Do the following steps as:

1.useradd eric

Very tricky question given to you that this user should not belongs to sysadmin group.

Do the following steps as:

1.groupadd sysusers

groupadd command is used to create the group and all group information is stored in /etc/group file.

Do the following steps as:

1.dump -0u –f /tmp/back /dev/hda4

dump is the standard backup utility. According to the questions, fullback should take. –0 means fullback, -u means update the /etc/dumpdates which maintains the backup record and -f means filename. If you are directly taking backup into other device, you can specify the device name.

e dump -0u -f /dev/st0 /dev/hda4. Where hda4 is a separate partition mounted on /home.

Do the following steps as:

1.echo “1” >/proc/sys/net/ipv4/ip_forward

2.vi /etc/sysctl.conf

net.ipv4.ip_forward = 1

If you want to use the Linux System as a Router to make communication between different networks, you need enable the IP forwarding. To enable on running session just set value 1 to /proc/sys/net/ipv4/ip_forward. As well as automatically turn on the IP forwarding features on next boot set on /etc/sysctl.conf file.

Do the following steps as:

1.vi /etc/exports

/data*.example.com(rw,sync)

Check the SELinux Context, should be like this:

-rw-r--r-- root root system_u:object_r:exports_t /etc/exports

Use the restorecon –R /etc command to restore the selinux context of the file.

2.service nfs start | restart

3.service portmap start | restart

4.chkconfig nfs on

5.chkconfig portmap on

In Linux to share the data we use the /etc/exports file. Pattern is:

Pathclient(permission)

Shared Directory Path, Client can be single host or domain name or ip address. Permission should specify without space with client lists in parentheses. NFS is RPC service so portmapper service should restart after starting the nfs service.

At exam Lab example.com domain resides on 172.24.0.0/16 Network and my133t.org resides on 172.25.0.0/16 Network.

1.vi /etc/squid/squid.conf

#detault:

http_port8080

#Recommended minimum configuration:

# Near the src acl src section

acl allownet src 172.24.0.0/255.255.0.0

acl denynet src 172.25.0.0/255.255.0.0

#Default:

# http_access deny all

#Under Herehttp_access allow allownet

http_access deny denynet

2.service squid start

3.chkconfig squid on

squid is a proxy caching server, using squid we can share the internet, block the internet, to certain network. First we should define the port for squid, the standard port for squid is 3128. We can run squid on different port by specifying http_port portnumber.

Do the following steps as:

1.vi /etc/exports

/storage*.example.com(rw,sync)

2.service nfs start

3.service portmap restart

4.chkconfig nfs on

5.chkconfig portmap on

In Linux to share the data we use the /etc/exports file. Pattern is:

Pathclient(permission)

Shared Directory Path, Client can be single host or domain name or ip address. Permission should specify without space with client lists in parentheses.

Do the following steps as:

1.vi /etc/exports

/data*.example.com(rw,sync)

2.service nfs start

3.service portmap restart

4.chkconfig nfs on

5.chkconfig portmap on

In Linux to share the data we use the /etc/exports file. Pattern is:

Pathclient(permission)

Shared Directory Path, Client can be single host or domain name or ip address. Permission should specify without space with client lists in parentheses.

Outside the LAN means my133t.org. All host on exam on example.com domain and outside domain means cracker.org.

To block the mail coming from cracker.org

1.vi /etc/mail/access

@my133t.orgREJECT

2.service sendmail start | restart

3.chkconfig sendmail on

Slave DNS is the backup of master DNS. Automatically within a certain time slave DNS synchronizes with the Master DNS server.

1.vi /var/named/chroot/etc/named.conf

zone “example.com” IN {

type slave;

masters { 192.100.0.254; };

file “example.com.zone”;

};

named-checkconf command checks the syntax for /var/named/chroot/etc/named.conf file.

service named start | restart

Do the following steps as:

1.vi /etc/security/limits.conf

user1hardnproc7

2.vi /etc/pam.d/system-auth

sessionrequired/lib/security/pam_limits.so

To limit the number of process or number of logins, we should configure on /etc/security/limits.conf. First Columns contains the username separated by comma or @group name. Second column either hard or soft limits. Third columns called the item, maxloigns or nproc etc.

To identify the session of users we should call the pam_limits module in /etc/pam.d/system-auth.

Document directive is used in apache configuration file to specify the directory where all web site related documents are. According to question eric user should able to write into the Document root directory.

Better set the permission using ACL (Access Control List), to apply the permission using acl needs to mount the filesystem with acl options. Example in above answer documentroot is in /var and /var is mounting separate file system so needs to mount the /var file system with acl option.

vi /etc/fstab

LABEL=/var/varext3defaults 1 1

mount –o remount /var

setfacl –m u:eric:rwx /var/www/example

getfacl /var/www/example

getfacl and setfacl two commands used to maintain the permission through acl. setfacl is used to set the permission on file/directory, getfacl is used to display the permission of file/directory.

Do the following steps as:

1.vi /etc/security/access.conf

-:john:LOCAL

2.vi /etc/pam.d/system-auth

accountrequired/lib/security/pam_access.so

/etc/security/access.conf file helps to allow or deny login to users on the basis of origin.

Syntax of /etc/security/access.conf

permission : users : origins

The first field should be a "+" (access granted) or "-" (access denied) character.

The second field should be a list of one or more login names, group names, or ALL (always matches). A pattern of the form user@host is matched when the login name matches the "user" part, and when the "host" part matches the local machine name.

The third field should be a list of one or more tty names (for non-networked logins), host names, domain names (begin with "."), host addresses, internet network numbers (end with "."), ALL (always matches) or LOCAL (matches any string that does not contain a "." character).

In our example denied to john user to login locally.

You should know about the /etc/inittab file, where default runlevel will define. And Much more runlevel specific Scripts are called here.

Actually that problem will occur if you don’t specify the default runlevel.

Reboot the system

Boot the System on single user mode.

Except for a normal boot of Linux, single-user mode is the most commonly used option. This is the system maintenance mode for experienced Linux administrators. It allows you to perform clean backups and restores to any partitions as needed from local hardware. It also allows you to run administration commands, recover or repair password and shadow password files, run filesystem checks, and so forth.

vi /etc/inittab and Write

id:runlevel:initdefault:

Standard Runlevels in RedHat Enterprise Linux

Runlevel

Description

0

Halt

1

Single-user mode, for maintenance (backups/restores) and repairs

2

Multiuser, without networking

3

Multiuser, with networking

4

Unused

5

X11, defaults to a GUI login screen. Logins bring the user to a GUI desktop.

6

Reboot (never set initdefault in /etc/inittab to this value!)

Do the following steps as:

1. Use fdisk /dev/hdaTo create new partition.

Type nFor New partition

It will ask for Logical or Primary Partitions. Press l for logical.

It will ask for the Starting Cylinder: Use the Default by pressing Enter Key.

Type the Size: +100MYou can Specify either Last cylinder of Size here.

Press P to verify the partitions lists and remember the partitions name. Default System ID is 83 that means Linux Native.

Type t to change the System ID of partition.

Type Partition Number

Type 82 that means Linux Swap.

Press w to write on partitions table.

Either Reboot or use partprobe command.

mkswap /dev/hda?To create Swap File system on partition.

swapon /dev/hda?To enable the Swap space from partition.

free –mVerify Either Swap is enabled or not.

vi /etc/fstab

/dev/hda?swapswapdefaults0 0

Reboot the System and verify that swap is automatically enabled or not.

Do the following steps as:

1.First check the size of Logical Volume: lvdisplay /dev/vo/myvol

2.Increase the Size of Logical Volume: lvextend -L+121M /dev/vo/myvol

3.Make Available the size on online: resize2fs /dev/vo/myvol

4.Verify the Size of Logical Volume: lvdisplay /dev/vo/myvol

5.Verify that the size comes in online or not: df -h

We can extend the size of logical Volume using the lvextend command. As well as to decrease the size of Logical Volume, use the lvresize command. In LVM v2 we can extend the size of Logical Volume without unmount as well as we can bring the actual size of Logical Volume on online using ext2online command.

Do the following steps as:

1.vi /etc/sysconfing/network

NETWORKING=yes

HOSTNAME=station?.example.com

GATEWAY=192.168.0.254

2.service network restart

Or

1.vi /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0

ONBOOT=yes

BOOTPROTO=static

IPADDR=X.X.X.X

NETMASK=X.X.X.X

GATEWAY=192.168.0.254

2.ifdown eth0

3.ifup eth0

This is boot related problem. There will be same questions repeated two times but problem is different.

First When you restart the system you will get the Error:

File Not Found

mount: error 15 mounting ext3

mount: error 2 mounting none

switchroot: mount failed: 22

umount /initrd/dev/: 2

Kernel Panic: no syncing: Attempted to kill init !

Restart the System

Check the grub boot loader configuration by pressing e shortcut key.

You will see like:

root (hd0,0)

kernel /vmlinuz-2.6.9-5.EL ro root= / rhgb quiet

initrd /initrd-2.6.9-5.EL.img

OR

root (hd0,0)

kernel /vmlinuz-2.6.9-5.EL ro root=LABEL=/root rhgb quiet

initrd /initrd-2.6.9-5.EL.img

Then Edit Boot loader to make like

root (hd0,0)

kernel /vmlinuz-2.6.9-5.EL ro root=LABEL=/ rhgb quiet

initrd /initrd-2.6.9-5.EL.img

Check all lines and edit as same as above. Press b to boot the system

After booting the system you should correct the /etc/grub.conf file.

If still you are getting Error likeFile not found, it seems that either kernel file or initrd file is missing. To troubleshoot with these problem, boot the system on rescue mode.

linux rescue

chroot /mnt/sysimage

Check the files on /boot, if not available install the kernel package from ftp or nfs server

Create the initrd image file on boot using: mkinitrd initrd-2.6.9-5.EL.img `uname –r`

Do the following steps as:

Use fdisk /dev/hdaTo create new partition.

Type nFor New partitions

It will ask for Logical or Primary Partitions. Press l for logical.

It will ask for the Starting Cylinder: Use the Default by pressing Enter Key.

Type the Size: +100MYou can Specify either Last cylinder of Size here.

Press P to verify the partitions lists and remember the partitions name.

Press w to write on partitions table.

Either Reboot or use partprobe command.

Use mkfs –t ext3 /dev/hda? Where ? is your partition number

Or

mke2fs –j /dev/hda? To create ext3 filesystem.

mkdir /mnt/neo

vi /etc/fstab

Write:

/dev/hda?/mnt/neoext3defaults1 2

Verify by mounting on current Sessions also:

mount /dev/hda? /mnt/neo

In Network problem thinks to check:

IP Configuration: use ifconfig command either IP is assigned to interface or not?

Default Gateway is set or not?

Hostname is set or not?

Routing problem is there?

Device Driver Module is loaded or not?

Device is activated or not?

Check In this way:

use ifconfig command and identify which IP is assigned or not.

cat /etc/sysconfig/networkWhat, What is written here. Actually here are these parameters.

NETWORKING=yes or no

GATEWAY=x.x.x.x

HOSTNAME=?

NISDOMAIN=?

Correct the file

Use vi /etc/sysconfig/network-scirpts/ifcfg-eth0 and check the proper options

DEVICE=eth0

ONBOOT=yes

BOOTPROTO=static

IPADDR=x.x.x.x

NETMAKS=x.x.x.x

GATEWAY=x.x.x.x

Use service network restart or start command

Do the following steps as:

Think while Problems occurred on booting System on Runlevel 5 (X Window).

/tmp is full or not

Quota is already reached

Video card or resolution or monitor is misconfigured.

xfs service is running or not.

Do These:

1.df –h /tmp/tmp is full remove the unnecessary file

quota usernameif quota is already reached remove unnecessary file from home directory.

Boot the System in runlevel 3.you can pass the Kernel Argument from boot loader.

Use command: system-config-displayIt will display a dialog to configure the monitor, Video card, resolution etc.

Set the Default Runlevel 5 in /etc/inittab

id:5:initdefault:

6.Reboot the System you will get the GUI login Screen.

To understand the role of a boot loader, take a step back from Linux. When you boot your computer, the BIOS starts by detecting basic hardware, including your hard drives. Once it's done, it looks for the boot loader on the Master Boot Record of the first available disk. If you're working with an older PC, the BIOS can't find your boot loader unless it's located within the first 1,024 cylinders of the hard disk.

Newer BIOSes overcome this problem with Logical Block Addressing, which is also known as LBA mode. LBA mode reads 'logical' values for the cylinder, head, and sector, which allows the BIOS to 'see' a larger disk drive.

If you have multiple hard drives, there is one more caveat. If your drives are IDE hard drives, the /boot directory must be on a hard drive attached to the primary IDE controller. If your drives are all SCSI hard drives, the /boot directory must be located on a hard drive with SCSI ID 0 or ID 1. If you have a mix of hard drives, the /boot directory must be located on either the first IDE drive or a SCSI drive with ID 0. In other words, this is not an issue on the Red Hat exams unless the computer that you're tested on has more than two hard drives. And I believe that's less likely, as that would increase the cost of the exam.

If you are getting the Kernel panic error, it means it is boot loader related problem. Redhat Enterprise Linux uses the GRUB boot loader. You can pass the kernel parameter from the boot loader as well as you can correct the kernel parameter passing from boot loader from GRUB screen at boot time.

GRUB boot loader configuration file is: /etc/grub.conf

And Correct Configuration is:

default=0

timeout=5

splashimage=(hd0,0)/grub/splash.xpm.gz

hiddenmenu

title Red Hat Enterprise Linux ES (2.6.9-5.EL)

root (hd0,0)

kernel /vmlinuz-2.6.9-5.EL ro root=LABEL=/ rhgb quiet

initrd /initrd-2.6.9-5.EL.img

Probably miss-configured the boot loader, so giving this problem. You can pass the correct parameter from GRUB prompt:

Table 3-3:GRUB Editing Commands

Command

Description

b

Boot the currently listed operating system

d

Delete the current line

e

Edit the current line

o

Create an empty line underneath the current line

O

Create an empty line above the current line

If you know all parameters and sequence of the boot loader you can enter in command prompt also.

Press c on GRUB screen.

Grub>root (hd0,0)

grub>kernel /vmlinuz-2.6.9-5.EL ro root=LABEL=/ rhgb quiet

grub>initrd /initrd-2.6.9-5.EL.img

grub>boot

Do the following steps as:

Use netconfig command

Enter the IP Address as given station number by your examiner: example: 172.24.0.1

Enter Subnet Mask

Enter Default Gateway and primary name server

press on ok

ifdown eth0

ifup eth0

verify using ifconfig

In the lab server is playing the role of router, IP forwarding is enabled. Just set the Correct IP and gateway, you can ping to 172.25.254.254.

Do the following steps as:

Use fdisk /dev/hdaTo create new partition.

Type nFor New partitions

It will ask for Logical or Primary Partitions. Press l for logical.

It will ask for the Starting Cylinder: Use the Default by pressing Enter Key.

Type the Size: +100MYou can Specify either Last cylinder of Size here.

Press P to verify the partitions lists and remember the partitions name.

Press w to write on partitions table.

Either Reboot or use partprobe command.

Use mkfs –t ext3 /dev/hda? Where ? is your partition number

Or

mke2fs –j /dev/hda? To create ext3 filesystem.

mkdir /mnt/neo

vi /etc/fstab

Write:

/dev/hda?/mnt/neoext3defaults1 2

Verify by mounting on current Sessions also:

mount /dev/hda? /mnt/neo

Do the following steps as:

1.First check the size of Logical Volume: lvdisplay /dev/vo/myvol

2.Increase the Size of Logical Volume: lvextend -L+121M /dev/vo/myvol

3.Make Available the size on online: ext2online /dev/vo/myvol

4.Verify the Size of Logical Volume: lvdisplay /dev/vo/myvol

5.Verify that the size comes in online or not: df -h

We can extend the size of logical Volume using the lvextend command. As well as to decrease the size of Logical Volume, use the lvresize command. In LVM v2 we can extend the size of Logical Volume without unmount as well as we can bring the size of Logical Volume on online using ext2online command.

Do the following steps as:

1.Use fdisk /dev/hdaTo create new partition.

Type nFor New partition

It will ask for Logical or Primary Partitions. Press l for logical.

It will ask for the Starting Cylinder: Use the Default by pressing Enter Key.

Type the Size: +100MYou can Specify either Last cylinder of Size here.

Press P to verify the partitions lists and remember the partitions name. Default System ID is 83 that means Linux Native.

Type t to change the System ID of partition.

Type Partition Number

Type 82 that means Linux Swap.

Press w to write on partitions table.

Either Reboot or use partprobe command.

mkswap /dev/hda?To create Swap File system on partition.

swapon /dev/hda?To enable the Swap space from partition.

free –mVerify Either Swap is enabled or not.

vi /etc/fstab

/dev/hda?swapswapdefaults0 0

Reboot the System and verify using free command that swap is automatically enabled or not.

By Default system accept the logs only generated from local host. To accept the Log from other host configure:

vi /etc/sysconfig/syslog

SYSLOGD_OPTIONS="-m 0 -r"

Where

-m 0 disables 'MARK' messages.

-r enables logging from remote machines

-x disables DNS lookups on messages recieved with -r

service syslog restart

While you load the X Window System, you will get the problem. Problem may caused by different error.

1.Check the /tmp is full ?

2.Check your quota, hard limit is already crossed ?

3.Check xfs service is running ?

4.Configure the Video card, Resolution, monitor type using: system-config-display (Most Probably in Redhat exam)

5.Edit the /etc/inittab to set default runlevel 5.

id:5:initdefault:

Do the following steps as:

Use fdisk /dev/hdaTo create new partition.

Type nFor New partitions

It will ask for Logical or Primary Partitions. Press l for logical.

It will ask for the Starting Cylinder: Use the Default by pressing Enter Key.

Type the Size: +100MYou can Specify either Last cylinder of Size here.

Press P to verify the partitions lists and remember the partitions name.

Press w to write on partitions table.

Either Reboot or use partprobe command.

Use mkfs –t ext3 /dev/hda?

Or

mke2fs –j /dev/hda? To create ext3 filesystem.

vi /etc/fstab

Write:

/dev/hda?/dataext3defaults0 0

11. Verify by mounting on current Sessions also:

mount /dev/hda? /data

Do the following steps as:

1.chmod g+s /data

2.Verify using: ls -ld /data

Permission should be like:

drwxrws--- 2 root sysadmin 4096 Mar 16 18:08 /data

If SGID bit is set on directory then who every users creates the files on directory group owner automatically the owner of parent directory.

To set the SGID bit: chmod g+s directory

To Remove the SGID bit: chmod g-s directory

Do the following steps as:

groupadd training

To create a group we use the groupadd command.

Verify from: cat /etc/group whether group added or not?

Very Tricky question from redhat. Actually question is giving scenario to you to implement quota to neo user. You should apply the quota to neo user on /home that neo user shouldn’t occupied space more than 70K.

1.vi /etc/fstab

LABEL=/home/homeext3defaults,usrquota0 0To enable the quota on filesystem you should mount the filesystem with usrquota for user quota and grpquota for group quota.

2.touch /home/aquota.userCreating blank quota database file.

3.mount -o remount /homeRemounting the /home with updated mount options. You can verify that /home is mounted with usrquota options or not using mount command.

4.quotacheck -u /homeInitialization the quota on /home

5.edquota –u neo /homeQuota Policy editor

See the snapshot

1 Disk quotas for user neo (uid 500):

2 Filesystem blocks soft hard inodes soft hard

4 /dev/mapper/vo-myvol 2 30 70 1 0 0

Can you set the hard limit 70 and soft limit as you think like 30.

Do the following steps as:

1.cat >schedule

*/2 * * * * /bin/echo “Hello World” >/dev/tty8

crontab schedule

Verify using: crontab –l

service crond restart

Cron helps to schedule on recurring events. Pattern of Cron is:

MinuteHourDay of MonthMonthDay of WeekCommands

0-590-231-311-120-7 where 0 and 7 means Sunday.

Note * means every. To execute the command on every two minutes */2.

To add the scheduled file on cron job: crontab filename

To List the Cron Shedule: crontab –l

To Edit the Schedule: crontab –e

To Remove the Schedule: crontab –r

chown or chgrp command is used to change the ownership.

Syntax of chown: chown [-R] username:groupname file/directory

Syntax of chgrp: chgrp [-R] groupname file/directory

Whenever user creates the file or directory, the owner of that file/directory automatically will be that user and that user’s primary group name.

To change group owner ship

chgrp training /data Which set the Group Ownership to training

or

chown root.training /dataWhich set the user owner to root and group owner to training group.

Verify /data using: ls -ld /data

You will get: drwxr-xr-x 2 root training …………..

Do the following steps as:

1.Open the Browser and type the above URL.

2.Fill the form as required all information.

Questions asking you to install the dialog package from the server. In your Lab FTP server as well as NFS server are configured. You can install either through FTP or NFS.

1.Just Login to server1.example.com through FTP: ftp server1.example.com

2.Enter to pub directory: cd pub

3.Enter to RedHat/RPMS: cd RedHat/RPMS

4.Download the Package: mget dialog-*

5.Logout from the FTP server: bye

6.Install the package: rpm -ivh dialog-*

7.Verify the package either installed or not: rpm -q dialog

Do the following steps as:

usermod -G training user1

usermod -G training user2

usermod -G training user3

Verify from : cat /etc/group

There are two types of group, I) primary group II) Secondary or supplementary group.

Primary Group: Primary group defines the files/directories and process owner group there can be only one primary group of one user.

Secondary Group is used for permission. Where permission are defined for group members, user can access by belonging to that group.

Here user1, user2 and user3 belong as supplementary to training group. So these users get the permission of group member.

Do the following steps as:

useradd user1

useradd user2

useradd user3

passwd user1

passwd user2

passwd user3

We create the user using useradd command and we change the password of user using passwd command. If you want to set the blank password use: passwd -d username.

Note: Examiner will provide you the Installation startup CD. And here mentioned size may vary see on the exam paper.

1.Insert the CD on CD-ROM and start the system.

2.In Boot: Prompt typelinux askmethod

3. It will display the Language, keyboard selection.

4. It will ask you for the installation method.

5. Select the FTP from the list

6. It will ask the IP Address, Net mask, Gateway and Name Server. Select Use

Dynamic IP Configuration: because DHCP Server will be configured in your exam lab.

7. It will ask for the FTP site name and Redhat Enterprise Linux Directory.

Specify the FTP Server: 192.168.0.254

Directory: pubBecause anonymous login on /var/ftp.

8. After Connecting to the FTP Server Installation will start. Go up to the partition screen by selecting the different Options.

9. Create the partition According to the Question because Size and what-what partition should you create at installation time is specified in your question

10. Then select the MBR Options, time zone and go upto package selections.

It is another Most Important Time of installation. Due to the time limit, you should be

care about the installation packages. At Exam time you these packages are enough.

X-Window System

GNOME Desktop

(these two packages are generally not required)

Administration Tools.

System Tools

Windows File Server

FTP Servers

Mail Servers

Web Servers

Network Servers

Editors

Text Based Internet

Server Configuration Tools

Printing Supports

When installation will complete, your system will reboot. Jump for another Question.

Do the following steps as:

1.vi /etc/httpd/conf/httpd.conf

<VirtualHost 192.100.0.1>

ServerNamewww.abc.com

DocumentRoot /var/www/abc/

<Directory /var/www/abc>

AllowOverrideauthconfig

</Directory>

DirectoryIndexindex.html

ServerAdminwebmaster@abc.com

ErrorLog logs/error_abc.logs

CustomLog logs/custom_abc.logs common

</VirtualHost>

2.Create the directory and index page on specified path. (Index page can download fromftp://server1.example.comat exam time)

3.vi /var/www/abc/.htaccess

AuthName“Only to Authorized Users”

AuthTypebasic

AuthUserFile/etc/httpd/conf/mypasswd

requirevalid-user

htpasswd –c /etc/httpd/conf/mypasswd user5

htpasswd –m /etc/httpd/conf/mypasswd user6

chgrp apache /etc/httpd/conf/mypasswd

chmod g+r /etc/httpd/conf/mypasswd

service httpd restart

chkconfig httpd on

AllowOverride Authconfig is used to specify which and how much configuration can be overridden by directory specific .htaccess files.

One of the most common tasks performed in users’ .htaccess files is adding authorization. Typically, a user will setup authorization for directories that hold sensitive information with a configuration.

Do the following steps as:

1.vi /etc/hosts.deny

sshd:ALL EXCEPT .example.com

or

1.vi /etc/hosts.deny

sshd:ALL

2.vi /etc/hosts.allow

sshd:.example.com

We can secure the services using tcp_wrappers. There are main two files, /etc/hosts.allow and /etc/hosts.deny.

There will be three stage access checking

- Is access explicitly permitted? Means permitted from /etc/hosts.allow?

- Otherwise, Is access explicitly denied? Means denied from /etc/hosts.deny?

- Otherwise, by default permit access if neither condition matched.

To deny the services we can configure /etc/hosts.deny file using ALL and EXCEPT operation. Pattern of /etc/hosts.allow and /etc/hosts.deny file is:

Demon_list:client_list:options

In Client list can be either domain name or IP address.

Do the following steps as:

1.vi /etc/security/limits.conf

user1,user2-maxlogins1

@training-maxlogins5

2.vi /etc/pam.d/system-auth

sessionrequired/lib/security/pam_limits.so

To limit the number of process or number of logins, we should configure on /etc/security/limits.conf. First Columns contains the username separated by comma or @group name. Second column either hard or soft limits. Third columns called the item, maxloigns or nproc etc.

To identify the session of users we should call the pam_limits module in /etc/pam.d/system-auth.

Do the following steps as:

1.vi /etc/httpd/conf/httpd.conf

<VirtualHost 192.168.0.?>

ServerNamestation?.example.com

DocumentRoot /var/www/station?

DirectoryIndexindex.html

ServerAdminwebmaster@example.com

</VirtualHost>

2.Create the directory and index page on specified path. (Index page can download fromftp://server1.example.comat exam time)

3.service httpd start|restart

4.chkconfig httpd on

Do the following steps as:

1.vi /etc/vsftpd/vsftpd.conf

anonymous_enable=no

2.service vsftpd restart

/etc/vsftpd/vsftpd.conf file is used to allow or deny to anonymous or real user. To allow anonymous anonymous_enable=yes should be there. Sample configuration is like.

# Allow anonymous FTP? (Beware - allowed by default if you comment this out).

anonymous_enable=YES

#

# Uncomment this to allow local users to log in.

local_enable=YES

#

# Uncomment this to enable any form of FTP write command.

write_enable=YES

#

# Default umask for local users is 077. You may wish to change this to 022,

# if your users expect that (022 is used by most other ftpd's)

local_umask=022

#

# Uncomment this to allow the anonymous FTP user to upload files. This only

# has an effect if the above global write enable is activated. Also, you will

# obviously need to create a directory writable by the FTP user.

#anon_upload_enable=YES

#

# Uncomment this if you want the anonymous FTP user to be able to create

# new directories.

#anon_mkdir_write_enable=YES

#

# Activate directory messages - messages given to remote users when they

# go into a certain directory.

dirmessage_enable=YES

#

# Activate logging of uploads/downloads.

xferlog_enable=YES

#

# Make sure PORT transfer connections originate from port 20 (ftp-data).

connect_from_port_20=YES

#

# If you want, you can arrange for uploaded anonymous files to be owned by

# a different user. Note! Using "root" for uploaded files is not

# recommended!

#chown_uploads=YES

#chown_username=whoever

#

# You may override where the log file goes if you like. The default is shown

# below.

#xferlog_file=/var/log/vsftpd.log

#

# If you want, you can have your log file in standard ftpd xferlog format

xferlog_std_format=YES

#

# You may change the default value for timing out an idle session.

#idle_session_timeout=600

#

# You may change the default value for timing out a data connection.

#data_connection_timeout=120

#

# It is recommended that you define on your system a unique user which the

# ftp server can use as a totally isolated and unprivileged user.

#nopriv_user=ftpsecure

#

# Enable this and the server will recognise asynchronous ABOR requests. Not

# recommended for security (the code is non-trivial). Not enabling it,

# however, may confuse older FTP clients.

#async_abor_enable=YES

#

# By default the server will pretend to allow ASCII mode but in fact ignore

# the request. Turn on the below options to have the server actually do ASCII

# mangling on files when in ASCII mode.

# Beware that turning on ascii_download_enable enables malicious remote parties

# to consume your I/O resources, by issuing the command "SIZE /big/file" in

# ASCII mode.

# These ASCII options are split into upload and download because you may wish

# to enable ASCII uploads (to prevent uploaded scripts etc. from breaking),

# without the DoS risk of SIZE and ASCII downloads. ASCII mangling should be

# on the client anyway..

#ascii_upload_enable=YES

#ascii_download_enable=YES

#

# You may fully customise the login banner string:

#ftpd_banner=Welcome to blah FTP service.

#

# You may specify a file of disallowed anonymous e-mail addresses. Apparently

# useful for combatting certain DoS attacks.

#deny_email_enable=YES

# (default follows)

#banned_email_file=/etc/vsftpd.banned_emails

#

# You may specify an explicit list of local users to chroot() to their home

# directory. If chroot_local_user is YES, then this list becomes a list of

# users to NOT chroot().

#chroot_list_enable=YES

# (default follows)

#chroot_list_file=/etc/vsftpd.chroot_list

#

# You may activate the "-R" option to the builtin ls. This is disabled by

# default to avoid remote users being able to cause excessive I/O on large

# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume

# the presence of the "-R" option, so there is a strong case for enabling it.

#ls_recurse_enable=YES

pam_service_name=vsftpd

userlist_enable=YES

#enable for standalone mode

listen=YES

tcp_wrappers=YES

Do the following steps as:

1.vi /etc/security/time.conf

login;*;user15|user16;Sa0000-2400

2.vi /etc/pam.d/login

accountrequiredpam_time.so

For Time based authentication, we should configured in /etc/security/time.conf

Syntax of /etc/security/time.conf

services;ttys;users;times

services

is a logic list of PAM service names that the rule applies to.

ttys

is a logic list of terminal names that this rule applies to.

users

is a logic list of users to whom this rule applies.

times

the format here is a logic list of day/time-range entries the days are specified by a sequence of two character entries, MoTuSa for example is Monday Tuesday and Saturday. Note that repeated days are unset MoMo = no day, and MoWk = all weekdays bar Monday. The two character combinations accepted are

Mo Tu We Th Fr Sa Su Wk Wd Al

the last two being week-end days and all 7 days of the week respectively. As a final example, AlFr means all days except Friday.

pam_time modules checks the file /etc/security/time.conf for authentication. So, we should call the pam_time modules in /etc/pam.d/login.

Do the following steps as:

1.vi /etc/hosts.deny

vsftpd:ALL EXCEPT .example.com

We can secure the services using tcp_wrappers. There are main two files, /etc/hosts.allow and /etc/hosts.deny.

There will be three stage access checking

-Is access explicitly permitted? Means permitted from /etc/hosts.allow?

- Otherwise, Is access explicitly denied? Means denied from /etc/hosts.deny?

- Otherwise, by default permit access if neither condition matched.

To deny the services we can configure /etc/hosts.deny file using ALL and EXCEPT operation. Pattern of /etc/hosts.allow and /etc/hosts.deny file is:

Demon_list:client_list:options

In Client list can be either domain name or IP address.

Do the following steps as:

1.vi /etc/mail/local-host-names

example.com

2.vi /etc/mail/sendmail.mc

dnl # DEAMON_OPTIONS(`Port=smtp,Addr=127.0.0.1,Name=MTA`)dnl

MASQUERADE_AS(`example.com')dnl

define(`SMART_HOST',`smtp.abc.com')

3.m4 /etc/mail/sendmail.mc >/etc/mail/sendmail.cf

4.vi /etc/mail/virtusertable

info@example.comadmin@example.com

5.vi /etc/mail/access

192.168.0RELAY

/etc/mail/local-host-names file contains the aliases to hostname. Mail server program reads the /etc/mail/sendmail.cf. To change the configuration on mail server, we should edit the /etc/mail/sendmail.mc file and should generate the sendmail.cf using m4 command.

By default sendmail server allows to connect to local host only. So we should edit the/etc/mail/sendmail.mc file to allow connect to other hosts.

By default sendmail server will not forward mail. We should specify on /etc/mail/access to relay or to block mail coming from domain or network or individual email address.

To masquerade the address, MASQUERADE_AS option is in /etc/mail/sendmail.mc. SMART_HOST deliver all local mail locally and outgoing mail through another mail server.

/etc/mail/virtusertable file is used map virtual address to real address.

Eg.

info@example.comuser1@example.com

enquiry@example.comadmin@abc.com

Do the following steps as:

1.vi /etc/httpd/conf/httpd.conf

NameVirtualHost 192.100.0.X

<VirtualHostwww.abc.com >

ServerNamewww.abc.com

DocumentRoot /var/www/abc/

DirectoryIndexindex.html

ServerAdminwebmaster@abc.com

ErrorLog logs/error_abc.logs

CustomLog logs/custom_abc.logs common

</VirtualHost>

<VirtualHostwww.example.com >

ServerNamewww.example.com

DocumentRoot /var/www/example/

DirectoryIndexindex.html

ServerAdminwebmaster@example.com

ErrorLog logs/error_example.logs

CustomLog logs/custom_example.logs common

</VirtualHost>

2.Create the directory and index page on specified path. (Index page can download fromftp://server1.example.comat exam time)

3.service httpd start| restart

4.chkconfig httpd on

5.links http://www.abc.com

6.links http://www.example.com

For Name based Virtual Hosting, we should specified the IP address on which we are going to host the multiple sites using NameVirtualHost options.

ServerName means you FQDN, already lookup on DNS

DirectoryRoot path for web documents for this site.

DirectoryIndex default page for websites.