RedHat RH302 - RHCE (Redhat Certified Engineer)

Do the following steps as:

1.vi /etc/exports

/storage*.example.com(rw,sync)

2.service nfs start

3.service portmap restart

4.chkconfig nfs on

5.chkconfig portmap on

In Linux to share the data we use the /etc/exports file. Pattern is:

Pathclient(permission)

Shared Directory Path, Client can be single host or domain name or ip address. Permission should specify without space with client lists in parentheses.

Do the following steps as:

1.vi /etc/exports

/data*.example.com(rw,sync)

2.service nfs start

3.service portmap restart

4.chkconfig nfs on

5.chkconfig portmap on

In Linux to share the data we use the /etc/exports file. Pattern is:

Pathclient(permission)

Shared Directory Path, Client can be single host or domain name or ip address. Permission should specify without space with client lists in parentheses. NFS is RPC service so, portmapper service should restart after starting the nfs service.

Do the following steps as:

1.vi /etc/samba/smb.conf

[global]

netbios name=station?

workgroup=station?

security=user

smb passwd file=/etc/samba/smbpasswd

encrypt passwords=yes

hosts allow= .example.com

[data]

path=/data

public=no

writable=no

write list=john

browsable=yes

2.smbpasswd -a john

3.service smb start

4.chkconfig smb on

/etc/samba/smb.conf. There are some pre-defined section, i. globaluse to define the global options, ii. Printersuse to share the printers, iii. homesuse the share the user’s home directory.

Security=uservalidation by samba username and password. May be there are other users also. To allow certain share to certain user we should use valid users option.

smbpasswdHelps to change user’s smb password. –a option specifies that the username following should be added to the local smbpasswd file.

If any valid users option is not specified, then all samba users can access the shared data. By Default shared permission is on writable=no means read only sharing. Write list option is used to allow write access on shared directory to certain users or group members.

Your local domain mean example.com domain. Lookup the example.com using

host example.com you will get the IP address 192.168.0.254.

1.vi /etc/httpd/conf/httpd.conf

<VirtualHost 192.168.0.254>

ServerNamesexample.com

DocumentRoot /var/www/example

DirectoryIndexindex.html

ServerAdminwebmaster@example.com

</VirtualHost>

2.mkdir /var/www/example

3.Download the index.html file from the ftp server specified in question

4.Rename thewww.html file to index.html

5.service httpd start|restart

6.chkconfig httpd on

7.check using: links http://example.com

Do the following steps as:

1.vi /etc/mail/local-host-names

example.com

2.vi /etc/mail/sendmail.mc

dnl # DEAMON_OPTIONS(`Port=smtp,Addr=127.0.0.1,Name=MTA`)dnl

3.m4 /etc/mail/sendmail.mc >/etc/mail/sendmail.cf

4.vi /etc/mail/access

RELAY

example.comRELAY

5.service sendmail start | restart

6.chkconfig dovecot on

7.vi /etc/dovecot.conf

protocols = pop3 pop3s

8.service dovecot start | restart

9.chkconfig dovecot on

/etc/mail/local-host-names file contains the aliases to hostname. Mail server program reads the /etc/mail/sendmail.cf. To change the configuration on mail server, we should edit the /etc/mail/sendmail.mc file and should generate the sendmail.cf using m4 command.

By default sendmail server allows to connect to local host only. So we should edit the /etc/mail/sendmail.mc file to allow connect to other hosts.

By default sendmail server will not forward mail. we should specify on /etc/mail/access to relay or to block mail coming from domain or network or individual email address.

By default dovecot service start only the imap protocol. To start pop protocol with dovecot, we should write in /etc/dovecot.conf file.

Do the following steps as:

1.vi /etc/samba/smb.conf

[global]

netbios name=station?

workgroup=station?

security=user

smb passwd file=/etc/samba/smbpasswd

encrypt passwords=yes

hosts allow= .example.com

[data]

path=/data

public=no

writable=no

browsable=yes

2.smbpasswd -a eric

3.service smb start

4.chkconfig smb on

/etc/samba/smb.conf. There are some pre-defined section, i. globaluse to define the global options, ii. Printersuse to share the printers, iii. homesuse the share the user’s home directory.

Security=uservalidation by samba username and password. May be there are other users also. To allow certain share to certain user we should use valid users option.

smbpasswdHelps to change user’s smb password. –a option specifies that the username following should be added to the local smbpasswd file.

Do the following steps as:

1.vi /etc/squid/squid.conf

#detault:

http_port8080

#Recommended minimum configuration:

# Near the src acl src section

acl allownet src 192.168.0.0/255.255.255.0

acl denynet src 192.168.1.0/255.255.255.0

#Default:

# http_access deny all

#Under Herehttp_access allow allownet

http_access deny denynet

2.service squid start

3.chkconfig squid on

squid is a proxy caching server, using squid we can share the internet, block the internet, to certain network. First we should define the port for squid, the standard port for squid is 3128. We can run squid on different port by specifying http_port portnumber.

To block or allow the Internet access to hosts, we should create the acl (Access Control List). In this file we can specify only the IP address.

Example: acl aclname src IP/NetmaskAfter creating acl we can block or allow the internet to specified acl.

http_access allow | deny alcname

Do the following steps as:

1.touch /etc/nologin

2.vi /etc/securetty

comment all available terminall then first.

If /etc/nologin file is created, then pam modules pan_nologin deny to all non-root users to login locally.

/etc/pam.d/login file calls the module.

#%PAM-1.0

auth requiredpam_securetty.so

auth requiredpam_stack.so service=system-auth

auth requiredpam_nologin.so

account requiredpam_stack.so service=system-auth

password requiredpam_stack.so service=system-auth

# pam_selinux.so close should be the first session rule

session requiredpam_selinux.so close

session requiredpam_stack.so service=system-auth

session optionalpam_console.so

# pam_selinux.so open should be the last session rule

session requiredpam_selinux.so multiple open

pam_securetty modules checks the /etc/securetty file, which terminal are available to root. If terminal is not available in this file then pam_securetty module deny to login on unavailable terminal to root user.

Do the following steps as:

1.vi /etc/hosts.deny

sshd:ALL EXCEPT .example.com

or

1.vi /etc/hosts.deny

sshd:ALL

2.vi /etc/hosts.allow

sshd:.example.com

We can secure the services using tcp_wrappers. There are main two files, /etc/hosts.allow and /etc/hosts.deny.

There will be three stage access checking

- Is access explicitly permitted? Means permitted from /etc/hosts.allow?

- Otherwise, Is access explicitly denied? Means denied from /etc/hosts.deny?

- Otherwise, by default permit access if neither condition matched.

To deny the services we can configure /etc/hosts.deny file using ALL and EXCEPT operation. Pattern of /etc/hosts.allow and /etc/hosts.deny file is:

Demon_list:client_list:options

In Client list can be either domain name or IP address.

Do the following steps as:

1.vi /etc/security/access.conf

-:jack:ALL EXCEPT station10.example.com

2.vi /etc/pam.d/system-auth

accountrequired/lib/security/pam_access.so

/etc/security/access.conf file helps to allow or deny login to users on the basis of origin.

Syntax of /etc/security/access.conf

permission : users : origins

The first field should be a "+" (access granted) or "-" (access denied) character.

The second field should be a list of one or more login names, group names, or ALL (always matches). A pattern of the form user@host is matched when the login name matches the "user" part, and when the "host" part matches the local machine name.

The third field should be a list of one or more tty names (for non-networked logins), host names, domain names (begin with "."), host addresses, internet network numbers (end with "."), ALL (always matches) or LOCAL (matches any string that does not contain a "." character).

The EXCEPT operator makes it possible to write very compact rules