RedHat RH302 - RHCE (Redhat Certified Engineer)

Do the following steps as:

1.vi /etc/samba/smb.conf

[global]

netbios name=station?

workgroup = mygroup

server string=Share from Linux Server

security=user

smb passwd file=/etc/samba/smbpasswd

encrypt passwords=yes

hosts allow=192.168.0.

[data]

path=/data

writable=yes

public=no

browsable=yes

2.service smb start| restart

3.chkconfig smb on

Samba servers helps to share the data between linux and windows. Configuration file is /etc/samba/smb.conf. There are some pre-defined section, i. globaluse to define the global options, ii. Printersuse to share the printers, iii. homesuse to share the user’s home directory.

Security=uservalidation by samba username and password. May be there are other users also. To allow certain share to certain user we should use valid users option.

smbpasswdHelps to change user’s smb password. –a option specifies that the username following should be added to the local smbpasswd file.

If any valid users option is not specified, then all samba users can access the shared data. By Default shared permission is on writable=no means read only sharing. Write list option is used to allow write access on shared directory to certain users or group members.

To allow access the shared directory only from certain network or hosts, there is a option hosts allow= host or network. If this option is applied on global option, then it will apply to all shared directory.

Do the following steps as:

1.vi /etc/httpd/conf/httpd.conf

NameVirtualHost 192.100.0.X

ServerNamewww.abc.com

DocumentRoot /var/www/abc/

DirectoryIndexindex.html

ServerAdminwebmaster@abc.com

ErrorLog logs/error_abc.logs

CustomLog logs/custom_abc.logs common

ServerNamewww.example.com

DocumentRoot /var/www/example/

DirectoryIndexindex.html

ServerAdminwebmaster@example.com

ErrorLog logs/error_example.logs

CustomLog logs/custom_example.logs common

2.Create the directory and index page on specified path. (Index page can download fromftp://server1.example.comat exam time)

Check the SELinux context of index page , should like this:

-rw-r--r-- root root system_u:object_r:httpd_sys_content_t /var/www/html/index.html

If SELinux Context is mismatched, use the restorecon –R /var command

3.service httpd start| restart

4.chkconfig httpd on

5.links http://www.abc.com

6.links http://www.example.com

For Name based Virtual Hosting, we should specified the IP address on which we are going to host the multiple sites using NameVirtualHost options.

ServerName means you FQDN, already lookup on DNS

DirectoryRoot path for web documents for this site.

DirectoryIndex default page for websites.

Document directive is used in apache configuration file to specify the directory where all web site related documents are. According to question eric user should able to write into the Document root directory.

Better set the permission using ACL (Access Control List), to apply the permission using acl needs to mount the filesystem with acl options. Example in above answer documentroot is in /var and /var is mounting separate file system so needs to mount the /var file system with acl option.

vi /etc/fstab

LABEL=/var/varext3defaults 1 1

mount –o remount /var

setfacl –m u:eric:rwx /var/www/example

getfacl /var/www/example

getfacl and setfacl two commands used to maintain the permission through acl. setfacl is used to set the permission on file/directory, getfacl is used to display the permission of file/directory.

Your local domain mean example.com domain. Lookup the example.com using

host example.com you will get the IP address 192.168.0.254.

1.vi /etc/httpd/conf/httpd.conf

ServerNamesexample.com

DocumentRoot /var/www/example

DirectoryIndexindex.html

ServerAdminwebmaster@example.com

2.mkdir /var/www/example

3.Download the index.html file from the ftp server specified in question

4.Rename thewww.html file to index.html

Check the SELinux context of index page , should like this:

-rw-r--r-- root root system_u:object_r:httpd_sys_content_t /var/www/html/index.html

If SELinux Context is mismatched, use the restorecon –R /var command

5.service httpd start|restart

6.chkconfig httpd on

7.check using: links http://example.com

Do the following steps as:

1.vi /etc/mail/local-host-names

example.com

2.vi /etc/mail/sendmail.mc

dnl # DEAMON_OPTIONS(`Port=smtp,Addr=127.0.0.1,Name=MTA`)dnl

3.m4 /etc/mail/sendmail.mc >/etc/mail/sendmail.cf

4.vi /etc/mail/access

example.comRELAY

RELAY

5.service sendmail start | restart

6.chkconfig sendmail on

/etc/mail/local-host-names file contains the aliases to hostname. Mail server program reads the /etc/mail/sendmail.cf. To change the configuration on mail server, we should edit the /etc/mail/sendmail.mc file and should generate the sendmail.cf using m4command.

By default sendmail server allows to connect to local host only. So we should edit the /etc/mail/sendmail.mc file to allow connect to other hosts.

By default sendmail server will not forward mail. we should specify on /etc/mail/access to relay or to block mail coming from domain or network or individual email address.

Do the following steps as:

1.vi /etc/hosts.deny

in.telnetd:ALL EXCEPT 192.168.0.

We can secure the services using tcp_wrappers. There are main two files, /etc/hosts.allow and /etc/hosts.deny.

There will be three stage access checking

-Is access explicitly permitted? Means permitted from /etc/hosts.allow?

- Otherwise, Is access explicitly denied? Means denied from /etc/hosts.deny?

- Otherwise, by default permit access if neither condition matched.

To deny the services we can configure /etc/hosts.deny file using ALL and EXCEPT operation. Pattern of /etc/hosts.allow and /etc/hosts.deny file is:

Demon_list:client_list:options

In Client list can be either domain name or IP address. Here in.telnetd is the telnet server program name.

Do the following steps as:

1.vi /etc/dhcpd.conf

ddns-update-style none;

option routers 192.168.0.1;

option domain-name “example.com”;

option domain-name-servers 192.168.0.254;

default-lease-time 21600;

max-lease-time 43200;

subnet 192.168.0.0 netmask 255.255.255.0

{

range 192.168.0.1 192.168.0.254;

host dns1 {

hardware ethernet 00:50:FC:98:8D:00;

fixed-address 192.168.0.254;

}

host dns2 {

hardware ethernet 00:50:FC:98:8C:00;

fixed-address 192.168.0.253;

}

}

/etc/dhcpd.conf file is used to configure the DHCP. Some global options i.e Gateway, domainname, DNS server specified using option keyword. To assign as static ip from dhcp server, required the mac address of interface.

2. Check the SELinux Context, should be like this:

-rw-r--r-- root root system_u:object_r:dhcp_etc_t /etc/dhcpd.conf

3. Use the restorecon –R /etc command to restore the selinux context of the file.

4.service dhcpd start | restart

Do the following steps as:

1. Rename the file named.caching-nameserver.conf into named.conf file located into /var/named/chroot/etc

#mv /var/named/chroot/etc/named.caching-nameserver.conf /var/named/chroot/etc/named.conf

2. Check the permission and ownership as well as SELinux Context should be like as:

-rw-r----- root named system_u:object_r:named_conf_t /var/named/chroot/etc/named.conf

If selinux context is mismatch use the restorecon –R /var command

3.vi /etc/named.conf

zone “example.com” IN {

type master;

file “example.com.zone”;

};

/var/named/chroot/etc/named.conf file is used to register the zone as well as specify the global option for DNS server. There are two types of zone, i. Master, which contains the original data. ii. Slave, backup of master. Here is the example of master zone configuration.

4.vi /var/named/chroot/var/named/example.com.zone

$TTL 345345

@ IN SOA @ webmaster.example.com.(

101;Serial Number

1H;Refresh Time

1M;Retry Time

1W;Expire Time

1D;Minimum Time to Live

)

@ IN NS 192.100.0.X

www 0 IN A 192.100.0.1

www 0 IN A 192.100.0.2

www 0 IN A 192.100.0.3

www 0 IN A 192.100.0.4

www 0 IN A 192.100.0.5

3.service named start

4.rndc reload

5.chkconfig named on

6. Check the permission as well as SELinux Context should like this:

-rw-r--r-- root named root:object_r:named_zone_t /var/named/chroot/var/named/example.com.zone

If selinux context is mismatch use the restorecon –R /var command

7.service named start

8.rndc reload

9.chkconfig named on

Zone file should create on /var/named/chroot/var/named. Default Directory Path is specified on /var/named/chroot/etc/named.conf file.

$TTLTime To Live, How much seconds cache server stores the information about DNS. And Five Parameters specified Serial Number used by slave to synchronize withmaster server. Refresh and Retry Time used by slave server. NS is the Name (DNS) server where lookup the domain. A (Associated IP) for particular host.

Do the following steps as:

1.vi /etc/squid/squid.conf

#detault:

http_port8080

#Recommended minimum configuration:

# Near the src acl src section

acl mynet src 192.168.0.0/255.255.255.0

#Default:

# http_access deny all

#Under Herehttp_access allow mynet

2.service squid start

3.chkconfig squid on

squid is a proxy caching server, using squid we can share the internet, block the internet, to certain network. First we should define the port for squid, the standard port for squid is 3128. We can run squid on different port by specifying http_port portnumber.

To block or allow the Internet access to hosts, we should create the acl (Access Control List). In this file we can specify only the IP address.

Example: acl aclname src IP/NetmaskAfter creating acl we can block or allow the internet to specified acl.

http_access allow | deny alcname

Do the following steps as:

1.iptables –t filter –A INPUT –s ! 192.168.0.0/24 –p tcp --dport 22 –j DROP

iptables is the build-in firewall tools, used to filter the packets and for nat. By identifying Source Address, Destination Address, type of protocol, source and destination port we can filter the packets.

-sSource Address

-dDestination Address

-pLayer 3 Protocol

-dDestination Address

--sportSource Prot

--dportDestination Port

-iIncoming Interface

-oOutgoing Interface

-tTable either filter or nat or mangle

-AChain can be either INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING.

ssh service use the 22 port so we can block connection from outside the LAN.