Kollynetservices's Blog

Individual Project

kollynetservices — Thu, 26 Mar 2009 08:39:17 +0000

The individual project was an intresting one. I carried out installation and configuration of Joomla on CentOS a linux distro. A lot was learnt and discovered about LAMP as regards web hosting. My individual project was a bit in a mess, for the fact that I got the Joomla installed and configured late, I found out that I did not submit the report with the right program: I used microsoft words instead of Office word. I dont know the extent to which this will affect my mark. Hardly, did I even listened attentively in the DNS practical class. Because as at then, I have not completed the project report which really put me under pressure. I hope to make it up, in the group project, 40% is a great mark to mess up with. Anyway that is college for you as a full-time student with kids.

Securing the CentOS Perfect Setup with Bastille

kollynetservices — Mon, 09 Mar 2009 01:43:04 +0000

This article shows how to secure a CentOS server using psad, Bastille, and some other tweaks. psad is a tool that helps detect port scans and other suspicious traffic, and the Bastille hardening program locks down an operating system, proactively configuring the system for increased security and decreasing its susceptibility to compromise.

Create an additional account for Systems Administration
The “adduser” command will create an account.

adduser service

The “passwd” command will set the password for the “service” account.

passwd service

Creating a directory for downloads.
This will create a directory to download the RPMs and other files.

mkdir /downloads
cd /downloads

Installing PSAD
psad is a collection of three lightweight system daemons (two main daemons and one helper daemon) that run on Linux machines and analyze Netfilter log messages to detect port scans and other suspicious traffic. More information can be found here.

wget http://www.cipherdyne.com/psad/download/psad-1.4.6-1.i386.rpm
rpm -Uvh psad-1.4.6-1.i386.rpm

Installing Bastille
The Bastille Hardening program “locks down” an operating system, proactively configuring the system for increased security and decreasing its susceptibility to compromise. Bastille can also assess a system’s current state of hardening, granularly reporting on each of the security settings with which it works. More information can be found here.

wget http://easynews.dl.sourceforge.net/sourceforge/bastille-linux/Bastille-3.0.9-1.0.noarch.rpm
wget ftp://ftp.icm.edu.pl/vol/rzm4/linux-dag/redhat/el4/en/i386/RPMS.dag/perl-Curses-1.12-1.2.el4.rf.i386.rpm

rpm -ivh Bastille-3.0.9-1.0.noarch.rpm
rpm -Uvh perl-Curses-1.12-1.2.el4.rf.i386.rpm

Running Bastille
This will start the interactive prompt.

/usr/sbin/bastille -c

Interactive prompt response
These settings are recommendations for the Perfect Setup install. There may be certian values that may need to change if other software or packages have been installed.

Would you like to set more restrictive permissions on the administration utilities? -> YES

Would you like to disable SUID status for mount/umount? -> YES
Would you like to disable SUID status for ping? -> YES
Would you like to disable SUID status for at? -> YES
Would you like to disable the r-tools? -> YES
Would you like to disable SUID status for usernetctl? -> YES
Would you like to disable SUID status for traceroute? -> YES
Should Bastille disable clear-text r-protocols that use IP-based authentication? -> YES
Would you like to enforce password aging? -> YES
Do you want to set the default umask? -> YES
What umask would you like to set for users on the system? -> 007
Should we disallow root login on tty’s 1-6? -> NO
Should Bastille ask you for extraneous accounts to delete? -> NO
Would you like to password-protect the GRUB prompt? -> NO
Would you like to disable CTRL-ALT-DELETE rebooting? -> YES
Would you like to password protect single-user mode? -> NO
Would you like to set a default-deny on TCP Wrappers and xinetd? -> NO
Would you like to display “Authorized Use” messages at log-in time? -> YES
Who is responsible for granting authorization to use this machine? -> YOUR COMPANY NAME
Would you like to put limits on system resource usage? -> YES

Should we restrict console access to a small group of user accounts? -> YES
Which accounts should be able to login at console? -> root
Would you like to set up process accounting? -> NO

Would you like to disable acpid and/or apmd? -> YES
Would you like to disable PCMCIA services? -> YES
Would you like to disable GPM? -> YES
Would you like to deactivate the HP OfficeJet (hpoj) script on this machine? -> YES
Would you like to deactivate the ISDN script on this machine? -> YES
Would you like to deactivate kudzu’s run at boot? -> YES
Do you want to stop sendmail from running in daemon mode? -> YES
Would you like to deactivate named, at least for now? -> NO
Would you like to deactivate the Apache web server? -> NO
Would you like to bind the Web server to listen only to the localhost? -> NO
Would you like to bind the web server to a particular interface? -> NO

Would you like to deactivate the following of symbolic links? -> YES
Would you like to disable printing? -> YES
Would you like to install TMPDIR/TMP scripts? -> NO
Would you like to run the packet filtering script? -> YES

Do you need the advanced networking options? -> NO
DNS Servers: [0.0.0.0/0] -> **LEAVE DEFAULT**
Public interfaces: -> eth+
TCP services to audit: -> telnet ftp imap pop3 finger sunrpc exec login linuxconf ssh
UDP services to audit: -> 31337
ICMP services to audit: -> **BLANK**
TCP service names or port numbers to allow on public interfaces: -> 21 22 25 53 80 110 111 143 443 631 953 993 995 3306
UDP service names or port numbers to allow on public interfaces: -> **BLANK**
Force passive mode? -> YES
TCP services to block: -> 2049 2065:2090 6000:6020 7100
UDP services to block: -> 2049 6770
ICMP allowed types: -> destination-unreachable echo-reply time-exceeded
Enable source address verification? -> YES
Reject method: -> DENY
Interfaces for DHCP queries: -> **BLANK**
NTP servers to query: -> **BLANK**
ICMP types to disallow outbound: -> destination-unreachable time-exceeded
Should Bastille run the firewall and enable it at boot time? -> YES
Would you like to setup psad? -> YES
psad check interval: -> 15
Port range scan threshold: -> 1
Enable scan persistence? -> NO
Scan timeout: -> 3600
Show all scan signatures? -> NO
Danger Levels: -> 5 50 1000 5000 10000
Email addresses: -> root@localhost
Email alert danger level: -> 1
Alert on all new packets? -> YES
Enable automatic blocking of scanning IPs? -> NO
Should Bastille enable psad at boot time? -> YES
Are you finished answering the questions, i.e. may we make the changes? -> YES

http://www.howtoforge.com/bastille_firewall_centos

The Apache Web Server

kollynetservices — Mon, 02 Mar 2009 10:30:44 +0000

For most people, the World Wide Web has become synonymous with the Internet. No discussion of Internet services is complete without mention of web servers. Web servers have become an essential part of every networked business—they are used to advertise products and offer services to external customers as well as to coordinate and disseminate information within the organization. Linux systems make excellent web servers. In fact, the Apache server software that comes with Linux is the most widely used web server in the world. The daemon that Apache installs on a Linux
system to create a web server is the Hypertext Transport Protocol daemon (httpd).
Installing Apache
The Apache web server is part of most Linux distributions, and that includes the Red Hat Linux distribution. The Apache web server software is one of the components that can be selected during the operating system installation. If Apache is not among the software you selected during the initial installation, you need to install it . The easiest way to install software is with a package manager.
There are a couple that are available, but the most popular is the RPM Package Manager (RPM). RPM can also be used from the command line to manage the installation of optional software.
Use the rpm command to install the software you need, remove software you don’t want, and check what software is installed in your system. rpm has many possible options, but most of them are for the developers who build the packages you want to install. For a network administrator, rpm can be reduced to three basic commands:
•rpm –i package: The –i option is used to install software.
•rpm –e package: The –e option is used to remove software.
rpm –q: The –q option is used to list a software package already installed in the computer.
Use –qa to list all installed packages.
•
To find the Apache package delivered with the distribution, mount the Linux distribution CD−ROM,
and look in the RPMS directory. Here is an example from our Red Hat system:
$ cd /mnt/cdrom/RedHat/RPMS
$ ls *apache*
apache−1.3.20−16.i386.rpm
apacheconf−0.8.1−1.noarch.rpm
This example assumes that the CD−ROM was mounted on /mnt/cdrom. It shows that two software packages related to Apache are included in the Red Hat distribution. One is the web server software, and the other is an X Window System Apache configuration tool.
Install apache−1.3.20−16.i386.rpm with this command:
# rpm –i apache−1.3.20−16.i386.rpm
After installing the package, check that it is installed with another rpm command:
$ rpm −q apache
apache−1.3.20−16
This example shows Apache being installed from the Red Hat distribution CD−ROM. If your Linux distribution does not include the Apache software, or if you want the latest release, download Apache from the Internet. It is available on the network in RPM format and in binary format for systems that do not have rpm tools. Apache software is available at httpd.apache.org in both source and binary forms. Open your browser to the Apache web page and select the Download link

Sybex.Linux.Network.Servers.eBook-EEn.pdf

DHCP server

kollynetservices — Sun, 22 Feb 2009 03:29:22 +0000

I encountered a little problem in setting up the DHCP server on the VMware, for the initial server I installed crashed which I could not figured out what exactly happened but thanks to Tim who came to my rescue. I could not finish the exercise in the class due to time wasted. Now I got it running on my machine at home.

What is DHCP?
Dynamic Host Configuration Protocol (DHCP) is a network protocol that enables a server to automatically assign an IP address to an individual computer’s TCP/IP stack software. DHCP assigns a number dynamically from a defined range of numbers (i.e., a scope) configured for a given network.
Almost all wireless access points, many wired Ethernet routers, and computers running Internet Connection Sharing have built-in DHCP servers. While this makes configuration of a small network easier, it can cause problems when the DHCP servers are used in larger networks.

Client computers configured to use DHCP for IP assignment do not need to have a statically assigned IP address. In addition, they generally do not need to have addresses configured for DNS servers or WINS servers, as these are also set by the DHCP server.
DHCP assigns a TCP/IP address when a system is started. Typically, it works like this:
1. A user turns on a computer with a DHCP client.
2. The client computer sends a broadcast request (called a DISCOVER or DHCPDISCOVER), looking for a DHCP server to answer.
3. The router directs the DISCOVER packet to the correct DHCP server.
4. The server receives the DISCOVER packet. Based on availability and usage policies set on the server, the server determines an appropriate address (if any) to give to the client. The server then temporarily reserves that address for the client and sends back to the client an OFFER (or DHCPOFFER) packet, with that address information. The server also configures the client’s DNS servers, WINS servers, NTP servers, and sometimes other services as well.
5. The client sends a REQUEST (or DHCPREQUEST) packet, letting the server know that it intends to use the address.
6. The server sends an ACK (or DHCPACK) packet, confirming that the client has a been given a lease on the address for a server-specified period of time.

When a computer uses a static IP address, it means that the computer is manually configured to use a specific IP address. One problem with static assignment, which can result from user error or inattention to detail, occurs when two computers are configured with the same IP address. This creates a conflict that results in loss of service. Using DHCP to dynamically assign IP addresses minimizes these conflicts.

http://kb.iu.edu/data/adov.html

CentOS Installation

kollynetservices — Mon, 16 Feb 2009 06:15:16 +0000

Last week Tuesday internet and network services practical class featured basic desktop and server installation of CentOS. The desktop installation includes basic office applications while the server runs basic network services.

NDISwrapper
NDISwrapper is a free software driver wrapper that enables the use of Microsoft Windows drivers for wireless network devices (cards, USB modems, and routers), on Unix-like operating systems, for devices sharing the same architecture only, namely either x86 or x86-64. NDISwrapper works by implementing the Windows kernel and NDIS APIs, and dynamically linking the driver to this implementation.

Native drivers for Unix and Linux are not available for many wireless network adapters, as manufacturers supply neither drivers nor the information required to write them. NDISwrapper allows Windows drivers available for virtually all adapters to be used under Unix and Linux.

http://en.wikipedia.org/wiki/Ndiswrapper

Usb wireless Adapter: Ralink rt73
I have found this tutorial to be very helpful in installing and configuring a usb wireless adapter Ralink rt73 window’s driver on fedora core 6 and it worked like a charm. Although, I have given away the box now but I hope to try this on CentOS as soon as I could get another box.

http://www.linuxquestions.org/linux/answers/Networking/Linksys_Ver4_Using_NDISWrapper

Before getting started you will have to go download Ndiswrapper 0.8 from here:
http://sourceforge.net/projects/ndiswrapper/

Then download the driver for Windows or you locate the driver on the CD :

And finally dhcpcd from here:
http://www.phystech.com/download/dhcpcd.html

Hello world!

kollynetservices — Thu, 12 Feb 2009 05:52:56 +0000

Welcome to WordPress.com. This is your first post. Edit or delete it and start blogging!