Scripted Install of Joomla 3.0 in Centos/RHEL 6.x

Joomla 3.0 was released a little while back so I thought I would write a new post showing how to install it, but it turns out that my previous post works just as well, so I'll just link to it.

Install Joomla

At the time of writing this is the latest version of Joomla.

I have written a script to automate the installation on a new server, see below.

It's not the best script ever but it seems to do the job.

Assuming you call the script joomlainstaller.sh, you should invoke it like this:

joomlainstaller.sh "http://joomlacode.org/gf/download/frsrelease/17965/78414/Joomla_3.0.3-Stable-Full_Package.zip" Joomla JoomlaUser Password

Don't forget to make your script executable with the folliwubg command:

chmod +x joomlainstaller.sh

#!/bin/bash

EXPECTED_ARGS=4
E_BADARGS=65

if [ $# -ne $EXPECTED_ARGS ]
then
  echo "Usage: $0 JoomlaZipUrl Joomladbname Joomladbuser Joomladbpass"
  exit $E_BADARGS
fi

S1="Create database if not exists $2;"
S2="CREATE USER '$3'@'localhost' IDENTIFIED BY '$4';"
S3="GRANT ALL PRIVILEGES ON '$2'.* TO '$3'@'localhost' IDENTIFIED BY '$4';"
S4="Flush privileges;"

SQLCMD = "${S1}${S2}${S3}${S4}"

echo -e "Install the Web Server\n"

yum groupinstall "Web Server"  -y

echo -e "Install the MySQL\n"

yum groupinstall "MySQL Database server" -y

echo -e "Install the PHP and few others\n"

yum install man wget php php-mysql unzip policycoreutils-python -y

mkdir joomlainst

filename=$(basename "$1")

echo -e "Get $filename from $1 \n"

wget $1

echo -e "Unzip $filename and move\n"

unzip $filename -d joomlainst
mv joomlainst/* /var/www/html

echo -e "Start MySQL Service\n"

service mysqld start; chkconfig mysqld on

/usr/bin/mysql_secure_installation

echo -e "Create $2 Database and user $3 MySQL Service\n"

mysql -u root -p -e "$SQLCMD"

echo -e "Open port 80 on Firewall\n"

iptables -I INPUT -p tcp --dport http -j ACCEPT ; service iptables save

echo -e "Turn output buffering off\n"

sed -i 's/output_buffering = 4096/output_buffering = Off/g' /etc/php.ini

echo -e "Create Joomla config file\n"

touch /var/www/html/configuration.php
chmod 666 /var/www/html/configuration.php

echo -e "Start Apache\n"

service httpd start; chkconfig httpd on

echo -e "Disable SELinux"

setenforce 0
sed -i 's/=enforcing/=disabled/' /etc/selinux/config

Installing and using Pen Load balancing software in RHEL/CentOS 6.x

Last week I was asked to provide alternatives to NLB as we seem to be having problems getting delivery of a couple of switches for our test environment, or something like that. At any rate, NLB does not work too well with ESXi in our environment for various reasons, so I remembered about PEN, as I had used in a development environment ages ago.

You can compile from source, if you want to, but there is an already compiled rpm, which can be downloaded from here (This is the EPEL repository for CentOS 5).

Installing it's a simple case of using yum:

yum install -y pen

At this point you can start load balancing with pen like this:

 /usr/bin/pen -l pen8080.log 8080 10.168.20.82:8080 10.168.20.83:8080

This will distribute traffic arriving at this server on port 8080 to port 8080 on .82 and .83 with sticky sessions. If you want round robin stick an -r in, like this:

/usr/bin/pen -l pen8080.log -r 8080 10.168.20.82:8080 10.168.20.83:8080

The only downside of using pen like this is that if the box goes down for any reason so does Pen, which means that we need a start up script. I named the file /etc/init.d/penlb8080. The file name should match the servicename variable in the script:

#!/bin/bash
# Pen Starting Script
# chkconfig: 345 93 92
#Source function library
. /etc/init.d/functions

pen="/usr/bin/pen"
lockfile="/var/lock/subsys/pen"
servicename="penlb8080"
RETURNVALUE=0

PIDFILE=/var/run/pen.pid-8080
LOGFILE=/var/log/pen8080.log
CONTROLPORT=18080
LISTENPORT=8080
SERVERS=2
SERVER1=10.168.20.82:80
SERVER2=10.168.20.83:80

start() {
echo -n $"Starting $servicename: "
daemon $pen -S $SERVERS -p $PIDFILE -l $LOGFILE -C $CONTROLPORT $LISTENPORT $SERVER1 $SERVER2
RETURNVALUE=$?
echo
[ $RETURNVALUE = 0 ] && touch $lockfile
return $RETURNVALUE
}
stop() {
echo -n $"Stopping $servicename: "
kill -9 `cat $PIDFILE`
rm $PIDFILE
RETURNVALUE=$?
echo
[ $RETURNVALUE = 0 ] && rm -f $lockfile
return $RETURNVALUE
}
case "$1" in
start)
start
;;
stop)
stop
;;
restart)
stop
start
;;
status)
status $pen
;;
*)
echo "Usage: $servicename {start|stop|restart|status}"
exit 1
esac

exit $?

Make the script executable:

chmod +x /etc/init.d/penlb8080

Add to list of services controlled by chkconfig:

chkconfig --add penlb8080

Start this pen load balancer instance with:

service penlb8080 start

If you also wanted to run a second pen instance you could use the same script as above but with certain modifications. Say you wanted to run a second load balancer on port 80 as well, all you need to change are the following values, as well as the script name (penlb80):

servicename="penlb80"
PIDFILE=/var/run/pen.pid-80
LOGFILE=/var/log/pen80.log
CONTROLPORT=10080
LISTENPORT=80

Extend Logical Volume RHEL/CentOS 6.x

In a previous post, I discussed how to generally manipulate logical volumes, the one thing I forgot to do was to do a real life test. What do I mean by a real life test?

We had an old box with a single hard drive and RHEL 6 installed on it. Unfortunately, it was a very small hard drive and we wanted to dump a database on that server to do a few tests, so we added another hard drive then did the following, hopefully self-explanatory:

1. pvcreate /dev/sdb1
2. vgextend VolGroup /dev/sdb1
3. lvextend -l +100%FREE /dev/mapper/VolGroup-lv_root
4. resize2fs /dev/mapper/VolGroup-lv_root

Now the root filesystem is a ginormous 38 GB, which is big enough for our purposes.

It's crucial that step 4 is carried out, as otherwise the filesystem will not extend to the totality of the logical volume, which is what was missing from my previous post.

SSH Single Sign On for CentOS 6.2 or RHEL 6.0 using a Windows 2008 AD domain

In one of my previous posts I discussed how to join a CentOS 6.2 server to a Windows 2008 AD domain. There was one thing that wasn't working and that really, and I mean, REALLY annoyed me and this was: single sign on, i.e. using SSH to login to another server in the domain without being prompted for your password again.

After a lot of head banging, cursing and wondering why oh why had I decided to embark in such a doomed enterprise, I managed to get it working. I assume that you have followed my previous post on how to join a CentOS 6 (RHEL 6 works too) and that you have two linux machines that have joined the domain. A second machine is only needed for testing purposes, you could use putty instead. I needed the second machine for other purposes, so that is the route I chose. I have also tested it with putty and it does work as well.

Here is the list of steps needed:

1. From the Windows domain controller run the following command, which will create spns and upns. Note that you will need to run it as Administrator:

   ktpass -princ host/adtest.my.org@MY.ORG -mapuser MY\adtest$  -pass Passw0rd123 -ptype KRB5_NT_PRINCIPAL -crypto All -out adtest.keytab


2. Copy adtest.keytab to your linux box, I simply mounted the c drive of the DC on the linux box, but this might not be available to you.
3. If your server doesn't have a keytab file (/etc/krb5.keytab), then you can just move adtest.keytab to /etc/krb5.keytab otherwise you will need to merge it, which you can do with the ktutil tool, see this link for instructions.
4. [Optional] Limit encryption to RC4-HMAC, by editing the kerberos configuration file /etc/krb5.conf and adding the following to the [libdefaults] directive:

default_tkt_enctypes=rc4-hmac
default_tgs_enctypes=rc4-hmac
permitted_enctypes =rc4-hmac

5. Restart the OpenSSH daemon:

   service sshd restart

6. Configure the OpensSSH client. This will limit SSO to hosts in the domain:

Host *.my.org
GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes

7. Repeat steps 1 to 6 for the second server if needed.
8. Login to first server with a domain account that has linux attributes set.
9. Ensure that a Kerberos ticket has been issued: 

klist

Ticket cache: FILE:/tmp/krb5cc_10000_TjT7rk
Default principal: linuxuser@MY.ORG

Valid starting     Expires            Service principal
02/28/12 17:41:06  02/29/12 03:39:31  krbtgt/MY.ORG@MY.ORG
        renew until 02/29/12 03:41:06

10. Open secure shell on second server, which will log you without a prompt for credentials
    

    ssh adtest5.my.org

It is very important that name resolution is working correctly as you could get issues if it doesn't work properly, thus an up to date DNS server is quite useful. If you don't have a DNS server make sure that your hosts files are up to date with all the server names involved.

If you hit any problems, the simplest way to trouble shoot is to open a debug ssh daemon, which you can do like this (you can add a couple more ds for extra debug info but I think debug1 is all you need):

/usr/sbin/sshd -p 31415 -d

You'll need to allow traffic on port 31415 or the port you choose, which you can easily do by stopping iptables. Clearly this should only be done in servers that are not internet facing. If the server is internet facing then just open port 31415, e.g:

iptables -I INPUT -p tcp --dport 31415 -j ACCEPT

You can connect to this server with:

ssh servername -p 31415 -v

This should tell you what the problem is, e.g:

debug1: Unspecified GSS failure.  Minor code may provide more information
Key table entry not found

This was actually caused by a name resolution problem.

Join RHEL 6 server to a Windows 2003 Active Directory domain.

I think I might be losing my mind. At work a colleague asked me for instructions on how to join a RHEL6 box to a windows domain and I just pointed him to my blog, but he could not find the post I had in mind, because it looks as if I've not actually posted it, so here it goes:

1. Ensure that name resolution is working. At the very least you should be able to ping your domain controller, in my case mars.dev.com. If you can't, have a look at your /etc/resolv.conf file. Sample file:

   search dev.com test.com
   nameserver 10.168.20.203

2. Depending on your installation type, you might have to install several of the packages below (It looks like I went for a base install only):

   yum install pam_krb5 pam_ldap nss-pam-ldapd samba policycoreutils-python -y

3. Run authconfig-tui. Make sure that Kerberos realm is in capitals:
   
   

   
   

   

   
   

   
4. Ensure that Name Service Switch is configured for ldap authentication. In essence, check that /etc/nsswitch.conf has the following values:

passwd:     files ldap

shadow:     files ldap

group:      files ldap

5. Edit the local LDAP name service daemon configuration (/etc/nslcd.conf). A bind account to the Active Directory is needed, so create that account now (I have created binding in the Users OU). The mappings (for Microsoft Service for unix 3.5) need to be modified. Below is a list of changes to /etc/nslcd.conf:

binddn cn=binding, cn=User,dc=dev,dc=com

bindpw mypass 

#The Default search scope

scope sub 

#Customize certain database lookups

base   group  dc=dev,dc=com

base   passwd dc=dev,dc=com

base   shadow dc=dev,dc=com

# Mappings for Services for UNIX 3.5

filter passwd (objectClass=User)

map    passwd uid              msSFU30Name

map    passwd uidNumber       msSFU30UidNumber

map    passwd gidNumber       msSFU30GidNumber

map    passwd userPassword     msSFU30Password

map    passwd homeDirectory    msSFU30HomeDirectory

map   passwd  LoginShell       msSFU30LoginShell

filter shadow (objectClass=User)

map    shadow uid              msSFU30Name

map    shadow userPassword     msSFU30Password

filter group  (objectClass=Group)

map    group  uniqueMember     msSFU30PosixMember

map    group gidNumber       msSFU30GidNumber

6. Change permissions on /etc/nslcd.conf file so that it is only readable by root:

   chmod 600 /etc/nslcd.conf

7. Ensure that the local LDAP name service daemon (nslcd) is set to start with the server:

   chkconfig nslcd on

8. Edit /etc/samba/smb.conf. Make sure that there is only a security directive active. Comment out all others.

Network Related Options

workgroup =dev

Domain members options

security = ads

realm = DEV.COM

use kerberos keytab = true  #not really sure about this one

password server = mars.dev.com

9. Ensure that iptables lets traffic through on port 389:

iptables –I INPUT –p tcp --dport ldap –j ACCEPT; service iptables save

10. Run the following command to join the domain:

net ads join –U domainadmin

11. At this point you have successfully joined to the AD domain, you can test this by getting a list of users or group. You should get back the users and/or groups that have linux attributes, at least the binding account.

    getent passwd

    getent group

12. In order to create a user's home directory on first login add this directive to /etc/pam.d/sshd. I only log on using ssh. If you are logging in at the box, rather than remotely, you need to modify /etc/pam.d/logon too, I believe. Note that this will not work if SELinux is on.

    session required pam_mkhomedir.so skel=/etc/skel umask=0022

13. Allow polyinstatiation in SELinux settings:

     setsebool -P allow_polyinstantiation 1

14. Temporarily set SELinux to permissive:

setenforce 0

15. If you login with a domain user (ssh binding@domaintest, where domaintest is the server that has just joined the domain), the directory will be created, but you will also have a record of what would've gone wrong on /var/log/audit/audit.conf had SElinux been on, which in my case is this:

type=AVC msg=audit(1329063091.971:160): avc:  denied  { create } for  pid=5510 comm="mkhomedir_helpe" name="binding" scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:home_root_t:s0 tclass=dir type=AVC msg=audit(1329063091.973:161): avc:  denied  { create } for  pid=5510 comm="mkhomedir_helpe" name=".bashrc" scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:home_root_t:s0 tclass=file type=AVC msg=audit(1329063091.973:161): avc:  denied  { write open } for  pid=5510 comm="mkhomedir_helpe" name=".bashrc" dev=dm-0 ino=263825 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:home_root_t:s0 tclass=file type=AVC msg=audit(1329063091.973:162): avc:  denied  { setattr } for  pid=5510 comm="mkhomedir_helpe" name=".bashrc" dev=dm-0 ino=263825 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:home_root_t:s0 tclass=file type=AVC msg=audit(1329063092.015:163): avc:  denied  { setattr } for  pid=5510 comm="mkhomedir_helpe" name="binding" dev=dm-0 ino=263284 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:home_root_t:s0 tclass=dir

16. Create a SELinux policy module to allow the creation of home directories when the user first logs in:

    less /var/log/audit/audit.log  | grep denied > mkdir.log 

    audit2why < mkdir.log 

    audit2allow -M mkdir -i mkdir.log 

    semodule -i mkdir.pp

17. Renable SELinux:

    setenforce 1

I wonder how much tweaking, if any, will be required for a Windows 2008 Active Directory domain.

NTP -- Synchronize time using other NTP peers

Let's start by configuring an NTP server. You can install the ntp server with:

yum install ntp -y

Make sure that it starts on system start up:

chkconfig ntp on

Open the firewall and save the changes:

 iptables -I INPUT -p udp --dport ntp -j ACCEPT; service iptables save

Edit the ntp config file /etc/ntp.conf and add the following line:

restrict 10.168.20.0 mask 255.255.255.0 nomodify notrap

This will allow any client in the 10.168.20.0 network to get its time from the ntp server, except that it does not quite do it for me, as I don't have an internet connection. This is because a local server is way down in the pecking order or stratum, so a few extra steps are required:

echo "10.168.20.227" >> /etc/ntp/step-tickers
echo "10.168.20.227" >> /etc/ntp/ntpservers

Assuming that 10.168.20.227 is the ip address of your ntp server. You can now start your ntp server with:

service ntpd start

Interestingly, there are no SELinux settings related to ntp and you can block hosts by using iptables rules.

In order to configure a client to use this ntp server, simply add the following line to the ntp config file of your server:

server 10.168.20.227

Set the ntp daemon to start at boot time and start the service:

chkconfig ntpd on
service ntpd start

You can now use the following command to check the configuration is working:

ntpq -p

which should have a result like this:

          remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 10.168.20.227   LOCAL(0)        11 u   45   64    1    0.479  263675.   0.000

SSH -- Configure additional options described in documentation

How long is a piece of string?

All I can say about this objective, is that you had better familiarize yourself with the SSH daemon config file (/etc/ssh/sshd_config) and the manual pages (man sshd & man sshd_config) as well as the ssh client config (/etc/ssh/ssh_confg) and manual pages (man ssh & man ssh_config).

SSH -- Configure key-based authentication

This is actually a fairly simple objective. The default configuration is to accept key-based authentication, note this line on the /etc/ssh/sshd_config file:

#PubkeyAuthentication yes

Although the line is commented out, this is actually the default and as such does no need to be explicitly stated, if you wanted to prevent key based authentication, just add this line:

PubkeyAuthentication no

At any rate back to the objective. On the client, issue the following command, and follow the instructions, to generate a key:

ssh-keygen

Note that you don't actually need to add a passphrase, just press enter. This will allow you to login without being prompted for a passprhase.

The last step is to copy the public key that you have just generated to the server you want to login to:

ssh-copy-id  user@<servername>

That's it, if you did not provide a passphrase, you should be able to login with:

ssh user@<servername>

Note, that both ssh-keygen and ssh-copy-id have several options and that you should study them to see what they do.

I guess that in the exam you could be asked to install ssh, even if it does get installed by default. At any rate, just issue the following command:

yum install openssh-server -y

You should then make sure that it is set to run at boot time:

chkconfig sshd on

You can allow ssh traffic through by opening port 22:

iptables -I INPUT -p tcp --dport 22 -j ACCEPT; service iptables save

Depending on your configuration, you might need to change SELinux settings. You can check the SELinux settings like this:

getsebool -a | grep ssh

Finally, you can limit the users that can login by using the DenyUsers directive in the  /etc/ssh/sshd_config file like so:

DenyUsers naughtyuser

Remember to restart the daemon after any changes:

service sshd restart

If you want to prevent hosts from accessing SSH, you can do it by using iptables rules, e.g.:

iptables -I INPUT -p tcp --dport 22 -s 10.168.20.233 -j DROP; service iptables save

I think this pretty much covers this objective.

SMTP -- Configure an MTA to forward (relay) email through a smart host

This is actually quite simple. You need to modify the following line in the postfix config file (/etc/postfix/main.cf):

relayhost = 10.168.20.227

This will relay emails to host 10.168.20.227, which means that this host needs to be configured as Postfix server, see my previous post here.

Note that you still need to change other configuration settings as detailed in my previous post.

SMTP -- Configure a mail transfer agent (MTA) to accept inbound email from other systems

Postfix is normally installed by default, but just in case it isn't, you can install it with:

yum install postfix mailx -y

mailx is useful to test that you have configured Postfix correctly. You will need to open port 25 for Postfix to work properly, like this:

iptables -I INPUT -p tcp --dport 25 -j ACCEPT; service iptables save

There only appears to be a single SELinux setting related to Postfix, and it seems to be switched on by default:

allow_postfix_local_write_mail_spool --> on

Make sure that Postfix will run when the server reboots and start the service:

chkconfig postfix on
service postfix start

Finally, if you want to prevent users from sending emails, you could add the following directive to the Postfix config file:

smtpd_recipient_restrictions =
        check_sender_access hash:/etc/postfix/restricted_senders

You can now add any users you want to prevent from sending email by adding them to this file like this:

 testuser@dev.com reject

The usual suspects covered let's get back to the objective. You'll need to edit the postfix configuration file (/etc/postfix/main.cf) and make sure you set and uncomment the following settings:

myhostname = redhat.dev.com
mydomain = dev.com
myorigin = $mydomain
inet_interfaces = all
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain

You can now restart postfix and test your configuration remotely, see this post for details.

SMB -- Provide network shares suitable for group collaboration

In sharp contrast to the similar objective for NFS, this objective is clearly defined and easily achievable.

I have added a group called Users to my system and created a few users giving them the group Users as a supplemental group (e.g. useradd -G Users auser). Created a samba password for these users and then added the following to my /etc/samba/smb.conf file:

[myothershare]
browseable=yes
path = /myshareddirectory
force group = +Users
valid users = @Users myuser
write list = @Users
create mask = 0770
force create mode =660

Now, let's set SELinux settings (I'm assuming that you have already set samba_export_all_ro as per my previous post):

 setsebool -P samba_export_all_rw 1

And the security context type:

 chcon -t samba_share_t /myshareddirectory/

Let's set ownerships and permissions:

   chgrp Users /myshareddirectory/
   chmod -R 770 /myshareddirectory/

You can now,assuming that your server is 192.168.1.64, finally, mount the share with (you might need to install cifs-utils):

mount.cifs //192.168.1.64/mycolshare /test -o user=myuser

When you create a file now it should have rw permissions for both owner and group and thus files should be read and writeable for any users in the Users group.

-rw-rw----. 1 502 501 0 Jul  8 20:45 createdbyanotheruser
-rw-rw----. 1 501 501 0 Jul  8 21:02 createdbyauser

SMB -- Provide network shares to specific clients

The crux of this objective lies with the /etc/samba/smb.conf file, which is where all the samba (smb shares are configured).

In order to install samba, just issue the following command:

yum install samba -y

You will need to open the firewall for ports 139 & 445 (don't forget to save it):

iptables -I INPUT -p tcp --dport 139 -j ACCEPT
iptables -I INPUT -p tcp --dport 445 -j ACCEPT

Make sure that samba starts with the system:

chkconfig smb on
chkconfig nmb on

There are a few SELinux settings related to samba(default settings):

samba_create_home_dirs --> off
samba_domain_controller --> off
samba_enable_home_dirs --> off
samba_export_all_ro --> off
samba_export_all_rw --> off
samba_run_unconfined --> off
samba_share_fusefs --> off
samba_share_nfs --> off
use_samba_home_dirs --> off
virt_use_samba --> off

Note, that there is a bit off information regarding SELinux contexts on the samba config file.

You can now start samba with:

service smb start; service nmb start

Let's get back to the objective, say you want to create a share called myshare to all clients in your network, you'll need to edit /etc/samba/smb.con like this:

[myshare]
        comment=A share for me
        path = /myshareddirectory
        browseable = yes
        writable = no
        valid users=myuser
        hosts allow = 192.168.1. 10.168.1.65
        hosts deny = 192.168.1.33

This share will be available to all hosts in 192.168.1.0, except for 33 and also to 10.168.1.65.
You'll need to set the following SELinux setting to allow to list the files:

setsebool -P samba_export_all_ro 1

and if you want to set the share as writable, you'll also need this:

setsebool -P samba_export_all_rw 1

Remember to change the security context type of your shared directory, in my case:

chcon -t samba_share_t /myshareddirectory

You need to add the samba user myuser:

smbpasswd -a myuser

You can now,assuming that your server is 192.168.1.64, finally, mount the share with (you might need to install cifs-utils):

mount.cifs //192.168.1.64/myshare /test -o user=myuser

NFS -- Provide network shares suitable for group collaboration

At first, I thought that this was in essence the same objective as Create and configure set-GID directories for collaboration, where the folder that you set up is also shared and writeable to everybody, ie chmod 4777, but I'm not sure that this is actually the case, as you are depending on the user's umask to set the right permissions for the files created, in other words you need to make the files world writeable.

An alternative is to set the uid and gid of the anonymous user so that they match the owner of the share, but this is also the same as making it world writable, just a little bit more elegantly and you still need to set up the directory for collaboration in the NFS server, if that is indeed required. In a similar vein, you can change the shared directory's ownership to nfsnobody.

It is worth bearing in mind that NFS works using uid and gids, so that if you set the gid (or the uid) to 514 and the client does not have a group with gid 514 it won't know who to match, so you will get permissions errors. More intriguingly, if you set  an (either anonuid or anongid) on the share (e.g. home/col *(rw,sync,anongid=514)) and create a file with a user that has uid =gid=501 and has 514 as a secondary group, the file will belong to user with uid=501 in the server, which may or may not be the same user as in the client. In other words, this needs some sort of directory service to work properly, which to me sounds more complicated than the average objective, even for the RHCE exam.

Thus, in essence, in other for this to work properly you need to have both server and client being member of a domain, then set up group collaboration on a share where the group owner is a domain group and finally simply export the share, which al seems way beyond the average objective as I said above.

Since I've meaning for a while to write a post about setting openLDAP up, so once this is done, I will update this post.

NFS -- Provide network shares to specific clients

The crux of this objective lies with the /etc/exports file, which is where all the available nfs shares are configured.

In the exam you might have to install nfs, which you can do with:

yum install nfs-utils -y

You will need to open the firewall for port 2049 (don't forget to save it):

iptables -I INPUT -p tcp --dport nfs -j ACCEPT
iptables -I INPUT -p udp --dport nfs -j ACCEPT

Make sure that nfs starts with the system (Make sure the rpcbind is also set to start with the system):

chkconfig nfs on
chkconfig nfslock on

There are a few SELinux settings related to nfs (default settings):

allow_ftpd_use_nfs --> off
allow_nfsd_anon_write --> off
git_system_use_nfs --> off
httpd_use_nfs --> off
nfs_export_all_ro --> on
nfs_export_all_rw --> on
qemu_use_nfs --> on
samba_share_nfs --> off
use_nfs_home_dirs --> on
virt_use_nfs --> off
xen_use_nfs --> off

You can now start nfs with:

service nfs start

Let's get back to the objective, say you want to share directory /distro to all clients in your network, you'll need to edit /etc/exports like this (assuming that your network is 10.168.20.0):

/distro  10.168.20.0/24(ro)

Note that there is no space between the address/mask and the export options. Similarly, if you just want to share to a single client you can specify it by ip address or hostname or even fqdn, like this:

/distro 10.168.20.225(ro,sync)
/distro rhel6test.dev.com(ro,sync)
/distro 10.168.20.225(ro,sync) rhel6test.dev.com(ro,sync)
/distro 10.168.20.0/24(ro,sync) rhel6(ro,sync)

Note that the third line is the same as the first two lines combined and the fourth is just another example of how options can be combined.
You can now export the filesystems and restart nfs with:

exportfs -av; service nfs restart

FTP -- Configure anonymous-only download

This objective has mostly been covered here. This time I tried from a different server to test the server and I had this strange behaviour:

ftp 10.168.20.233
Connected to 10.168.20.233 (10.168.20.233).
220 (vsFTPd 2.2.2)
Name (10.168.20.233:root): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (10,168,20,233,38,221).
ftp: connect: No route to host
ftp> cd pub

250 Directory successfully changed.
ftp> ls
227 Entering Passive Mode (10,168,20,233,161,152).
ftp: connect: No route to host
ftp> pwd
257 "/pub"

After a bit of hunt, I discovered that the ip_conntrack_ftp module is needed for passive mode to work properly, thus:

modprobe ip_conntrack_ftp; service vsftpd restart

It works fine now:

ftp 10.168.20.233
Connected to 10.168.20.233 (10.168.20.233).
220 (vsFTPd 2.2.2)
Name (10.168.20.233:root): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (10,168,20,233,141,198).
150 Here comes the directory listing.
drwxr-xr-x    2 0        0            4096 May 26  2010 pub
226 Directory send OK.

Now, we just need to make it permanent, which requires a script to be written. Note that this needs to have a .modules extension and be placed in the /etc/sysconfig/modules directory:

#!/bin/sh
exec /sbin/modprobe ip_conntrack_ftp >/dev/null 2>&1

I have called mine ip_conntrack_ftp.modules thus in order to make it executable, I issue this command:

chmod +x  /etc/sysconfig/modules/ip_conntrack_ftp.modules

Note that there are no SELinux settings related to this objective and that in order to prevent hosts from accessing the service you should use an iptables rule. User based authentication is enabled by default, as local users are enabled by default (local_enable=YES), but in order to allow access to them you will need to set this SELinux setting:

setsebool -P ftp_home_dir 1

To me this conflicts with the objective of configuring anonymous-only download, but would seem to satisfy Configure host-based and user-based security for the service, so it's hard to say for sure

A caching-only name server Redux

I must say that I was not very satisfied with this post about a caching-only name server. I had to faff about with the named.ca file and disable dnssec, all in all it just left a very dissatisfied me. Thus, I thought I would had a go with a VM running from my laptop, so that I would have access to internet.

I installed bind:

yum install bind -y

This is the /etc/named.conf file:

options {
        listen-on port 53 { any; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { any; };
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;
        dnssec-lookaside auto;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";

Note changes to default file in bold.

Made sure about the usual suspects:

chkconfig named on

iptables -I INPUT -p udp --dport 53 -j ACCEPT; iptables -I INPUT -p tcp --dport 53 -j ACCEPT;service iptables save

service named start

And these are the results of two dig queries:

dig www.fuji.jp
;; Query time: 953 msec
;; SERVER: 192.168.1.65#53(192.168.1.65)
;; WHEN: Fri Jul 01 17:36:16 2011
;; MSG SIZE  rcvd: 112

dig www.fuji.jp
;; Query time: 0 msec
;; SERVER: 192.168.1.65#53(192.168.1.65)
;; WHEN: Fri Jul 01 17:36:19 2011
;; MSG SIZE  rcvd: 112

This feels a lot more satisfying. In this world of fast internet connections even a name query across several thousand miles takes less than a second, which makes me doubt the usefulness of a caching name server. I'm not saying that I cannot be useful, I'm just saying that it is of no use to me now

DNS -- Configure a caching-only name server to forward DNS queries

Hot on the heels of my previous post comes this one. Assuming that you have followed the previous post simply, add the following lines to your /etc/named.conf file in the options section (change the ip address to whatever you dns server is):

forwarders {10.168.20.233;};
forward only;

Restart the bind daemon and off you go.

Note that since we are actually forwarding name queries, there is no need to modify the /var/named/named.ca file, like I had to do in the previous post.

DNS -- Configure a caching-only name server

I must confess, yet again, that I'm not 100% sure what this objective refers to. My understanding is as follows: A caching server is, as its name indicates, used to cache queries, therefore an authoritative server is needed to first provide the actual answer that will be cached by this server, so far so good. I think this is geared towards having a single DNS server within an organization, so that internet name queries are cached on this server.

My RHEL6 boxes don't have internet access, so this has been a little bit awkward for me to test. I essentially set up a master DNS server and then modified the /var/named/named.ca file in the caching name server, where I changed the ip address of one the servers to be my master dns server, like this:

M.ROOT-SERVERS.NET.     3600000 IN      A       10.168.20.233

I think I might be getting a little bit ahead of myself. Let's start from the beginning and install Bind:

yum install bind -y

You'll now need to edit the bind configuration file /etc/named.conf and make a few changes:

listen-on port 53 { any; };
allow-query     { any; };

Given the fact that I had not configured DNSSec properly I also commented the dnssec lines out.

/*      dnssec-enable yes;
        dnssec-validation yes;
        dnssec-lookaside auto;
*/

Ensure that the Bind daemon is set to run at boot time:

chkconfig named on

Open up the firewall and save the changes:

iptables -I INPUT -p udp --dport 53 -j ACCEPT; iptables -I INPUT -p tcp --dport 53 -j ACCEPT;service iptables save

You can now start named:

service named start

The best way to test this is to use dig and look at the times it takes to run a query. In my case, I can just turn off the master dns server and if the results are cached, then I will get a response, e.g.:

dig myserver.domain.com
;; Query time: 2 msec
;; SERVER: 10.168.20.234#53(10.168.20.234)

dig myserver.domain.com
;; Query time: 0 msec
;; SERVER: 10.168.20.234#53(10.168.20.234)

This feels a little bit unsatisfying, so I used the tc command to add a 200 milisecond delay to all traffic on eth0 (note that this is done in the master dns server)

tc qdisc add dev eth0 root netem delay 200ms

I bounced the caching server and tried again with dig:

dig myserver.domain.com
;; Query time: 202 msec
;; SERVER: 10.168.20.234#53(10.168.20.234)

dig myserver.domain.com
;; Query time: 0 msec
;; SERVER: 10.168.20.234#53(10.168.20.234)

A lot better this time :). It now makes a bit more sense to have a caching name server.

Note that the cache is stored in memory and therefore will disappear after a reboot of the server or of named itself, see here.

Also note, that there are no SELinux settings related to this objective and that in order to prevent hosts from accessing the service you should use an iptables rule.

Rng-Utils and Entropy RHEL6 style

I gave configuring DNSSEC a go last night but I had a bit of a problem. When I ran this command to create the key for my domain zone:

dnssec-keygen -a RSASHA1 -b 1024 -n ZONE domain

This was the result, for a while

Generating key pair.

It seemed to hang there. The problem turns out to be a lack of entropy, which can be checked with this:

cat /proc/sys/kernel/random/entropy_avail
73

It turns out that this is not good enough to generate a key, so the standard advice is to try to compile a kernel or generate some I/O work. Compiling a kernel was really not an option, so I tried to generate some I/O work but to no avail. After a googling for a bit I came across the rng daemon, which will generate a bit of entropy for you.

rngd -r /dev/urandom -o /dev/random -b

Now entropy in the system is:

cat /proc/sys/kernel/random/entropy_avail
3968

Which is enough to generate the key. Note that /dev/urandom is not truly random, as it will use SHA1 to generate random data when the entropy pool has been depleted, see this for a better explanation. However, this is good enough for my test system.

You need to install rng-tools in RHEL6 to use the rng daemon, note that it is no longer rng-utils.

HTTP/HTTPS -- Configure group-managed content

I must confess that I'm not sure what this objective refers to. I initially thought this referred to group authentication, however when I tried to find other what other people were saying I came up empty. This blog does not cover it, neither does this one. It does not seem to be covered by this book. I was about to give up, when I found this blog, where the objective is simply to set up a directory that is configured for collaborative editing.
Note that there is an error, step four should use chown rather than chgrp.