This how-to presents the minimal configuration of the samba server with sample share without any access restrictions. More information on these can be found in html manual or man smb.conf.
INSTALLATION
[root@server ~]# yum install samba
Helpful docs:
[root@server ~]# firefox /usr/share/doc/samba-3.0.33/htmldocs/index.html
Mark to run on boot:
[root@server ~]# chkconfig smb on
IPTABLES
Grep /etc/services for netbios and microsoft-ds to determine the ports that need to be opened:
[root@server ~]# grep -i microsoft-ds /etc/services
microsoft-ds 445/tcp
microsoft-ds 445/udp
[root@server ~]# grep -i netbios /etc/services
netbios-ns 137/tcp # NETBIOS Name Service
netbios-ns 137/udp
netbios-dgm 138/tcp # NETBIOS Datagram Service
netbios-dgm 138/udp
netbios-ssn 139/tcp # NETBIOS session service
netbios-ssn 139/udp
Add the iptables rules:
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p tcp --dport 137:139 -j ACCEPT
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p udp --dport 137:139 -j ACCEPT
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p tcp --dport 445 -j ACCEPT
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p udp --dport 445 -j ACCEPT
[root@server ~]# service iptables save
Saving firewall rules to /etc/sysconfig/iptables: [ OK ]
[root@server ~]#
MINIMAL CONFIGURATION
In /etc/samba/smb.conf add the following lines
[sambashare]
comment = My Samba Share
path = /samba
Create the samba share directory and set right SELINUX context:
[root@server ~]# mkdir /samba
[root@server ~]# touch /samba/file
[root@server ~]# semanage fcontext -a -t samba_share_t "/samba(/.*)?"
[root@server ~]# restorecon -Rv /samba/
restorecon reset /samba context user_u:object_r:default_t:s0->system_u:object_r:samba_share_t:s0
[root@server ~]# ls -Z /samba/
[root@server ~]# ls -Z / |grep samba
drwxr-xr-x root root system_u:object_r:samba_share_t samba
Add your user to the samba users:
[root@server ~]# smbpasswd -a piotr
New SMB password:
Retype new SMB password:
Added user piotr.
VERIFICATION
Verbose option provides some more information that might be helpful in debugging. My common mistake is, that I mimic the mount.nfs syntax and after server.example.com/ I put the path to my share. Here we use the name of the samba share which is string embraced between [] in smb.conf. On the client host:
[root@piotr ~]# mount -t cifs //server.example.com/sambashare /mnt/sambashare/ --verbose -o user=piotr
Password:
mount.cifs kernel mount options: ip=192.168.1.1,unc=\\server.example.com\sambashare,,ver=1,user=piotr,pass=********
[root@piotr ~]# cd /mnt/sambashare/
[root@piotr sambashare]# ll
total 4
-rw-r--r-- 1 root root 0 Oct 26 00:36 file
Tuesday, October 26, 2010
Monday, October 25, 2010
Web Proxy: Squid
DELIVERABLE
Web proxy server available to all the nodes on the network.
INSTALLATION
[root@server ~]# yum install squid
CONFIGURATION
The main configuration file is /etc/squid/squid.conf.
You want to add the lines allowing access from your local networks, just uncomment and modify the right entries:
acl our_networks src 192.168.1.0/24
http_access allow our_networks
This line defines the port on which squid will be listening. Leave the default.
http_port 3128
Mark to run on boot and start:
[root@server ~]# chkconfig squid on
[root@server ~]# service squid start
init_cache_dir /var/spool/squid... Starting squid: . [ OK ]
VERIFICATION
[root@server ~]# netstat -tulpn | grep 3128
tcp 0 0 0.0.0.0:3128 0.0.0.0:* LISTEN 21358/(squid)
Both on the server and the client node change the browser proxy settings to server.example.com:3128 and check whether that works.
Web proxy server available to all the nodes on the network.
INSTALLATION
[root@server ~]# yum install squid
CONFIGURATION
The main configuration file is /etc/squid/squid.conf.
You want to add the lines allowing access from your local networks, just uncomment and modify the right entries:
acl our_networks src 192.168.1.0/24
http_access allow our_networks
This line defines the port on which squid will be listening. Leave the default.
http_port 3128
Mark to run on boot and start:
[root@server ~]# chkconfig squid on
[root@server ~]# service squid start
init_cache_dir /var/spool/squid... Starting squid: . [ OK ]
VERIFICATION
[root@server ~]# netstat -tulpn | grep 3128
tcp 0 0 0.0.0.0:3128 0.0.0.0:* LISTEN 21358/(squid)
Both on the server and the client node change the browser proxy settings to server.example.com:3128 and check whether that works.
Mail Services: Dovecot
Dovecot
We start the configuration with dovecot. Later on it can be used to test Mail Transfer Agent (MTA), which will be described in the next post.
INSTALLATION
[root@server ~]# yum install dovecot
CONFIGURATION
Generate certificate:
[root@server ~]# cd /etc/pki/tls/certs
[root@server certs]# make dovecot.pem
The certificate is located in /etc/pki/tls/certs/dovecot.pem.
The main configuration file /etc/dovecot.conf should contain the following lines:
protocols = imap imaps pop3 pop3s # choose the desired protocols
ssl_cert_file = /etc/pki/tls/certs/dovecot.pem # path to generated certificate
ssl_key_file = /etc/pki/tls/certs/dovecot.pem # path to generated certificate
Now mark dovecot to run on boot and start it:
IPTABLES
VERIFICATION
Check that dovecot is listening on the desired ports:
Send a test mail and access it using imaps. Also imap, pop and pops can be used.
We start the configuration with dovecot. Later on it can be used to test Mail Transfer Agent (MTA), which will be described in the next post.
INSTALLATION
[root@server ~]# yum install dovecot
CONFIGURATION
Generate certificate:
[root@server ~]# cd /etc/pki/tls/certs
[root@server certs]# make dovecot.pem
The certificate is located in /etc/pki/tls/certs/dovecot.pem.
The main configuration file /etc/dovecot.conf should contain the following lines:
protocols = imap imaps pop3 pop3s # choose the desired protocols
ssl_cert_file = /etc/pki/tls/certs/dovecot.pem # path to generated certificate
ssl_key_file = /etc/pki/tls/certs/dovecot.pem # path to generated certificate
Now mark dovecot to run on boot and start it:
[root@server ~]# chkconfig dovecot on
[root@server ~]# service dovecot start
Starting Dovecot Imap: [ OK ]
IPTABLES
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p tcp --dport 110 -j ACCEPT
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p udp --dport 110 -j ACCEPT
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p tcp --dport 143 -j ACCEPT
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p udp --dport 143 -j ACCEPT
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p tcp --dport 993 -j ACCEPT
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p udp --dport 993 -j ACCEPT
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p tcp --dport 995 -j ACCEPT
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p udp --dport 995 -j ACCEPT
[root@server ~]# service iptables save
Saving firewall rules to /etc/sysconfig/iptables: [ OK ]
VERIFICATION
Check that dovecot is listening on the desired ports:
[root@server ~]# netstat -tulpn |grep dovecot
tcp 0 0 :::993 :::* LISTEN 19995/dovecot
tcp 0 0 :::995 :::* LISTEN 19995/dovecot
tcp 0 0 :::110 :::* LISTEN 19995/dovecot
tcp 0 0 :::143 :::* LISTEN 19995/dovecot Send a test mail and access it using imaps. Also imap, pop and pops can be used.
[root@server ~]# echo "test mail" |mail -s "test mail" piotr
[root@server ~]# mutt -f imaps://piotr@server.example.com
Web Server with Virtual Hosts
DELIVERABLE
Web server with two virtual hosts.
INSTALLATION
[root@server ~]# yum install httpd httpd-manual mod_ssl
[root@server ~]# chkconfig httpd on
IPTABLES
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p tcp --dport 80 -j ACCEPT
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p udp --dport 80 -j ACCEPT
[root@server ~]# service iptables save
Saving firewall rules to /etc/sysconfig/iptables: [ OK ]
CONFIGURATION
Take advantage of the manual:
[piotr@server ~]$ firefox /var/www/manual/index.html
The main configuration file /etc/httpd/conf/httpd.conf should have the following lines. No need to tamper with the rest for now.
At the bottom of the file you should have something similar:
NameVirtualHost *:80
<VirtualHost *:80>
DocumentRoot /var/www/html
ServerName www.example.com
</VirtualHost>
Create a sample index.html:
[root@server ~]# echo "www.example.com" > /var/www/html/index.html
The rule to resolve www.example.com has to be added into the zone file. We just point www into server:
[root@server ~]# cat /var/named/example.com.zone
$TTL 86400
@ IN SOA server.example.com. root.example.com. (
45 ; serial
3H ; refresh
15M ; retry
1W ; expiry
1D ) ; minimum
NS server
server A 192.168.1.1
piotr A 192.168.1.2
www CNAME server
Restart named:
[root@server ~]# service named restart
Stopping named: [ OK ]
Starting named: [ OK ]
Now it can be tested with firefox or directly in CLI with elinks or lynx.
SECOND VIRTUAL HOST
Let's add one more virtual host into our configuration. To make the things more complicated we will place the Document Root in /virtual.
Modify the /etc/httpd/conf/httpd.conf by adding the following lines:
<VirtualHost *:80>
DocumentRoot /virtual
ServerName www2.example.com
</VirtualHost>
Again add the right pointer into zone file and restart named:
[root@server ~]# echo "www2 CNAME server" >> /var/named/example.com.zone
[root@server ~]# service named restart
Stopping named: [ OK ]
Starting named: [ OK ]
Create the root directory and add index.html
[root@server ~]# mkdir /virtual
[root@server ~]# echo "www2.example.com" > /virtual/index.html
Now we need to set the proper SELINUX context on this directory. It should be the same as the one set on /var/www:
[root@server ~]# semanage fcontext -l |grep /var/www
[root@server ~]# semanage fcontext -a -t httpd_sys_content_t "/virtual(/.*)?"
[root@server ~]# restorecon -Rv /virtual/
restorecon reset /virtual context user_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0
restorecon reset /virtual/index.html context user_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0
VERIFICATION
Now both addresses www.example.com and www2.example.com should give different home pages served from different locations.
Web server with two virtual hosts.
INSTALLATION
[root@server ~]# yum install httpd httpd-manual mod_ssl
[root@server ~]# chkconfig httpd on
IPTABLES
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p tcp --dport 80 -j ACCEPT
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p udp --dport 80 -j ACCEPT
[root@server ~]# service iptables save
Saving firewall rules to /etc/sysconfig/iptables: [ OK ]
CONFIGURATION
Take advantage of the manual:
[piotr@server ~]$ firefox /var/www/manual/index.html
The main configuration file /etc/httpd/conf/httpd.conf should have the following lines. No need to tamper with the rest for now.
At the bottom of the file you should have something similar:
NameVirtualHost *:80
<VirtualHost *:80>
DocumentRoot /var/www/html
ServerName www.example.com
</VirtualHost>
Create a sample index.html:
[root@server ~]# echo "www.example.com" > /var/www/html/index.html
The rule to resolve www.example.com has to be added into the zone file. We just point www into server:
[root@server ~]# cat /var/named/example.com.zone
$TTL 86400
@ IN SOA server.example.com. root.example.com. (
45 ; serial
3H ; refresh
15M ; retry
1W ; expiry
1D ) ; minimum
NS server
server A 192.168.1.1
piotr A 192.168.1.2
www CNAME server
Restart named:
[root@server ~]# service named restart
Stopping named: [ OK ]
Starting named: [ OK ]
Now it can be tested with firefox or directly in CLI with elinks or lynx.
SECOND VIRTUAL HOST
Let's add one more virtual host into our configuration. To make the things more complicated we will place the Document Root in /virtual.
Modify the /etc/httpd/conf/httpd.conf by adding the following lines:
<VirtualHost *:80>
DocumentRoot /virtual
ServerName www2.example.com
</VirtualHost>
Again add the right pointer into zone file and restart named:
[root@server ~]# echo "www2 CNAME server" >> /var/named/example.com.zone
[root@server ~]# service named restart
Stopping named: [ OK ]
Starting named: [ OK ]
Create the root directory and add index.html
[root@server ~]# mkdir /virtual
[root@server ~]# echo "www2.example.com" > /virtual/index.html
Now we need to set the proper SELINUX context on this directory. It should be the same as the one set on /var/www:
[root@server ~]# semanage fcontext -l |grep /var/www
[root@server ~]# semanage fcontext -a -t httpd_sys_content_t "/virtual(/.*)?"
[root@server ~]# restorecon -Rv /virtual/
restorecon reset /virtual context user_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0
restorecon reset /virtual/index.html context user_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0
VERIFICATION
Now both addresses www.example.com and www2.example.com should give different home pages served from different locations.
FTP Server with anonymous upload
DELIVERABLE
Secure FTP server with upload directory for anonymous users.
INSTALLATION
[root@server ~]# yum -y install vsftpd
[root@server ~]# chkconfig vsftpd on
IPTABLES
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p tcp --dport 21 -j ACCEPT
[root@server ~]# service iptables save
Saving firewall rules to /etc/sysconfig/iptables: [ OK ]
Add ip_conntrack_ftp into IPTABLES_MODULES in /etc/sysconfig/iptables-config:
[root@server ~]# grep IPTABLES_MODULES= /etc/sysconfig/iptables-config
IPTABLES_MODULES="ip_conntrack_netbios_ns ip_conntrack_ftp"
CONFIGURATION
[root@server ~]# grep -v ^# /etc/vsftpd/vsftpd.conf
anonymous_enable=YES
local_enable=YES
write_enable=YES
local_umask=022
anon_upload_enable=YES #
anon_umask=077#
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
chown_uploads=YES#
chown_username=daemon#
xferlog_std_format=YES
listen=YES
pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES
Flip the SELINUX boolean:
[root@server ~]# setsebool allow_ftpd_anon_write on
Create a directory for upload:
[root@server ~]# mkdir /var/ftp/incoming
[root@server ~]# chgrp ftp /var/ftp/incoming/
[root@server ~]# chmod 730 /var/ftp/incoming/
Ensure it has a right context:
[root@server ~]# chcon -t public_content_rw_t /var/ftp/incoming/
TCP wrappers:
[root@server ~]# echo "vsftpd: 192.168.1." >> /etc/hosts.allow
[root@server ~]# grep -v ^# /etc/hosts.allow
mountd,portmap: 192.168.1.
vsftpd: 192.168.1.
Restart the service:
[root@server ~]# service vsftpd restart
Shutting down vsftpd: [ OK ]
Starting vsftpd for vsftpd: [ OK ]
VERIFICATION
Let's connect from the client station and upload the file:
[root@piotr ~]# lftp server.example.com -u anonymous
Password:
lftp anonymous@server.example.com:~> ls
drwx-wx--- 2 0 50 4096 Oct 24 21:16 incoming
drwxr-xr-x 2 0 0 4096 May 13 2009 pub
lftp anonymous@server.example.com:/> cd incoming/
lftp anonymous@server.example.com:/incoming> put anaconda-ks.cfg
930 bytes transferred
lftp anonymous@server.example.com:/incoming> bye
Now on the server, uploaded file indeed is owned by user daemon:
[root@server ~]# ll /var/ftp/incoming/
total 8
-rw------- 1 daemon ftp 930 Oct 25 00:18 anaconda-ks.cfg
Secure FTP server with upload directory for anonymous users.
INSTALLATION
[root@server ~]# yum -y install vsftpd
[root@server ~]# chkconfig vsftpd on
IPTABLES
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p tcp --dport 21 -j ACCEPT
[root@server ~]# service iptables save
Saving firewall rules to /etc/sysconfig/iptables: [ OK ]
Add ip_conntrack_ftp into IPTABLES_MODULES in /etc/sysconfig/iptables-config:
[root@server ~]# grep IPTABLES_MODULES= /etc/sysconfig/iptables-config
IPTABLES_MODULES="ip_conntrack_netbios_ns ip_conntrack_ftp"
CONFIGURATION
[root@server ~]# grep -v ^# /etc/vsftpd/vsftpd.conf
anonymous_enable=YES
local_enable=YES
write_enable=YES
local_umask=022
anon_upload_enable=YES #
anon_umask=077#
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
chown_uploads=YES#
chown_username=daemon#
xferlog_std_format=YES
listen=YES
pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES
Flip the SELINUX boolean:
[root@server ~]# setsebool allow_ftpd_anon_write on
Create a directory for upload:
[root@server ~]# mkdir /var/ftp/incoming
[root@server ~]# chgrp ftp /var/ftp/incoming/
[root@server ~]# chmod 730 /var/ftp/incoming/
Ensure it has a right context:
[root@server ~]# chcon -t public_content_rw_t /var/ftp/incoming/
TCP wrappers:
[root@server ~]# echo "vsftpd: 192.168.1." >> /etc/hosts.allow
[root@server ~]# grep -v ^# /etc/hosts.allow
mountd,portmap: 192.168.1.
vsftpd: 192.168.1.
Restart the service:
[root@server ~]# service vsftpd restart
Shutting down vsftpd: [ OK ]
Starting vsftpd for vsftpd: [ OK ]
VERIFICATION
Let's connect from the client station and upload the file:
[root@piotr ~]# lftp server.example.com -u anonymous
Password:
lftp anonymous@server.example.com:~> ls
drwx-wx--- 2 0 50 4096 Oct 24 21:16 incoming
drwxr-xr-x 2 0 0 4096 May 13 2009 pub
lftp anonymous@server.example.com:/> cd incoming/
lftp anonymous@server.example.com:/incoming> put anaconda-ks.cfg
930 bytes transferred
lftp anonymous@server.example.com:/incoming> bye
Now on the server, uploaded file indeed is owned by user daemon:
[root@server ~]# ll /var/ftp/incoming/
total 8
-rw------- 1 daemon ftp 930 Oct 25 00:18 anaconda-ks.cfg
Sunday, October 24, 2010
Autofs
Short follow-up on the previous post. We configured NFS. Now the shares exist on the server and to access it, we have a few options. We can mount the shares manually each time we want to access it, which is tedious. We can put the proper entry in /etc/fstab, which may fail on boot if the share is not available. We can use autofs to automatically mount the predefined share whenever we access the specific directory, which is needless to say, very desired. This last solution is presented here and tested on the client machine that runs Fedora 13.
Make autofs start on boot:
[root@localhost ~]# chkconfig autofs on
First the automounter maps have to be defined in /etc/auto.master:
[root@localhost ~]# grep -v ^# /etc/auto.master
/- /etc/auto.direct
/home /etc/auto.home
[root@localhost ~]# cat /etc/auto.home
* -rw,soft 192.168.1.1:/home/&
[root@localhost ~]# cat /etc/auto.direct
/nfsauto -ro,sync 192.168.1.1:/nfsshare
Start/restart the service:
[root@localhost ~]# service autofs start
Loading autofs4: [ OK ]
Starting automount: [ OK ]
This is it! Now enetring local /nfsauto will trigger mounting remote /nfsshare from server.example.com. Additionally, the remote home directory will be mounted upon login.
There is one risk here, though. Our home directory is mounted from the remote share. If the share is not available for some reason, we would not be able to log in. It might be a good practice to put our remote home under /home/user/remote. This way we avoid the troubles still benefiting from all the goodies that autofs brings.
Make autofs start on boot:
[root@localhost ~]# chkconfig autofs on
First the automounter maps have to be defined in /etc/auto.master:
[root@localhost ~]# grep -v ^# /etc/auto.master
/- /etc/auto.direct
/home /etc/auto.home
[root@localhost ~]# cat /etc/auto.home
* -rw,soft 192.168.1.1:/home/&
[root@localhost ~]# cat /etc/auto.direct
/nfsauto -ro,sync 192.168.1.1:/nfsshare
Start/restart the service:
[root@localhost ~]# service autofs start
Loading autofs4: [ OK ]
Starting automount: [ OK ]
This is it! Now enetring local /nfsauto will trigger mounting remote /nfsshare from server.example.com. Additionally, the remote home directory will be mounted upon login.
There is one risk here, though. Our home directory is mounted from the remote share. If the share is not available for some reason, we would not be able to log in. It might be a good practice to put our remote home under /home/user/remote. This way we avoid the troubles still benefiting from all the goodies that autofs brings.
NFS Server
DELIVERABLE
NFS server sharing user home directories and selected nfsshare directory.
INSTALLATION
IPTABLES
NFS depends on a few rpc services. Therefore, the ports on which they listen have to be explicitly defined. This can be done in /ets/sysconfig/nfs. I use ports above 4001 for this purpose.
Let's restart NFS:
NFS failed to shutdown cleanly. This is a well-known issue and occures when exports is empty. More information here. Seems that the fix was pushed to Fedora 14, which is due out on November 2. Let's check whether all the services switched to the desired ports:
And here is a gotcha! As you can see the status ports are still 775 and 778, although configuration file commands something else. To fix that we need to restart nfslock service, which governs statd daemon. Many times it was enough to restart nfs only to have all the changes in /etc/sysconfig/nfs take effect. However the last two installations of RHEL 5.4 required also this additional step.
Finally, we can define the ports that need to be open. These are:
nfs 2049
portmap 111
rpc services: 4001:4004
SELINUX
To check whether service can be protected by SELINUX we can check the bottom of selinux man page or simply:
Let's examine nfs-related booleans:
The one that should draw your attention is use_nfs_home_dirs. Flip this one on:
DIRECTORY EXPORT
What is shared on your NFS server is defined in /etc/exports. Create a directory /nfsshare, export it and verify:
Create nfsshare directory and sample file:
Edit /etc/exports:
Export the shares. Can be done also with service nfs restart:
Verify:
On piotr.example.com:
All seems fine, lets mount nfsshare under /mnt/nfsshare:
The resources that are remotely mounted can be viewed with:
ACCESS RESTRICTION
This can be achieved in multiple ways. Iptables , although more difficult to manage seems to be the safest choice. Then we have /etc/exports file where we can define what is shared and to whom. Additionally, tcp wrappers can be used. To test the confguration we need to deny all access to all services in /etc/hosts.deny and list the services and hosts that are allowed in /etc/hosts.allow. If the matching rule is not found in /etc/hosts.allow and /etc/hosts.deny does not exists, by fault of omission the access is granted. The proper settings in my setup are as follows:
[piotr@server ~]$ grep -v ^# /etc/hosts.deny
ALL: ALL
NFS server sharing user home directories and selected nfsshare directory.
INSTALLATION
[root@server ~]# yum install nfs-utils
[root@server ~]# chkconfig nfs on
[root@server ~]# service nfs start
Starting NFS services: [ OK ]
Starting NFS quotas: [ OK ]
Starting NFS daemon: [ OK ]
Starting NFS mountd: [ OK ]
IPTABLES
NFS depends on a few rpc services. Therefore, the ports on which they listen have to be explicitly defined. This can be done in /ets/sysconfig/nfs. I use ports above 4001 for this purpose.
[root@server ~]# grep -v ^# /etc/sysconfig/nfs
RQUOTAD_PORT=4001
LOCKD_TCPPORT=4002
LOCKD_UDPPORT=4002
MOUNTD_PORT=4003
STATD_PORT=4004
Let's restart NFS:
[root@server ~]# service nfs restart
Shutting down NFS mountd: [ OK ]
Shutting down NFS daemon: [ OK ]
Shutting down NFS quotas: [ OK ]
Shutting down NFS services: [FAILED]
Starting NFS services: [ OK ]
Starting NFS quotas: [ OK ]
Starting NFS daemon: [ OK ]
Starting NFS mountd: [ OK ]
[root@server ~]# rpcinfo -p
program vers proto port
100000 2 tcp 111 portmapper
100000 2 udp 111 portmapper
100024 1 udp 775 status
100024 1 tcp 778 status
100011 1 udp 4001 rquotad
100011 2 udp 4001 rquotad
100011 1 tcp 4001 rquotad
100011 2 tcp 4001 rquotad
100003 2 udp 2049 nfs
100003 3 udp 2049 nfs
100003 4 udp 2049 nfs
100021 1 udp 4002 nlockmgr
100021 3 udp 4002 nlockmgr
100021 4 udp 4002 nlockmgr
100021 1 tcp 4002 nlockmgr
100021 3 tcp 4002 nlockmgr
100021 4 tcp 4002 nlockmgr
100003 2 tcp 2049 nfs
100003 3 tcp 2049 nfs
100003 4 tcp 2049 nfs
100005 1 udp 4003 mountd
100005 1 tcp 4003 mountd
100005 2 udp 4003 mountd
100005 2 tcp 4003 mountd
100005 3 udp 4003 mountd
100005 3 tcp 4003 mountd
And here is a gotcha! As you can see the status ports are still 775 and 778, although configuration file commands something else. To fix that we need to restart nfslock service, which governs statd daemon. Many times it was enough to restart nfs only to have all the changes in /etc/sysconfig/nfs take effect. However the last two installations of RHEL 5.4 required also this additional step.
[root@server ~]# service nfslock restart
Stopping NFS locking: [ OK ]
Stopping NFS statd: [ OK ]
Starting NFS statd: [ OK ]
Finally, we can define the ports that need to be open. These are:
nfs 2049
portmap 111
rpc services: 4001:4004
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p tcp --dport 111 -j ACCEPT
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p udp --dport 111 -j ACCEPT
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p tcp --dport 2049 -j ACCEPT
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p udp --dport 2049 -j ACCEPT
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p tcp --dport 4001:4004 -j ACCEPT
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p udp --dport 4001:4004 -j ACCEPT
[root@server ~]# service iptables save
Saving firewall rules to /etc/sysconfig/iptables: [ OK ]
SELINUX
To check whether service can be protected by SELINUX we can check the bottom of selinux man page or simply:
[root@server ~]# man -k _selinux # equivalent to apropos _selinux
ftpd_selinux (8) - Security-Enhanced Linux policy for ftp daemons
httpd_selinux (8) - Security Enhanced Linux Policy for the httpd daemon
kerberos_selinux (8) - Security Enhanced Linux Policy for Kerberos
named_selinux (8) - Security Enhanced Linux Policy for the Internet Name server (named) daemon
nfs_selinux (8) - Security Enhanced Linux Policy for NFS
pam_selinux (8) - PAM module to set the default security context
rsync_selinux (8) - Security Enhanced Linux Policy for the rsync daemon
samba_selinux (8) - Security Enhanced Linux Policy for Samba
ypbind_selinux (8) - Security Enhanced Linux Policy for NIS
Let's examine nfs-related booleans:
[root@server ~]# getsebool -a |grep nfs
allow_ftpd_use_nfs --> off
allow_nfsd_anon_write --> off
httpd_use_nfs --> off
nfs_export_all_ro --> on
nfs_export_all_rw --> on
nfsd_disable_trans --> off
qemu_use_nfs --> on
samba_share_nfs --> off
use_nfs_home_dirs --> off
virt_use_nfs --> off
The one that should draw your attention is use_nfs_home_dirs. Flip this one on:
[root@server ~]# setsebool -P use_nfs_home_dirs on
DIRECTORY EXPORT
What is shared on your NFS server is defined in /etc/exports. Create a directory /nfsshare, export it and verify:
Create nfsshare directory and sample file:
[root@server ~]# mkdir /nfsshare
[root@server ~]# touch /nfsshare/mynfsfile
[root@server ~]# chmod 777 /nfsshare/
Edit /etc/exports:
[root@server ~]# cat /etc/exports
/nfsshare *(rw,sync)
/home *(rw,sync)
Export the shares. Can be done also with service nfs restart:
[root@server ~]# exportfs -va
exporting *:/nfsshare
exporting *:/home
Verify:
[root@server ~]# showmount -e localhost
Export list for localhost:
/home *
/nfsshare *
On piotr.example.com:
[root@piotr ~]# showmount -e server.example.com
Export list for server.example.com:
/home *
/nfsshare *
All seems fine, lets mount nfsshare under /mnt/nfsshare:
[root@piotr ~]# mkdir /mnt/nfsshare
[root@piotr ~]# mount -t nfs server.example.com:/nfsshare /mnt/nfsshare/
[root@piotr ~]# ll /mnt/nfsshare/
total 4
-rw-r--r-- 1 root root 0 Oct 24 14:44 mynfsfile
[root@piotr ~]# mount -t nfs server.example.com:/home /home/
The resources that are remotely mounted can be viewed with:
[root@server ~]# showmount -a
All mount points on server.example.com:
192.168.1.2:/home
192.168.1.2:/nfsshare
ACCESS RESTRICTION
This can be achieved in multiple ways. Iptables , although more difficult to manage seems to be the safest choice. Then we have /etc/exports file where we can define what is shared and to whom. Additionally, tcp wrappers can be used. To test the confguration we need to deny all access to all services in /etc/hosts.deny and list the services and hosts that are allowed in /etc/hosts.allow. If the matching rule is not found in /etc/hosts.allow and /etc/hosts.deny does not exists, by fault of omission the access is granted. The proper settings in my setup are as follows:
[piotr@server ~]$ grep -v ^# /etc/hosts.allow
mountd,portmap: 192.168.1.
mountd,portmap: 192.168.1.
[piotr@server ~]$ grep -v ^# /etc/hosts.deny
ALL: ALL
Saturday, October 23, 2010
Master DNS Server
In this step the deliverable is a master DNS server for the domain example.com.
This domain has currently two nodes: piotr and server. Although the scope of RHCE includes only caching and forwarding nameservers, this setup will come in handy in the future.
Let's install all the packages associated with bind.
IPTABLES
Add the rules to the firewall, save the settings and update the runlevel information with chkconfig:
CONFIGURATION
To get started with configuration tasks we fetch the sample named.conf from the docs:
What helps is to open the documentation that is included with the rpm:
Below the configuration dumps for the minimal configuration:
Quick syntax check:
And restart the service if all is fine:
Now if we decide we want to put named in chroot jail we need to run:
What happened here is, that all configuration files have been moved into /var/named/chroot and in the original location we can now find the symbolic links to these files. So every time we add some new configuration files we need to issue bind-chroot-admin -e to update the links.
[root@server ~]# ll /var/named/
total 60
drwxr-x--- 6 root named 4096 Oct 23 12:28 chroot
drwxrwx--- 2 named named 4096 Oct 23 15:11 data
lrwxrwxrwx 1 root named 48 Oct 23 15:11 example.com.revzone -> /var/named/chroot//var/named/example.com.revzone
lrwxrwxrwx 1 root named 45 Oct 23 14:57 example.com.zone -> /var/named/chroot//var/named/example.com.zone
lrwxrwxrwx 1 root named 45 Oct 23 14:57 localdomain.zone -> /var/named/chroot//var/named/localdomain.zone
lrwxrwxrwx 1 root named 43 Oct 23 14:57 localhost.zone -> /var/named/chroot//var/named/localhost.zone
lrwxrwxrwx 1 root named 44 Oct 23 14:57 named.broadcast -> /var/named/chroot//var/named/named.broadcast
lrwxrwxrwx 1 root named 37 Oct 23 14:57 named.ca -> /var/named/chroot//var/named/named.ca
lrwxrwxrwx 1 root named 44 Oct 23 14:57 named.ip6.local -> /var/named/chroot//var/named/named.ip6.local
lrwxrwxrwx 1 root named 40 Oct 23 14:57 named.local -> /var/named/chroot//var/named/named.local
lrwxrwxrwx 1 root named 39 Oct 23 14:57 named.zero -> /var/named/chroot//var/named/named.zero
drwxrwx--- 2 named named 4096 Jul 29 2009 slaves
[root@server ~]# ll /etc/named*
lrwxrwxrwx 1 root named 52 Oct 23 14:57 /etc/named.caching-nameserver.conf -> /var/named/chroot//etc/named.caching-nameserver.conf
lrwxrwxrwx 1 root named 33 Oct 23 14:57 /etc/named.conf -> /var/named/chroot//etc/named.conf
lrwxrwxrwx 1 root named 42 Oct 23 14:57 /etc/named.rfc1912.zones -> /var/named/chroot//etc/named.rfc1912.zones
This domain has currently two nodes: piotr and server. Although the scope of RHCE includes only caching and forwarding nameservers, this setup will come in handy in the future.
Let's install all the packages associated with bind.
[root@server ~]# yum install bind bind-chroot caching-nameserver
IPTABLES
Add the rules to the firewall, save the settings and update the runlevel information with chkconfig:
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p udp --dport 53 -j ACCEPT
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p tcp --dport 53 -j ACCEPT
[root@server ~]# service iptables save
Saving firewall rules to /etc/sysconfig/iptables: [ OK ]
[root@server ~]# chkconfig named on
CONFIGURATION
To get started with configuration tasks we fetch the sample named.conf from the docs:
[root@server ~]# cp /usr/share/doc/bind-9.3.6/sample/etc/named.conf /etc/named.conf
What helps is to open the documentation that is included with the rpm:
[piotr@server ~]$ firefox /usr/share/doc/bind-9.3.6/arm/Bv9ARM.html &
Below the configuration dumps for the minimal configuration:
[root@server ~]# cat /etc/named.conf
options {
directory "/var/named"; // the default
dump-file "data/cache_dump.db";
statistics-file "data/named_stats.txt";
memstatistics-file "data/named_mem_stats.txt";
allow-query { any; };
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
include "/etc/named.rfc1912.zones";
zone "example.com" {
type master;
file "example.com.zone";
};
zone "1.168.192.in-addr.arpa" {
type master;
file "example.com.revzone";
};
[root@server ~]# cat /var/named/example.com.zone
$TTL 86400
@ IN SOA server.example.com. root.example.com. (
45 ; serial
3H ; refresh
15M ; retry
1W ; expiry
1D ) ; minimum
NS server
server A 192.168.1.1
piotr A 192.168.1.2
[root@server ~]# cat /var/named/example.com.revzone
$TTL 86400
@ IN SOA server.example.com. root.example.com. (
42 ; serial
3H ; refresh
15M ; retry
1W ; expiry
1D ) ; minimum
IN NS server.example.com.
1 IN PTR server.example.com.
2 IN PTR piotr.example.com.
Quick syntax check:
[root@server ~]# service named configtest
zone localdomain/IN: loaded serial 42
zone localhost/IN: loaded serial 42
zone 0.0.127.in-addr.arpa/IN: loaded serial 1997022700
zone 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 1997022700
zone 255.in-addr.arpa/IN: loaded serial 42
zone 0.in-addr.arpa/IN: loaded serial 42
zone example.com/IN: loaded serial 45
zone 1.168.192.in-addr.arpa/IN: loaded serial 42
And restart the service if all is fine:
[root@server ~]# service named restart
Stopping named: [ OK ]
Starting named: [ OK ]
Now if we decide we want to put named in chroot jail we need to run:
[root@server named]# bind-chroot-admin -e
What happened here is, that all configuration files have been moved into /var/named/chroot and in the original location we can now find the symbolic links to these files. So every time we add some new configuration files we need to issue bind-chroot-admin -e to update the links.
[root@server ~]# ll /var/named/
total 60
drwxr-x--- 6 root named 4096 Oct 23 12:28 chroot
drwxrwx--- 2 named named 4096 Oct 23 15:11 data
lrwxrwxrwx 1 root named 48 Oct 23 15:11 example.com.revzone -> /var/named/chroot//var/named/example.com.revzone
lrwxrwxrwx 1 root named 45 Oct 23 14:57 example.com.zone -> /var/named/chroot//var/named/example.com.zone
lrwxrwxrwx 1 root named 45 Oct 23 14:57 localdomain.zone -> /var/named/chroot//var/named/localdomain.zone
lrwxrwxrwx 1 root named 43 Oct 23 14:57 localhost.zone -> /var/named/chroot//var/named/localhost.zone
lrwxrwxrwx 1 root named 44 Oct 23 14:57 named.broadcast -> /var/named/chroot//var/named/named.broadcast
lrwxrwxrwx 1 root named 37 Oct 23 14:57 named.ca -> /var/named/chroot//var/named/named.ca
lrwxrwxrwx 1 root named 44 Oct 23 14:57 named.ip6.local -> /var/named/chroot//var/named/named.ip6.local
lrwxrwxrwx 1 root named 40 Oct 23 14:57 named.local -> /var/named/chroot//var/named/named.local
lrwxrwxrwx 1 root named 39 Oct 23 14:57 named.zero -> /var/named/chroot//var/named/named.zero
drwxrwx--- 2 named named 4096 Jul 29 2009 slaves
[root@server ~]# ll /etc/named*
lrwxrwxrwx 1 root named 52 Oct 23 14:57 /etc/named.caching-nameserver.conf -> /var/named/chroot//etc/named.caching-nameserver.conf
lrwxrwxrwx 1 root named 33 Oct 23 14:57 /etc/named.conf -> /var/named/chroot//etc/named.conf
lrwxrwxrwx 1 root named 42 Oct 23 14:57 /etc/named.rfc1912.zones -> /var/named/chroot//etc/named.rfc1912.zones
Friday, October 22, 2010
DHCP Server
My next step is to configure DHCP server to provide IP address to my client node. I usually start with search for the possible packages to install. Here yum search dhcp gives dhcp as the installation package.
[root@server ~]# yum install dhcp
IPTABLES
My standard practice is to add my own chain in the begining of INPUT chain:
[root@server ~]# iptables -N MYCHAIN
[root@server ~]# iptables -I INPUT -j MYCHAIN
Then we open port 67 on which dhcpd is listening:
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p tcp --dport 67 -j ACCEPT
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p udp --dport 67 -j ACCEPT
As you can see, the service provision is already restricted only to the nodes on the 192.168.1.0 subnet.
Then remember to save the iptables:
[root@server ~]# service iptables save
Saving firewall rules to /etc/sysconfig/iptables: [ OK ]
You can also edit directly /etc/sysconfig/iptables or use GUI system-config-securitylevel. Whichever method you use, stick to it. Mixing brings bad results, not only when it comes to iptables rules.
CONFIGURATION
Mark dhcpd to start on boot with:
[root@server ~]# chkconfig dhcpd on
The standard /etc/dhcpd.conf points to docs. So let's get the template to work on:
[root@server ~]# cp /usr/share/doc/dhcp*/dhcpd.conf.sample /etc/dhcpd.conf
After the changes my configuration file looks like this:
default-lease-time 21600;
max-lease-time 43200;
group {
use-host-decl-names on;
host piotr.example.com {
hardware ethernet 12:34:56:78:AB:CD;
fixed-address 192.168.1.2;
}
}
}
My client host is piotr.example.com which for convenience has a static mapping.
Now it is time to start/restart the service. It is a good practice to validate the syntax beforehand:
[root@server ~]# service dhcpd configtest && service dhcpd restart
Syntax: OK
Shutting down dhcpd: [ OK ]
Starting dhcpd: [ OK ]
[root@server ~]# yum install dhcp
IPTABLES
My standard practice is to add my own chain in the begining of INPUT chain:
[root@server ~]# iptables -N MYCHAIN
[root@server ~]# iptables -I INPUT -j MYCHAIN
Then we open port 67 on which dhcpd is listening:
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p tcp --dport 67 -j ACCEPT
[root@server ~]# iptables -I MYCHAIN -s 192.168.1.0/24 -p udp --dport 67 -j ACCEPT
As you can see, the service provision is already restricted only to the nodes on the 192.168.1.0 subnet.
Then remember to save the iptables:
[root@server ~]# service iptables save
Saving firewall rules to /etc/sysconfig/iptables: [ OK ]
You can also edit directly /etc/sysconfig/iptables or use GUI system-config-securitylevel. Whichever method you use, stick to it. Mixing brings bad results, not only when it comes to iptables rules.
CONFIGURATION
Mark dhcpd to start on boot with:
[root@server ~]# chkconfig dhcpd on
The standard /etc/dhcpd.conf points to docs. So let's get the template to work on:
[root@server ~]# cp /usr/share/doc/dhcp*/dhcpd.conf.sample /etc/dhcpd.conf
After the changes my configuration file looks like this:
[root@server ~]# cat /etc/dhcpd.conf
ddns-update-style interim;
ignore client-updates;
subnet 192.168.1.0 netmask 255.255.255.0 {
option subnet-mask 255.255.255.0;
option domain-name "example.com";
option domain-name-servers 192.168.1.1;
option time-offset -18000; # Eastern Standard Time
range 192.168.1.10 192.168.1.20;ddns-update-style interim;
ignore client-updates;
subnet 192.168.1.0 netmask 255.255.255.0 {
option subnet-mask 255.255.255.0;
option domain-name "example.com";
option domain-name-servers 192.168.1.1;
option time-offset -18000; # Eastern Standard Time
default-lease-time 21600;
max-lease-time 43200;
group {
use-host-decl-names on;
host piotr.example.com {
hardware ethernet 12:34:56:78:AB:CD;
fixed-address 192.168.1.2;
}
}
}
My client host is piotr.example.com which for convenience has a static mapping.
Now it is time to start/restart the service. It is a good practice to validate the syntax beforehand:
[root@server ~]# service dhcpd configtest && service dhcpd restart
Syntax: OK
Shutting down dhcpd: [ OK ]
Starting dhcpd: [ OK ]
Networking: Static IP
Servers usually get static IPs. A few files need to modified as follows:
[root@localhost ~]# cat /etc/sysconfig/network
NETWORKING=yes
NETWORKING_IPV6=no
HOSTNAME=server.example.com
Upon next login we will have prompt showing the desired hostname. Lets ensure with ifconfig that there is no typo in IP address.
[root@localhost ~]# cat /etc/sysconfig/network
NETWORKING=yes
NETWORKING_IPV6=no
HOSTNAME=server.example.com
[root@localhost ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth0
# Intel Corporation 82540EP Gigabit Ethernet Controller (Mobile)
DEVICE=eth0
BOOTPROTO=static
IPADDR=192.168.1.1
NETMASK=255.255.255.0
HWADDR=00:0D:60:FC:93:54
ONBOOT=yes
[root@localhost ~]# grep -v ^# /etc/hosts
192.168.1.1 server.example.com server
127.0.0.1 localhost.localdomain localhost
::1 localhost6.localdomain6 localhost6
Upon next login we will have prompt showing the desired hostname. Lets ensure with ifconfig that there is no typo in IP address.
[root@server ~]# ifconfig eth0 |grep inet
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
DVD Repo
First off all, I want to use my installation DVD as a repository. To do that we add rhel-dvd.repo with the follwoing content:
The DVD is automatically mounted in the directory with spaces, which are not accepted in baseur. The following sym link resolves the issue.
Then yum update processes the repo data.
[root@localhost ~]# cat /etc/yum.repos.d/rhel-dvd.repo
[rhel-dvd]
name=Red Hat Enterprise Linux DVD
baseurl=file:///mnt/rheldvd/Server
enabled=1
gpgcheck=0
The DVD is automatically mounted in the directory with spaces, which are not accepted in baseur. The following sym link resolves the issue.
[root@localhost ~]# ln -s /media/RHEL_5.4\ i386\ DVD/ /mnt/rheldvd
Then yum update processes the repo data.
[root@localhost ~]# yum update
Wednesday, October 20, 2010
What is this all about?
As this is a first post I should explain what is going to happen here. As I am currently preparing myself to take RHCE exam, I will be putting here my notes. Mostly the things I expect to encounter during the exam based on the requirements list. You will find here: how to configure specific services, some small tips&tricks, things that appeared to be essential and were not too obvious for me, some things that took me hours to figure out, which I of course will not admit to and in general all things to help you improve your Linux knowledge in the scope of RHCE. Lots of fun! I try to make sure that the configuration posted reflects current 'best practices'.
I use RHEL 5.4 on T41 but you will get the same behavior with CentOS. Additionally, I have a Fedora 13 host on Pangolin Performance that serves as a client to test network services.
Feel free to comment and challenge whatever you find in here. As there is more than one way to skin a cat, I deem no rights to claim my way is the best. I just promote what works for me. If you do something better please share it, I will be happy to update the entry and give you credits in the comments.
Let's get started. The next post will be about setting the environment.
Feel free to comment and challenge whatever you find in here. As there is more than one way to skin a cat, I deem no rights to claim my way is the best. I just promote what works for me. If you do something better please share it, I will be happy to update the entry and give you credits in the comments.
Let's get started. The next post will be about setting the environment.
Subscribe to:
Posts (Atom)