptop can work without OpenSSH server. If you need not to provide the remote login and file transfer capabilities of SSH, disable and remove the SSHD server. CentOS / RHEL / Fedora Linux user can disable and remove openssh-server with yum command:

# chkconfig sshd off

# yum erase openssh-server

Debian / Ubuntu Linux user can disable and remove the same with apt-get command:
# apt-get remove openssh-server
You may need to update your iptables script to remove ssh exception rule. Under CentOS / RHEL / Fedora edit the files /etc/sysconfig/iptables and /etc/sysconfig/ip6tables. Once done restart iptables service:

# service iptables restart

# service ip6tables restart

#2: Only Use SSH Protocol 2

SSH protocol version 1 (SSH-1) has man-in-the-middle attacks problems and security vulnerabilities. SSH-1 is obsolete and should be avoided at all cost. Open sshd_config file and make sure the following line exists:

Protocol 2

#3: Limit Users' SSH Access

By default all systems user can login via SSH using their password or public key. Sometime you create UNIX / Linux user account for ftp or email purpose. However, those user can login to system using ssh. They will have full access to system tools including compilers and scripting languages such as Perl, Python which can open network ports and do many other fancy things. One of my client has really outdated php script and an attacker was able to create a new account on the system via a php script. However, attacker failed to get into box via ssh because it wasn't in AllowUsers.
Only allow root, vivek and jerry user to use the system via SSH, add the following to sshd_config:

AllowUsers root vivek jerry

Alternatively, you can allow all users to login via SSH but deny only a few users, with the following line:

DenyUsers saroj anjali foo

You can also configure Linux PAM allows or deny login via the sshd server. You can allow list of group name to access or deny access to the ssh.

#4: Configure Idle Log Out Timeout Interval

User can login to server via ssh and you can set an idel timeout interval to avoid unattended ssh session. Open sshd_config and make sure following values are configured:

ClientAliveInterval 300
ClientAliveCountMax 0

You are setting an idle timeout interval in seconds (300 secs = 5 minutes). After this interval has passed, the idle user will be automatically kicked out (read as logged out). See how to automatically log BASH / TCSH / SSH users out after a period of inactivity for more details.

#5: Disable .rhosts Files

Don't read the user's ~/.rhosts and ~/.shosts files. Update sshd_config with the following settings:

IgnoreRhosts yes

SSH can emulate the behavior of the obsolete rsh command, just disable insecure access via RSH.

#6: Disable Host-Based Authentication

To disable host-based authentication, update sshd_config with the following option:

HostbasedAuthentication no

#7: Disable root Login via SSH

There is no need to login as root via ssh over a network. Normal users can use su or sudo (recommended) to gain root level access. This also make sure you get full auditing information about who ran privileged commands on the system via sudo. To disable root login via SSH, update sshd_config with the following line:

PermitRootLogin no

However, bob made excellent point:

Saying "don't login as root" is h******t. It stems from the days when people sniffed the first packets of sessions so logging in as yourself and su-ing decreased the chance an attacker would see the root pw, and decreast the chance you got spoofed as to your telnet host target, You'd get your password spoofed but not root's pw. Gimme a break. this is 2005 - We have ssh, used properly it's secure. used improperly none of this 1989 will make a damn bit of difference. -Bob

#8: Enable a Warning Banner

Set a warning banner by updating sshd_config with the following line:

Banner /etc/issue

Sample /etc/issue file:

----------------------------------------------------------------------------------------------
You are accessing a XYZ Government (XYZG) Information System (IS) that is provided for authorized use only.
By using this IS (which includes any device attached to this IS), you consent to the following conditions:

+ The XYZG routinely intercepts and monitors communications on this IS for purposes including, but not limited to,
penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM),
law enforcement (LE), and counterintelligence (CI) investigations. 

+ At any time, the XYZG may inspect and seize data stored on this IS.

+ Communications using, or data stored on, this IS are not private, are subject to routine monitoring,
interception, and search, and may be disclosed or used for any XYZG authorized purpose.

+ This IS includes security measures (e.g., authentication and access controls) to protect XYZG interests--not
for your personal benefit or privacy.

+ Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching
or monitoring of the content of privileged communications, or work product, related to personal representation
or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work
product are private and confidential. See User Agreement for details.
----------------------------------------------------------------------------------------------

Above is standard sample, consult your legal team for exact user agreement and legal notice details.

#8: Firewall SSH Port # 22

You need to firewall ssh port # 22 by updating iptables or pf firewall configurations. Usually, OpenSSH server must only accept connections from your LAN or other remote WAN sites only.

Netfilter (Iptables) Configuration

Update /etc/sysconfig/iptables (Redhat and friends specific file) to accept connection only from 192.168.1.0/24 and 202.54.1.5/29, enter:

-A RH-Firewall-1-INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -s 202.54.1.5/29 -m state --state NEW -p tcp --dport 22 -j ACCEPT

If you've dual stacked sshd with IPv6, edit /etc/sysconfig/ip6tables (Redhat and friends specific file), enter:

-A RH-Firewall-1-INPUT -s ipv6network::/ipv6mask -m tcp -p tcp --dport 22 -j ACCEPT

Replace ipv6network::/ipv6mask with actual IPv6 ranges.

*BSD PF Firewall Configuration

If you are using PF firewall update /etc/pf.conf as follows:

pass in on $ext_if inet proto tcp from {192.168.1.0/24, 202.54.1.5/29} to $ssh_server_ip port ssh flags S/SA synproxy state

#9: Change SSH Port and Limit IP Binding

By default SSH listen to all available interfaces and IP address on the system. Limit ssh port binding and change ssh port (by default brute forcing scripts only try to connects to port # 22). To bind to 192.168.1.5 and 202.54.1.5 IPs and to port 300, add or correct the following line:

Port 300
ListenAddress 192.168.1.5
ListenAddress 202.54.1.5

A better approach to use proactive approaches scripts such as fail2ban or denyhosts (see below).

#10: Use Strong SSH Passwords and Passphrase

It cannot be stressed enough how important it is to use strong user passwords and passphrase for your keys. Brute force attack works because you use dictionary based passwords. You can force users to avoid passwords against a dictionary attack and use john the ripper tool to find out existing weak passwords. Here is a sample random password generator (put in your ~/.bashrc):

genpasswd() {
 local l=$1
        [ "$l" == "" ] && l=20
       tr -dc A-Za-z0-9_ < /dev/urandom | head -c ${l} | xargs
}

Run it:
genpasswd 16
Output:

uw8CnDVMwC6vOKgW

#11: Use Public Key Based Authentication

Use public/private key pair with password protection for the private key. See how to use RSA and DSA key based authentication. Never ever use passphrase free key (passphrase key less) login.

#12: Use Keychain Based Authentication

keychain is a special bash script designed to make key-based authentication incredibly convenient and flexible. It offers various security benefits over passphrase-free keys. See how to setup and use keychain software.

#13: Chroot SSHD (Lock Down Users To Their Home Directories)

By default users are allowed to browse the server directories such as /etc/, /bin and so on. You can protect ssh, using os based chroot or use special tools such as rssh. With the release of OpenSSH 4.8p1 or 4.9p1, you no longer have to rely on third-party hacks such as rssh or complicated chroot(1) setups to lock users to their home directories. See this blog post about new ChrootDirectory directive to lock down users to their home directories.

#14: Use TCP Wrappers

TCP Wrapper is a host-based Networking ACL system, used to filter network access to Internet. OpenSSH does supports TCP wrappers. Just update your /etc/hosts.allow file as follows to allow SSH only from 192.168.1.2 172.16.23.12 :

sshd : 192.168.1.2 172.16.23.12

See this FAQ about setting and using TCP wrappers under Linux / Mac OS X and UNIX like operating systems.

#15: Disable Empty Passwords

You need to explicitly disallow remote login from accounts with empty passwords, update sshd_config with the following line:

PermitEmptyPasswords no

#16: Thwart SSH Crackers (Brute Force Attack)

Brute force is a method of defeating a cryptographic scheme by trying a large number of possibilities using a single or distributed computer network. To prevents brute force attacks against SSH, use the following softwares:

DenyHosts is a Python based security tool for SSH servers. It is intended to prevent brute force attacks on SSH servers by monitoring invalid login attempts in the authentication log and blocking the originating IP addresses.
Explains how to setup DenyHosts under RHEL / Fedora and CentOS Linux.
Fail2ban is a similar program that prevents brute force attacks against SSH.
security/sshguard-pf protect hosts from brute force attacks against ssh and other services using pf.
security/sshguard-ipfw protect hosts from brute force attacks against ssh and other services using ipfw.
security/sshguard-ipfilter protect hosts from brute force attacks against ssh and other services using ipfilter.
security/sshblock block abusive SSH login attempts.
security/sshit checks for SSH/FTP bruteforce and blocks given IPs.
BlockHosts Automatic blocking of abusive IP hosts.
Blacklist Get rid of those bruteforce attempts.
Brute Force Detection A modular shell script for parsing application logs and checking for authentication failures. It does this using a rules system where application specific options are stored including regular expressions for each unique auth format.
IPQ BDB filter May be considered as a fail2ban lite.

#17: Rate-limit Incoming Port # 22 Connections

Both netfilter and pf provides rate-limit option to perform simple throttling on incoming connections on port # 22.

Iptables Example

The following example will drop incoming connections which make more than 5 connection attempts upon port 22 within 60 seconds:

#!/bin/bash
inet_if=eth1
ssh_port=22
$IPT -I INPUT -p tcp --dport ${ssh_port} -i ${inet_if} -m state --state NEW -m recent  --set
$IPT -I INPUT -p tcp --dport ${ssh_port} -i ${inet_if} -m state --state NEW -m recent  --update --seconds 60 --hitcount 5 -j DROP

Call above script from your iptables scripts. Another config option:

$IPT -A INPUT  -i ${inet_if} -p tcp --dport ${ssh_port} -m state --state NEW -m limit --limit 3/min --limit-burst 3 -j ACCEPT
$IPT -A INPUT  -i ${inet_if} -p tcp --dport ${ssh_port} -m state --state ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -o ${inet_if} -p tcp --sport ${ssh_port} -m state --state ESTABLISHED -j ACCEPT
# another one line example
# $IPT -A INPUT -i ${inet_if} -m state --state NEW,ESTABLISHED,RELATED -p tcp --dport 22 -m limit --limit 5/minute --limit-burst 5-j ACCEPT

See iptables man page for more details.

*BSD PF Example

The following will limits the maximum number of connections per source to 20 and rate limit the number of connections to 15 in a 5 second span. If anyone breaks our rules add them to our abusive_ips table and block them for making any further connections. Finally, flush keyword kills all states created by the matching rule which originate from the host which exceeds these limits.

sshd_server_ip="202.54.1.5"
table  persist
block in quick from 
pass in on $ext_if proto tcp to $sshd_server_ip port ssh flags S/SA keep state (max-src-conn 20, max-src-conn-rate 15/5, overload  flush)

#18: Use Port Knocking

Port knocking is a method of externally opening ports on a firewall by generating a connection attempt on a set of prespecified closed ports. Once a correct sequence of connection attempts is received, the firewall rules are dynamically modified to allow the host which sent the connection attempts to connect over specific port(s). A sample port Knocking example for ssh using iptables:

$IPT -N stage1
$IPT -A stage1 -m recent --remove --name knock
$IPT -A stage1 -p tcp --dport 3456 -m recent --set --name knock2
 
$IPT -N stage2
$IPT -A stage2 -m recent --remove --name knock2
$IPT -A stage2 -p tcp --dport 2345 -m recent --set --name heaven
 
$IPT -N door
$IPT -A door -m recent --rcheck --seconds 5 --name knock2 -j stage2
$IPT -A door -m recent --rcheck --seconds 5 --name knock -j stage1
$IPT -A door -p tcp --dport 1234 -m recent --set --name knock
 
$IPT -A INPUT -m --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -p tcp --dport 22 -m recent --rcheck --seconds 5 --name heaven -j ACCEPT
$IPT -A INPUT -p tcp --syn -j doo

fwknop is an implementation that combines port knocking and passive OS fingerprinting.
Multiple-port knocking Netfilter/IPtables only implementation.

#19: Use Log Analyzer

Read your logs using logwatch or logcheck. These tools make your log reading life easier. It will go through your logs for a given period of time and make a report in the areas that you wish with the detail that you wish. Make sure LogLevel is set to INFO or DEBUG in sshd_config:

LogLevel INFO

#20: Patch OpenSSH and Operating Systems

It is recommended that you use tools such as yum, apt-get, freebsd-update and others to keep systems up to date with the latest security patches.

Other Options

To hide openssh version, you need to update source code and compile openssh again. Make sure following options are enabled in sshd_config:

#  Turn on privilege separation
UsePrivilegeSeparation yes
# Prevent the use of insecure home directory and key file permissions
StrictModes yes
# Turn on  reverse name checking
VerifyReverseMapping yes
# Do you need port forwarding?
AllowTcpForwarding no
X11Forwarding no
#  Specifies whether password authentication is allowed.  The default is yes.
PasswordAuthentication no

Verify your sshd_config file before restarting / reloading changes:
# /usr/sbin/sshd -t
Tighter SSH security with two-factor or three-factor (or more) authentication.

20 Linux System Monitoring Tools Every SysAdmin Should Know

2011-01-12T09:15:00.000+05:30

Need to monitor Linux server performance? Try these built-in command and a few add-on tools. Most Linux distributions are equipped with tons of monitoring. These tools provide metrics which can be used to get information about system activities. You can use these tools to find the possible causes of a performance problem. The commands discussed below are some of the most basic commands when it comes to system analysis and debugging server issues such as:

Finding out bottlenecks.
Disk (storage) bottlenecks.
CPU and memory bottlenecks.
Network bottlenecks.

#1: top - Process Activity Command

The top program provides a dynamic real-time view of a running system i.e. actual process activity. By default, it displays the most CPU-intensive tasks running on the server and updates the list every five seconds.

Fig.01: Linux top command

Commonly Used Hot Keys

The top command provides several useful hot keys:

Hot Key	Usage
t	Displays summary information off and on.
m	Displays memory information off and on.
A	Sorts the display by top consumers of various system resources. Useful for quick identification of performance-hungry tasks on a system.
f	Enters an interactive configuration screen for top. Helpful for setting up top for a specific task.
o	Enables you to interactively select the ordering within top.
r	Issues renice command.
k	Issues kill command.
z	Turn on or off color/mono

=> Related: How do I Find Out Linux CPU Utilization?

#2: vmstat - System Activity, Hardware and System Information

The command vmstat reports information about processes, memory, paging, block IO, traps, and cpu activity.
# vmstat 3
Sample Outputs:

procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu------
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
 0  0      0 2540988 522188 5130400    0    0     2    32    4    2  4  1 96  0  0
 1  0      0 2540988 522188 5130400    0    0     0   720 1199  665  1  0 99  0  0
 0  0      0 2540956 522188 5130400    0    0     0     0 1151 1569  4  1 95  0  0
 0  0      0 2540956 522188 5130500    0    0     0     6 1117  439  1  0 99  0  0
 0  0      0 2540940 522188 5130512    0    0     0   536 1189  932  1  0 98  0  0
 0  0      0 2538444 522188 5130588    0    0     0     0 1187 1417  4  1 96  0  0
 0  0      0 2490060 522188 5130640    0    0     0    18 1253 1123  5  1 94  0  0

Display Memory Utilization Slabinfo

# vmstat -m

Get Information About Active / Inactive Memory Pages

# vmstat -a
=> Related: How do I find out Linux Resource utilization to detect system bottlenecks?

#3: w - Find Out Who Is Logged on And What They Are Doing

w command displays information about the users currently on the machine, and their processes.

# w username

# w vivek

Sample Outputs:

17:58:47 up 5 days, 20:28,  2 users,  load average: 0.36, 0.26, 0.24
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
root     pts/0    10.1.3.145       14:55    5.00s  0.04s  0.02s vim /etc/resolv.conf
root     pts/1    10.1.3.145       17:43    0.00s  0.03s  0.00s w

#4: uptime - Tell How Long The System Has Been Running

The uptime command can be used to see how long the server has been running. The current time, how long the system has been running, how many users are currently logged on, and the system load averages for the past 1, 5, and 15 minutes.
# uptime
Output:

18:02:41 up 41 days, 23:42,  1 user,  load average: 0.00, 0.00, 0.00

1 can be considered as optimal load value. The load can change from system to system. For a single CPU system 1 - 3 and SMP systems 6-10 load value might be acceptable.

#5: ps - Displays The Processes

ps command will report a snapshot of the current processes. To select all processes use the -A or -e option:
# ps -A
Sample Outputs:

PID TTY          TIME CMD
    1 ?        00:00:02 init
    2 ?        00:00:02 migration/0
    3 ?        00:00:01 ksoftirqd/0
    4 ?        00:00:00 watchdog/0
    5 ?        00:00:00 migration/1
    6 ?        00:00:15 ksoftirqd/1
....
.....
 4881 ?        00:53:28 java
 4885 tty1     00:00:00 mingetty
 4886 tty2     00:00:00 mingetty
 4887 tty3     00:00:00 mingetty
 4888 tty4     00:00:00 mingetty
 4891 tty5     00:00:00 mingetty
 4892 tty6     00:00:00 mingetty
 4893 ttyS1    00:00:00 agetty
12853 ?        00:00:00 cifsoplockd
12854 ?        00:00:00 cifsdnotifyd
14231 ?        00:10:34 lighttpd
14232 ?        00:00:00 php-cgi
54981 pts/0    00:00:00 vim
55465 ?        00:00:00 php-cgi
55546 ?        00:00:00 bind9-snmp-stat
55704 pts/1    00:00:00 ps

ps is just like top but provides more information.

Show Long Format Output

# ps -Al
To turn on extra full mode (it will show command line arguments passed to process):
# ps -AlF

To See Threads ( LWP and NLWP)

# ps -AlFH

To See Threads After Processes

# ps -AlLm

Print All Process On The Server

# ps ax

# ps axu

Print A Process Tree

#  ps -ejH

#  ps axjf

#  pstree

Print Security Information

# ps -eo euser,ruser,suser,fuser,f,comm,label

# ps axZ

# ps -eM

See Every Process Running As User Vivek

# ps -U vivek -u vivek u

Set Output In a User-Defined Format

# ps -eo pid,tid,class,rtprio,ni,pri,psr,pcpu,stat,wchan:14,comm

# ps axo stat,euid,ruid,tty,tpgid,sess,pgrp,ppid,pid,pcpu,comm

# ps -eopid,tt,user,fname,tmout,f,wchan

Display Only The Process IDs of Lighttpd

# ps -C lighttpd -o pid=
OR
# pgrep lighttpd
OR
# pgrep -u vivek php-cgi

Display The Name of PID 55977

# ps -p 55977 -o comm=

Find Out The Top 10 Memory Consuming Process

# ps -auxf | sort -nr -k 4 | head -10

Find Out top 10 CPU Consuming Process

# ps -auxf | sort -nr -k 3 | head -10

#6: free - Memory Usage

The command free displays the total amount of free and used physical and swap memory in the system, as well as the buffers used by the kernel.
# free
Sample Output:

total       used       free     shared    buffers     cached
Mem:      12302896    9739664    2563232          0     523124    5154740
-/+ buffers/cache:    4061800    8241096
Swap:      1052248          0    1052248

=> Related: :

#7: iostat - Average CPU Load, Disk Activity

The command iostat report Central Processing Unit (CPU) statistics and input/output statistics for devices, partitions and network filesystems (NFS).
# iostat
Sample Outputs:

Linux 2.6.18-128.1.14.el5 (www03.nixcraft.in)  06/26/2009

avg-cpu:  %user   %nice %system %iowait  %steal   %idle
           3.50    0.09    0.51    0.03    0.00   95.86

Device:            tps   Blk_read/s   Blk_wrtn/s   Blk_read   Blk_wrtn
sda              22.04        31.88       512.03   16193351  260102868
sda1              0.00         0.00         0.00       2166        180
sda2             22.04        31.87       512.03   16189010  260102688
sda3              0.00         0.00         0.00       1615          0

=> Related: : Linux Track NFS Directory / Disk I/O Stats

#8: sar - Collect and Report System Activity

The sar command is used to collect, report, and save system activity information. To see network counter, enter:
# sar -n DEV | more
To display the network counters from the 24th:
# sar -n DEV -f /var/log/sa/sa24 | more
You can also display real time usage using sar:
# sar 4 5
Sample Outputs:

Linux 2.6.18-128.1.14.el5 (www03.nixcraft.in)   06/26/2009

06:45:12 PM       CPU     %user     %nice   %system   %iowait    %steal     %idle
06:45:16 PM       all      2.00      0.00      0.22      0.00      0.00     97.78
06:45:20 PM       all      2.07      0.00      0.38      0.03      0.00     97.52
06:45:24 PM       all      0.94      0.00      0.28      0.00      0.00     98.78
06:45:28 PM       all      1.56      0.00      0.22      0.00      0.00     98.22
06:45:32 PM       all      3.53      0.00      0.25      0.03      0.00     96.19
Average:          all      2.02      0.00      0.27      0.01      0.00     97.70

#9: mpstat - Multiprocessor Usage

The mpstat command displays activities for each available processor, processor 0 being the first one. mpstat -P ALL to display average CPU utilization per processor:
# mpstat -P ALL
Sample Output:

Linux 2.6.18-128.1.14.el5 (www03.nixcraft.in)   06/26/2009

06:48:11 PM  CPU   %user   %nice    %sys %iowait    %irq   %soft  %steal   %idle    intr/s
06:48:11 PM  all    3.50    0.09    0.34    0.03    0.01    0.17    0.00   95.86   1218.04
06:48:11 PM    0    3.44    0.08    0.31    0.02    0.00    0.12    0.00   96.04   1000.31
06:48:11 PM    1    3.10    0.08    0.32    0.09    0.02    0.11    0.00   96.28     34.93
06:48:11 PM    2    4.16    0.11    0.36    0.02    0.00    0.11    0.00   95.25      0.00
06:48:11 PM    3    3.77    0.11    0.38    0.03    0.01    0.24    0.00   95.46     44.80
06:48:11 PM    4    2.96    0.07    0.29    0.04    0.02    0.10    0.00   96.52     25.91
06:48:11 PM    5    3.26    0.08    0.28    0.03    0.01    0.10    0.00   96.23     14.98
06:48:11 PM    6    4.00    0.10    0.34    0.01    0.00    0.13    0.00   95.42      3.75
06:48:11 PM    7    3.30    0.11    0.39    0.03    0.01    0.46    0.00   95.69     76.89

#10: pmap - Process Memory Usage

The command pmap report memory map of a process. Use this command to find out causes of memory bottlenecks.
# pmap -d PID
To display process memory information for pid # 47394, enter:
# pmap -d 47394
Sample Outputs:

47394:   /usr/bin/php-cgi
Address           Kbytes Mode  Offset           Device    Mapping
0000000000400000    2584 r-x-- 0000000000000000 008:00002 php-cgi
0000000000886000     140 rw--- 0000000000286000 008:00002 php-cgi
00000000008a9000      52 rw--- 00000000008a9000 000:00000   [ anon ]
0000000000aa8000      76 rw--- 00000000002a8000 008:00002 php-cgi
000000000f678000    1980 rw--- 000000000f678000 000:00000   [ anon ]
000000314a600000     112 r-x-- 0000000000000000 008:00002 ld-2.5.so
000000314a81b000       4 r---- 000000000001b000 008:00002 ld-2.5.so
000000314a81c000       4 rw--- 000000000001c000 008:00002 ld-2.5.so
000000314aa00000    1328 r-x-- 0000000000000000 008:00002 libc-2.5.so
000000314ab4c000    2048 ----- 000000000014c000 008:00002 libc-2.5.so
.....
......
..
00002af8d48fd000       4 rw--- 0000000000006000 008:00002 xsl.so
00002af8d490c000      40 r-x-- 0000000000000000 008:00002 libnss_files-2.5.so
00002af8d4916000    2044 ----- 000000000000a000 008:00002 libnss_files-2.5.so
00002af8d4b15000       4 r---- 0000000000009000 008:00002 libnss_files-2.5.so
00002af8d4b16000       4 rw--- 000000000000a000 008:00002 libnss_files-2.5.so
00002af8d4b17000  768000 rw-s- 0000000000000000 000:00009 zero (deleted)
00007fffc95fe000      84 rw--- 00007ffffffea000 000:00000   [ stack ]
ffffffffff600000    8192 ----- 0000000000000000 000:00000   [ anon ]
mapped: 933712K    writeable/private: 4304K    shared: 768000K

The last line is very important:

mapped: 933712K total amount of memory mapped to files
writeable/private: 4304K the amount of private address space
shared: 768000K the amount of address space this process is sharing with others

#11 and #12: netstat and ss - Network Statistics

The command netstat displays network connections, routing tables, interface statistics, masquerade connections, and multicast memberships. ss command is used to dump socket statistics. It allows showing information similar to netstat. See the following resources about ss and netstat commands:

#13: iptraf - Real-time Network Statistics

The iptraf command is interactive colorful IP LAN monitor. It is an ncurses-based IP LAN monitor that generates various network statistics including TCP info, UDP counts, ICMP and OSPF information, Ethernet load info, node stats, IP checksum errors, and others. It can provide the following info in easy to read format:

Network traffic statistics by TCP connection
IP traffic statistics by network interface
Network traffic statistics by protocol
Network traffic statistics by TCP/UDP port and by packet size
Network traffic statistics by Layer2 address

Fig.02: General interface statistics: IP traffic statistics by network interface

Fig.03 Network traffic statistics by TCP connection

#14: tcpdump - Detailed Network Traffic Analysis

The tcpdump is simple command that dump traffic on a network. However, you need good understanding of TCP/IP protocol to utilize this tool. For.e.g to display traffic info about DNS, enter:
# tcpdump -i eth1 'udp port 53'
To display all IPv4 HTTP packets to and from port 80, i.e. print only packets that contain data, not, for example, SYN and FIN packets and ACK-only packets, enter:
# tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
To display all FTP session to 202.54.1.5, enter:
# tcpdump -i eth1 'dst 202.54.1.5 and (port 21 or 20'
To display all HTTP session to 192.168.1.5:
# tcpdump -ni eth0 'dst 192.168.1.5 and tcp and port http'
Use wireshark to view detailed information about files, enter:
# tcpdump -n -i eth1 -s 0 -w output.txt src or dst port 80

#15: strace - System Calls

Trace system calls and signals. This is useful for debugging webserver and other server problems. See how to use to trace the process and see What it is doing.

#16: /Proc file system - Various Kernel Statistics

/proc file system provides detailed information about various hardware devices and other Linux kernel information. See Linux kernel /proc documentations for further details. Common /proc examples:

# cat /proc/cpuinfo

# cat /proc/meminfo

# cat /proc/zoneinfo

# cat /proc/mounts

17#: Nagios - Server And Network Monitoring

Nagios is a popular open source computer system and network monitoring application software. You can easily monitor all your hosts, network equipment and services. It can send alert when things go wrong and again when they get better. FAN is "Fully Automated Nagios". FAN goals are to provide a Nagios installation including most tools provided by the Nagios Community. FAN provides a CDRom image in the standard ISO format, making it easy to easilly install a Nagios server. Added to this, a wide bunch of tools are including to the distribution, in order to improve the user experience around Nagios.

18#: Cacti - Web-based Monitoring Tool

Cacti is a complete network graphing solution designed to harness the power of RRDTool's data storage and graphing functionality. Cacti provides a fast poller, advanced graph templating, multiple data acquisition methods, and user management features out of the box. All of this is wrapped in an intuitive, easy to use interface that makes sense for LAN-sized installations up to complex networks with hundreds of devices. It can provide data about network, CPU, memory, logged in users, Apache, DNS servers and much more. See how to install and configure Cacti network graphing tool under CentOS / RHEL.

#19: KDE System Guard - Real-time Systems Reporting and Graphing

KSysguard is a network enabled task and system monitor application for KDE desktop. This tool can be run over ssh session. It provides lots of features such as a client/server architecture that enables monitoring of local and remote hosts. The graphical front end uses so-called sensors to retrieve the information it displays. A sensor can return simple values or more complex information like tables. For each type of information, one or more displays are provided. Displays are organized in worksheets that can be saved and loaded independently from each other. So, KSysguard is not only a simple task manager but also a very powerful tool to control large server farms.

Fig.05 KDE System Guard {Image credit: Wikipedia}

See the KSysguard handbook for detailed usage.

#20: Gnome System Monitor - Real-time Systems Reporting and Graphing

The System Monitor application enables you to display basic system information and monitor system processes, usage of system resources, and file systems. You can also use System Monitor to modify the behavior of your system. Although not as powerful as the KDE System Guard, it provides the basic information which may be useful for new users:

Displays various basic information about the computer's hardware and software.
Linux Kernel version
GNOME version
Hardware
Installed memory
Processors and speeds
System Status
Currently available disk space
Processes
Memory and swap space
Network usage
File Systems
Lists all mounted filesystems along with basic information about each.

Fig.06 The Gnome System Monitor application

Bonus: Additional Tools

A few more tools:

nmap - scan your server for open ports.
lsof - list open files, network connections and much more.
ntop web based tool - ntop is the best tool to see network usage in a way similar to what top command does for processes i.e. it is network traffic monitoring software. You can see network status, protocol wise distribution of traffic for UDP, TCP, DNS, HTTP and other protocols.
Conky - Another good monitoring tool for the X Window System. It is highly configurable and is able to monitor many system variables including the status of the CPU, memory, swap space, disk storage, temperatures, processes, network interfaces, battery power, system messages, e-mail inboxes etc.
GKrellM - It can be used to monitor the status of CPUs, main memory, hard disks, network interfaces, local and remote mailboxes, and many other things.
vnstat - vnStat is a console-based network traffic monitor. It keeps a log of hourly, daily and monthly network traffic for the selected interface(s).
htop - htop is an enhanced version of top, the interactive process viewer, which can display the list of processes in a tree form.
mtr - mtr combines the functionality of the traceroute and ping programs in a single network diagnostic tool.

Did I miss something? Please add your favorite system motoring tool in the comments.

Feature	Avidemux	Cinelerra	Kdenlive	Kino	LiVES
License	GPL	GPL	GPLv2	GPL	GPLv3+
Cost	Free	Free	Free	Free	Free
Paid Support	N	Y	N	N	N
RAM (min)	?	256M	256M	?	128M
Hard Disk (min)	?	?	1G	?	10G
CPU	?	500Mhz	600Mhz	?	800Mhz
High Definition Video Editing	?	Y	Y	?	Y
Non-destructive Editing	?	Y	Y	Y	Y
Full-screen Playback	?	Y	Y	Y	Y
Storyboard Mode	?	N	Y	Y	N
Video Tracks	Y	Y	Y	?	Y
Audio Tracks	Y	Y	Y	?	Y
Linear Timecode Display	?	Y	Y	?	Y
DVD Output	?	Y	Y	N	Y
HD Output	?	Y	Y	N	Y
Smart Phone Output	?	Y	Y	N	Y
QuickTime Output	?	Y	Y	N	Y
Windows Media Output	?	Y	Y	N	Y
MPEG-4 Output	?	Y	Y	Y	Y
Web Output	?	Y	Y	N	N

I had Volume Group /dev/vg1 that consist two physical volumes /dev/sdb1 and /dev/sdc1 . One of physical volume /dev/sdc1, corrupted due to disk problem , now the challenge was to recover LVM. I decided to use pvremove command, in following way
root#pvremove /dev/sdc1
Above command displayed error couldn't find device uuid 'xxxxxxx'
Then issue tried forcefully
root#pvremove -ff /dev/sdc1
After some warning, it removed that physical volume.
Then i issued pvdisplay command
root#pvdisplay
This display message ' Couldn't find device with uuid xxxxxx'

Now what you need to do is to create a physical volume with new disk with missing uuid .
For that following command can be used

root# pvcreate --uuid=xxxxxx /dev/sdd1 --restorefile=/etc/lvm/archive/vg0_0.vg

Where /dev/sdd1 is new hard disk in replace of /dev/sdc1
Then restore the vg metadata with following command
root# vgcfgrestore -f /etc/lvm/archive/vg0_0.vg tvg0
Note: check archive of vg in /etc/lvm/archive

Quick and Dirty setup for Samba 3 and Windows 2003

2011-01-11T09:33:00.000+05:30

These are the absolute bare minimum steps to get your Samba server integrated as a member server in an AD controlled domain with Win2k3 as the DC.
1. ENSURE your samba box has an A record and associated PTR in DNS.
2. On your DC, disable signing: Run Domain Controller Policy tool and edit Account Policies -> Security Options -> Microsoft network client: Digitally sign communications (always) Set this to Disabled. Do the same in the Domain Policy tool. Note, you will need to reboot the server for this step, though it won't tell you to. Disable on your samba server as well with the following in smb.conf

client signing = no
client use spnego = no

3. On your samba server, install kerberos5, and edit /etc/krb5.conf. It should contain:

[libdefaults]
       default_realm = YOUR.ADS.DOMAIN
       dns_lookup_kdc = false
       dns_lookup_realm = false

[domain_realm]
       .your.domain.name=YOUR.ADS.DOMAIN
       your.domain.name=YOUR.ADS.DOMAIN

[realms]
YOUR.ADS.DOMAIN = {
       default_domain = your.domain.name
       kdc = IP.OF.THE.DC
}

4. Ensure smb.conf contains

realm = YOUR.ADS.DOMAIN
workgroup = YOUR
security = ADS

5. Get a ticket using kerberos: kinit administrator (enter the administrator password when prompted). The klist command should then list a ticket.
6. Join the domain using 'net ads join'. This should use the credentials in your kerberos ticket.
7. Set up winbind - ensure the following is in smb.conf

winbind uid = 10000-20000
winbind gid = 10000-20000
winbind enum groups = yes
winbind enum users = yes

8. store your winbind credentials with wbinfo --set-auth-user=DOMAIN\\administrator%password
9. modify /etc/pam.d/samba (on woody) or the appropriate pam file to add "sufficient" for auth and account using pam_winbind.so. These need to go BEFORE the pam_unix.so calls for samba. My /etc/pam.d/samba is as follows:

auth            sufficient      pam_winbind.so
auth            required        pam_unix.so nullok
account         sufficient      pam_winbind.so
account         required        pam_unix.so
session         required        pam_unix.so
password        required        pam_unix.so

10. Modify /etc/nsswitch.conf with the following:

passwd:         winbind compat
group:          winbind compat
shadow:         winbind compat

11. Restart samba and winbind.
12. All should work. :) Browse your server and see...

Making Samba communicate with your Windows domain

2011-01-11T09:30:00.000+05:30

Takeaway: If you have a Windows domain controller in your organization, Samba allows you to authenticate Linux users via the domain. All it takes is a little bit of tweaking.

Getting Samba to completely accept authentication information from an existing domain is quite a challenge. It requires changes to a few configuration files and awareness of more than a few subsystems within the Linux environment. Although simpler approaches are available in Samba, they have their own challenges, such as requiring the setup of user accounts on the Linux box and the creation of persistent connections to the authenticating domain server.

User accounts
In previous versions of Samba it was possible to allow authentication from an NT domain, but the major caveat was that the user account had to exist on the Samba machine—even if the account was logged in through the domain controller. To fix this limitation, a daemon was developed called winbind. This daemon is a pluggable authentication module (PAM) that interrogates a Windows-based domain controller for authentication information for a user and, if properly authenticated, creates the appropriate mapping between Linux user IDs and Windows IDs. In short, it provides the bridge necessary so a local Linux account is not necessary for a Windows Domain user. Winbind is now a direct part of the main Samba distribution, including the RedHat9 distributed version, 2.2.7.

Despite being a part of Samba, winbind actually allows all kinds of connections besides just Samba connections without a local Linux account. For instance, Telnet and SSH connections will work without local accounts via winbind once installed; however, this is beyond the scope of my discussion today.

Because of early UNIX-only single sign-on efforts, Linux developers created a Name Service Switch (NSS) subsystem. This subsystem provided a unified way of looking up host names as well as enumerating user accounts, groups, and other utilitarian functions. Winbind hooks into NSS to allow a UNIX application to enumerate the users of a connected Windows NT/Windows 2000 domain. Although it’s beyond the scope of this article to discuss how one might do this, or why one might do this, the necessary changes to the configuration files are outlined for completeness.

PAM, not spam
The pluggable authentication module (PAM) architecture was designed to allow for a standard way for applications to authenticate users while maintaining extensibility for new authentication mechanisms. With PAM, every application need not concern itself with where the user is actually authenticated, only that the user was authenticated by the system. PAM is a default part of RedHat9 and the configuration files it uses can be found in the /etc/pam.d directory. By integrating with PAM, Winbind provides a transparent way of mapping non-local users to the system.

Configuring Samba to authenticate against a domain
The first step in getting Samba to authenticate to a Windows domain is to add winbind to NSS by changing two lines in the /etc/nsswitch.conf file. The two lines are the password and group lines. They should be changed by adding winbind after the existing entries. Once changed, they should look like the following:
passwd: files winbind
group: files winbind

The next step is to make the appropriate changes to the Samba configuration file, /etc/samba/smb.conf. The first change is to change the workgroup entry in the global section to match the name of your domain. Next, change the security entry to be domain. Finally, change the password server to * or, alternatively, you can specify your domain controllers by name leaving a space after each one. After being modified, the lines should look something like the following:
workgroup = MYDOMAIN
security = DOMAIN
password server = *

With those changes in place, it’s time to add a few configuration lines for winbind. These entries all go in the global section and should look like these:
winbind separator = +
winbinduid = 10000-20000
winbindgid = 10000-20000
winbindenum users = yes
winbindenum groups = yes

The settings for Winbind can be set to anything you like; however, the settings here should be good enough to get you going. The separator is a + sign instead of the familiar backslash character used by Windows, in part due to the rules for using a backslash in a UNIX shell. The uid and gid ranges are just to keep the numbers assigned to the mappings by Winbind out of the way of local users. Finally, enum users and enum groups allow the enumeration of users and groups from the domain, respectively.

All of the changes to the configuration file have been made, so save the file.

The next step is to create a machine account in the Windows domain for the Samba machine. Winbind will use this machine account to do its work. The account is created by using the smbpasswd utility with options. The command needs the -j option followed by the domain name that the Samba server is being connected to. It also requires the -r option followed by the server name that the Samba server is being connected to. Finally, it requires the -U option to specify the user account that has permissions to create computer accounts in the domain. Once assembled, the command should look something like this:
smbpasswd -j MYDOMAIN –r MYPDC –U Administrator

You’ll be prompted for your password for the administrator so that Samba can create the user account for the user. Once this step has been completed, it’s time to restart Samba. The quickest way to do this is to do type ps–ea | grepsmbd and then kill the process listed. This is the first column of the returned results. To kill the process, type the “kill” command, followed by a space and the process ID. Restart Samba by typing smbd.

Verifying that Samba is set up
The next step is to verify that the winbind daemon is able to communicate with the server. Verifying that winbind is working is done by using the wbinfo command. The first step is to type wbinfo–p. This pings the winbind daemon to ensure that it’s running. If the test fails, check to see if the process is running but not responding by typing ps-ea | grepwinbindd. If you get no results, the process just hasn’t been started. If you do get a response, then winbindd is really confused since it’s not responding to basic pings. This will require a look into the error logs, as described later in this article.

If there are no errors, the next step is to type wbinfo–t. This tests the computer account that you just created to make sure it’s working correctly.

Next, it’s important to check the ability to retrieve users. This is done by first executing the wbinfo command with a -A option followed by the domain, username, and password that wbinfo can use to satisfy further requests. The format of the command is:
wbinfo -A DOMAIN+USER%PASSWORD

The command will likely return without generating any errors, even if you have mistyped the password. The final step is to type wbinfo-u, which should return a list of users from the domain.

Troubleshooting the setup
There are plenty of potential issues with the setup, ranging from basic networking problems to password mismatches and beyond. Here are a few basic steps toward determining the source of your problem.

First, if you get an error from wbinfo indicating an error looking up domain users, you’re more than likely having some sort of a problem connecting to the domain controller. This might be a network problem, or something as simple as a typo in the domain name in the workgroup name setting in the /etc/samba/smb.conf file. Checking for items that you may have overlooked or miskeyed is a good place to start.

On the other hand, if you get an error number from wbinfo that matches 0xc000006d, you’ve probably miskeyed the password when entering the wbinfo -A command. Either that or you didn’t enter the wbinfo -A command at all. Try the command again. Also, make sure that you tried the wbinfo -t command and received a message back that the secret is good. You might get a password error if your computer account is broken.

Finally, if these don’t answer your question, you can restart winbindd with a debugging level to spit out all kinds of detail to the log file. The log file is located in /var/log/samba and is named log.winbindd. If you’ve not turned debugging on, however, the file is likely to contain very little that’s useful. To turn debugging on, issue the command ps-ea | grepwinbindd and kill off the listed process as you did for smbd above. Then type winbindd-d 100. This turns the debug level all the way up for winbindd. Try the wbinfo command that failed and then go through the log file looking for what may have gone wrong. Be prepared to wade through a great deal of the log, as it fills up quite quickly at this debugging level.

Also, you may also find it useful to look at the log files for a machine. These files are named with the netbios machine name and an extension of .log. For instance, my notebook named boguer-nb created a file boguer-nb.log. This file is with the rest of the Samba logs in the /var/log/samba directory

Native LDAP, native Kerberos and Windows Server 2003 R2 AD Services and schema for cross platform identity management

2011-01-11T09:28:00.000+05:30

Scenario

The scenario for this tech note is as follows. You have Active Directory installed on Windows Server 2003 R2 and use Active Directory to provide directory and authentication services to Windows-based clients. You also have Linux and UNIX installed in the same datacenter and you wish to use Active Directory as your central system for providing consistent directory and authentication services to these systems as well. You have a desire to standardize directory services using LDAP technology and authentication using Kerberos. Ultimately you want to have one centralized account entry and password for each user and group in Active Directory and have users and systems be able to leverage the account information and credentials from Windows, UNIX and Linux client systems. You might also be using Samba on your Linux and UNIX systems for sharing files with your Windows systems and wish to leverage Active Directory for centralized user account information and authenticated access to shared files.

Solution Overview

This solution uses the industry-standard LDAP protocol for directory services and Kerberos for authentication. Since Microsoft Active Directory uses LDAP for directory services and most Linux and UNIX systems include LDAP software, it is logical to leverage this popular modern protocol for managing centralized user, group and system information. With the addition of Microsoft’s Identity Management for UNIX component that is available for Windows Server 2003 R2 and Windows Server 2008 (“Longhorn”), customers now have a Microsoft supported method for storing UNIX-specific user and group information in Active Directory. This is accomplished through the addition of UNIX schema extensions for user and group information in Active Directory and an additional UNIX Properties tab in the management tool for user and group properties. Likewise, Kerberos is a standard technology for providing authentication across most modern operating systems and is the central authentication system for Active Directory. This is the centralized system we will use for storing and using one set of user passwords in Active Directory that can be used by both Windows and UNIX/Linux clients.
Finally, since many users need a simple way to share files between Windows and UNIX/Linux, we include instructions on how to set up the popular Open Source project, Samba, for SMB file serving from UNIX/Linux systems. This allows Windows users to use an authenticated “single sign-on” method for storing and retrieving files on UNIX/Linux systems using the native CIFS file sharing protocol for file. In addition, Samba is used to join the UNIX or Linux system to the Active Directory domain. Our Samba instructions leverage the underlying LDAP/Kerberos infrastructure in order to provide consistent centralized passwords and user / group information.
This solution will allow users to log into UNIX and Linux systems using their Windows account name and password via Active Directory. In this solution, UNIX specific information such as the default UNIX shell is stored centrally in Active Directory to simplify the management of users across multiple systems. This also means that a UNIX user will have a single consistent UID across all UNIX systems that use this setup. This solution can also lay the groundwork for enabling true single sign-on capabilities through the use of Kerberos-enabled utilities on UNIX.

Solution Implementation Details

To implement this solution we used Microsoft Windows Server 2003 R2 Standard Edition with Service Pack 2 as the server environment. This server was configured with the following capabilities installed and enabled:

Active Directory Domain Controller
DNS Server
DHCP Server
Active Directory Services: Identity Management for UNIX

On the client side, we installed Fedora Core Linux 6. The key packages that were leveraged for this solution include:

krb5-libs
pam_krb5
krb5-workstation
openldap-*
nss_ldap
samba-client-3.0.23
samba-common-3.0.23
samba-3.0.23

Normally, these components are installed by default on Fedora Core. For other systems, you may need to install Kerberos, LDAP and Samba software separately. It is also important to ensure that you are running a recent version of Samba and that the Samba daemon – smbd – has been built with Kerberos, LDAP and Active Directory support. The “Samba by Example” guide has details on how to ensure that your Samba software has the appropriate services built-in. This technote assumes that you are familiar with the basic administration concepts for both Windows Server and Fedora Core Linux.

Setting up Windows Server 2003

We begin by setting up the environment on the Windows Server system. Complete the following steps on your Windows Server system: 1. Install Windows Server 2003 R2 and accept the standard options during the install.
2. Using the “Manage Your Server” wizards, set up the server as a first server which means installing and configuring the system as an Active Directory Domain Controller, DNS Server and DHCP Server. For this implementation, we called our domain “milltest”.
3. Using the “Add or Remove Programs” tool in the Control Panel, add the component, Active Directory Services: Identity Management for UNIX. Be sure that “Server for NIS” is installed as part of this package. This will ensure that the Active Directory schema is set up correctly for storing UNIX attributes and will enable the “UNIX Attributes” tab in the properties page
for users and groups within the “Active Directory Users and Computers” MMC. The Server for NIS program itself is not used and does not need to be configured or turned on.
4. Run the program: All Programs >> Administrative Tools >> Active Directory User and Computers. For this example implementation, create a Security Group called “unixusers” and open the properties for this group. Click on the UNIX Attributes tab for “unixusers” and select the default domain name for your NIS Domain (which should be the same as your Active Directory domain) and enter a GID such as 10000. Click OK to save your changes to this new group. You could also enable an existing group such as “Domain Users” however some UNIX systems are not able to handle group names beyond a certain length or ones that have spaces in the name.
5. For each Active Directory user that you want to enable for UNIX logins, you will need to configure their UNIX attribute properties. For example, create a new user called Bob Smith with a user logon name of “bob”. Give “bob” a password and uncheck the “User must change password at next logon” option. Open the properties for user “Bob Smith” and select the UNIX Attributes tab. For the NIS Domain field, select the default domain name. The rest of the attributes should be automatically filled in; however you can change these to suit your needs. For example, you could change the Login Shell to “/bin/bash”. The primary group name should be set to “unixusers” or another group that is UNIX enabled. In our example, we set the primary group to “Domain Users” since Fedora Core Linux supports long group names and group names with spaces.
6. Finally, we need to create a special user account for handling LDAP requests from the UNIX/Linux clients. We used an account name of “ldap” and made the account a member of the “Domain Guests” group. This account does not need any special administrative privileges. We set the user password to “not24get!” and made sure that in Account options, “User cannot change password” and “Password never expires” are checked and all other options are unchecked.
7. There are no special steps required to enable Kerberos services for UNIX clients.
Your Windows Server system is now ready to provide LDAP directory services and Kerberos authentication services to UNIX and Linux clients.

Setting up Fedora Core Linux

The next step is to set up a Linux system as a client for Active Directory services. In this case, the Linux client can be either a Linux desktop or server. The term “client” refers to how the Linux system is configured to use Active Directory client services from a Windows Server system. In a previous technote we used Fedora’s graphical administration tools configure the system. For this technote, we will document how to configure the system by manually editing system files since this method requires more customization of certain system files. Complete the following steps on your Fedora Core Linux system: 1. Install a standard version of Fedora Core Linux. We used most of the defaults for our install. Make sure that the Kerberos (krb), Open LDAP and Samba packages are installed on your system.
2. Use DHCP to get an IP address from Windows Server by providing the IP address for the Windows Server system when prompted for the DHCP server. Alternatively, you can hard code an IP address in the same network as the Windows domain.
3. Make sure the DNS client is set up to use the Windows Server domain controller (normally automatic if DHCP is used). Check the /etc/resolv.conf file once you have installed Linux to be sure that DNS is configured correctly to use your Active Directory domain controller as a “nameserver” and that the Active Directory domain name is defined after the “search” parameter.
4. Make sure you have set the system host name for your Linux system. For example edit the file /etc/sysconfig/network and ensure that the HOSTNAME variable is set with your host name.
5. Also be sure to configure /etc/hosts so that your fully qualified domain name and host name are defined with either the local address or an IP address if using a static IP address. This should be the first entry in the definition list even if you currently have localhost defined for the local interface. You should also include a definition for the name and IP address for the Active Directory server being used for authentication.
6. Configure your Linux system to use the Network Time Protocol and set it to use the Windows Server IP address as the first NTP Server. This is done on Fedora by running System à Administration à Date & Time. It is essential to have the Linux system clock synchronized with the Windows Server clock, otherwise Kerberos authentication will not work correctly.
7. The file /etc/pam.d/system-auth needs to be configured to use both UNIX and Kerberos methods for authentication. It is also useful to add an extra “session” entry to enable the creation of home directories on first login to the Linux system by a user. We generated the following file by using the graphical Authentication tool included with Fedora (System >> Administration >> Authentication) and adding the pam_mkhomedir entry in the session section:

auth required pam_env.so

auth sufficient pam_unix.so nullok try_first_pass

auth requisite pam_succeed_if.so uid >= 500 quiet

auth sufficient pam_krb5.so use_first_pass

auth required pam_deny.so

account required pam_unix.so broken_shadow

account sufficient pam_localuser.so

account sufficient pam_succeed_if.so uid < 500 quiet

account [default=bad success=ok user_unknown=ignore] pam_krb5.so

account required pam_permit.so

password requisite pam_cracklib.so try_first_pass retry=3

password sufficient pam_unix.so md5 shadow nis nullok try_first_pass use_authtok

password sufficient pam_krb5.so use_authtok

password required pam_deny.so

session optional pam_keyinit.so revoke

session required pam_mkhomedir.so skel=/etc/skel umask=0022

session required pam_limits.so

session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid

session required pam_unix.so

session optional pam_krb5.so

8. The first Kerberos file to manually configure is the file /etc/krb.conf. Add two lines at the beginning of the file to define your new Active Directory Kerberos realm. For example, if the domain is MILLTEST.LOCAL and the Active Directory server is ws2003r2.milltest.local, then you would insert the following lines at the beginning of the file:

MILLTEST.LOCAL ws2003r2.milltest.local:88
MILLTEST.LOCAL ws2003r2.milltest.local:749 admin server

9. The next Kerberos file to edit is /etc/krb.realms. Insert your domain name as the first line of the file. For example, using the settings in the previous step, you would add:

.milltest.local MILLTEST.LOCAL

10. The final Kerberos file to edit is /etc/krb5.conf. Ensure that the [libdefaults], [realms] and [domain_realm] sections have the correct entries. Using our example settings above, these sections would have the following entries:

[libdefaults]

default_realm = MILLTEST .LOCAL

dns_lookup_realm = true

dns_lookup_kdc = true

[realms]

MILLTEST .LOCAL = {

kdc = ws2003r2.milltest .local:88

admin_server = ws2003r2.milltest .local:749

kpasswd_server = ws2003r2.milltest .local:464

kpasswd_protocol = SET_CHANGE

default_domain = true

}

[domain_realm]

*.addomain.local = MILLTEST .LOCAL

.addomain.local = MILLTEST .LOCAL

11. The next step is to configure LDAP on Fedora. The central LDAP file to configure is /etc/ldap.conf. This file needs to be set up correctly with information related to the Active Directory Windows Server (the first 5 lines) as well as map the schema to be used for accessing user and group account information in Active Directory. Note on lines 4 and 5 we define the “ldap” user that was created in Active Directory and we set the password that is used for that account. Only the first 5 lines should be modified for your environment. The following file shows how we set up our LDAP environment:

host 192.168.0.10

base dc=milltest,dc=local

uri ldap://ws2003r2.milltest.local/

binddn ldap@milltest.local

bindpw not24get!

scope sub

timelimit 120

bind_timelimit 120

idle_timelimit 3600

nss_initgroups_ignoreusers root,ldap

referrals no

ssl no

nss_base_passwd dc=milltest,dc=local?sub

nss_base_shadow dc=milltest,dc=local?sub

nss_base_group
dc=milltest,dc=local?sub?&(objectCategory=group)(gidnumber=*)

nss_map_objectclass posixAccount user

nss_map_objectclass shadowAccount user

nss_map_objectclass posixGroup group

nss_map_attribute uid sAMAccountName

nss_map_attribute homeDirectory unixHomeDirectory

nss_map_attribute gecos cn

nss_map_attribute shadowLastChange pwdLastSet

nss_map_attribute uniqueMember member

pam_login_attribute sAMAccountName

pam_filter objectclass=User

pam_password ad

12. The next system that needs to be set up is the nsswitch configuration file /etc/nsswitch.conf. The changes to this file direct the system to use LDAP to look up user and group information from Active Directory in addition to using local files. The following lines should be updated with the LDAP directive:

passwd: files ldap

group: files ldap

shadow: files ldap

If you are planning on also using Samba, then you will also need to include Samba’s winbind for name resolution. The /etc/nsswitch.conf file would read:

passwd: files ldap winbind

group: files ldap winbind

shadow: files ldap winbind

13. At this point, we have everything in place to enable logging into a Linux system using an Active Directory username and password and leveraging Active Directory, via Kerberos and LDAP, for directory services and authentication. If you had no plans to use Samba for file and print serving to Windows clients from the Linux server, then you would need no additional steps. However, adding Samba to the mix has advantages beyond enabling file and print sharing. The main advantage is that by joining your Linux system to the Active Directory domain using Samba allows you to create a computer account for the Linux system in Active Directory and secure the Kerberos relationship between the two systems which will help to prevent Kerberos authentication spoofing. The bottom line is your environment will be more secure, so for this reason we highly recommend completing the last steps to enable Samba, even if you have no plans to use file and print serving from Linux.
14. The final file to set up is the Samba smb.conf file. This file is the main configuration file for Samba-3 and there are many possible combinations of settings that can be used to customize your Samba environment. Refer to the Samba-3 documentation for details on the various settings. For our environment, we want to enable our Fedora system as an Active Directory client, with Kerberos authentication support and use the LDAP services from Active Directory to provide consistent uid and gid mapping across all Linux machines in the domain. Since Active Directory user and group names will be enumerated when we use the getent command via the LDAP entries in /etc/nsswitch.conf, we do not need to turn on user and group enumeration via winbind – which will improve performance. We also want to automatically share out the home directory for Active Directory users who have logged into the Fedora system. This is an optional setting. Using our test domain settings, the /etc/samba/smb.conf file would have the following entries:

[global]

unix charset = LOCALE

workgroup = MILLTEST

netbios name = FEDORA100

realm = MILLTEST.LOCAL

server string = Fedora_6

security = ADS

use kerberos keytab = Yes

idmap backend = ad

ldap idmap suffix = dc=milltest,dc=local

ldap admin dn = cn=ldap,cn=Users,dc=milltest,dc=local

ldap suffix = dc=milltest,dc=local

idmap uid = 500-100000000

idmap gid = 500-100000000

log level = 1

syslog = 0

log file = /var/log/samba/%m

printcap name = CUPS

winbind use default domain = yes

winbind nested groups = Yes

[homes]

comment = Home Directories

valid users = %D\%U

read only = No

browseable = No

15. The final steps to enable this configuration are to reset the Samba environment and join the Linux system to the Windows Active Directory domain. In order to complete these steps, you may want to create and run a shell script with the following commands:

service smb stop

service winbind stop

rm -f /etc/samba/*tdb

rm -f /var/cache/samba/*tdb

rm -f /var/cache/samba/*dat

echo "Enter the password for the Active Directory Administrator”

net ads join -U Administrator

smbpasswd –w not24get!

service winbind start

service smb start

chkconfig smb on

chkconfig winbind on

Note on line 8 we use the “smbpasswd –w” command to store the ldap user password in the Samba secrets.tdb file.
Your Fedora Linux system should now be configured to use Active Directory for user and group information directory services and Kerberos authentication using the KDC on Windows Server. In order to test the setup, use the “getent passwd” command to confirm that you can see both local users that exist in /etc/passwd and Windows domain users from Active Directory.
You should also test whether the setup is working correctly by logging in to the Linux system using a standard Active Directory account name and password. If the user has no home directory on the system, it should be automatically created for them. If the login fails, double check that the clocks are synchronized to the same time on both Windows and Linux. If the clocks are off by even a few minutes, then Kerberos will not work correctly.

Using Server for NIS, IdMU and Kerberos for Unix/Linux Directory and Authentication Services

2011-01-11T09:25:00.000+05:30

Scenario

The scenario for this tech note is as follows. You have Active Directory installed on Windows Server 2003 R2 and use Active Directory to provide directory and authentication services to Windows-based clients. You also have Linux and UNIX installed in the same datacenter and you wish to use Active Directory as your central system for providing consistent directory and authentication services to these systems as well. In the past you have used NIS for centralized directory services on UNIX. Ultimately you want to have one centralized account entry and password for each user and group in Active Directory and have users and systems able to leverage the account information and credentials from Windows, UNIX and Linux client systems.

Solution Overview

This solution uses NIS (Network Information Service) technology for user and group information look-ups. NIS has been used on UNIX systems for many years and is a standard part of virtually every Linux and UNIX system. NIS support is also built into Windows Server 2003 R2 and Microsoft Windows Services for UNIX. Kerberos is used for authentication and password validation in this solution. Kerberos is the default system for authentication for modern Windows domains and is also widely used and included in most UNIX and Linux systems. The final solution will allow users to log into UNIX and Linux systems using their Windows account name and password via Active Directory. In addition, UNIX specific information such as the user’s shell is also stored in Active Directory and used during the login session. This solution can also lay the groundwork for enabling true single sign-on capabilities through the use of Kerberos-enabled utilities on UNIX.

Solution Implementation Details

Active Directory Domain Controller
DNS Server
DHCP Server
Active Directory Services: Identity Management for UNIX (which includes Server for NIS)
Other Network File and Print Services: Microsoft Services for NFS (which includes the User Name Mapping service)

On the client side, we installed Fedora Core Linux 6. The key packages that were leveraged for this solution include:

krb5-libs
pam_krb5
krb5-workstation

The required NIS client components are installed by default on Fedora Core. For other systems, you may need to install NIS client software separately. This tech note assumes that you are familiar with the basic administration concepts for both Windows Server and Fedora Core Linux.

Setting up Windows Server 2003 R2

We begin by setting up the environment on the Windows Server system. Complete the following steps on your Windows Server system:

Install Windows Server 2003 R2 and accept the standard options during the install.
Using the “Manage Your Server” wizards, set up the server as a first server which means installing and configuring the system as an Active Directory Domain Controller, DNS Server and DHCP Server. For this implementation, we called our domain “milltest”.
Using the “Add or Remove Programs” tool in the Control Panel, add the following components:
- Active Directory Services: Identity Management for UNIX. Be sure that “Server for NIS” and “Administration Components” are installed as part of this package.
- Other Network File and Print Services: Microsoft Services for NFS. It is recommended that you install all the components of this package although technically you do not need all the NFS components.
Run the program: All Programs à Identity Management for UNIX à Microsoft Identity Management for UNIX. This MMC plugin is the key interface for configuring the Server for NIS service. Enable the “Server for NIS” service by right clicking on “Server for NIS” and selecting “Start Service”.
Run the program: All Programs à Administrative Tools à Active Directory User and Computers. For this example implementation, create a Security Group called “unixusers” and open the properties for this group. Click on the UNIX Attributes tab for “unixusers” and select the default domain name for your NIS Domain (which should be the same as your Active Directory domain) and enter a GID such as 10000. Click OK to save your changes to this new group. You could also enable an existing group such as “Domain Users” however some UNIX systems are not able to handle group names beyond a certain length or ones that have spaces in the name.
For each Active Directory user that you want to enable for UNIX logins, you will need to configure their UNIX attribute properties. For example, create a new user called Bob Smith with a user logon name of “bob”.

Give “bob” a password and uncheck the “User must change password at next logon” option. Open the properties for user “Bob Smith” and select the UNIX Attributes tab. For the NIS Domain field, select the default domain name. The rest of the attributes should be automatically filled in; however you can change these to suit your needs. For example, you could change the Login Shell to “/bin/bash”. The primary group name should be set to “unixusers” or another group that is UNIX enabled. In our example, we set the primary group to “Domain Users” since Fedora Core Linux support long group names and group names with spaces.
Run the program: All Programs à Administrative Tools à Microsoft Services for Network File System. This MMC plug-in is the key interface for configuring the NFS and User Name Mapping services. Enable the “User Name Mapping” service by right clicking on “User Name Mapping” and selecting “Start Service”. Now, right click on “User Name Mapping” and select Properties. Under the “UNIX User Source” tab, ensure “Use Network Information Service (NIS)” is enabled. Now, select the “Simple Mapping” tab and make sure “Use simple maps” is checked and your domain name is selected as the Windows domain. Click on “Add…” at the bottom of this dialog box to add a new NIS mapping. The defaults that are provided should be fine which will have your Windows domain name in lower case listed as the NIS domain name, the NIS server should be the name of the Windows server you are working on and the Windows domain name should be the domain name in all upper case. Hit Apply and then go back to the “UNIX User Source” tab and select “Synchronize Now”.
Right click on “User Maps” and make sure that “Show simple maps” is selected and do the same for “Group Maps”. You should see the enabled users and groups in the right panel. It is also possible to set up more complex maps between Windows user names and UNIX user names. See the Microsoft nfsmgmt help system for more information if you need to do this.
There are no special steps required to enable Kerberos services for UNIX clients.

Your Windows Server system is now ready to provide NIS directory services and Kerberos authentication services to UNIX and Linux clients.

Setting up Fedora Core Linux

The next step is to set up a Linux system as a client for Active Directory services. In this case, the Linux client can be either a Linux desktop or server. The term client refers to how the Linux system is configured to use Active Directory client services from a Windows server system. Complete the following steps on your Fedora Core Linux system:

Install a standard version of Fedora Core Linux. We used most of the defaults for our install. Make sure that the Kerberos (krb) packages are installed on your system.
Use DHCP to get an IP address from Windows Server by providing the IP address for the Windows Server system when prompted for the DHCP server. Alternatively, you can hard code an IP address in the same network as the Windows domain.
Make sure the DNS client is set up to use the Windows Server domain controller (normally automatic if DHCP is used). Check the /etc/resolv.conf file once you have installed Linux to be sure that DNS is configured correctly.
Configure your Linux system to use the Network Time Protocol and set it to use the Windows Server IP address as the first NTP Server. This is done on Fedora by running System >> Administration >> Date & Time. It is essential to have the Linux system clock synchronized with the Windows Server clock, otherwise Kerberos authentication will not work correctly.
Run the program: System >> Administration >> Authentication. This tool assists with configuring the appropriate directory and authentication services for your Fedora system.

Click on the “User Information” tab, check “Enable NIS Support” and uncheck any other options.
Configure NIS with the Windows domain name and IP address for the Windows Active Directory controller.
Click on the “Authentication” tab and check “Enable Kerberos support” and uncheck any other options.
Click on “Configure Kerberos …” and fill in Kerberos fields with:

Realm = Windows domain name in upper case
KDCs = the fully qualified domain name of the Windows domain controller appended with :88.
Admin Servers = fully qualified domain name of the Windows domain controller appended with :749.
Check the two DNS options, “Use DNS to resolve hosts to realms” and “Use DNS to locate KDCs for realms”.

Click on the “Options” tab and check “Cache User Information” and “Local authentication is sufficient for local users”
Click on OK to save all changes.

Once the changes have been made using the Authentication tool, check the various /etc/krb* files to ensure that there are no example realm entries in the files. These should just contain information relevant to connecting to the Windows Server system.
It is useful to add an extra entry to the file /etc/pam.d/system-auth to enable the creation of home directories on first login to the Linux system by a user. In the session section of this file towards the end, add the line:

session required pam_mkhomedir.so skel=/etc/skel umask=0022

Your Fedora Linux system should now be configured to use the NIS services on Windows Server for user and group information directory services and Kerberos authentication using the KDC on Windows Server. In order to test the setup, use “getent passwd” command to confirm that you can see both local users that exist in /etc/passwd and Windows domain users from Active Directory. You will only be able to see Active Directory users if the Active Directory user has been enabled as a UNIX user in the “Active Directory Users and Computers” MMC on Windows Server.
You should now test whether the setup is working correctly by logging in to the Linux system using a UNIX-enabled Active Directory account name and password. If the user has no home directory on the system, it should be automatically created for them. If the login fails, double check that the clocks are synchronized to the same time on both Windows and Linux and that all services mentioned above are enabled. If the clocks are off by even a few minutes, then Kerberos will not work correctly.

Summary

By implementing this solution, you will substantially reduce the management overhead for account and authentication management for heterogeneous Windows and Linux environments. Users now have one account name and password to remember for logging into both Windows and Linux. Administrators can setup new user accounts for both Windows and Linux by simply adding a single new account entry into Active Directory. Administrators can also deny access to all systems for any user by simply disabling their Active Directory account. Policy settings such as password complexity and length requirements are now enforced for users on both Windows and Linux. Deploying new Linux systems is simplified since administrators no longer need to set up individual user accounts for every new Linux machine.There are two other methods for solving the Windows/UNIX/Linux Active Directory integration challenge that are presented in this series. If you wish to use Samba instead of NIS for storing user information then you should read the tech note titled: “Using Samba client technology and Kerberos for Active Directory-based identity management”. If you wish to use LDAP for storing user information then you should read the tech note titled: “Using native LDAP, native Kerberos and Windows Server 2003 R2 Active Directory services and schema for cross-platform identity management”.

Implementing and configuring NFS on Windows Server 2003 R2

2011-01-11T09:22:00.001+05:30

With Windows Server 2003 R2 several of the components that were previously part of Windows Services for UNIX (SFU) became part of the base operating system distribution. This includes the Network File System (NFS) components. There have been changes to these components since the release of SFU version 3.5.
With Windows Server2003 R2 the NFS components no longer contain support for PCNFS and Gateway for NFS. The resource overhead with Gateway for NFS was fairly high and it was deemed much better for the client machines to connect as full NFS clients. The gained speed and lower resource use with NFS Client make this decision very clear. Since more Windows systems are able to run full NFS Clients rather than PCNFS, a similar decision was made for PCNFS support.
There is also new functionality added that will continue to be used in future Windows Server releases. One of these new bits of functionality is the addition of Unix user ID information within Active Directory (AD). Based on RFC 2307 this information can be used by NFS clients and servers for correctly mapping Windows IDs to and from UNIX IDs. It can be used for NIS support as well. The Username Mapping (UNM) available with SFU continues to be available with Windows Server 2003 R2 to support IT sites as they transition to using the new AD functionality. It should be noted that starting with Windows Server 2008 (Longhorn) UNM will no longer be supported.
These changes mean that administrators need to do some planning for the longer term to be prepared for later releases of Windows Server. Server 2003 R2 can be viewed as a “transition release” because UNM and RFC 2307 in AD are supported. The planning involves not only servers, but also clients. Client machines running NFS Client from SFU 3.5 are capable of using UNM, but cannot use the newer 2307/AD capability for ID mapping. This applies to any Windows client release prior to Windows Vista, e.g. Windows XP. Windows Vista comes with NFS Client capabilities that can use both UNM and 2307/AD functionality. Windows Server 2003 R2 is thus capable of supporting both the old UNM and the newer 2307/AD ID mapping. But from Server 2008 and onward the client machines will need to be Windows Vista as a minimum.

Selecting Component Installation

The first of several tasks is to install all of the needed components (NFS Server and any supporting components). Which supporting components you will need depends on what support is required for the NFS Client machines in particular. If your client systems are releases of Windows prior to Windows Vista then you will need to use UNM. Those earlier systems will be running SFU 3.5’s NFS Client which only works with UNM.
If you have a completely new array of just Windows Vista machines then the recommendation is to use the newer RFC 2307 functionality in AD. The will mean fewer changes and transitions in your next upgrade cycle.
For definition purposes here is a brief explanation of what identity mapping is and why it is required. Modern Windows systems have unique identifiers for users and groups; these identifiers are different than with Unix systems. Unix UIDs and GIDs are only guaranteed to be unique on a per machine basis. A global management system, such as LDAP or NIS, can be used by Unix machines to enact a network-wide regime. In contrast the Windows identifiers are virtually unique amongst all Windows systems with the use of a SID (Security IDentifier). A SID and a UID/GID naturally do not match.
To create common ground for identification between the two systems, identity management on Microsoft Windows has been extended to provide UIDs and GIDs for users and groups respectively. Initially with SFU an implementation of NIS in conjunction with a User Name Mapping server allowed for the common ground between Windows and Unix systems. Starting with Windows Server 2003 R2 and continuing with Windows Server 2008 the information to map SIDs to UIDs and GIDs becomes part of AD’s implementation of RFC 2307.
With a Unix UID and GID stored in either or both UNM and AD on a per user basis, an easy mapping between Windows SIDs and Unix UIDs/GIDs is achievable. Now a Windows computer and a Unix computer can communicate user identification using common credentials. This leads to NFS communications between Windows and Unix computers.

Installing NFS Server and friends

Note: It is assumed that you have already installed Active Directory and DNS with the correct configuration. Open the Control Panel and then start the Add/Remove Programs utility. After it has started select from the left panel “Add/Remove Windows Components.”

This will open a new panel. A list of components will be presented. Those components that already have a checkmark in the box at their left are already installed. Scroll down until you find the entry for ‘Other Network File and Print Services.’ (Why NFS is lumped in with Print Services is unknown, but this arrangement does change with the next Server release.)

Now select the Details button. A new window will open titled “Other Network File and Print Services.”

From this Window choose “Microsoft Services for NFS” and choose Details again. Yet another window will open, showing all of the available components related to NFS, titled ‘Microsoft Services for NFS.’

In the ‘Microsoft Services for NFS’ window you will select all of the components that you need to support your local configuration. You should check all of the available selection boxes in a typical situation because all of these components will be needed. If you are not going to use UNM because all of your client machines are now Windows Vista then you won’t need to select User Name Mapping. Once all of the choices are made, click on OK (several times) to begin the installation/activation.

Configuring NFS Server

On Windows Server 2003 R2 the NFS Server can be configured to use UNM or AD/2307. Details on configuring UNM and AD/2307 follow this section.

Configuring NFS Server for UNM

Open the Services for NFS console. This can be started from the Start Menu then Administrative Tools then Microsoft Services for Network File System.

In the left panel select “Microsoft Services for NFS” and then right-click to pop up the action menu. Choose the Properties entry. A new window will open labeled ‘Properties.’ Make sure that the box beside “Active Directory Lookup” is not checked otherwise AD/2307 will be used. In this window enter either the domain name of the machine or the IP address of the machine that the UNM server is running on. Since this is most likely the machine you are starting NFS Server on, this is a good default choice. Any NFS Clients that communicate with this NFS Server should have the same UNM Server. This can prevent confusion if two different UNM Servers have slightly different information. Click OK to close the window.
Now right-click on the entry “User Name Mapping” – it is a sub-item of the “Microsoft Services for NFS” entry in the left panel – to get a popup menu. From this
popup menu select “Properties.” A new window will open titled “User Name Mapping Properties.” You will see two tabs: “UNIX User Source” and “Simple Mapping.” On the Unix User Source tab you can select between “Use Network Information Service (NIS)” or “Use Password and Group files.” (NIS is often grouped under the section “Identity Management,” which also includes Password Synchronization, when you are looking for on-line help or other articles).
When “Use Network Information Service (NIS)” is selected then an NIS server is used to get the UID and GID information to initialize the mapping. With this information two types of mapping can happen: simple and advanced.
When “Use Password and Group files” is selected you can then specify the path to the password file and the group file. These two files will be used to set the information for mapping UIDs and GIDs to users and groups respectively. Both the password and group files must be kept on a filesystem (disk) local to the machine. There can only be one of each file. If you have multiple password and/or group files then it is up to you to manually merge these files together and insure that each file has unique IDs for each entry. With this information two types of mapping can happen: again, simple and advanced.
Simple mapping can happen when the usernames in the password file are identical in spelling and the intended user already is in the Windows user database. This is true when you have specified using NIS or password/group files. Simple maps are the most straight-forward and easiest. If you have been manually administering your users and groups this way then lucky you! Switch to the second tab panel of this Window, “Simple Mapping.” Then check the box labeled “Use Simple maps.” If you have more than one Windows Domain and you are using the password and group files, you may need to select the correct one from the dropdown menu. However, with most networks with only one domain, the default is correct. If you are using NIS then on this tab panel you will need to add the correct NIS domain to get the ID information.
Now click the OK button to set the information.
Advanced mapping must be used when one or more of the usernames in the password file does not match the intended Windows user by either spelling or intended user. The next section deals with Advanced maps in more detail. With either NIS or password/group files you should make sure that the simple mapping is not selected in the User Name Mapping Properties window’s tab named Simple Mapping.
The interval at the bottom of the panel for synchronizing the data is self-explanatory. You can click the “Synchronize now” button to force an immediate synchronization.
Don’t reboot just yet. There is still more to do in the next section if you are using Advanced Mapping.

Creating Maps

The user and group maps instruct UNM which Windows user or group is to match to which UID or GID. Thus when a remote machine makes, for example, an NFS request using a UID and GID it can be mapped to a Windows account with a SID so that correct file access permissions are used. There is a third map that controls which hosts are allowed to have or not have access. Again, you must be the Administrator or a member of the Administrators group to make changes to these maps. In the window for managing Microsoft Service for Network File System, in the left panel expand User Name Mapping by clicking on the plus sign (“+”). This should expand to show two sub-entries: User Maps and Group Maps. With little surprise the method for setting Advanced Maps for users and groups is virtually identical.

To create an Advanced Map for users right click on the “User Maps” entry to get the popup menu and select “Create Map.” A new window will open titled “Create Advanced User Mapping.”

You will see two sections on screen. The left side is for listing Windows users and the right side is for listing Unix users. Click the appropriate button to get a list of the Windows and Unix users. Select the Windows user on the left side (with a mouse click) and then select the Unix user in the right side that are to map to each other. Then select “Add” to set the mapping. Repeat these steps for as many maps as you need to do. You can have many Windows users mapping to one Unix account, but this should be highly discouraged for security reasons.
Creating an Advanced Map for groups is so similar to creating an Advanced Map for users you should already understand and need no further instruction.
The final map to be concerned with is the “.maphosts” file. This file sets the criteria for allowing or denying access from remote host machines. The syntax is similar to NIS syntax. Each line in the file specifies one hostname. If a line has no modifiers then the current default is used; initially this is “+”. This is the same as if the “+” modifier was added at the end of the line. If the “-“ modifier is specified at the end of the line then this host id is denied access. A modifier on a line by itself indicates accepting (+) or denying (-) all hosts not already specified on lines above. An example file is:

Rootbeer +

Cola –

Orange

+

In this example the host rootbeer is allowed access while cola is denied access. The host orange is denied access since the last modifier given was a “-“. The final line, just a “+” indicates that all other hosts are allowed access.
You should not have any hosts or modifier listed after a line that has only a “+” or “-“ because these lines will be ignored.
The “.maphosts” file is located in the %WINDIR%/msnfs directory. It can be edited with either a Windows or Interix editor.
Now that User Name Mapping is finished you should restart the UNM Service. You can do this more than one way. One method is with the Microsoft Services for Network File System panel. Right click the User Name Mapping entry to get the popup menu. Now stop the service. Once the service has stopped then start the service again with the popup menu selection.

Configuring 2307/AD for Unix IDs

By default the ability to set Unix IDs in Active Directory is not activated. The Server for NIS needs to be installed and activated. The first thing is to get NIS installed. Without it installed then the RFC 2307 part of AD cannot be used. From Add/Remove Programs select Add/Remove Windows Components. From the component window select “Active Directory Services” and then click the Details button. This will display the “Active Directory Services” window.

In the next window select “Identity Management for UNIX” and click the Details button again. Another window will open. Select “Server for NIS” and check the box associated with it. When you do this the check box with “Administration Components” will be checked automatically. This is required.

Now click OK in this window and click OK in the next window. You should be back at the components window now where you will select the Next button to start the installation. When it is done you will not be prompted to reboot. However, you must reboot to get the new 2307 information shown when you are looking at AD user information.
After the reboot, when you look at the Properties of a user in Active Directory, you will see a new tab labeled “UNIX Attributes.”

The first thing to do is to select the NIS domain. Once this is done then the other selectable and settable items become active. There are default entries for UID, shell and home directory. The entry for the Primary Group is left empty. You can change these values to match your needs. For example, it is quite common to change the default shell to “/bin/csh” or “/bin/bash.”
You can make these changes one user at a time through the AD GUI or through the command line utilities. With the command line utilities you can create a script to automate changes for a large group of users. An example of this would be changing the default shell for all users. This is a task that is slow, boring, tedious and error prone when using a GUI but quick and accurate with a script.
With Server for NIS installed you will want to set Services for NFS to use Active Directory. This will use the UNIX Attributes IDs for mapping identities. From the Microsoft Service for Network File System management console right click the
left panel entry “Microsoft Service for NFS” and select Properties. In the window that opens check the box beside “Active Directory Lookup.” Then enter the name of the Active Directory domain in the box below.
You should reboot the system for this change to properly take effect.
Mapping of user and group IDs to and from NFS for Windows accounts will get the information from Active Directory now. The IDs used will be those specified on the UNIX Attributes panel of the User’s or Group’s property window.

Configuring NFS Server for AD/2307

With RFC 2307 Active Directory can store Unix IDs (user and group) on a per user basis. This allows for a mapping between Windows SID and Unix UIDs/GIDs. If you are going to have both UNM and AD/2307 working at the same time, please remember that it is important to keep both synchronized with the same information for security reasons. Open the Microsoft Services for NFS console. This can be started from the Administrative Tools entry in the Start Menu.
In the left panel select “Services for NFS” and then right-click to pop up the action menu. Choose the Properties entry. A new window will open labeled ‘Properties.’ Have the box beside “Active Directory Domain Lookup” checked. Then enter either the domain name of the machine or the IP address of the machine that AD is running on for your Windows Domain. Then click OK.
You may need to reboot your machine for this change.

Sharing filesystems by NFS

Regardless of which choice is made for ID mapping you will need to adjust any firewall the system is using so that NFS clients can communicate with the server. You will need to ensure that the following ports are open before sharing any filesystem:

UDP: 111, 1039, 1047, 1048 and 2049.
TCP: 111, 1039, 1047, 1048 and 2049.

Once the ports can pass through the firewall then filesystems can be shared with the NFS Server. Within Windows Explorer select the filesystem to be shared by NFS. Then open a pop-up menu for the filesystem to be shared (right-click the mouse). From the popup menu select ‘Sharing and Security’ or ‘Properties.’ (It doesn’t matter since both open the same window.) A new window will open with several tabs. Select the tab labeled ‘NFS Sharing.’ On this panel choose “Share this folder.” Do set a name for this share so other systems can find it. If you have a secure enough network you may want to check the box for Allow Anonymous Access. If your anonymous ID is something other than “-2” you’ll need to change the default ID.
By default the filesystem shared by NFS is given read-only access with root access disallowed (quietly re-mapped to the anonymous ID). You can adjust this by clicking on the Permissions button to open a new window labeled “NFS Shared Permission.” Current permissions are listed. New permissions can be added and/or current permissions deleted and/or current permissions modified. You can set root access to "allowed" by selecting the checkbox in this window. How to do each is pretty much self-explanatory other than to note that “names” to add are machine names, not user or group names.
If there are any options you want to adjust you can do so now before selecting OK. Once you select OK then the filesystem should be available to an NFS Client.
It would be good to test that the filesystem is now available by attempting to mount it with an NFS Client on another machine. Using another machine will also verify that all network, firewall and access issues have been resolved. If access is a problem check that the client host has been listed with access allowed in the “.maphosts” file. This is the easiest to confirm before checking the firewall ports are open (on server and client) and verifying DNS information for the server and client can be found by each computer.

Summary

There are a lot of different items to install and configure just to get basic NFS Server support; however, the end result can be very productive in a heterogeneous operating system environment. Very few computer sites run solely one operating system these days. But interoperability amongst these systems is a must to avoid confusion and duplication of stored data. Of course security must be maintained as tightly as possible and the UNM and RFC 2307 support in Active Directory both help to ensure this.

(Tutorial) How To Install GNS3 on Centos/Redhat/Fedora

2011-01-07T19:45:00.003+05:30

IMP:: Installation of all this packages will take a lot of time. So do it when you are free.

OK lets roll

First we'll have to install dependencies

[user@admin ~]$ su

Password: (Type in your root password here)

[root@admin /]# yum install python python-devel xorg-x11-proto-devel libXext-devel

[root@admin /]# yum install gcc-c++

Now we'll download and install Qt4

[root@admin /]#cd /tmp

[root@admin tmp#wget http://ftp.uludag.org.tr/pub/source/2009/qt-x11-opensource-src-4.5.1.tar.gz

[root@admin tmp]#tar xzf qt-x11-opensource-src-4.5.1.tar.gz

[root@admin tmp]# cd qt-x11-opensource-src-4.5.1

[root@admin qt-x11-opensource-src-4.5.1]#./configure -nomake examples -nomake demos -qt-gif -no-exceptions -debug -qt3support

[root@admin qt-x11-opensource-src-4.5.1]#gmake <====This might take 2-3 hrs.

[root@admin qt-x11-opensource-src-4.5.1]#gmake install <====Another 30 mins or so

[root@admin qt-x11-opensource-src-4.5.1]#PATH=/usr/local/Trolltech/Qt-4.5.1/bin:$PATH

[root@admin qt-x11-opensource-src-4.5.1]#export PATH

Next we'll install SIP

[root@admin qt-x11-opensource-src-4.5.1]#cd ..

[root@admin tmp]#wget http://ftp.uludag.org.tr/pub/source/2009/sip-4.8.1.tar.gz

[root@admin tmp]#tar xzf sip-4.8.1.tar.gz

[root@admin tmp]#cd sip-4.8.1

[root@admin sip-4.8.1]#python configure.py

[root@admin sip-4.8.1]#make

[root@admin sip-4.8.1]#make install

Next we'll Install PyQt4

[root@admin sip-4.8.1]#cd ..

[root@admin tmp]#wget http://ftp.uludag.org.tr/pub/source/2009/PyQt-x11-gpl-4.5.2.tar.gz

[root@admin tmp]#tar xzf PyQt-x11-gpl-4.5.2.tar.gz

[root@admin tmp]#cd PyQt-x11-gpl-4.5.2

[root@admin PyQt-x11-gpl-4.5.2]#python configure.py

[root@admin PyQt-x11-gpl-4.5.2]#make <=====This will take 30-60 mins

[root@admin PyQt-x11-gpl-4.5.2]#make install

We are done with compiling part, now lets download GNS3 source files

[root@admin tmp]#cd /opt

[root@admin opt]#wget http://space.dl.sourceforge.net/project/gns-3/GNS3/0.7.2/GNS3-0.7.2-src.tar.bz2

[root@admin opt]#tar -xjvf GNS3-0.7.2-src.tar.bz2 && rm GNS3-0.7.2-src.tar.bz2

[root@admin opt]#mv GNS3-0.7.2-src /opt/GNS3

Create the following directories:
These directories will be used by GNS3 – such as projects – where your working projects will be stored, cache, temp, IOS images, etc.

[root@admin opt]#cd /opt/GNS3
[root@admin GNS3]#mkdir Dynamips
[root@admin GNS3]#mkdir IOS
[root@admin GNS3]#mkdir Project
[root@admin GNS3]#mkdir Cache
[root@admin GNS3]#mkdir tmp
[root@admin GNS3]#chmod o+rw -R ./Project
[root@admin GNS3]#chmod o+rw -R ./tmp

[root@admin GNS3]#chmod o+rw -R ./IOS

Download binary of dynamips and make it executable

[root@admin GNS3]#cd Dynamips

[root@admin Dynamips ]#wget http://www.ipflow.utc.fr/dynamips/dynamips-0.2.8-RC2-x86.bin

[root@admin Dynamips ]#chmod +x ./dynamips-0.2.8-RC2-x86.bin

IMP:: For 64-bit users

[root@admin Dynamips ]#wget http://www.ipflow.utc.fr/dynamips/dynamips-0.2.8-RC2-amd64.bin

[root@admin Dynamips ]#chmod +x ./dynamips-0.2.8-RC2-amd64.bin

You can create a desktop shortcut by right-clicking on the desktop and select “Create Launcher..”, Name it GNS3 and in the command section type in

python "/opt/GNS3/gns3"

Double click to open GNS3 and we will edit the default settings. If you don’t want to use desktop icons you can create a launcher from your programs menu by right clicking on the Main Menu, selecting Edit Menu. Select New Item on the right and you will be presented with the same window where you type in the above. From there you can move the launcher into any menu section of your choice.

Fire up GNS3

* Go to edit | preferences and in the ‘Terminal command:’ section type in:

gnome-terminal -t %d -e 'telnet %h %p' > /dev/null 2>&1 &

* Under ‘Paths’ change the ‘Project directory:’ to

/opt/GNS3/Project

and the ‘IOS/PIX directory:’ to

/opt/GNS3/IOS

* Click on Dynamips tab on the left

For the ‘Executable path:’ type in

/opt/GNS3/Dynamips/dynamips-0.2.8-RC2-x86.bin

* Change the ‘Working directory:’ to

/opt/GNS3/tmp

Click on the Capture tab on the left

* For the ‘Working directory for capture files:’ change it to

/opt/GNS3/Project

Imp:: When you want to stop the router, use right click stop on the router.

Samba/LDAP configuration on RHEL5

2011-01-07T09:09:00.002+05:30

Samba/LDAP configuration on RHEL5

Introduction

A straightfoward tutorial to configure Samba/LDAP as a Primary Domain Controller / Directory on RHEL5.

Note. local user mapping is mandatory as Samba needs UNIX users too.

Package dependencies

Make sure you've got those RHEL packages installed,

openldap-servers

nss_ldap

samba

httpd

mysql

mysql-server

php-ldap

php-mysql

php-pdo

php-cli

perl-DBI

perl-DBD-MySQL

perl-Convert-ASN1

perl-XML-NamespaceSupport

perl-XML-SAX

perl-Net-SSLeay

perl-IO-Socket-SSL

perl-LDAP

perl-Digest-SHA1

Note. the "nss_ldap" package provides the PAM/LDAP library,

ll /lib/security/pam_ldap.so

Plus those few ones from EPEL (fedoraproject.org/wiki/EPEL),

perl-Crypt-SmbHash

perl-Digest-MD4

perl-Jcode

perl-Unicode-Map

perl-Unicode-Map8

perl-Unicode-MapUTF8

perl-Unicode-String

Network settings

Configure static look ups,

vi /etc/hosts

like,

127.0.0.1  localhost

IP    HOSTNAME  SHORT_HOSTNAME

OpenLDAP server

Add that schema,

cp /usr/share/doc/samba-3.0.25b/LDAP/samba.schema /etc/openldap/schema/

Configure the daemon,

mv -f /etc/openldap/slapd.conf /etc/openldap/slapd.conf.dist

cat > /etc/openldap/slapd.conf <

include         /etc/openldap/schema/core.schema

include         /etc/openldap/schema/cosine.schema

include         /etc/openldap/schema/inetorgperson.schema

include         /etc/openldap/schema/nis.schema

include         /etc/openldap/schema/samba.schema

allow bind_v2

pidfile         /var/run/openldap/slapd.pid

argsfile        /var/run/openldap/slapd.args

database        bdb

suffix          "dc=example,dc=net"

rootdn          "cn=admin,dc=example,dc=net"

rootpw          LDAP_PASSWORD

# rootpw                {crypt}ijFYNcSNctBYg

directory       /var/lib/ldap

index objectClass                       eq,pres

index ou,cn,mail,surname,givenname      eq,pres,sub

index uidNumber,gidNumber,loginShell    eq,pres

index uid,memberUid                     eq,pres,sub

index nisMapName,nisMapEntry            eq,pres,sub

EOF9

Note you could use a crypted password. Then add,

password-hash   {CRYPT}

Note you could add some Samba indexes,

index           cn,sn,uid,displayName           pres,sub,eq

index           uidNumber,gidNumber             eq

index           sambaSID                        eq

index           sambaPrimaryGroupSID            eq

index           sambaDomainName                 eq

index           objectClass                     pres,eq

index           default                         sub

Note you could also add the TLS configuration later on.

Configure the database,

cp /etc/openldap/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

chown ldap:ldap /var/lib/ldap/DB_CONFIG

chmod 600 /var/lib/ldap/DB_CONFIG

Start, check and stop the service,

service ldap start

ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts # should return two lines

service ldap stop

slapcat # should return empty

Initialize the database,

cat > /etc/openldap/init.ldif <

dn: dc=example,dc=net

objectclass: dcObject

objectclass: organization

o: Ministere de la justice

dc: base

dn: cn=admin,dc=example,dc=net

objectclass: organizationalRole

cn: admin

EOF9

slapadd -l /etc/openldap/init.ldif && print " Done"

chown -R ldap:ldap /var/lib/ldap

chmod 600 /var/lib/ldap/*

slapcat # should return the two ldap entries

Start & check the service,

service ldap start

chkconfig ldap on

ldapsearch -x -b "dc=example,dc=net"

Phpldapadmin frontend (optional)

Prepare PHP,

mv -f /etc/php.ini /etc/php.ini.dist

sed 's/memory_limit = 16M/memory_limit = 32M/' /etc/php.ini.dist > /etc/php.ini

Fetch phpldapadmin (phpldapadmin.sourceforge.net) and untar it,

tar xzf phpldapadmin-1.1.0.5.tar.gz

mv phpldapadmin-1.1.0.5 /var/www/html/ldap

Note if this is a fresh OS install,

mv -f /etc/httpd/conf.d/welcome.conf /etc/httpd/conf.d/welcome.conf.dist

Configure the frontend,

vi /var/www/html/ldap/config/config.php

namely,

$config->custom->jpeg['tmpdir'] = "/tmp";

Start the http daemon,

service httpd start

chkconfig httpd on

Check the url and login,

IP/ldap

Samba Domain Controller

Configure the daemons,

mv /etc/samba/smb.conf /etc/samba/smb.conf.dist

cat /usr/share/doc/samba-3.0.25b/LDAP/smbldap-tools-0.9.2/smb.conf \

| sed '

/^$/d;

/^#/d;

/^[[:space:]]*#/d;

s|/opt/IDEALX/|/usr/local/|g;

s/cn=Manager/cn=admin/g;

s/dc=idealx,dc=org/dc=example,dc=net/g;

s/idealx.com/example.net/g;  

s/IDEALX-NT/EXAMPLE/g;

s/PDC-SRV/SHORT_HOSTNAME/g;

s/Samba Server %v/Domain Controller/g

/min passwd length/d;

/printer admin/d;

' > /etc/samba/smb.conf && print " Done"

Edit the configuration,

vi /etc/samba/smb.conf

and add this at the end for user shares,

[homes]

        comment = Home Directories

        browseable = no

        writable = yes

;       valid users = %S

;       valid users = MYDOMAIN\%S

Smbldap-tools connector

Prepare the scripts,

cp /usr/share/doc/samba-3.0.25b/LDAP/smbldap-tools-0.9.2/smbldap-* /usr/local/sbin/

cp /usr/share/doc/samba-3.0.25b/LDAP/smbldap-tools-0.9.2/smbldap_tools.pm /usr/local/sbin/

chmod +x /usr/local/sbin/smbldap*

Configure the connector,

cat /usr/share/doc/samba-3.0.25b/LDAP/smbldap-tools-0.9.2/smbldap.conf \

| sed '

/^$/d;

/^#/d;

/^[[:space:]]*#/d;

s|/opt/IDEALX/|/usr/local/|g;

s/cn=Manager/cn=admin/g;

s/dc=idealx,dc=org/dc=example,dc=net/g;

s/idealx.com/example.net/g;  

s/IDEALX-NT/EXAMPLE/g;

s/PDC-SRV/SHORT_HOSTNAME/g;

s/ldapTLS="1"/ldapTLS="0"/;

/cafile/d;

/clientcert/d;

/clientkey/d;

' >> /etc/smbldap-tools/smbldap.conf && print " Done"

Get the Domaine Controller's SID,

net getlocalsid

and edit the configuration to change the SID,

vi /etc/smbldap-tools/smbldap.conf

like,

SID=_SID_

Configure the access information,

cat > /etc/smbldap-tools/smbldap_bind.conf <

masterDN="cn=admin,dc=example,dc=net"

masterPw="LDAP_PASSWD"

EOF9

Fix file permissions,

chmod 644 /etc/smbldap-tools/smbldap.conf

chmod 600 /etc/smbldap-tools/smbldap_bind.conf

Ready to go

Configure the UNIX users' LDAP mapping,

authconfig-tui

Note. enable local authorize

Note. those files get altered,

#/etc/nsswitch.conf

#/etc/pam.d/system-auth-ac

#/etc/ldap.conf

#/etc/openldap/ldap.conf

Check Samba's configuration and setyp the LDAP master password,

testparm

smbpasswd -w LDAP_MASTER_PASSWORD

Populate the LDAP tree,

/usr/local/sbin/smbldap-populate

Start the Domain Controller,

tail -f /var/log/messages &

tail -f /var/log/samba/* &

service smb start

chkconfig on

net groupmap list

Join the "EXAMPLE" domain from a Windows box with those creditentials:

Login : root

Password : LDAP_MASTER_PASSWORD

Usage

Create a group,

smbldap-groupadd -a GROUPNAME

getent group | grep GROUPNAME

Create a user,

smbldap-useradd -a -g GROUPNAME -G 'Domain Users' -m -s /bin/ksh -d /home/USERNAME -F '' -P USERNAME

getent passwd | grep USERNAME

Note. primary group 'GROUPNAME' and secondary group 'Domain Users'

Note. other possible groups : "Administrators" and "Domain Admins"

Check in the LDAP repository for USERNAME's primary group,

dn: uid=USERNAME,ou=Users,dc=example,dc=net

...

gidNumber: GID_NUMBER

and secondary groups (primary group is also referenced as secondary group in the LDAP repo),

dn: cn=GROUPNAME,ou=Groups,dc=example,dc=net

...

memberUid: USERNAME

also,

dn: cn=Domain Users,ou=Groups,dc=example,dc=net

...

memberUid: USERNAME

World Record : 404907 websites hacked by iskorpitx (Turkish Hacker) !

2010-12-13T10:50:00.003+05:30

404907 websites hacked by Iskorpitx (Turkish Hacker)

Type the word “Iskorpitx” into Google, and see what you get. Exactly the same word spit back at you, except from any number of different sites. That’s because Iskorpitx is the handle of a hacker who recently committed the biggest hacking incident in web-hosting history. Those search results are the graffiti he left.

Quote from zone-h.org:
"Turkish cracker going by the handle "Iskorpitx", succesfully hacked 21,549 websites in one shot (plus 17,000 as our last update) and defaced (on a secondary page) all of them with a message showing the Turkish flag (with AtaTurk face on it)"

Also, Iskorpitx was reportedly responsible for the largest defacement in web history, successfully hacking 21,549 websites in one shot in May 2006.

Biggest news was about NZ Parliament video site being hacked, and also sites hosted by A2Hosting and GoDaddy.But the attack was actually bigger than that, even some Estonian sites were attacked.

After doing a research, it appears to me that iSKORPiTX does this sort of thing from time to time, every 3-6 months or so. I found one place where someone said he attacked over 20,000 sites in under 24 hours.

Iskorpitx has quite a reputation for this sort of thing. Since 2003, he's hacked an estimated 117,000 websites, not even including this latest round, and some of those were the sites of his own country's government.

Based on Zone-H’s record which is always verified to be accurate, tens of thousands of GoDaddy customers were defaced. Without some kind of investigation, we can’t be certain if GoDaddy knew what and when but if the forum thread from April 2005 is authentic and accurate, then we have a big problem that nothing was done in over a year which resulted in the biggest mass web defacement ever. As a customer of GoDaddy hosting myself, I want to know the truth.

It remains unknown whether the most recent attacks where made at the root or webserver level. Iskorpitx executes his hacks by creating subpages, regardless of what authorization level he achieves on the servers.

Iskorpitx's motivations are unclear. Although many of the Turkish hackers have religious agendas, he does not seem to share them. Whatever his reasons or inspiration, Iskorpitx is acting as a massive nuisance throughout the Web.

Pakistan Law Website and 9 other Hacked By Team NUTS

2010-12-13T10:48:00.000+05:30

Pakistan Law Website and 9 other Hacked By Team NUTS

Law website : http://nwfplaws.gon.pk/

Other websites Hacked are :

http://aits.com.pk/
http://tsn.com.pk/index.html
http://supersoft.com.pk/
http://pizzanpratha.com/
http://icms.pk/
http://theexperts.com.pk/index.html
http://hydrotech.org.pk/
http://aits.com.pk/
http://techsense.com.pk/default.html

Genesco's Credit Card Processing System Hacked !

2010-12-13T10:44:00.000+05:30

Specialty retailer Genesco Inc. said Friday that it suffered a criminal intrusion into the part of its computer network that processes payment card transactions and certain details of cards might have been compromised, but added that the intrusion was likely contained after the company took immediate steps to secure the affected part of its network. The company expressed confidence that customers can now safely use their credit and debit cards in its stores.

Nashville, Tennessee-based Genesco said that the portion of its computer network that processes payment card transactions for its United States Journeys, Journeys Kidz, Shi by Journeys and Johnston & Murphy stores, and for some of its Underground Station stores suffered a criminal intrusion. While the extent of the intrusion was not known at the current point of time, the company said it is conducting a probe with the help of an outside expert to determine the extent of any possible compromise of customer information that occurred in the intrusion.

Robert Dennis, Chairman, President and Chief Executive Officer of Genesco said, "Since we learned of the intrusion, we have worked diligently with outside experts to protect our customers' information and we are confident that they are safe shopping with their credit and debit cards at our stores. We recommend that our customers review their card statements and other account information carefully and immediately notify their card issuer if they suspect fraudulent use. We sincerely regret any inconvenience this attack on our network may cause our customers."

Genesco noted it was possible that the credit or debit card number, expiration date and card verification code contained on the magnetic stripe of some payment cards used at stores in the affected chains may have been compromised during the intrusion. However, the company said it currently has no reason to believe that personal information, such as names, addresses or Social Security numbers, was acquired by the intruder. Further, the company said that payment card transactions in any of its e-commerce or catalog businesses, Lids Sports businesses, or its Canadian stores did not seem to be affected by the intrusion.

Genesco said it has notified law enforcement authorities as well as the major payment card brands and is cooperating with them to identify those responsible for the intrusion. On Wednesday, Mastercard Inc. said its website was experiencing heavy traffic, but credit card use was not affected. The company made no comment on whether the website had been taken down by hackers. The media had earlier reported a series of hacker attacks on various websites belonging to organizations that have denied service to Wikileaks, the whistleblower website. Mastercard had said on Monday that 'it would no longer process donations" to Wikileaks, terming the site's activities "illegal".

Paypal, Visa Inc. and other banks previously connected to Wikileaks also severed their ties with Wikileaks. These companies withdrew services to the controversial website after it leaked secret U.S. diplomatic cables. In retaliation, hackers in support of Wikileaks brought down the websites of the credit card giants.

In Friday's regular trading session, GCO is trading at $38.86, up $0.20 or 0.52% on a volume of 1,580 shares. The stock has been trading in a range of $21.00-$41.20 in the past 52 weeks.

Cracking the BlackBerry

2010-09-05T09:00:00.000+05:30

The showdown between the Indian government and Research in Motion, the Canadian company behind the BlackBerry service has reached a crescendo. Indian security agencies have always been leery of BlackBerry's walled garden approach. But after the UAE, Saudi Arabia and now Lebanon announced a ban on BlackBerry services, the Indian government seems to have been galvanised into action.

Is there really a security risk with the BlackBerry or is the government over-reacting? There are many ways to access email with your mobile device. Most smartphones are designed to integrate the mobile device with the office network. To the server, the smartphone appears as just another computer which can pull emails from the server and users read emails on their phones in much the same way as they do on their laptops. The BlackBerry service, on the other hand, is designed so that all data sent by a BlackBerry device is compressed to a fraction of its original size before being sent to vast RIM server farms in Canada. These servers connect to individual BlackBerries using a "push" technology that allows email messages to reach the recipient device almost as soon as it hits the Canadian server. The compression also ensures that the message is encrypted, imparting, in addition to rock-steady reliability, an unparalleled privacy in email communication.

Now, while privacy is good — perhaps even necessary for the legitimate business user — it is a nightmare for law enforcement agencies constantly locking horns with tech-savvy terrorists. The inability to read email exchanges between individuals plotting anti-national activity is often the difference between preventing a crime and getting there too late.

Under Indian telecom licenses, the government has the right to require telcos to allow the government access to their networks. However, interception is of little use if the message being intercepted is itself encrypted. The encryption algorithms used by BlackBerries are designed to withstand decryption attempts by super-computers. Which is why the Indian government wants RIM to part with its encryption keys.

Even if RIM does agree to do this, of itself, this will not solve the problem. Even if the government has access to encryption keys in respect of all retail customers, it would still be unable to access emails sent from corporate BlackBerry accounts. Enterprise customers can buy their own BlackBerry servers with advanced security features. These private BlackBerry servers have their own encryption keys, over which RIM has no access, in order to assure customers that no one outside their organisation have access to their email. It is currently impossible for RIM to provide the government access to the many thousands of keys already issued to enterprise customers even if a decision is taken to do so going forward.

There is a third service that is potentially even more dangerous from a law enforcement perspective — BlackBerry Messenger. Anyone who has a BlackBerry device can share their PIN with any other BlackBerry owner and send messages between their respective devices instantly and without charge. This extremely popular application has a huge following in the Blackberry universe, but since it enables instant messaging, has real time implications for law enforcement.

There is little doubt that the fears of Indian law enforcement agencies are well founded. But practically, is there anything one can do about it?

The BlackBerry service provides an encrypted solution that protects customer emails without the need for customers to implement complex settings. However, encryption technology, of the high level used by the BlackBerry service, is not the exclusive preserve of RIM. Anyone with even moderate computer skills would be able to implement the same level of encryption to cloak email passing between personal computers or other mobile devices. It will be relatively easy for a terrorist armed with such devices and using the normal 3G or GPRS data connectivity to ensure that their messages are impossible to read, even if intercepted. What then will the government do next — ban all connected mobile devices? While there is every need to be vigilant and to constantly evolve our defences, we must be rational and measured in our reactions. There is a fine line between precaution and paranoia.

The writer is a Bangalore-based lawyer

RHS333 - Red Hat Enterprise Security and Network Services

2010-08-30T08:54:00.000+05:30

Components of the Exam

The Enterprise Security: Network Services Expertise Exam is organized into two sections:

Centralized Authentication Security: 3.0 hours
Network Service Security: 3.0 hours

In order to earn the Enterprise Security: Network Services Certificate of Expertise, one must earn a score of 70 or higher on each section.

Study Points for the Exam

Prerequisite skills for the Exam

Candidates must be a Red Hat Certified Engineer on a release that is considered current in order to take this exam.

Enterprise Security: Network Services

Candidates should be able to perform the tasks listed below.

Centralized Authentication Security

configure an NIS server to provide directory services
configure Kerberos to provide user authentication
configure NFSv4 server
configure a network client to use NIS for directory information
configure a network client to use Kerberos for authentication
configure a network client to mount an NFSv4 export
configure r-clients (rlogin, rcp, etc.) and telnet to use Kerberos

Network Services Security

Use xinetd and TCP wrappers to restrict access to network services
Configure Postfix and Sendmail to:
- filter mail based on message characteristics
- use TLS for secure communication
- use the Real-time Blackhole List (RBL) via DNS
Configure POP/IMAP to use SSL/TLS for secure communication
Configure the following aspects of DNS:
- master domain
- slave domain
- views
- forwarders
- blackhole lists (RBL)
- TSIG
Use GPG tools to:
- generate key pairs
- sign documents
- encrypt documents
- decrypt documents
- verify document signatures
configure a certificate authority (CA) and sign certificate requests
configure httpd to use a SSL certificate signed by a certifying authority
configure httpd to use passwords and/or network location to restrict access to content
configure FTP security to
- support FTP only users
- implement host based access restrictions

As with all Red Hat performance-based exams, configurations must persist after reboot without intervention.