RedHat RH302 - RHCE (Redhat Certified Engineer)

Do the following steps as:

1.vi /etc/hosts.deny

sshd:ALL EXCEPT .example.com

or

1.vi /etc/hosts.deny

sshd:ALL

2.vi /etc/hosts.allow

sshd:.example.com

We can secure the services using tcp_wrappers. There are main two files, /etc/hosts.allow and /etc/hosts.deny.

There will be three stage access checking

- Is access explicitly permitted? Means permitted from /etc/hosts.allow?

- Otherwise, Is access explicitly denied? Means denied from /etc/hosts.deny?

- Otherwise, by default permit access if neither condition matched.

To deny the services we can configure /etc/hosts.deny file using ALL and EXCEPT operation. Pattern of /etc/hosts.allow and /etc/hosts.deny file is:

Demon_list:client_list:options

In Client list can be either domain name or IP address.

Note: In Exam Lab there will be two different domain example.com which is known as local domain and another is cracker.org which is called non trusted domain. So only from .example.com means allow only to example.com deny to every one.

Do the following steps as:

1.vi /etc/httpd/conf.d/ssl.conf

<VirtualHost 192.100.0.2>

ServerNamewww.rhce.com

DocumentRoot /var/www/rhce

DirectoryIndex index.html index.htm

ServerAdminwebmaster@rhce.com

SSLEngine on

SSLCertificateFile/etc/httpd/conf/ssl.crt/server.crt

SSLCertificateKeyFile/etc/httpd/conf/ssl.key/server.key

</VirtualHost>

2.cd /etc/httpd/conf

3.make testcert

4.Create the directory and index page on specified path. (Index page can download fromftp://server1.example.comat exam time)

5.service httpd start|restart

6.chkconfig httpd on

Apache can provide encrypted communications using SSL (Secure Socket Layer). To make use of encrypted communication, a client must request to https protocol, which is uses port 443. For HTTPS protocol required the certificate file and key file.

Do the following steps as:

1.vi /etc/samba/smb.conf

[global]

netbios name=station?

workgroup=linuxgroup

security=share

printcap name=/etc/printcap

load printers=yes

printing=cups

[printers]

path=/var/spool/samba

browsable=yes

printable=yes

guest ok=no

writable=no

Samba servers helps to share the data between linux and windows. Configuration file is /etc/samba/smb.conf. There are some pre-defined section, i. globaluse to define the global options, ii. Printersuse to share the printers, iii. homesuse to share the user’s home directory.

/etc/printcap file contains all installed printers name. Printing is print system used on server.

Do the following steps as:

vi /etc/mail/virtusertable

@cracker.orgeric

service sendmail restart

/etc/mail/virtusertable file is used to send the mail coming for virtual user to real user. According to question, all mail to cracker.org should get by eric user so

@cracker.orgeric : Which sends all mail of cracker.org to eric user.

Do the following steps as:

1.vi /etc/mail/local-host-names

example.com

2.vi /etc/mail/sendmail.mc

dnl # DEAMON_OPTIONS(`Port=smtp,Addr=127.0.0.1,Name=MTA`)dnl

MASQUERADE_AS(`example.com')dnl

define(`SMART_HOST',`smtp.abc.com')

3.m4 /etc/mail/sendmail.mc >/etc/mail/sendmail.cf

4.vi /etc/mail/virtusertable

info@example.comadmin@example.com

5.vi /etc/mail/access

192.168.0RELAY

/etc/mail/local-host-names file contains the aliases to hostname. Mail server program reads the /etc/mail/sendmail.cf. To change the configuration on mail server, we should edit the /etc/mail/sendmail.mc file and should generate the sendmail.cf using m4 command.

By default sendmail server allows to connect to local host only. So we should edit the/etc/mail/sendmail.mc file to allow connect to other hosts.

By default sendmail server will not forward mail. We should specify on /etc/mail/access to relay or to block mail coming from domain or network or individual email address.

To masquerade the address, MASQUERADE_AS option is in /etc/mail/sendmail.mc. SMART_HOST deliver all local mail locally and outgoing mail through another mail server.

/etc/mail/virtusertable file is used map virtual address to real address.

Eg.

info@example.comuser1@example.com

enquiry@example.comadmin@abc.com

Do the following steps as:

1.vi /etc/named.conf

acl localnet { 192.168.0.0/24; };

options {

allow-query { localnet; };

};

2.service named restart | start

allow-query is a global option on /etc/named.conf, specifies an address match list of hosts allowed to query this server. If this option is not set, any host can query the server.

IMAP is a very usefully protocol, but it lacks encryption. The dovecot package distributed with RHEL includes the ability to use IMAP over SSL, This requires the creation of a PEM format certificate.

cd /usr/share/ssl/certs

make dovecot.pem : Which generates the dovecot.pem certificate by reading MakeFile

Enable the imaps protocol from /etc/dovecot.conf

vi /etc/dovecot.conf

protocols = imap imaps

service dovecot restart : Restart the Dovecot service

Do the following steps as:

1.vi /etc/squid/squid.conf

#detault:

http_port8080

#Recommended minimum configuration:

# Near the src acl src section

acl mynet src 192.168.0.0/255.255.255.0

#Default:

# http_access deny all

#Under Herehttp_access allow mynet

2.service squid start

3.chkconfig squid on

squid is a proxy caching server, using squid we can share the internet, block the internet, to certain network. First we should define the port for squid, the standard port for squid is 3128. We can run squid on different port by specifying http_port portnumber.

To block or allow the Internet access to hosts, we should create the acl (Access Control List). In this file we can specify only the IP address.

Example: acl aclname src IP/NetmaskAfter creating acl we can block or allow the internet to specified acl.

http_access allow | deny alcname

Do the following steps as:

1.usermod -G sysuser jackie

2.usermod –G sysuser curtin

3.Verify by reading /etc/group file

Using usermod command we can make user belongs to different group. There are two types of group one primary and another is secondary. Primary group can be only one but user can belongs to more than one group as secondary.

usermod -g groupname usernameTo change the primary group of the user

usermod -G groupname usernameTo make user belongs to secondary group.

Do the following steps as:

1.vi /var/schedule

30 17 * * * /sbin/dump -0u /dev/st0 /dev/hda7

2.crontab /var/schedule

3.service crond restart

We can add the cron schedule either by specifying the scripts path on /etc/crontab file or by creating on text file on crontab pattern.

cron helps to schedule on recurring events. Pattern of cron is:

MinuteHourDay of MonthMonthDay of WeekCommands

0-590-231-311-120-7 where 0 and 7 means Sunday.

Note * means every. To execute the command on every two minutes */2.