sudo yum -y install mariadb mariadb-serverTo start and enable it so that it starts again post reboot:
systemctl start mariadb.serviceFinally, run this script (and follow the steps therein) to finalize the installation:
systemctl enable mariadb.service
mysql_secure_installationI'm not entirely, if anything else is required by this objective to be honest and I'm a bit rusty with Linux, which is why I started with something easy.
yum install ntp -yMake sure that it starts on system start up:
chkconfig ntp onOpen the firewall and save the changes:
iptables -I INPUT -p udp --dport ntp -j ACCEPT; service iptables saveEdit the ntp config file /etc/ntp.conf and add the following line:
restrict 10.168.20.0 mask 255.255.255.0 nomodify notrapThis will allow any client in the 10.168.20.0 network to get its time from the ntp server, except that it does not quite do it for me, as I don't have an internet connection. This is because a local server is way down in the pecking order or stratum, so a few extra steps are required:
echo "10.168.20.227" >> /etc/ntp/step-tickersAssuming that 10.168.20.227 is the ip address of your ntp server. You can now start your ntp server with:
echo "10.168.20.227" >> /etc/ntp/ntpservers
service ntpd startInterestingly, there are no SELinux settings related to ntp and you can block hosts by using iptables rules.
server 10.168.20.227Set the ntp daemon to start at boot time and start the service:
chkconfig ntpd onYou can now use the following command to check the configuration is working:
service ntpd start
ntpq -pwhich should have a result like this:
#PubkeyAuthentication yesAlthough the line is commented out, this is actually the default and as such does no need to be explicitly stated, if you wanted to prevent key based authentication, just add this line:
PubkeyAuthentication noAt any rate back to the objective. On the client, issue the following command, and follow the instructions, to generate a key:
ssh-keygenNote that you don't actually need to add a passphrase, just press enter. This will allow you to login without being prompted for a passprhase.
ssh-copy-id user@<servername>That's it, if you did not provide a passphrase, you should be able to login with:
ssh user@<servername>Note, that both ssh-keygen and ssh-copy-id have several options and that you should study them to see what they do.
yum install openssh-server -yYou should then make sure that it is set to run at boot time:
chkconfig sshd onYou can allow ssh traffic through by opening port 22:
iptables -I INPUT -p tcp --dport 22 -j ACCEPT; service iptables saveDepending on your configuration, you might need to change SELinux settings. You can check the SELinux settings like this:
getsebool -a | grep sshFinally, you can limit the users that can login by using the DenyUsers directive in the /etc/ssh/sshd_config file like so:
DenyUsers naughtyuserRemember to restart the daemon after any changes:
service sshd restartIf you want to prevent hosts from accessing SSH, you can do it by using iptables rules, e.g.:
iptables -I INPUT -p tcp --dport 22 -s 10.168.20.233 -j DROP; service iptables saveI think this pretty much covers this objective.
relayhost = 10.168.20.227This will relay emails to host 10.168.20.227, which means that this host needs to be configured as Postfix server, see my previous post here.
yum install postfix mailx -ymailx is useful to test that you have configured Postfix correctly. You will need to open port 25 for Postfix to work properly, like this:
iptables -I INPUT -p tcp --dport 25 -j ACCEPT; service iptables saveThere only appears to be a single SELinux setting related to Postfix, and it seems to be switched on by default:
allow_postfix_local_write_mail_spool --> onMake sure that Postfix will run when the server reboots and start the service:
chkconfig postfix onFinally, if you want to prevent users from sending emails, you could add the following directive to the Postfix config file:
service postfix start
smtpd_recipient_restrictions =You can now add any users you want to prevent from sending email by adding them to this file like this:
check_sender_access hash:/etc/postfix/restricted_senders
testuser@dev.com rejectThe usual suspects covered let's get back to the objective. You'll need to edit the postfix configuration file (/etc/postfix/main.cf) and make sure you set and uncomment the following settings:
myhostname = redhat.dev.comYou can now restart postfix and test your configuration remotely, see this post for details.
mydomain = dev.com
myorigin = $mydomain
inet_interfaces = all
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
[myothershare]Now, let's set SELinux settings (I'm assuming that you have already set samba_export_all_ro as per my previous post):
browseable=yes
path = /myshareddirectory
force group = +Users
valid users = @Users myuser
write list = @Users
create mask = 0770
force create mode =660
setsebool -P samba_export_all_rw 1And the security context type:
chcon -t samba_share_t /myshareddirectory/Let's set ownerships and permissions:
chgrp Users /myshareddirectory/You can now,assuming that your server is 192.168.1.64, finally, mount the share with (you might need to install cifs-utils):
chmod -R 770 /myshareddirectory/
mount.cifs //192.168.1.64/mycolshare /test -o user=myuserWhen you create a file now it should have rw permissions for both owner and group and thus files should be read and writeable for any users in the Users group.
-rw-rw----. 1 502 501 0 Jul 8 20:45 createdbyanotheruser
-rw-rw----. 1 501 501 0 Jul 8 21:02 createdbyauser
yum install samba -yYou will need to open the firewall for ports 139 & 445 (don't forget to save it):
iptables -I INPUT -p tcp --dport 139 -j ACCEPTMake sure that samba starts with the system:
iptables -I INPUT -p tcp --dport 445 -j ACCEPT
chkconfig smb onThere are a few SELinux settings related to samba(default settings):
chkconfig nmb on
samba_create_home_dirs --> offNote, that there is a bit off information regarding SELinux contexts on the samba config file.
samba_domain_controller --> off
samba_enable_home_dirs --> off
samba_export_all_ro --> off
samba_export_all_rw --> off
samba_run_unconfined --> off
samba_share_fusefs --> off
samba_share_nfs --> off
use_samba_home_dirs --> off
virt_use_samba --> off
service smb start; service nmb startLet's get back to the objective, say you want to create a share called myshare to all clients in your network, you'll need to edit /etc/samba/smb.con like this:
[myshare]This share will be available to all hosts in 192.168.1.0, except for 33 and also to 10.168.1.65.
comment=A share for me
path = /myshareddirectory
browseable = yes
writable = no
valid users=myuser
hosts allow = 192.168.1. 10.168.1.65
hosts deny = 192.168.1.33
setsebool -P samba_export_all_ro 1and if you want to set the share as writable, you'll also need this:
setsebool -P samba_export_all_rw 1Remember to change the security context type of your shared directory, in my case:
chcon -t samba_share_t /myshareddirectoryYou need to add the samba user myuser:
smbpasswd -a myuserYou can now,assuming that your server is 192.168.1.64, finally, mount the share with (you might need to install cifs-utils):
mount.cifs //192.168.1.64/myshare /test -o user=myuser
yum install nfs-utils -yYou will need to open the firewall for port 2049 (don't forget to save it):
iptables -I INPUT -p tcp --dport nfs -j ACCEPTMake sure that nfs starts with the system (Make sure the rpcbind is also set to start with the system):
iptables -I INPUT -p udp --dport nfs -j ACCEPT
chkconfig nfs onThere are a few SELinux settings related to nfs (default settings):
chkconfig nfslock on
allow_ftpd_use_nfs --> offYou can now start nfs with:
allow_nfsd_anon_write --> off
git_system_use_nfs --> off
httpd_use_nfs --> off
nfs_export_all_ro --> on
nfs_export_all_rw --> on
qemu_use_nfs --> on
samba_share_nfs --> off
use_nfs_home_dirs --> on
virt_use_nfs --> off
xen_use_nfs --> off
service nfs startLet's get back to the objective, say you want to share directory /distro to all clients in your network, you'll need to edit /etc/exports like this (assuming that your network is 10.168.20.0):
/distro 10.168.20.0/24(ro)Note that there is no space between the address/mask and the export options. Similarly, if you just want to share to a single client you can specify it by ip address or hostname or even fqdn, like this:
/distro 10.168.20.225(ro,sync)Note that the third line is the same as the first two lines combined and the fourth is just another example of how options can be combined.
/distro rhel6test.dev.com(ro,sync)
/distro 10.168.20.225(ro,sync) rhel6test.dev.com(ro,sync)
/distro 10.168.20.0/24(ro,sync) rhel6(ro,sync)
exportfs -av; service nfs restart
ftp 10.168.20.233
Connected to 10.168.20.233 (10.168.20.233).
220 (vsFTPd 2.2.2)
Name (10.168.20.233:root): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (10,168,20,233,38,221).
ftp: connect: No route to host
ftp> cd pub
250 Directory successfully changed.After a bit of hunt, I discovered that the ip_conntrack_ftp module is needed for passive mode to work properly, thus:
ftp> ls
227 Entering Passive Mode (10,168,20,233,161,152).
ftp: connect: No route to host
ftp> pwd
257 "/pub"
modprobe ip_conntrack_ftp; service vsftpd restartIt works fine now:
ftp 10.168.20.233Now, we just need to make it permanent, which requires a script to be written. Note that this needs to have a .modules extension and be placed in the /etc/sysconfig/modules directory:
Connected to 10.168.20.233 (10.168.20.233).
220 (vsFTPd 2.2.2)
Name (10.168.20.233:root): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (10,168,20,233,141,198).
150 Here comes the directory listing.
drwxr-xr-x 2 0 0 4096 May 26 2010 pub
226 Directory send OK.
#!/bin/shI have called mine ip_conntrack_ftp.modules thus in order to make it executable, I issue this command:
exec /sbin/modprobe ip_conntrack_ftp >/dev/null 2>&1
chmod +x /etc/sysconfig/modules/ip_conntrack_ftp.modulesNote that there are no SELinux settings related to this objective and that in order to prevent hosts from accessing the service you should use an iptables rule. User based authentication is enabled by default, as local users are enabled by default (local_enable=YES), but in order to allow access to them you will need to set this SELinux setting:
setsebool -P ftp_home_dir 1To me this conflicts with the objective of configuring anonymous-only download, but would seem to satisfy Configure host-based and user-based security for the service, so it's hard to say for sure
forwarders {10.168.20.233;};Restart the bind daemon and off you go.
forward only;
M.ROOT-SERVERS.NET. 3600000 IN A 10.168.20.233I think I might be getting a little bit ahead of myself. Let's start from the beginning and install Bind:
yum install bind -yYou'll now need to edit the bind configuration file /etc/named.conf and make a few changes:
listen-on port 53 { any; };Given the fact that I had not configured DNSSec properly I also commented the dnssec lines out.
allow-query { any; };
/* dnssec-enable yes;Ensure that the Bind daemon is set to run at boot time:
dnssec-validation yes;
dnssec-lookaside auto;
*/
chkconfig named onOpen up the firewall and save the changes:
iptables -I INPUT -p udp --dport 53 -j ACCEPT; iptables -I INPUT -p tcp --dport 53 -j ACCEPT;service iptables saveYou can now start named:
service named startThe best way to test this is to use dig and look at the times it takes to run a query. In my case, I can just turn off the master dns server and if the results are cached, then I will get a response, e.g.:
dig myserver.domain.com
;; Query time: 2 msec
;; SERVER: 10.168.20.234#53(10.168.20.234)
dig myserver.domain.comThis feels a little bit unsatisfying, so I used the tc command to add a 200 milisecond delay to all traffic on eth0 (note that this is done in the master dns server)
;; Query time: 0 msec
;; SERVER: 10.168.20.234#53(10.168.20.234)
tc qdisc add dev eth0 root netem delay 200msI bounced the caching server and tried again with dig:
dig myserver.domain.com
;; Query time: 202 msec
;; SERVER: 10.168.20.234#53(10.168.20.234)
dig myserver.domain.comA lot better this time :). It now makes a bit more sense to have a caching name server.
;; Query time: 0 msec
;; SERVER: 10.168.20.234#53(10.168.20.234)
#!/bin/bashIf you move/copy the script from a different directory or you use a different directory, the SELinux context is likely to be wrong and will need to be changed, so bear that in mind.
echo "Content-type: text/html"
echo ""
echo "Uptime is: $(uptime)"
chmod +x uptime.cgiYou can now test your new cgi script with:
elinks 127.0.0.1/cgi-bin/uptime.cgiYou might want to add the following directives to a different directory to enable script execution and allow other script extensions.
Directory Options +ExecCGINote that the . before the file extension is not needed and that the extensions are case insensitive.
AddHandler cgi-script pl cgi
UserDir public_htmlAnd then simply uncomment the example provided, which will give you read access to the user files:
# UserDir disabled
<Directory /home/*/public_html>You'll now need to create a public_html directory for all users and make sure that permissions and SELinux are configured correctly. This is for a user called myuser.
AllowOverride FileInfo AuthConfig Limit
Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
<Limit GET POST OPTIONS>
Order allow,deny
Allow from all
</Limit>
<LimitExcept GET POST OPTIONS>
Order deny,allow
Deny from all
</LimitExcept>
</Directory>
mkdir /home/myuser/public_html;chmod 701 /home/myuser; chmod 705 /home/myuser/public_htmlNow create a test page and give it the right permissions:
echo 'A Simple User Page' >> public_html/index.html; chmod 604 public_html/index.htmlFinally, set the SELinux settings to enable home directories:
setsebool -P httpd_enable_homedirs 1and change the user contexts to the Apache user context (you can get this command from the manual page for httpd_selinux):
chcon -R -t httpd_sys_content_t /home/myuser/public_htmlRestart Apache and you should be able to visit myuser's fancy page:
elinks 127.0.0.1/~myuserYou can create by public_html directory and even a simple page for all new users by modifying the skeleton directory, like so:
mkdir /etc/skel/public_htmlThis only helps for new users, but for existing users the process could be scripted like this:
echo 'A Simple User Page' >> public_html/index.html;
chmod -R 705 /etc/skel/public_html/
#!/bin/bash
if [ -n "$1" ]This script can be improved by looping through the accounts and checking that public_html does not exist, but it does the work.
then
user=$1
else
echo "Usage prepare username"
exit
fi
##Set appropriate permissions for home directory
chmod 701 /home/$user
##Create public_html
mkdir /home/$user/public_html
##Create Index.html file
echo "A Simple User Page for $user" >> /home/$user/public_html/index.html;
##Change permissions and ownership
chown -R $user:$user /home/$user/public_html
chmod -R 705 /home/$user/public_html/
##Change SELinux context
chcon -R -t httpd_sys_content_t /home/$user/public_html
NameVirtualHost *:80I now create the DocumentRoot directories:
<VirtualHost *:80>
ServerAdmin webmaster@dummy-host.example.com
DocumentRoot /var/www/rhel6virtual/
ServerName rhel6virtual.dev.com
ErrorLog logs/rhel6virtual
CustomLog logs/rhel6virtual common
</VirtualHost>
<VirtualHost *:80>
ServerAdmin webmaster@dummy-host.example.com
DocumentRoot /var/www/rhel6morevirtual
ServerName rhel6morevirtual.dev.com
ErrorLog logs/rhel6mv
CustomLog logs/rhel6mv common
</VirtualHost>
mkdir /var/www/rhel6virtual; mkdir /var/www/rhel6morevirtualand add a file to each directory to allow easy testing:
echo "More Virtual" > /var/www/rhel6morevirtual/index.html;
echo "Virtual" > /var/www/rhel6virtual/index.htmlYou can now restart Apache:
httpd -k restartSo now if you visit http://rhel6virtual.dev.com/index.html you'll see a web page that simply says Virtual and if you visit http://rhel6morevirtual.dev.com/index.html you'll see a web page that simply says More Virtual.
getsebool -a | grep httpdFor an explanation of what each settings does, check this manual page out:
man httpd_selinuxIn order to prevent access to the websites you can use iptables (don't forget to save the configuration), e.g.
iptables -I INPUT -p tcp --dport 80 -s 10.168.20.0/24 -j DROPor you can edit the configuration file for Apache, add the following to the second virtual host from above:
<Directory "/var/www/rhel6morevirtual/">Only 10.168.20.203 can see rhel6morevirtual now.
Options Indexes FollowSymLinks
AllowOverride None
Order deny,allow
Allow from 10.168.20.203
Deny from all
</Directory>
htpasswd -cm /etc/httpd/conf/apachepass myuserNow, edit the Apache config file and inside the directory directive for "/var/www/rhel6morevirtual/" add:
AuthType BasicRestart Apache and now the only user that can see rhel6morevirtual will be myuser.
AuthName "Restricted Files"
AuthUserFile /etc/httpd/conf/apachepass
Require user myuser
AuthType BasicYou now need to run:
AuthName "Restricted to myuser"
AuthUserFile /home/myuser/public_html/.htauthusers
Require valid-user
htpasswd -c .htauthusers myuserIf you try to visit the page, you'll be prompted for a username and password. The beauty of this method is that it allows users without root access to restrict access to "their" web site.
#$ModLoad imtcp.soso that they look like this
#$InputTCPServerRun 514
$ModLoad imtcp.soOpen the firewall and save the configuration change to the firewall:
$InputTCPServerRun 514
iptables -I INPUT -p tcp --dport 514 -j ACCEPT; service iptables saveAll that remains is to restart the logging daemon:
service rsyslog restartNote that you could use UDP instead or as well as TCP. The rsyslog manual is your friend.
*.* @@10.168.20.233:514The above assumes that you want to log everything to a server on 10.168.20.233 on port 514. It is of course possible to simply log a category, e.g. mail, cron, authentication, etc.. Use the next line to log authentication to the same server:
authpriv.* @@10.168.20.233:514All that remains is to restart the logging daemon:
service rsyslog restartYou can test that the system is logging to the remote server with:
logger "remote logger"Incidentally, the logger command is very good for adding logging to bash scripting, so be sure to remember it.
