installing:

yum install acl

check default mount options on block:

dumpe2fs /dev/sda2 | grep acl

apply acl to block:

tune2fs -o acl /dev/sda2

 Partitions created on install automatically mounted with acl

edit fstab to add fs option:

acl

remount device:

mount -o remount 

on home dirs:

chmod 701 /home/
setfacl -m mask: 

manage acls:

# set acls
setfacl -m [d:]u:: 
setfacl -m [d:]g:: 

# get acls
getfacl 

# remove acls
setfacl -x u: 
setfacl -x g: 
setfacl --remove-all 
setfacl --remove-default 

create group:

groupadd -g # 

add users to group:

usermod -g  

chown dir:

chown root: 

chmod dir SGID:

chmod <2770|g+s> 

install:

rpm -ivh 

update:

rpm -Uvh 

freshen:

rpm -Fvh 

remove:

rpm -e 

query by filename:

rpm -qf /path/to/file

verify file:

rpm -Vf /path/to/file

query all installed:

rpm -qa

Find out what files have been modified since package install

rpm -qf /etc/inittab
rpm -V -p init-scripts*.rpm

query all files associated

rpm -ql squid | grep ncsa

 while inside the rescue environment, use the –-root option to specify the real location of your root file system (e.g. –-root=/mnt/sysimage).

install new kernel:

yum install kernel
rpm -ivh 

check grub conf has been updated:

less /boot/grub/grub.conf

edit the yum repo conf /etc/yum.repos.d/:

[id]
name=the name of your repo
baseurl=http://locationofyourrepo.example/repo
enabled=1
gpgcheck=0

• Main configuration is in /boot/grub/grub.conf
• see examples in /usr/share/doc/grub-*/menu.lst
• /boot/grub/grub.conf = default=0 (references system kernel to boot into)

to create new init ram disk:

mkinitrd /boot/initrd-`uname -r`.img `uname -r`

to use software raid, we need two devices/partitions set to “linux raid autodetect”, use fdisk and set partition type to “fd”

create a raid device:

mdadm --create /dev/md0 -a yes --level=<0|1|4|5|6||10> --raid-devices=2 /dev/sda7 /dev/sda8

 Watch the -a yes for udev to create device file on reboot

format raid device:

mkfs.ext3 /dev/md0

remove disk from array:

mdadm /dev/md0 --remove 

add disk to array:

mdadm /dev/md0 --add 

fail a disk:

mdadm /dev/md0 --fail 

stop array:

mdadm --stop /dev/md0

check status:

mdadm --detail /dev/md0
cat /proc/mdstat

 Remember to add raid device into /etc/fstab and check mounting device

config in /etc/sysctl.conf

# search for options
sysctl -a | grep 
# apply changes made to config
sysctl -p

 Need to look into what is reqired here ?

Redhat config tool:

system-config-date

config file locate /etc/ntp.conf

configuration server example:

server 0.pool.ntp.org
server 1.pool.ntp.org
server 2.pool.ntp.org

apply changes after config change:

service ntpd restart
chkconfig ntpd on

verify changes:

ntpq -p

boot into rescue mode:

linux rescue

• when working in non-chrooted environment:
  • mount /dev/hdc /mnt/cdrom to access install dvd
  • rpm commands require -root=/mnt/sysimage

manually make /dev and /proc available in chrooted mode:

mount -o bind /dev /mnt/sysimage/dev
mount -o bind /proc /mnt/sysimage/proc

check the following in order:

• MBR
• /boot/grub/grub.conf
• /etc/fstab
• /etc/inittab
• /etc/rc.d/rc.sysinit
• /etc/rc.d/rc?.d
• /etc/rc.d/init.d/*
• /etc/rc.d/rc.local

grub errors

• in general, use the last line before the error message to see where grub error'd out
• to find correct value for root option, type find /grub/stage1 at the grub command line ( remember that all file names in grub.conf are relative to the root option)
• check for missing files in kernel and/or initrd lines

kernel errors

• missing/corrupt initrd file results in: kernel panic - not syncing: vfs: unable to mount root fs on unknown-block
• invalid root parameter for kernel results in: setuproot: error mounting /proc: No such file or directory

reinstall grub on MBR:

grub-install 

new initrd:

mkinitrd /boot/initrd-`uname -r`.img `uname -r`

corrupt filesystem:

fsck 

if fsck is unable to locate a superblock, you can specify an alternative one: :

dumpe2fs 
fsck -b  

check which process on listening on what port:

netstat -ntaupe | grep LIST

redhat lvm tool:

system-config-lvm

create physical volume partition:

fdisk 
Command (m for help) : t
Partition number (1-4)
2
Partition ID (L to list options): 8e
Command (m for help) : w

create physical volume:

pvcreate 

create volume group:

vgcreate  

extend volume group:

vgextend  

create logical volume:

lvcreate --size 10G --name  
mkfs.ext3 /dev//
# add to /etc/fstab

extend logical volume:

lvextend --size 12G /dev//
resize2fs /dev//

shrink logical volume:

resize2fs  M
lvreduce --size M 

remove logical volume:

lvremove 

display volumegroup info:

vgdisplay 

enable/disable SELinux in /etc/sysconfig/selinux:

SELINUX=enforcing
SELINUXTYPE=targeted

install setroubleshoot:

yum install setroubleshoot
service setroubleshoot start
chkconfig setroubleshoot on

install selinux management tool:

yum install policycoreutils-gui

redhat selinux management tool:

system-config-selinux

change selinux status:

setenforce 

launch setroubleshoot gui browser:

sealert -b

list selinux booleans:

getsebool -a

list selinux errors:

sealert -a /var/log/ | less

set selinux boolean:

setsebool -P  = <0|1>

list security contexts:

ls -Z 

change security contexts:

# using reference (copy contexts from existing known-good file)
chcon -R --reference  

# manual
chcon -R -u  
chcon -R -t  

yum install httpd mod_ssl
chkconfig httpd on

start/stop apache:

apachectl start/stop/graceful/restart

chcon -R -u system_u 
chcon -R -t httpd_sys_context_t 
chcon -R --reference /var/www 

cd /etc/pki/tls/certs
make httpd.crt ## include passphrase

#decrypt key
openssl rsa -in httpd.key -out decrypted.key
mv decrypted.key ../private/httpd.key

• ~user/ requirements
  • UserDir directive
  • chmod 701 homedir
  • change security context on user homedir
  • chmod 705 /home/user/public_html
• .htaccess requirements
  • AllowOverride All directive
• NameBasedVitual Hosts requirements
  • NameVirtualHost *:80 NameVirtualHost *:443 to be specified in /etc/httpd/conf/httpd.conf
  • Each virtual host needs = ServerAdmin / DocumentRoot / ServerName / ErrorLog / CustomLog
  • logs are in logs/

httpd -S
httpd -t
httpd -D DUMP_VHOSTS

Ports: 80/443 TCP

Firewall Edit:

system-config-securitylevel

hosts are allowed by default and will need to be explicitly denied:

>
     Order deny,allow
     Deny from 192.168.1.0/255.255.255.0
     Deny from somedomain.com

hosts are denied by default and need to be allowed:

>
     Order allow,deny
     Allow from 192.168.1.0/255.255.255.0
     Allow from somedomain.com

Web Password file

htpasswd -c /path/to/file 
htpasswd /path/to/file 

Web group file /path/to/groupfile: testgroup: user1 user2

Access configuration users

>
     AuthType basic
     AuthName "locked site"
     AuthUserFile /path/to/userfile
     Require user user1

Access configuration groups

>
     AuthType basic
     AuthName "locked site"
     AuthUserFile /path/to/userfile
     AuthGroupFile /path/to/groupfile
     Require group testgroup

elinks ://address

yum install samba samba-client
service smb start
chkconfig smb on

Enable shared home dirs:

setsebool -P samba_enable_home_dirs=1

Mark directory sharable with samba:

chcon -R -t samba_share_t 

Redhat samba configuration tool:

yum install system-config-samba
system-config-samba

Set samba workgroup/domain:

workgroup = 

if no wins server available, enable:

wins support = yes

security modes:

# check the local pwdb (default)
security = user

# member server of a domain (uses DC as pwdb)
security = domain
password server = 
workgroup = 

# member of active directory domain
security = ads
password server = kerberos.domain.com
realm = EXAMPLE.COM

# use pwdb on another server thats not a DC
security = 

share options:

[]
# path for share
path =  

# share is visible 
browseable = 

# rw enabled
writeable = 

# this is a shared printer
printable = 

# all users connecting to this share use  as their primary group
group = 

join domain:

net rpc join -U root

fstab example:

///     cifs    user=,pass=    0 0

mount commands:

# root only
mount -o username= "//server/share" 
# users mount command
/sbin/mount.cifs //server/share  -o username=

 /sbin.mount.cifs & /sbin/umount.cifs require a chmod u+s to allow to be used by non-root users

firewall:

hosts allow/deny can be used per-server or per-share:

hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24
hosts deny = 0.0.0.0/0

account maintenance:

# add account (local linux account must exist first, or be translated via /etc/samba/smbusers):
smbpasswd -a 

# enable/disable account:
smbpasswd -e 
smbpasswd -d 

# remove account:
smbpasswd -x 

 service smb reload may be needed after account changes

list shares:

smbclient -L  -U 

browse shares:

smbclient /// -U 

test allow/deny statements for a host:

testparm /etc/samba/smb.conf  

yum install portmap nfs-utils
service nfs start
chkconfig portmap on
chkconfig nfs on
chkconfig nfslock on
chkconfig netfs on

Support for read-write access:

setsebool -P nfs_export_all_rw=1

redhat tool:

yum install system-config-nfs
system-config-nfs

/etc/exportfs format:

 () [() ...]

activate exports:

service nfs restart

• edit /etc/sysconfig/nfs to set static ports, and restart
• set host / network restrictions per export in /etc/exports

Add the following to /etc/hosts.allow:

portmap: 

mountd: 

rpc.statd: 

firewall config:

# see ports (include ALL tcp-udp ports)
rpcinfo -p

use normal file permissions

list exports:

showmount -e 

yum install vsftpd
service vsftpd start
chkconfig vsftpd on

allow local users to login to ftp and access local home dir:

setsebool -P ftp_home_dir=1

Configure non-standard directory for ftp ro/rw:

#read-only
chcon -R -t public_content_t 
#read-write
chcon -R -t public_content_rw_t 

To enable write access for anonymous users, set directory with the following, and enable the following boolean:

chcon -R -t public_content_rw_t 
setsebool -P allow_ftpd_anon_write=1

• use iptables -s !

  to block hosts

 ftp data transfers will not work unless ip_conntrack_ftp is added to IPTABLES_MODULES in /etc/sysconfig/iptables-config

tcp_wrappers:

vsftpd : 192.168.1.

• allow/deny controlled via /etc/vsftpd/user_list ( users in /etc/vsftpd/ftpusers are always denied via pam)
• default allow/deny is configured by userlist_deny statement in vsftpd.conf

lftp 

yum install squid
chkconfig squid on

vi /etc/squid/squid.conf

visible_hostname 

# deny sites
acl baddomains dstdomain .microsoft.com
acl baddomains dstdomain .hotmail.com

acl our_network src 192.168.1.0/24

http_access deny baddomains
http_access allow out_networks

Allow squid daemon to connect to the network:

setsebool -P squid_connect_any=1

firewall config:

to configure NAT to listen on port 8080:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 81 -j REDIRECT --to-ports 3128

allow access from local networks:

acl our_networks src 192.168.1.0/24 192.168.2.0/23
http_access allow our_networks

The following requires a web browser to test

edit the configuration /etc/squid/squid.conf:

# enable the following auth_param options
auth_param basic program /usr/lib/squid/ncsa_auth /usr/etc/passwd
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off

# change the acl to reflect auth_param
acl  proxy_auth REQUIRED

# finally edit the http_access line
http_access allow 

Allow squid to read htpasswd file:

chmod o+s /usr/etc/passwd

squid -z
service squid start
HTTP_PROXY=hostname:port elinks

yum install postfix
service sendmail stop
chkconfig sendmail off
alternatives --config mta
service postfix start
chkconfig postfix on

enable the following in /etc/postfix/main.cf

myhostname = 
mydomain = 
myorigin = $mydomain
inet_interfaces = all
mynetworks = 192.168.1.0/24, 127.0.0.1/8

mail aliases /etc/aliases:

: ,

 Remember to run newaliases command

vitual aliases hash:/etc/postfix/virtual:

: ,
# enable virtual aliases in main.cf:
virtual_alias_maps = hash:/etc/postfix/virtual

 Remember to postmap hash:/etc/postfix/virtual

outbound address rewriting in hash:/etc/postfix/generic:

@ @
# enable outbound rewriting in main.cf
smtp_generic_maps = hash:/etc/postfix/generic

 Remember to postmap hash:/etc/postfix/generic

• use iptables -s !

  to block hosts

copy postfix configuration from doc example /usr/share/doc/postfix-*/README_SASL*, and make sure MECH=PAM is configured in /etc/sysconfig/saslauthd

enable saslauthd:

service saslauthd start
chkconfig saslauthd on

restart postfix:

postfix reload

test smtp:

telnet  25
ehlo me
# check for 250-AUTH ... info

yum install dovecot
service dovecot start
chkconfig dovecot on

enable which protocols are to be used:

protocols = "list of protocols"

create the ssl certificate:

# edit cert settings
vi /etc/pki/dovecot/dovecot-openssl.cnf
/usr/share/doc/dovecot-*/examples/mkcert.sh
service dovecot restart

• use iptables -s !

  to block hosts

use pam_listfile in /etc/pam.d/dovecot

test mailbox access:

mutt -f ://@

yum install openssh-server
chkconfig sshd on

enable only local network through firewall (iptables):

# first we need to remove last reject rule
cat /etc/sysconfig/iptables
# Copy bottom reject rule to clipboard
iptables -D 
iptables -A  -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT
iptables -A 
service iptables save

firewall config:

tcp_wrappers example:

sshd : 192.168.0.

allow/deny user access:

AllowUsers user1 user2 [email protected]
DenyUsers user4 user5 [email protected]

test logging in:

ssh @

yum install bind-chroot caching-nameserver
service named start
chkconfig named on

copy sample config:

cp -a /var/named/chroot/etc/named.caching-nameserver.conf /var/named/chroot/etc/named.conf

caching-only nameserver:

• edit listen-on directives (comment out to listen on all interfaces)
• edit allow-query directives (comment out allow queries from everyone)
• edit match-clients and match-destinations directives to allow recursive queries from other hosts

slave nameserver:

• get slave example from /usr/share/doc/bind-*/sample/etc/named.conf

allow named to write in working directory:

setsebool -P named_write_master_zones=1

firewall config:

allow-query example:

allow-query { 192.168.0.0/16; localnets; };

N/A

test query:

dig @ 

test zone transfer:

dig @  axfr

yum install ntp
service ntpd start
chkconfig ntpd on

http://unixjournal.org/wiki/rhce#configure_ntp_for_time_synchronization_with_a_higher-stratum_server

firewall config:

system-config-securitylevel

allow others to sync with us:

restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap

N/A

show peers:

ntpq -p

RHCEs must also be able to:

yum install system-config-kickstart

1. make installation tree available
2. create kickstart file (use system-config-kickstart to create ks.cfg) and validate (using ksvalidator)
3. validate kickstart file
4. make kickstart file available
   • bootable diskette (place in top level directory)
   • bootable cdrom (place in top level directory)
   • network (http, ftp, nfs)
5. use bootable media and supply appropriate kernel parameter

ks=floppy:/ks.cfg
ks=cdrom:/ks.cfg
ks=http://example.com/ks.cfg
ks=nfs:example.com:/ks.cfg

 do not use system-config-securitylevel, as it will overwrite your custom iptables rules. the following method seems to be the best way to go:

1. make changes in /etc/sysconfig/iptables
2. run /etc/init.d/iptables restart to apply changes

packet filtering example:

-A  -p  -m  [-s[!] ] --dport  -j ACCEPT

enable ip forwarding in /etc/sysctl.conf:

net.ipv4.ip_forward = 1

to test from another machine:

ip route replace default via 

inbound dnat:

iptables -t nat -A PREROUTING -p  --dport  -j DNAT --to-dest :

outbound dnat:

iptables -t nat -A OUTPUT -p  --dport  -j DNAT --to-dest :

masquerading:

iptables -t nat -A POSTROUTING -o  -j MASQUERADE

snat:

iptables -t nat -A POSTROUTING -j SNAT --to-source :

• /usr/share/doc/pam-*/txts

• /etc/pam.d
• /etc/security

allow/deny users if listed in /etc/special:

auth required pam_listfile.so onerr=success item=user sense= file=/etc/special

file format:

 :  [except ] [: ]

search order:

1. /etc/hosts.allow
2. /etc/hosts.deny
3. allow by default

 searching stops on first match

 Make sure to append “ALL: ALL” into /etc/hosts.deny

unable to log in

• password wrong or expired?
• account locked?
• shell set to /sbin/nologin, /bin/false, etc.?
• user and PermitRootLogin no in /etc/ssh/sshd_config?
• root user and terminal not listed in /etc/securetty?
• non-root user and /etc/nologin exists?
• check pam_listfile restrictions