Zyxw5P5F

1###Features of Red Hat Enterprise v6###
2Features:
3 1. Current Release: 6
4 2. Based on 2.6.x kernel
5 3. Supports graphical and text-based installations
6  a. Graphical installer is more feature-rich than text-based installer
7 4. Downloadable via: HTTP from redhat.com
8  a. Available as trial and/or subscription
9 5. Installable from:
10  a. Local media: CDs, DVDs (1-DVD ISO image), USB
11  b. Network: HTTP, NFS, FTP
12  c. PXE - Network Installation
13 6. Virtualization - KVM
14 7. EXT4 - Default FS for new installations
15  a. Also works with: /boot due to GRUP support
16 8. Disk encryption, including root (/) file system
17 9. Platforms:
18  a. x86(32-bit)
19  b. x86_64 (AMD64 & Intel64)
20  c. IBM Power
21  d. System z
22
23System Requirements:
24 1. 1GHz P4 processor - preferably dual core or better
25 2. 1GB RAM - preferably 4GB or better
26 3. 3GB Storage for - minimum installation
27 4. 5GB storage for - full installation
28
2910. Compatibility cupport for older programs (compat* RPMS)
30Note: These are libraries to ensure the operation of older programs
31Note: This ensures that certified applications continue to run
32
3311. Anaconda auto-formats disk with:
34  a. '/boot'
35  b. '/' - root
36  c. '/home' (if >= 50GB of storage are available)
37  d. 'swap'
38
3912. Anaconda & running system use: NetworkManager to auto-configure networking
40  a. Uses DHCP by default
41  b. Requires minimum intervention
42
4313. Anaconda (installer) still supports absolute control over variables
44  a. i.e. network settings may be specified during installation
45
46##Prep Installation (HTTP) Server###
47Features:
48 1. Easy access to ISO image contents
49
50Tasks:
51 1. Mount ISO image in web-accessible directory on: 192.168.75.101/LinuxCBT/EL-6/Misc/RHEL6/
52
53Note: Boot ISO image may be downloaded from redhat.com or created from DVD ISO image:
54
55 2. Reboot server and supply the following boot string:
56  a. Press 'Tab' to edit boot option
57  b. 'linux repo=http://192.168.75.101/LinuxCBT/EL-6/Misc/RHEL6 resolution=800x600 ip=192.168.75.20 netmask=255.255.255.0 gateway=192.168.75.1 dns=192.168.75.101'
58###Basic Linux Skills###
59Features:
60 1. A number of key commands
61
62Tasks:
63 1. 'tty' - reveals connected terminal
64  a. '/dev/pts/0' - psuedo-terminal 1
65Note: Terminals are either real (console) or fake (pseudo)
66Note: SSH and GUI terminals are pseudo
67Note: Physical console terminals are real (tty?)
68
69 2. 'whoami' - reveals currently-logged-in user
70 3. 'w & who'
71  a. 'who -a' - reveals ALL users and their processes
72  b. 'w' - reveals currently-logged-in user and processes, etc.
73 4. 'pwd' - prints working directory of full path from '/' root of file system
74 5. 'cd' - changes directory
75  a. 'cd ..' - moves one level up in the directory tree
76  b. 'cd .' - current directory
77  c. 'cd /' - moves using absolute path
78  d. 'cd ~' - changes to currently-logged-in user's $HOME
79  e. 'cd with tab-completion' - shortens navigation time
80Note: Use Tab-completion with BASH shell commands to shorten navigation time
81
82 6. 'ls' - lists directories/files
83   a. 'ls' - lists current directory in short form
84   b. 'ls -l' - lists "" in long form
85   c. 'ls -l /' - lists '/' in long form
86   d. 'ls -al' - lists current directories entries including hidden items
87   e. 'ls -l .Xauthority .ssh/' - lists multiple items
88   f. 'ls -ltr' - sorts with most recent at the bottom
89  7. 'touch' - creates zero-byte file or updates timestamp on pre-existing file
90  8. 'echo' - echoes information to a default of STDOUT
91   a. 'echo "This is a test" '
92  9. 'cat' - concatenates (brings together) content
93   a. 'cat test.txt'
94Note: '$?' var contains the exit status of the most recently executed command
95   b. 'cat test.txt test2.txt > test3.txt'
96 10. 'id' - returns: UID, GID, GROUPS, SELinux Context (if enabled)
97 11. 'mkdir' - creates new directories
98  a. 'mkdir temp'
99 12. 'rm' - removes file(s)/directory(ies) - removes recursively
100  a. 'rm -rf temp*'
101  b. 'rm -rf temp[34]' - removes a range of items using Regular Expression (RegEx) - Character-Class
102 13. 'which' - searches current $PATH for executable
103  a. 'which cat' && 'which ls'
104 14. 'echo $PATH' - reveals the current $PATH
105 15. Redirection:
106  a. '<' - INPUT - Usually defaults to a source file
107  b. '>' - OUTPUT - clobbers target file
108  c. '>>' - APPEND - appends to target file if it exists and creates it if it doesn't
109 Examples:
110  a. 'cat test.txt' - reads the file 'test.txt' as STDIN (Standard INPUT)
111Note: However, most commands will wait for keyboard input if no input file is specified
112i.e.  b. 'cat ' - waits on STDIN for input
113Note: Use: 'CTRL-D' to quit STDIN from keyboard
114Note: 'cat -' does the same as: 'cat'
115
116  b. 'cat test.txt > helloworld.txt' - bypasses STDOUT (Standard OUTPUT)
117  c. 'cat test.txt >> helloworld.txt' - "" but APPENDS to target file
118 16. Linux | UNIX Pipes - connects output stream of command a to input stream of command b
119   a. 'cat /var/log/messages | less' - pipes output of 'cat...' into 'less'
120   b. 'cat /var/log/messages | grep kernel | less' - parses '/var/log/messages' for keyword 'kernel' then pipes the output to 'less' to display one pageful at a time
121Note: When piping, STDIN becomes the content of the pipe
122 17. Command Chaining
123  a. 'cat /var/log/messages | grep kernel | wc -l'
124  b. 'rm -rf temp* ; ls -l' - runs both commands independently
125Note: Command Chaining is not dependent upon the exit status of the most-recently executed command
126
127 18. Command Dependency: AND || OR
128  a. 'rm -rf temp* || ls -l' - run 'ls -l' if 'rm -rf temp*' fails
129  b. 'rm -rf temp* && ls -l' - run 'ls -l' if and only if 'rm -rf temp*' works
130
131
132 10. Command History - built-in command (BASH)
133  a. 'history'
134
135Note: BASH maintains a number of variables per shell
136  a. 'OLDPWD' - updated as you navigate the directory tree
137  b. 'LOGNAME'
138  c. 'SHELL'
139etc.
140  11. 'export' exports vars
141   a. 'export PATH=$PATH:/tmp' -appends '/tmp' to current shell's PATH
142
143  12. 'more' - similar to 'less'
144  13. 'cp' - copies data
145   a. 'mkdir temp && cp -v test.txt temp/ && ls -l temp/'
146  14. 'mv' - moves data
147   a. 'mv test.txt temp/ && ls -l . && ls -l temp/ && echo $?'
148Note: In scripts, prefix exit status with meaningful text:
149i.e. 'echo "EXIT STATUS: " $? '
150Note: BASH Shell allows simple navigation using:
151 a. 'CTRL-a' - takes you to the beginning of the line
152 b. 'CTRL-e' - takes you to the end of the line
153 c. 'CTRL-b' - back one character
154 d. 'CTRL-f' - forward one character
155
156 15. 'dmesg' - Kernel Ring Buffer - Pre-Syslog
157  a. '/var/log/dmesg' - 'dmesg'
158Note: Also contains how the most recent invocation of the kernel took place (command-line)
159  b. 'dmesg | grep -i 'command line' ' - returns current kernel command line
160
161 16. 'head & tail' - Returns header and footer of text documents
162  a. 'head /var/log/messages' - returns first 10 lines
163  b. 'tail /var/log/messages' - returns last 10 lines
164 17. 'file' - returns the type of data stored in a file
165 18. 'ps' - lists processes
166  a. 'ps' -lists processes for current user
167 19. 'top' - dynamic 'ps', 'free', 'uptime', 'vmstat'
168 20. 'free' - memory allocation - RAM & SWAP
169 21. 'uptime' - shows system uptime and load average
170 22. 'df' - shows disk allocation and mount point
171   a. 'df -h' - human-readable format
172Note: '-h' often means human-readable for many commands
173 23. 'cat /proc/cpuinfo' - enumerates detected CPUs
174Note: '/proc' is a virtual (in-RAM) FS which houses system statistics
175Note: System utilities read from: /proc to display values: i.e. 'free', 'top', etc.
176 24. 'uname' - enumerates kernel version
177 25. 'seq' - generates a sequence of numbers - useful with looping in the $SHELL
178
179
180###Compression Utilities###
181Features:
182 1. de/Compression of content
183 2. 'gzip/gunzip'
184 3. 'bzip2/bunzip2'
185 4. 'zip/unzip'
186 5. 'tar'
187
188
189Tasks:
190 1. 'gzip'
191  a. 'gzip -c 1million.txt ' - redirects compressed file to STDOUT
192  b. 'gzip -c 1million.txt > 1million.txt.gz' - redirects compressed output to file
193  c. 'gzip -l 1million.txt.gz' - returns compression statistics
194  d. 'zcat 1million.txt.gz' - dumps (catenates) the contents of 1million.txt.gz to STDOUT
195  e. 'gunzip 1million.txt.gz' - overwrites, with permission, the original file
196  f. 'gunzip -c 1million.txt.gz > 1million.txt2' 
197
198Note: Typical compressed file online resembles: 'filename.tar.gz'
199
200 2. 'bzip2'
201  a. 'bzip2 -c 1million.txt > 1million.txt.bz2'  
202  b. 'bunzip2 -c 1million.txt.bz2 > 1million.txt3' - redirects source
203  c. 'bzcat 1million.txt.bz2' - dumps original content to STDOUT
204
205 3. 'zip & unzip'
206  a. 'zip 1million.txt.zip 1million.txt'
207  b. 'unzip 1million.txt.zip' - attempts to overwrite original file
208  c. 'zcat 1million.txt.zip'
209
210 4. 'tar' - creates archives
211  a. 'tar -cvf temp.tar temp/' - creates an archive without compression
212  b. 'tar -tvf temp.tar' - enumerates contents of tarball
213  c. 'tar -cvzf temp.tar.gz temp/' - creates Tar - Gzip image
214  d. 'tar -cvjf temp.tar.bz2 temp/ temp2/' - create Tar - Bzip2 image
215  e. 'tar -xvf temp.tar.gz' - extracts file, recreating hierarchy
216
217Note: 'du' - shows disk utilization for directory hierarchy
218  a. 'du -ch' - returns storage of hiearchy from current directory, below
219  b. 'du -chs' -returns total storage sans individual items
220
221
222###Checksums###
223Features:
224 1. Integrity checks on content (files)
225 2. Included tools:
226  a. 'md5sum' - 128-bit
227  b. 'sha1sum' - 160-bit
228  c. 'sha256sum' - 256-bit
229  d. 'sha512sum' - 512-bit
230
231Tasks:
232 1. 'md5sum'
233  a. 'md5sum 1million.txt' - returns string that is unique to its content
234  b. 'md5sum 1million.txt2' - returns the same string because the content are identical
235  c. Alter content in various files and compare MD5SUMs
236Note: A single bit differential will cause the checksum to vary
237
238 2. 'sha1sum'
239  a. 'sha1sum 1million.txt'
240
241Note: Backticks are used to support shell-based command-substitution
242i.e. 'rpm -qf `which sha1sum`' OR 'rpm -qf $(which sha1sum)'
243
244  b. 'sha1sum 1million* > 1million.txt.sha1sums'
245  c. 'sha1sum -c 1million.txt.sha1sums' - confirm SHA1SUMs wholesale
246
247 3. 'sha256sum' - 256-bit
248  a. 'sha256sum 1million* > 1million.txt.sha256sums'
249  b. 'sha25sum --quiet -c 1million.txt.sha25sums' - quietly checks ALL sums
250Note: Returns error if 1 or more fail
251
252 4. 'sha512sum' - 512-bit
253  a. 'sha512sum 1million* > 1million.txt.sha512sums'
254
255Note: If file changes during checksum calculation, then its checksum will be incorrect, resulting in confirmation failures
256
257
258###GREP###
259Features:
260 1. Processes lines using regular expressions (normal and metacharacters)
261 2. Returns entire lines when keyword is matched
262 3. Searches are case-sensitive, by default (use: '-i' to enable case-insensitivity)
263 4. Shares regular expressions with: Awk & Sed
264
265Tasks:
266 1. Create file with content
267 2. Peform queries
268  a. 'grep "Linux" grep.test.txt' - returns ALL matches for the case: 'Linux'
269  b. 'grep -i "linux" grep.test.txt' - returns ALL cases of the word: 'linux'
270  c. 'grep "2" grep.test.txt' - returns ALL lines containing the number 2
271 3. Metacharacters
272  a. 'grep "2011$" grep.test.txt' - returns lines that terminate with: '2011'
273Note: '$' means to search for content @ the end of the line
274  b. 'grep "^Linux" grep.test.txt ' - returns lines beginning with: 'Linux' - case-sensitive
275  c. 'grep -i "^Linux" grep.test.txt ' - returns lines beginning with: 'Linux' - case-insensitive
276Note: '^' & '$' are anchor tags
277  d. 'grep "L.*" grep.test.txt ' - searches for 'L' followed by any characters
278  e. 'grep '^L.*' grep.test.txt ' - searches for 'L' where begins the line, etc.
279Note: '.*' - means 0 or more matches
280  f. 'grep -i '^L.*CBT$' grep.test.txt - searches where 'L' begins the line and 'CBT' ends the line
281  g. 'grep -i '^L.*CBT $' grep.test.txt ' - searches where 'L' begins the line and ' ' ends the line
282  h. 'grep -i '^L.*CBT.* $' grep.test.txt' - searches where 'L' begins the line and ' ' ends the line with variations between
283  i. grep -i '[Red|2011]' grep.test.txt' - uses character classes
284
285 4. Parse system log
286  a. 'grep -i '^Jan  9' /var/log/messages-20110109 '
287  b. 'grep -i '^Jan  7' /var/log/messages-20110109 | grep -i 'kernel' '
288  c. 'grep -i '^Jan  [89]' /var/log/messages-20110109 | grep -i 'kernel' ' - searches for both: 'Jan  8' and 'Jan  9'
289
290
291###Awk###
292Features:
293 1. Field Processor
294 2. Supports grep-style (POSIX) regular expressions
295 3. Default field-delimiter is whitespace
296 4. Stores fields (columns) into tokens, which then become accessible during processing
297 5. Loops over input one line at a time
298 6. Will accept input from: file or STDIN or pipe
299
300Tasks:
301 1. awk '{ print $0 }' grep.test.txt - prints each line in its entirety
302 2. awk '{ print $1 }' grep.test.txt - prints column #1 from each line
303 3. awk '{ print $2 }' grep.test.txt - prints column #2 from each line
304 4. awk '{ print $2,$1 }' grep.test.txt - prints column #1 then #2
305 5. awk '/Red/ { print $0}' grep.test.txt - prints ALL columns where line includes 'Red'
306 6. awk '/Red/ { print $1,"-",$2,"-",$3}' grep.test.txt - prints ALL columns, with transformations, where line includes 'Red'
307 7. awk '{ if ($2 ~ /2011/) print $0 }' grep.test.txt - prints ALL columns of records containing '2011' in the second column
308 8. awk '/2011$/ { print $0 }' grep.test.txt - prints lines ending in: '2011'
309 9. awk '/2011$/ { print $0 }' - waits on STDIN for input
31010. grep 2011 /var/log/messages | awk '/2011$/ { print $0 }' - accepts a pipe
31111. awk '{ if ($2 ~ /9/) print $3,$4,$5,$6 }' /var/log/messages - prints columns $3-$6 where colum 2 = '9'
312
313
314###Sed (Stream Editor)###
315Features:
316 1. Stream Editing
317 2. Manipulate text at any point
318 3. Instructions may be specified on command line or via file
319 4. Supports POSIX Regular Expressions (Grep & Awk)
320
321Tasks:
322 1. 'sed -n '1p' grep.test.txt ' - prints the first line of the file
323 2. 'sed -n '2p' grep.test.txt ' - prints the second line ...
324 3. 'sed -n '$p' grep.test.txt ' - prints the last line ...
325 4. 'sed -n 4,13p grep.test.txt ' - prints lines 4 - 13 ...
326 5. 'sed -n '1!p' grep.test.txt ' - prints ALL but line 1
327 6. 'sed -n '1,3!p' grep.test.txt ' - prints ALL but lines 1-3
328 7. 'sed -n -e '/2011/p' grep.test.txt ' - prints lines containing '2011'
329 8. 'sed -n -e '/2011$/p' grep.test.txt ' - prints lines ending with '2011'
330 9. 'sed -n -e '/^2011/p' grep.test.txt ' - prints lines beginning with '2011'
33110. 'sed -n -e '/^2011$/p' grep.test.txt ' - prints lines starting & ending with '2011'
33211. 'sed -n -e '/[0-9]/p' grep.test.txt - prints lines containing numbers
33312. 'sed -n -e '/^[0-9][0-9][0-9][0-9]$/p' grep.test.txt' - prints lines containing 4 juxtaposed numbers
33413. 'sed -n -e '/^[0-9]\{4\}$/p' grep.test.txt ' - returns lines containing 4 juxtaposed numbers that begin and end the line
33514. 'sed -n -e '/^Red/,/Linux/p' grep.test.txt - extracts a range of lines from string: '^Red' to 'Linux'
33615. 'sed -n -e '/^Red/,+2p' grep.test.txt' - extracts line with 'Red' and 2 others
33716. 'sed -e '/^$/d' grep.test.txt' - deletes blank lines
33817. 'sed -e '/^$/d' grep.test.txt > grep.test.txt2' - deletes blank lines and saves results
33918. 'sed -i.bak -e '/^$/d' grep.test.txt' - deletes blank lines in-place and archives original(source) file
34019. 'sed -n -e 's/2010/2011/p' grep.test.txt '
341Note: '-n' suppresses non-matching lines
342
343
344###Perl###
345Features:
346 1. All-purpose scripting environment
347
348Tasks:
349 1. Exploring Perl Environment
350  a. 'perl -e 'print "Hello World\n;"' - prints 'Hello World' to STDOUT
351  b. ' perl -e 'print "Hello World\n";' -e 'print "Learning about the magic of Perl\n"; ' -w '
352  c. ' perl -e '$fname = "Deano"; $lname = "Davis"; print "$fname $lname\n"; ' -w
353 2. Write simple script
354Note: All shell scripts should include a shebang header: i.e. '#!/path/to/script_engine'
355  a. create simple script
356  b. check for errors - 'perl -c name_of_script'
357  c. flag script executable: 'chmod +x perl_script_1.pl'
358
359###User & Group Management###
360Features:
361 1. GUI
362 2. TUI - Text User Interface tools
363
364Tasks:
365 1. 'system-config-users' - create additional users and evaluate
366Note: If user's $SHELL is set to: '/sbin/nologin' the user will not be able to obtain a shell, nor will 'root' be able to 'su' as that user: i.e. 'adm', 'daemon', 'bin', etc.
367Note: System accounts typically are present in the process listing sans TTY because they do not need a $SHELL
368Note: Regular users who are defined with: '/sbin/nologin' as their $SHELL may not access the system via a $SHELL. i.e. via 'SSH' or 'Telnet', however, they may access the system via an appropriate daemon. i.e. 'FTPD'
369
370Note: Defaults are assigned to new accounts, including, but not limited to:
371 1. $SHELL = /bin/bash
372 2. $HOME = /home/$USER
373
374 2. $SHELL Tools
375  a. 'groupadd linuxcbt4'
376  b. 'useradd -d /home/linuxcbt4 -s /bin/bash -g linuxcbt4 linuxcbt4'
377  c. 'passwd linuxcbt4'
378
379Note: Account information, by default, is stored in:
380 a. '/etc/passwd' - general account data: username, uid, gid, $HOME, $SHELL, reference to shadow
381 b. '/etc/shadow' - password and policy data
382
383Sample '/etc/shadow' entry:
384linuxcbt:$CqvB.$o4lwrI5pS2Ovh6IgyA9w3FDwGi9wJjEXYcbot6o5NsjahpEQK5GzHz8ccj7pX3rnPq2ozE7fwQEchJmEZB8T8/:14981:0:99999:7:::
385  d. '/etc/shadow':
386   d1. login name
387   d2. encrypted password
388   d3. Days since Unix epoch, password was last changed
389   d4. Days before password may be changed
390   d5. Days after which password must be changed
391   d6. Days before password is to expire that user is warned
392   d7. Days after password expires that account is disabled
393   d8. Days since Unix epoch, that account is disabled
394   d9. Reserved
395
396Note: 'usermod' - basic: /etc/passwd changes
397Note: 'chage' - /etc/shadow policy changes
398
399 3. Use 'chage' to alter account policy for users
400  a. 'chage -M 10 linuxcbt4 && chage -l linuxcbt4'
401  b. 'chage -M 3 -m 1 linuxcbt3 && chage -l linuxcbt3'
402
403 4. Explore: '/etc/login.defs'
404  a. Contains account policy settings
405  b. Modify defaults to company policy
406
407 5. Test policy changes by creating new account
408  a. 'groupadd linuxcbt5 && useradd -g linuxcbt5 -d /home/linuxcbt5 -s /bin/bash linuxcbt5 && chage -l linuxcbt5'
409
410 6. 'userdel'
411  a. 'userdel -r linuxcbt5' - removes user, group, $HOME, $MAIL traces
412
413###File Types - Permissions###
414Features:
415 1. Classification of files
416 2. Permissions
417
418Tasks:
419 1. Classification of files
420  a. Use: 'ls -l' to expose file properties
421'-rw-rw-r--. 1 linuxcbt linuxcbt 6888896 Jan  7 16:46 1million.txt'
422  '-' -> standard file
423'drwxr-xr-x. 2 linuxcbt linuxcbt    4096 Jan  7 11:14 Desktop'
424  'd' -> directory
425Note: RHEL6 uses color templates for classifying files:
426 'black' -> standard file
427 'blue' -> directory
428 'red' -> compressed file
429 'green' -> executable
430Note: The color pattern is subject to change, so don't always rely upon it
431'crw-------. 1 root root      4,   1 Jan  7 11:31 tty1'
432  'c' -> character device
433'lrwxrwxrwx. 1 root root          15 Jan  7 11:03 stdin -> /proc/self/fd/0'
434  'l' -> symbolic link
435
436'brw-rw----. 1 root disk      8,   0 Jan  7 11:03 sda'
437  'b' -> block (storage) device - i.e. hard drive, USB stick, etc.
438
439 2. Permissions
440  a. Represented by 9-rightmost bits in 10-bit permissions block
441'-rw-rw-r--. 1 linuxcbt linuxcbt 6888896 Jan  7 16:46 1million.txt'
442
443'rw-' - owner bits - 2,3,4 = 4+2 = 6
444'rw-' - group owner bits - 5,6,7 = 4+2 = 6
445'r--' - other/everyone bits - 8,9,10 = 4+0 = 4
446
447Permissions Values:
448 'r' = 4 = read
449 'w' = 2 = write
450 'x' = 1 = execute
451  b. Use 'chmod' to influence permissions on file objects - it changes the octal mode
452  c. Default permissions are inherited from the $UMASK var
453
454  d. 'chmod 666 /tmp/1million.txt'
455  e. 'chmod u-w /tmp/1million.txt' - removes owner's ability to write to the content
456  e. 'chmod o-w /tmp/1million.txt' - removes other/everyone's ability to write to the content
457  f. 'chmod g-w /tmp/1million.txt' - removes group's ability to write to the content
458
459'drwxrwxr-x. 2 linuxcbt linuxcbt 4096 Jan  7 17:23 temp'
460Default directory permissions is octal: 775
461
462  g. 'chown linuxcbt /tmp/1million.txt && ls -l /tmp/1million.txt'
463  h. 'chmod o-r /tmp/1million.txt && stat /tmp/1million.txt'
464  i. 'chmod 600 /tmp/1million.txt && stat /tmp/1million.txt'
465  j. 'chown linuxcbt:linuxcbt /tmp/1million.txt && stat /tmp/1million.txt'
466  k. 'chgrp linuxcbt /tmp/1million.txt && stat /tmp/1million.txt'
467
4683. SETUID/SETGID/STICKY Bit
469  a. 'chmod 4755 perl_script_1.pl' - causes script to always run as user/owner
470Note: permission will reflect: '4755' with 'rws' 
471Note: The 's' replaces the 'x' for the owner to indicate SETUID
472
473  b. 'mkdir /projectx && chmod 2755 /projectx' - causes files created in directory to inherit group permissions
474  b1. 'chmod g=s /projectx'
475
476  b2. 'groupadd projectx'
477  b3. 'chown linuxcbt:projectx /projectx'
478  b4. 'chmod 2775 /projectx && stat /projectx'
479
480  c. '/tmp' -> example of sticky bit - leading value of: '3'
481   c1. 'chmod 3777 /tmp' || 'chmod +t /tmp' - sets sticky bit on object
482
483
484###Symbolic Links###
485Features:
486 1. Two types
487  a. 'symlinks' - soft - facilitate intra/inter-file-system links
488   a1. based on file names in the file system, NOT inodes
489  b. 'hard links' - hard - facilitate intra-file-system links
490   b1. based on inodes, NOT file names
491
492Tasks:
493 1. Symlinks - shortcuts
494  a. 'ln -s /tmp/1million.txt ./tmp.1million.txt'
495lrwxrwxrwx. 1 linuxcbt linuxcbt   17 Jan 11 11:56 tmp.1million.txt -> /tmp/1million.txt
496Creates a link to the actual file name
497Note: Soft-links do NOT increment the link counter returned by 'ls -l' || 'stat'
498Note: So long as the source file name and directory location remain unchanged, the soft-links will work
499
500 2. Hardlinks - shortcuts to inodes - may not span (go across) file systems
501  a. 'ln /tmp/1million.txt /projects/hard.1million.txt' - increments the link counter
502  b. 'ls -li filename' - reveals inode
503Note: permissions apply to ALL linked (hard & soft) files
504
505
506###Quota Implemenation###
507Features:
508 1. Limit storage consumption per user/group
509 2. Based on: disk block usage or inode usage
510 3. Imposed in 2 stages (thresholds): soft & hard
511   a. Soft limit: may be execeeded for up to the grace period
512   b. Hard limit: may never be execeeded under any circumstance
513
514Requires:
515 1. 'quota*' RPM
516 2. Must associates file system(s) with quota management: user and/or group
517
518Steps:
519 1. Enable in: '/etc/fstab'
520   a. 'defaults,usrquota,grpquota' - impose on: '/home'
521 2. Remount the file system: '/home'
522Note: Effect quota management during single-user / installation modes to avoid disconnects in service
523  a. 'mount -o remount /home' - remounts the file system
524Note: Optional methods of remounting the file system include: umount/mount OR reboot the system
525  b. 'mount' - reflects whether or not: 'usrquota', 'groupquota' options have been enabled
526
527 3. Create quota database files and generate disk usage table - defines baseline
528  a. 'quotacheck -cug /home' - applies user and group quotas
529Note: 'quotacheck' should be run in: Single-user mode OR when the system reboots to facilitate: read-only remount of target file system
530  b. Use: '-m' option to override
531
532 4. Check defined quota database:
533  a. 'quotacheck -amvug' - checks quotas - forces check
534
535 5. Assign quota policies per user and/or group:
536  a. 'edquota linuxcbt4' - uses default editor ($EDITOR)
537
538 6. Run 'quotacheck -avugm' to update stats
539 7. Run 'repquota /home' to show FS-wide usage report
540 8. Use: 'edquota -t' to modify grace period
541  a. 'edquota -T linuxcbt4'
542
543 9. Use: 'quotaon ...' - to enter production mode
544  a. 'quotaon -vug /home' - enters production mode
545  b. 'quotaon -p /home' - echoes current quota status
546
547Note: Default grace period is 7-days
54810. Attempt to write data beyond soft limit grace period
549
550
551###Provision Partitions & File Systems###
552Features:
553 1. Ability to provision additional storage
554
555Tools:
556 1. 'fdisk'
557 2. 'parted'
558 3. 'mke2fs' - ext2,ext3,ext4 FSs
559
560Storage Hierarchy:
561 Disk
562  -Partition(s)
563    -File System(s)
564
565Tasks:
566 1. Enumerate available storage:
567  a. 'fdisk -l' - enumerates disks and partitions
568  b. 'parted -l' - ""
569
570 2. Provision additional storage:
571  a. Select disk: /dev/sdb
572  b. 'parted /dev/sdb'
573  c. 'mkpart primary 1 10GB'
574  d. 'mke2fs -t ext4 -j /dev/sdb1' - overlays EXT4 FS on: /dev/sdb1
575  e. 'mkdir /temp10G1'
576  f. 'mount /dev/sdb1 /temp10G1 && mount'
577  g. Create content in new repository
578
579 3. Repeat process on the same disk
580 
581 4. Make partitions available across reboots:
582  a. '/etc/fstab'
583 5. Unmount both partitions and re-mount via: '/etc/fstab'
584  a. 'umount /temp10G1 && umount /temp10G2 && mount'
585  b. 'mount -a' - reads the contents of: '/etc/fstab'
586Note: Paritioning is typically handled during installation and/or within runlevel 1
587
588
589###Provision Swap Space###
590Features:
591 1. Generates additional virtual memory
592 2. Temporary fix for RAM-shortage. Permanent fix is to add more RAM.
593 3. Requires no system downtime
594 4. Works with dedicated partitions
595 5. Works with existing file systems
596 6. Works across disks, consequently improving performance
597
598Tasks:
599 1. Define swap partition and provision
600  a. 'fdisk /dev/sdb' - create partition and set to type '82' with 't' option
601  b. 'mkswap /dev/sdb3' - i.e. similar to: 'mke2fs'
602Note: If necessary, reboot the system after using: 'fdisk' or 'parted' to provision new swap partition
603  c. 'swapon -s' displays current swap devices
604  d. 'swapon -v /dev/sdb3' - enables swapping on specific device
605  e. 'swapoff /dev/sdb3' - disables swapping on specific device: /dev/sdb3
606
607 2. Define swap storage on existing file system
608  a. 'dd if=/dev/zero of=/swapfile1G  bs=1024 count=1048576' - generates a file that we can overlay a swap file system on of size: 1G
609  b. 'mkswap /swapfile1G'
610  c. 'swapon -v /swapfile1G'
611
612###Logical Volume Managment (LVM)###
613Features: 
614 1. Volume sets - aggreate storage from disparate sources
615 2. Resize storage on-the-fly
616 3. Provision storage as necessary
617
618Tasks:
619 1. LVM Storage Hierarchy
620  Logical Volume - configure file system at this level
621   - Volume Groups - represents one or more physical volumes
622    - Physical Volumes: (i.e. /dev/sdb4, /dev/sdc3, etc.) - partition, using fdisk or parted: LVM type (8e)
623
624 2. Create LVM Storage Hierarchy - 6-Steps
625   a. Create LVM partitions on available disks
626   a1. 'parted /dev/sdb'
627   a2. 'mkpart primary start end'  
628   a3. 'set partition_num lvm on'
629   a4. 'reboot'
630
631   b. 'pvcreate /dev/sdb4 /dev/sdc3' - create physical LVM volumes from partitions
632    b1. 'pvdisplay'
633   c. 'vgcreate volgroupvar /dev/sdb4 /dev/sdc3' - allocates both volumes to the volume group
634   d. 'lvcreate -L 5GB -n logvolvar volgroupvar'
635   e. 'mke2fs -t ext4 -j /dev/volgroupvar/logvolvar' - overlays EXT4 FS on LVM volume
636   f. 'mkdir /lvmvar1 && mount /dev/volgroupvar/logvolvar /lvmvar1'
637   g. Update: '/etc/fstab' for persistence
638
639
640 3. Resize LVMs
641  a. 'lvresize -L 6GB /dev/volgroupvar/logvolvar'
642  b. 'resize2fs /dev/volgroupvar/logvolvar 6G'
643  c. 'lvresize -L 4GB /dev/volgroupvar/logvolvar'
644  d. 'resize2fs /dev/volgroupvar/logvolvar 4G'
645Note: Reductions will likely return errors resulting in re-provisioning of the FS
646
647 4. Rename Logical Volume
648  a. 'lvrename volgroupvar logvolvar logvolopt' - renames volume, NOT volume group
649  b. 'lvresize -L 6GB /dev/volgroupvar/logvolopt' - restores to 6GB
650
651 5. Rename Volume Group
652  a. 'vgrename volgroupvar volgroupopt' - renames the volume group
653  b. update: '/etc/fstab' - to reflect volume group name change
654
655 6. Assign more partitions(storage) to LVM
656  a. 'parted /dev/sdc'
657  b. 'mkpart primary 16.1GB 26.1GB'
658  c. 'set 4 lvm on'
659  d. 'pvcreate /dev/sdc4' - assigns LVM partition to LVM management
660  e. 'vgextend volgroupopt /dev/sdc4' - extends volume group: 'volgroupopt'
661  f. 'lvresize -L 15GB /dev/volgroupopt/logvolopt' - online resize
662  g. 'resize2fs /dev/volgroupopt/logvolopt 15G' - online resize
663
664 7. LVM GUI
665  a. 'system-config-lvm'
666  b. 'ssh -X root@192.168.75.20' - redirects X.org session back to local GUI
667  c. Extend storage of: '/dev/volgroupopt/logvolopt' to: 16GB
668Note: GUI will send appropriate commands to system to:
669  a. Resize logical volume (logvolopt)
670  b. Resize EXT4 FS to appropriate size
671
672 8. Recreate LVM hierarchy
673  a. Unmount any partitions tied to: '/dev/sd[bc]'
674  b. 'parted /dev/sdb' - remove partitions & create new LVM partitions 
675  c. 'init 6' - reboot
676  d. Use: 'system-config-lvm' to create volume group from: '/dev/sdb1' & '/dev/sdc1'
677  e. Create logical volume: 'logvolopt'
678  f. Mount at: '/opt'
679
680
681###RAID###
682Features:
683 1. Data spread across 2 or more disk/partitions
684 2. Redundancy - recover from catastrophy
685 3. Levels: 0,1,4,5,6,10
686
687
688Tasks:
689 1. RAID0 - volume set creation i.e. LVM
690  a. Create multiple partitions: /dev/sd[bc][5-8] - of type '83' || 'linux'
691  b. 'init 6' - reboot
692  c. 'mdadm --create /dev/md0 --level=0 --raid-devices=2 /dev/sdb5 /dev/sdc5'
693  d. 'mke2fs -t ext4 -j /dev/md0'
694  e. 'mkdir /raid0 && mount /dev/md0 /raid0'
695  f. 'nano /etc/fstab'
696
697 2. RAID1 - mirroring - halves the storage
698  a. 'mdadm --create /dev/md1 --level=1 --raid-devices=2 /dev/sdb6 /dev/sdc6'
699  b. 'mke2fs -t ext4 -j /dev/md1'
700  c. 'mkdir /raid1 && mount /dev/md1 /raid1'
701 
702 3. RAID5 - striping with parity - sacrifices the equivalent of 1-drive(partition)
703  a. 'mdadm --create /dev/md2 --level=5 --raid-devices=4 /dev/sdb7 /dev/sdb8 /dev/sdc7 /dev/sdc8'
704  b. 'mke2fs -t ext4 -j /dev/md2'
705  c. 'mkdir /raid5 && mount /dev/md2 /raid5 && seq 1000000 > /raid5/1million.txt && ls -l /raid5'
706  d. nano /etc/fstab
707  e. test auto-mount during system initialization
708
709
710###RAID Management###
711Features:
712 1. Create
713 2. Assemble: assembles pre-existing array(s)
714 3. Manage: Use to fail devices to take them offline
715 4. Monitor: E-mail, run processes, etc.
716 5. Misc: '--query', '--detail', '--examine'(individual RAID components'
717
718Tasks:
719 1. 'cat /proc/mdstat' - enumerates currently-available RAID-arrays (sets)
720 2. 'mdadm --query /dev/md[0-2]' - returns information about the 3 arrays: 0-2
721 3. Publish RAID array as a read-only volume
722  a. 'umount /dev/md0' - unmounts the RAID array
723  b. 'mdadm -o /dev/md0' - flags, in the superblock, the array: /dev/md0 as Read-Only
724  c. 'mount /dev/md0 /raid0'
725  d. 'mount'
726 4. Publish RAID array as a read-write volume
727  a. 'umount /dev/md0' - unmounts the RAID array
728  b. 'mdadm -w /dev/md0' - flags, in the superblock, the array: /dev/md0 as Read-Write
729  c. 'mount /dev/md0 /raid0'
730  d. 'mount'
731 5. Stop RAID volume for management purposes
732  a. 'mdadm --manage --stop /dev/md0' - facilitates offline management
733Note: Stopping/deactivating the array will remove its '/dev/md?' entry
734Note: There are multiple ways to reassemble RAID arrays:
735 1. command-line: 'mdadm -A /dev/md0 /dev/sdb5 /dev/sdc5' - restarts (reassembles) '/dev/md0' from its component parts
736 2. '/etc/mdadm.conf' - associates DEVICES & ARRAYS and management/notification info.
737   a. 'DEVICE /dev/sdb[5678] /dev/sdc[5678]'
738   b. 'ARRAY /dev/md0 devices=/dev/sdb5,/dev/sdc5'
739
740
741 6. Other options:
742  a. 'mdadm -D /dev/md[0-2] - enumerates info. about ARRAYS
743  b. 'mdadm -E /dev/sd[bc][78] - enumerates info. about the 4 partions on the 2 drives: /dev/sd[bc]
744
745
746###Package Management with RPM###
747Features:
748 1. Compression of packages
749 2. SHA-256 hashes are used to sign packages
750 3. RPM DB: '/var/lib/rpm' - tracks installed packages, attributes of package files, etc.
751 4. 5-Modes of operations:
752  a. Install
753  b. Uninstall
754  c. Upgrade
755  d. Query
756  e. Verify
757 5. Caveat: Does NOT auto-resolve dependencies: Use 'yum'
758 6. Caveat: RPM does NOT track non-RPM programs/apps: i.e. '*.tar.gz' || '*.tar.bz2'
759
760Tasks:
761 1. Query
762  a. 'rpm -qa' - dumps ALL installed packages (RPMs)
763  b. 'rpm -qa | grep grep' - 'grep-2.6.3-2.el6.i686'
764'grep' - main name of package
765'2.6.3-2' - package version
766'el6.i686' - RedHat Version & Platform
767  c. 'rpm -qi grep' - returns metadata about 'grep' package
768  d. 'rpm -ql grep' - enumerates the contents of the package: 'grep'
769  e. 'rpm -qf /bin/grep' - enumerates the file's package membership
770  f. 'rpm -qd grep' - enumerates the included documentation
771  g. 'rpm -qc lftp' - enumerates a package's configuration file(s)
772  h. 'rpm -qpi http://192.168.75.101/LinuxCBT/EL-6/Misc/RHEL6/Server/Packages/unix2dos-2.2-35.el6.i686.rpm'
773
774 2. Verify - Verifies file system contents against installed package in RPM DB
775Note: Returns: '.' per test performed if the test passed
776Note: If test fails, one of the following will be returned:
7775(MD5), S(file size), L(symlink), T(mod time), D(device), M(mode), ?(unreadable file), U(user), G(group)
778  a. 'rpm -Vvf /bin/grep' - compares: /bin/grep to 'grep' RPM
779  b. 'mv /bin/grep /bin/grep.original && touch /bin/grep'
780SM5....T.    /bin/grep
781
782 3. Install - Works if package does NOT exist on the system
783  a. 'rpm -ivh http://192.168.75.101/LinuxCBT/EL-6/Misc/RHEL6/Server/Packages/unix2dos-2.2-35.el6.i686.rpm'
784
785 4. Upgrade - Installs and/or Upgrades
786  a. 'rpm -Uvh http://192.168.75.101/LinuxCBT/EL-6/Misc/RHEL6/Server/Packages/dos2unix-3.1-37.el6.i686.rpm'
787  b. 'rpm -Uvh --replacepkgs http://192.168.75.101/LinuxCBT/EL-6/Misc/RHEL6/Server/Packages/grep-2.6.3-2.el6.i686.rpm'
788 5. Uninstall
789  a. 'rpm -e grep' - checks dependencies and warns where appropriate
790
791 6. Import RedHat RPM GPG Key to confirm package signatures:
792  a. 'rpm --import 
793
794
795###YUM###
796Features:
797 1. Package management
798 2. Auto-dependency resolution
799 3. Ability to specify multiple package sources
800
801
802Tasks:
803 1. Mirror 'Packages' directory on local system
804  a. 'lftp http://192.168.75.101/LinuxCBT/EL-6/Misc/RHEL6/Packages/'
805  b. 'mirror -v'
806
807 2. Run 'createrepo' against: '/var/www/html/RHEL6' - creates sub-directory: 'repodata' and various DB files to serve packages to 'yum' clients
808  a. Confirm that 'createrepo' RPM is installed
809  b. 'createrepo /var/www/html/RHEL6' - queries ALL 2679 packages and generates a SQLlite DB and ancillary files beneath: 'repodata' dir
810
811
812 3. Setup first 'yum' client: localhost
813  a. '/etc/yum.repos.d/linuxcbtserv2.repo'
814  '[linuxcbtserv2]
815   name=linuxcbtserv2
816   baseurl=http://192.168.75.21/RHEL6 '
817
818 4. Search & Install packages:
819  a. 'rpm -e dos2unix unix2dos' - removes both packages
820  b. 'yum search unix2dos' - searches for package
821  c. 'yum info unix2dos' - returns/dumps/enumerates package metadata
822  d. 'yum install unix2dos' - installs the package once
823  e. 'yum reinstall unix2dos' - reinstalls package. i.e. '--replacepkgs' with 'rpm'
824  f. 'yum -y reinstall unix2dos' - assumes yes when prompted
825  g. 'yum history' - returns usage history. i.e. BASH Shell history
826  h. 'yum -y erase unix2dos dos2unix' - assumes yes and removes both packages
827  i. 'yum deplist lftp' - dependencies and their providers are returned
828  j. 'yum localinstall dos2unix-3.1-37.el6.i686.rpm' - Note: The entire file name is indicated
829
830 
831 5. Define: 'linuxcbtserv1' as a 'yum' client of 'linuxcbtserv2
832 6. Define: 'linuxcbtserv1' as a 'yum' server
833  
834  a. 'lftp http://192.168.75.101/LinuxCBT/EL-6/Misc/RHEL6/Packages/'
835  b. 'mirror -v'
836  c. Confirm that 'createrepo' RPM is installed
837  d. 'createrepo /var/www/html/RHEL6' - queries ALL 2679 packages and generates a SQLlite DB and ancillary files beneath: 'repodata' dir
838
839
840 7. Define: 'linuxcbtserv2' as a 'yum' client of 'linuxcbtserv1
841
842Note: This configuration will provide YUM server redundancy via: 2-repo files per 'yum' client
843
844 
845'[linuxcbtserv1]
846   name=linuxcbtserv1
847   baseurl=http://192.168.75.20/RHEL6 '
848
849 8. Test YUM redundancy by enabling/disabling HTTPD(Apache) on both systems and installing/uninstalling packages
850
851
852###PackageKit###
853Features:
854 1. GUI for package management
855 2. Front-end to YUM
856 3. Supports YUM plug-ins
857 
858
859Tasks:
860 1. Explore Interface
861
862
863###Cron###
864Features:
865 1. Job Scheduler
866  a. minutely
867  b. hourly
868  c. daily
869  d. monthly
870  e. yearly
871Note: Fields: a-e are specified as per the order above in appropriate config. file
872
873 2. Assumes computer is always on unlike: anacron
874 3. Maintains: global and per-user schedules
875 4. /var/spool/cron - stores crontabs for: /etc/passwd users or LDAP or otherwise
876 5. Checks ALL config files every minute, including: /etc/anacrontab
877 6. Supplies 'crontab' utility to manage jobs
878 7. Runs in ALL multi-user modes. Does NOT execute in: Single-User (1) mode
879
880Tasks:
881 1. Analyze current cron setup
882  a. 'ps -ef | grep cron'
883  b. '/etc/crontab'
884
885 2. Define system-wide job
886  a. '*/1 * * * * linuxcbt	/usr/bin/uptime >> /home/linuxcbt/uptime.stat'
887
888 3. Define per-user job
889  a. 'crontab -e' - run as user principle: 'linuxcbt'
890
891 4. Manipulate 'linuxcbt's' job as 'root'
892  a. 'crontab -e -u linuxcbt' - run as 'root' - edits user's job(s)
893  b. 'crontab -l -u linuxcbt' - run as 'root' - lists user's job(s)
894
895 4. Restrict Cron-access
896  a. '/etc/cron.allow' - add 'linuxcbt to list - User MUST be on the list in order to submit jobs to 'cron'
897  b. '/etc/cron.deny' - add 'linuxcbt2' to list
898
899###Anacron###
900Features:
901 1. Runs jobs once per day during an allowed interval
902 2. Assumes computer is NOT always on, unlike: Cron
903 3. Facilitates delays in starting jobs - reduces resource contention
904 4. Maintains one schedule: '/etc/anacrontab'
905 5. Requires little-to-no intervention; handled by the system
906
907Tasks:
908 1. Examine: '/etc/anacrontab'
909
910
911
912###'at' and 'batch'###
913Features:
914 1. One-off job schedulers
915 2. 'at' runs based on time schedule
916 3. 'batch' runs based on system-utilization stats: default < 0.8 for load average
917
918Tasks:
919 1. Use 'at' to run jobs
920  a. 'at 15:58'
921  b. 'at 16:01'
922  c. 'at -f at.job.1 16:02'
923  d. 'at now + 1 day' - runs job 1-day from now (time submitted to job-queue)
924
925 2. Use 'batch' to run jobs
926  a. 'batch' - supply instructions on STDIN
927Note: 'batch' accepts no command-line options
928Note: 'at' runs the jobs on behalf of 'batch'
929Note: 'batch' is simply a special invocation of 'at'
930
931
932
933###Syslog###
934Features:
935 1. Logs daemon information
936 2. Logs remotely
937 3. Accepts, if configured, logs from remote hosts: i.e. routers, switches, firewalls, content switches, Linux hosts, etc.
938 4. Supports: Unix Domain Sockets (/dev/log)
939 5. Supports: Internet Sockets: (UDP:514) and/or (TCP:514)
940 6. Runs in ALL multi-user levels: 2-5
941
942
943Tasks:
944 1. Exploration of environment
945  a. '/etc/rsyslog.conf' - primary config file
946  b. '/etc/sysconfig/rsyslog' - ancillary config file, containing startup options
947
948 2. '/etc/resyslog.conf' - exploration
949Selector(s)						Action(s)
950*.info;mail.none;authpriv.none;cron.none                /var/log/messages
951
952# The authpriv file has restricted access.
953authpriv.*                                              /var/log/secure
954
955
956 3. Configure UDP:514 routing of messages from Cisco Router
957  a. '/etc/rsyslog.conf' - uncomment UDP section
958  b. Setup selector in: '/etc/rsyslog.conf'
959   b1. 'local4		/var/log/cisco/ciscorouter.log'
960  c. Create: '/var/log/cisco' - 'mkdir /var/log/cisco'
961  d. Configure router to log, via UDP, to our RHEL-6 Server
962
963'Jan 18 17:09:49 192.168.75.1 12987: 012457: Jan 18 17:10:44.123 EST: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 192.168.75.21 port 514 started - CLI initiated '
964
965Note: Syslog ALWAYS includes a: timestamp & hostname/IP prefix & message
966
967Note: Syslog supports a number of levels (0-7):
968 Debug(0), info, notice, warning, error, critical, alert, emerg(7)
969Note: Syslog supports a variety of facilities:
970 a. MAIL
971 b. AUTH
972 c. LOCAL0-7
973
974
975 4. Configure TCP:514 routing of messages from Cisco Router
976  a. '/etc/rsyslog.conf' - uncomment TCP section
977  b. Update router configuration
978
979###Log Rotation###
980Features:
981 1. Management of logs
982 2. Reduction/control of size of log files
983 3. Config files: '/etc/logrotate.d'
984 4. Primary config file: '/etc/logrotate.conf'
985 5. Auto-includes files in: '/etc/logrotate.d' into main config file: '/etc/logrotate.conf'
986 6. Rotates based on criteria: time || size-based
987
988'/etc/logrotate.d' - entry
989/var/log/httpd/*log {
990    missingok
991    notifempty
992    sharedscripts
993    delaycompress
994    postrotate
995        /sbin/service httpd reload > /dev/null 2>/dev/null || true
996    endscript
997}
998
999Tasks:
1000 1. Update 'logrotate' to handle: '/var/log/cisco/*log' - '/etc/logrotate.d/syslog'
1001
1002 2. Create separate file to handle: '/var/log/cisco/*log' - '/etc/logrotate.d/cisco'
1003 3. Update directives to rotate based on size-based criteria
1004
1005###Common Network Utilities###
1006Features:
1007 1. Determine if remote host is up/available: 'ping'
1008 2. Determine if local/remote service is available: 'telnet'
1009 3. Determine network sockets stats/connections: 'netstat'
1010 4. View L2 information: 'arp'
1011 5. View path taken by packets to remote system: 'traceroute'
1012 6. Hostname-to-IP and reverse resolution: 'nslookup', 'dig'
1013 7. Learn more information about and IP and/or block: 'whois'
1014
1015
1016Tasks:
1017 1. Explore Packet Internet Groper (PING)
1018  a. 'rpm -qf `/bin/ping`' - member of 'iputils' package
1019  b. 'ping -c 3 192.168.75.1 -s 32' - sends 32-bytes + 8-bytes (ICMP overhead)
1020  c. 'ping -c 3 -i 3 192.168.75.1' - sends 3-packets of 56-bytes, every 3-seconds to target
1021Note: PING may be blocked by L3 devices on your network and/or the Internet
1022
1023 2. Telnet - Don't use for TTY access to remote host. Use SSH. Use Telnet to test port-accessiblity.
1024  a. 'telnet 192.168.75.1 22' - Install if necessary using 'yum install telnet'
1025
1026 3. Netstat - reveals TCP:UDP:Unix Sockets - '/proc/net'
1027  a. 'netstat -a' - dumps ALL sockets with: service/port and hostname resolution
1028  b. 'netstat -an' - same as above, but suppresses name resolution
1029  c. 'netstat -ntl' - suppresses name resolution, shows ONLY TCP sockets, and listeners
1030  d. 'netstat -ntlp' - same as above, includes programs bound to ports
1031Note: 'Use '-p' option as root to reveal ALL programs'
1032Note: ':::514' - means that port is bound to ALL IPv6 addresses configured on the host
1033Note: '0.0.0.0:514' - means that port is bound to ALL IPv4 addresses configured on the host
1034  e. ' netstat -i'
1035  f. 'netstat -nulp' - returns ALL UDP listeners
1036  g. 'netstat -rn' - returns kernel routing table
1037
1038 4. ARP - Address Resolution Protocol
1039  a. 'arp -a || arp -e'
1040Note: ARP is usually self-managing. 
1041
1042 5. Traceroute - follows path taken by packets across the network (Intra/Internet)
1043  a. 'traceroute 192.168.75.1'
1044  b. 'traceroute www.linuxcbt.com'
1045
1046 6. 'nslookup'
1047  a. 'nslookup www.linuxcbt.com'
1048DNS client tools use: '/etc/resolv.conf' to determine which DNS servers to query
1049
1050 7. 'dig'
1051  a. 'dig www.linuxcbt.com'
1052  b. 'dig -x 71.6.195.206' - performs a reverse lookup
1053  c. 'dig linuxcbt.com mx'
1054
1055 8. 'whois' - Finds IP/domain ownership information
1056  a. 'whois linuxcbt.com'
1057
1058
1059###IPv4 Configuration###
1060Features:
1061 1. DHCP
1062 2. Static
1063 3. Virtual (Sub) Interfaces - supports single physical connected to multiple logical
1064i.e. 192.168.75.0/24 && 192.168.76.0/24 && 10.0.0.0/30
1065
1066Tasks:
1067 1. Explore key: Directories & Files
1068  a. '/etc/sysconfig/network' - system-wide settings: i.e. hostname, gateway, enabled|disabled
1069  b. '/etc/sysconfig/networking' - 'system-config-network' tool controls this directory. Don't edit manually.
1070  c. '/etc/hosts' - local name DB - should contain a record for the localhost: i.e. 'localhost.localdomain'
1071
1072192.168.75.21	linuxcbtserv2.linuxcbt.internal	linuxcbtserv2	# Added by NetworkManager
1073127.0.0.1	localhost.localdomain	localhost
1074::1	linuxcbtserv2.linuxcbt.internal	linuxcbtserv2	localhost6.localdomain6	localhost6
1075
1076Note: Add hosts to: '/etc/hosts', for which you cannot or should not resolve via DNS
1077
1078  d. '/etc/sysconfig/network-scripts'
1079   d1. Interface configuration files - describes up/down config of interfaces: i.e. eth0
1080   d2. Control files - describes how interfaces are to be brought: up/down - scripts
1081   d3. Network function files - contain key network information required for the stack
1082   d4. 'ifup-eth' - brings up ethernet interfaces: i.e. 'eth0', 'eth1', etc.
1083   d5. 'ifdown-eth' - brings down ethernet interfaces: i.e. 'eth0', 'eth1', etc.
1084
1085  e. 'ifconfig' - enumerates configuration of interfaces
1086Note: At minimum, a routeable, connected system has at least 2 interfaces:
1087 1. 'lo' - loopback - 127.0.0.1
1088 2. 'eth0' - Ethernet0 - Your Routeable IP/Net
1089
1090   e1. 'ifconfig'
1091
1092eth0      Link encap:Ethernet  HWaddr 00:11:11:A2:A2:D0  
1093          inet addr:192.168.75.21  Bcast:192.168.75.255  Mask:255.255.255.0
1094          inet6 addr: 2002:4687:db25:2:211:11ff:fea2:a2d0/64 Scope:Global
1095          inet6 addr: fe80::211:11ff:fea2:a2d0/64 Scope:Link
1096          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
1097          RX packets:14048921 errors:0 dropped:0 overruns:0 frame:0
1098          TX packets:9107918 errors:0 dropped:0 overruns:0 carrier:0
1099          collisions:0 txqueuelen:1000 
1100          RX bytes:469081450 (447.3 MiB)  TX bytes:4022814991 (3.7 GiB)
1101
1102lo        Link encap:Local Loopback  
1103          inet addr:127.0.0.1  Mask:255.0.0.0
1104          inet6 addr: ::1/128 Scope:Host
1105          UP LOOPBACK RUNNING  MTU:16436  Metric:1
1106          RX packets:4698 errors:0 dropped:0 overruns:0 frame:0
1107          TX packets:4698 errors:0 dropped:0 overruns:0 carrier:0
1108          collisions:0 txqueuelen:0 
1109          RX bytes:7374035 (7.0 MiB)  TX bytes:7374035 (7.0 MiB)
1110
1111  e2. 'ifconfig eth0:1 192.168.75.22 netmask 255.255.255.0'
1112   e2.1. 'ping -c 3 -I 192.168.75.22 192.168.75.21' - sources traffic as: 192.168.75.22
1113
1114  e3. 'ifconfig eth0:2 192.168.75.23 netmask 255.255.255.0'
1115
1116  e4. Preserve changes across system restart/ 'NetworkManager' service restart
1117   e4.1. 'cp -v /etc/sysconfig/network-scripts/ifcfg-eth0 ifcfg-eth0:1'
1118
1119  f. 'ifcfg eth0:3 add 192.168.75.24/24' - Does duplicate address detection & sends ARP to hosts on the same Net as the interface
1120   f1. 'ifcfg eth0:1 delete 192.168.75.22/24' - removes the sub-interface
1121   f2. 'ifconfig eth0:3 del 192.168.75.24' - removes the sub-interface
1122
1123
1124###IPv6 Configuration###
1125Features:
1126 1. Self-configuring - Prefix (/64), is auto-derived from Router
1127 2. Can be configured via: Neighbor discovery auto-config by router, DHCPv6, Statically(manually) 
1128
1129
1130Tasks:
1131 1. 'less /etc/sysconfig/network-scripts/ifup-ipv6' - peruse config
1132 2. Peruse Router Config
1133  2a. '2002:4687:DB25:2:21A:2FFF:FEE3:F240'
11342002:4687:DB25:2 - left-most 64-bits describes the subnet: /64 prefix - globally unique
1135:21A:2FFF:FEE3:F240 - right-most 64-bits describes the host. Includes 48-bit unique MAC address
1136
1137 3. PING6 various devices
1138  a. 'ping6 -c 3 -I eth0 2002:4687:DB25:2:21A:2FFF:FEE3:F240'
1139  b. 'ping 2002:4687:db25:2:211:11ff:fea2:a2d0' - from the router, PING6 RHEL-6 box
1140 4. Use browser to access Apache via: IPv6
1141  a. 'http://[2002:4687:db25:2:211:11ff:fea2:a2d0]/' - escape IPv6 address with '[]' || use: '/etc/hosts' || DNS
1142
1143Note: IPv6 is auto-configured, by default, so long as Router or DHCPv6 provides a usable prefix.
1144Note: Update host configuration: i.e. '/etc/hosts' and/or DNS to reflect name-to-IPv6 mappings
1145Note: Test with desired applications: i.e. 'ssh', 'http client', etc.
1146
1147
1148###Very Secure File Transfer Protocol Daemon (VSFTPD)###
1149Features:
1150 1. Anonymous (Default) and user-based FTP sessions
1151 2. SSL support (provided by SSH) no need for VSFTPD
1152 3. Does not permit 'root' or 'service accounts' access, by default
1153 4. Does not currently support IPv4 & IPv6 simultaneously with the same daemon.
1154
1155Tasks:
1156 1. Install using: 'yum'
1157 2. Enable 'vsftpd' in multi-user runlevels
1158  a. 'chkconfig vsftpd on'
1159 3. Start 'vsftpd' and explore access
1160
1161 4. Disable Anonymous access
1162 5. Test local user access and update SELinux configuration
1163  a. 'getsebool -a | grep ftp' - dumps FTP-related SELinux booleans
1164  b. 'setsebool -P ftp_home_dir=1'
1165Note: RHEL6 enables SELinux in 'enforcing' mode, requiring a slight change to the booleans to permit VSFTPD or any FTPD daemon to transition user into their: $HOME directory
1166
1167 6. Enable Dual-Logging
1168  a. 'dual_log_enable=yes'
1169 7. Enable server time for display of files/directories
1170  a. 'use_localtime=yes'
1171Note: 'man vsftpd.conf' for useful directives that apply to your application
1172
1173
1174###LFTP###
1175Features:
1176 1. Interactive (Shell-like) & Non-interactive modes
1177 2. Scriptable
1178 3. Servers supported: FTP, FTPS, SSH(SFTP), HTTP, etc.
1179 4. Mirroring of content: forward (download) & reverse (upload)
1180 5. Regular expressions
1181 6. Job Engine
1182
1183Tasks:
1184 1. Use 'lftp' to connect to VSFTPD
1185  a. 'lftp localhost' && 'open -u linuxcbt'
1186Note: LFTP batches authentication commands and submits when control-channel commands such as 'ls' are received
1187---- Connecting to localhost (127.0.0.1) port 21 - (no connection)
1188<--- 220 Welcome to linuxcbtserv2.linuxcbt.internal FTP service. - (traffic from server to client)
1189---> FEAT - (traffic from client to server)
1190
1191 2. Use 'lftp' to connect and mirror content
1192  a. 'mirror temp*' - forward mirror - downloads content from server to client
1193  b. 'mirror -Rv *' - reverse mirror - puts content on server from client
1194
1195 3. Run external commands with: '!command'
1196  a. '!bash' - launches an instance of BASH SHELL from within 'lftp'
1197  b. 'exit' - returns to 'lftp'
1198
1199 4. Test rate-limiting with 'vsftpd'
1200  a. 'local_max_rate=10000' - B/s (Bytes per second)
1201
1202 5. Job Management - Backrounding
1203  a. Use: 'CTRL-Z' to background jobs
1204  b. Use: 'jobs' to view progress of jobs
1205  c. Use: 'fg job_num' to foreground a specific job
1206
1207
1208 6. Explore LFTP environment
1209   a. '/etc/lftp.conf' - system-wide config file
1210
1211 7. Connect using 'lftp' to: SSH & HTTP servers
1212  a. 'lftp http://192.168.75.101/LinuxCBT/EL-6/Misc/RHEL6'  
1213  b. 'lftp -u linuxcbt sftp://192.168.75.101'
1214
1215
1216###Curl###
1217Features:
1218 1. Non-interactive file transfers with: HTTP|FTP|Telnet|etc.
1219 2. Default downloads to STDOUT
1220 3. Like 'wget'
1221
1222Tasks:
1223 1. 'curl http://192.168.75.101/LinuxCBT/EL-6/Misc/RHEL6/EULA' - dumps content of target file to STDOUT
1224Note: This can be useful when used with pipes, etc.
1225 2. Create multiple files on HTTP server and download, one-shot, with 'curl'
1226  a. 'for i in `seq 5`; do seq 1000000 > file$i.txt; done' - execute on target HTTP server
1227  b. 'curl -O http://192.168.75.101/LinuxCBT/EL-6/Misc/file[1-5].txt' - downloads file1..file5.txt to local system
1228
1229 3. Create files on multiple HTTP servers and aggregate with 'curl'
1230  a. 'curl -O http://192.168.75.{101,21}/LinuxCBT/file[1-5].txt'
1231
1232 4. Rate-Limit
1233  a. 'curl -O --limit-rate 1000k http://192.168.75.101/LinuxCBT/file[1-5].txt'
1234
1235###Rsync###
1236Features:
1237 1. Network Copies
1238 2. Optionally, local copies
1239 3. Ability to synchronize content quickly: i.e. staging -> production sites
1240 4. Uses SSH as a conduit
1241 5. Requires 'rsync' on client/server systems
1242 6. Non-interactive client
1243 7. Syntax is similar to: 'scp'
1244
1245Tasks:
1246 1. 'rsync -av SRC DST'
1247 2. 'rsync -av --delete SRC DST' - removes superfluous content on DST (reverse mirror)
1248
1249###TFTPD###
1250Features:
1251 1. Fast, UDP-based file transfers
1252 2. Unreliable, however, in a LAN-connected environment, it is rather reliable
1253 3. Update devices that function as TFTP clients: Cisco devices (routers, switches, firewalls, etc.)
1254 4. Managed via: 'XINETD'
1255
1256Tasks:
1257 1. Install 'tftp-server' RPM
1258  a. 'yum search tftp && yum -y install tftp-server'
1259'/var/lib/tftpboot' - directory where TFTPD-served content lives
1260'/etc/xinetd.d/tftp' - primary, XINETD-controlled, config file - enable/disable TFTPD here
1261'/usr/sbin/in.tftpd' - binary (daemon) - invoked by XINETD when necessary
1262
1263 2. Enable TFTP Server (TFTPD)
1264  a. '/etc/xinetd.d/tftp'
1265  b. 'service xinetd start'
1266  c. 'netstat -nul ' - ensure that: 'UDP:69' is listening and controlled by: 'xinetd'
1267
1268 3. Backup Cisco Router Configuration
1269  a. 'ssh linuxcbt@192.168.75.1'
1270  b. 'cp running-config tftp://192.168.75.21/linuxcbtrouter1.config'
1271Note: '/var/lib/tftpboot/' - root indicated in above URI, NOT the root (/) of the Linux FS
1272  c. 'touch /var/lib/tftpboot/linuxcbtrouter1.config && chmod 666 /var/lib/tftpboot/linuxcbtrouter1.config'
1273  d. Attempt to backup the configuration
1274
1275 4. Restore Cisco Router Configuration
1276  a. 'copy tftp://192.168.75.21/linuxcbtrouter1.config running-config'
1277Note: Sometimes, the restoration will generate errors. Check for accuracy
1278
1279 5. Use TFTP client to move data
1280Note: SFTP/SCP/FTPS are preferred, however, TFTP client may be convenient
1281Note: TFTP client is both: interactive & non-interactive
1282  a. 'tftp -v 192.168.75.21'
1283
1284 6. Overwrite TFTP Server data from rogue client:
1285  a. 'ssh 192.168.75.101 && tftp -v 192.168.75.21 -c put linuxcbtrouter1.config'
1286
1287Note: Best practice suggests that you should run TFTPD only when/if necessary. Disable when not needed and, flag files in: '/var/lib/tftpboot' to restrictive permissions: i.e. 'chmod 644 /var/lib/tftpboot/*'
1288
1289
1290###TELNETD###
1291Features:
1292 1. Clear-text means of accessing a TTY (PTY) across the wire
1293 2. XINETD-controlled
1294 3. Does NOT allow 'root' to access TTY via Telnet: '/etc/securetty'
1295 4. Reads, as a banner, '/etc/issue.net | /etc/issue'
1296 5. Reads, post-login, '/etc/motd' - publish useful info. here
1297Note: contents of: '/etc/motd' are also read by: SSHD
1298 6. Assigns pseudo-terminals akin to: SSHD , however, they are flagged as unencrypted
1299
1300Tasks:
1301 1. Install
1302  a. 'yum -y install telnet-server'
1303
1304 2. Examine Configuration
1305  a. '/etc/xinetd.d/telnet'
1306
1307 3. Use Telnet Server
1308  a. 'telnet 192.168.75.21'
1309  b. 'su ' - switches context to 'root'
1310Note: Be very careful when using 'su' with 'telnet' due to clear-text exposure of passwords
1311Note: Loopback connections do NOT traverse the wire. It's ALL virtual (local). It's relatively safe.
1312 c. 'telnet 192.168.75.21' - exposes session to switch-port (network)
1313
1314 4. Disable Telnet Server
1315  a. '/etc/xinetd.d/telnet' - set 'disable = yes'
1316  b. 'service xinetd restart'
1317  c. 'netstat -ntl | grep 23' - confirm whether TELNETD is still listening to: TCP:23
1318  d. 'netstat -ant | grep 23' - search for stale/existing sockets
1319
1320Note: TELNETD does NOT facilitate SSH functions/features such as:
1321 1. File Transfers: i.e. 'scp', 'sftp'
1322 2. PKI: i.e. public key/private keypairs
1323 3. Remote commands via command-line (one-off)
1324 4. Pseudo-VPNs
1325
1326
1327###Network Time Protocol Daemon###
1328Features:
1329 1. Time synchronization
1330 2. Multiple sources
1331 3. Supports symmetric keys for time sync with other, controlled(trusted), servers
1332 4. Multiple strata are supported in a hierarchy:
1333  a. Strata range: 1(most accurate)-16(least accurate)
1334Note: Most accurate means that the stratum level 1 server has access to an external clock (GPS, radio, etc.)
1335 5. NTP will NOT set your system's clock if it is skewed (off) by 1000 or more seconds
1336 6. If '-g' invocation option is used, '1000s' skew is overridden
1337 7. NTP is dynamic in its calculations; always adjusting the values surrounding target NTP servers
1338
1339Tasks:
1340 1. Explore configuration
1341  a. '/etc/ntpd.conf' - primary config file
1342 2. Start service
1343  a. 'service ntpd start'
1344 3. Query NTPD
1345  a. 'ntpq -np'
1346Note: Clocks labeled at: stratum 16 are considered unreliable
1347Note: NTP uses: UDP:123 for source and destination ports
1348
1349 4. Sync Cisco Router
1350  a. 'sh ntp ass'
1351  b. 'ntp server 192.168.75.21'
1352
1353 5. Sync Windows Server
1354  a. 'rdesktop 192.168.75.105'
1355
1356 6. Sync Debian Server with RedHat server & vice versa
1357Note: Configure NTP to sync with 3 or more clocks
1358
1359###Add Network Interfaces to Hosts###
1360Features:
1361 1. On-the-fly NIC provisioning
1362
1363
1364Tasks:
1365 1. Explore NIC layout on: 'linuxcbtserv2'
1366  a. 'ifconfig -a' - enumerates detected NICs - named: 'ethn'
1367  b. 'ethtool eth1'
1368  c. Explore: '/etc/sysconfig/network-scripts/ifcfg*' - search for device scripts
1369  c. 'nm-applet' - configure 'eth1' with static address
1370Note: 'nm-applet' will create: '/etc/sysconfig/network-scripts/ifcfg-eth1' script
1371Note: This will ensure that the interface is resumed upon reboot/runlevel-switch
1372
1373 2. Explore NIC layout on: 'linuxcbtserv1'
1374  a. 'ifconfig -a'
1375Note: The presence of an IPv6 link-local address: 'fe80::' means that the link is connected to another device: i.e. switch, host, etc.
1376  b. 'ethtool eth1' && 'ethtool eth2'
1377  c. 'system-config-network'
1378d. Enumerate 'ifcfg-eth1' script from both locations:
1379ls -li /etc/sysconfig/{networking/devices,network-scripts}/ifcfg-eth1
13801055028 -rw-r--r--. 3 root root 180 Jan 22 11:24 /etc/sysconfig/networking/devices/ifcfg-eth1
13811055028 -rw-r--r--. 3 root root 180 Jan 22 11:24 /etc/sysconfig/network-scripts/ifcfg-eth1
1382
1383Note: Now both: 'linuxcbtser1' and 'linuxcbtserv2' are both configured to allow DHCP configuration on their private subnet
1384'linuxcbtserv2' - DHCP Server
1385'linuxcbtserv1' - DHCP Client
1386Note: Ensure that interface script file contains: 'ONBOOT=yes' directive to ensure that the OS brings the interface up when rebooting (init 6) and/or switching run-levels
1387
1388
1389###DHCPD###
1390Features:
1391 1. Auto-configuration of IP client(s)
1392 2. Includes all sorts of settings: IPv4, IPv6, DNS, NTP, NIS, etc.
1393 3. DHCP is an UDP application (UDP:67)
1394
1395Tasks:
1396 1. Reconfigure 'eth1' to use: '/27'
1397  a. 'nano /etc/sysconfig/network-scripts/ifcfg-eth1' 'PREFIX=27'
1398
1399 2. Install DHCP
1400  a. 'yum -y install dhcp'
1401  b. 'rpm -ql dhcp'
1402/etc/dhcp - container for DHCPD configuration
1403/etc/dhcp/dhcpd.conf - IPv4 config
1404/etc/dhcp/dhcpd6.conf - IPv6 config
1405/var/lib/dhcpd - container for leases
1406/var/lib/dhcpd/dhcpd.leases - IPv4 leases
1407/var/lib/dhcpd/dhcpd6.leases - IPv6 leases
1408
1409
1410 3. Configure scope for: '192.168.76.0/27' - facilitates 2**5 -2 hosts
1411192.168.76.0 - Network address
1412192.168.76.1-30 - Usable
1413192.168.76.31 - Broadcast Address
1414
1415Note: Alter DHCPD to log using a different facility: i.e. 'local6' because boot messages are logged via: 'local7'
1416
1417 4. Start/invoke 'eth1' interface on: 'linuxcbtserv1'
1418Note: This will launch the 'dhclient' process, which will request configuration via DHCP
1419  a. 'ifup eth1'
1420 inet addr:192.168.76.1  Bcast:192.168.76.31  Mask:255.255.255.224
1421'.224' = '/27'
1422'/24' = '.0'
1423'/25' = '.128'
1424'/26' = '.192'
1425'/27' = '.224'
1426
1427
1428 5. Configure a reservation to ensure that: 'linuxcbtserv1' is ALWAYS served the same address
1429  a. 'nano /etc/dhcp/dhcpd.conf'
1430
1431Note: DHCPD follows the DORA process:
1432D - Discovery (Client)
1433O - Offer (Server)
1434R - Request (Client)
1435A - Acknowledgement (Server)
1436
1437###Service Management###
1438Features:
1439 1. Start|Stop|Adjust runlevels of services
1440 2. Three tools are available
1441  a. 'chkconfig' - shell
1442  b. 'ntsysv' - TUI
1443  c. 'system-config-services' - GUI
1444
1445
1446Tasks:
1447 1. 'chkconfig' - manages both: 'SYSV' & 'XINETD'
1448  a. 'chkconfig' - enumerates ALL services
1449  b. '--list vsftpd' - enumerates runlevel information for service: 'vsftpd'
1450Note: '/etc/init.d' - services repository
1451  c. '--level 2 vsftpd off'
1452  d. '--level 2345 vsftpd off'
1453  e. 'chkconfig vsftpd on | off' - synonmy for run-levels 2-5
1454  f. 'chkconfig tftp on' - enables XINETD-controlled service: 'tftp'
1455Note: XINETD-controlled services are automatically enabled|disabled by 'chkconfig'
1456Note: However, SYSV-controlled services are NOT automatically started|stopped
1457Note: Use 'service service_name start|stop' to control service
1458
1459
1460 2. 'ntsysv' - defaults to managing services in the current run-level
1461Manages both: 'SYSV' & 'XINETD' services
1462  a. 'ntsysv --level 35' - influences ONLY the levels specified on the CLI
1463Note: 'ntsysv' will NOT change the other, unspecified, run-levels
1464
1465 3. 'system-config-services' - GUI - Manages: 'SYSV' & 'XINETD' services
1466
1467
1468###BIND DNS###
1469Features:
1470 1. Standard naming system manager
1471 2. Name-to-IP resolution
1472 3. IP-to-Name resolution
1473 4. Client utilities are auto-installed: 'bind-utils*'RPM
1474 5. Caching-only server
1475 6. Primary server
1476 7. Secondary server
1477 8. Reverse zones
1478 9. IPv6 zones
147910. Operates as non-privileged user: 'named'
148011. Default configuration binds to: UDP:53 on IPv4|6 loopback (remote queries will fail)
148112. Load-balancing is provided in a proper configuration of: 2 or more authoritative servers
1482
1483Tasks:
1484 1. Explore Caching-only configuration
1485  a. Key files:
1486'/etc/logrotate.d/named' - logrotate entry
1487'/etc/named.conf' - zone definition file
1488'/etc/named.rfc1912.zones' - loopback forward | reverse zones for: IPv4|6
1489'/etc/rc.d/init.d/named' - INIT script: use with: 'chkconfig' | 'service'
1490'/var/named' - container for zones: IPv4|6 forward and/or reverse
1491'/var/named/data' - logfile repository
1492'/var/named/slaves' - slave-replication data (this server is slave to other server(s))
1493'/var/named/dynamic' - DDNS
1494
1495 2. Start and Explore Caching-only Server
1496  a. 'chkconfig named on && service named start && ps -ef | grep named' -
1497  b. 'dig @localhost www.linuxcbt.com'
1498  c. Ensure that server binds to ALL IP addresses and allows recursion from ALL
1499
1500
1501 3. Primary Server Configuration - Primary (go-to) authoritative server for a zone
1502Note: Primary servers tend to have: writable copies of zones, whereas secondary servers tend to have read-only copies of zones due to replication of zone(s) from primary server
1503
1504  a. Define primary zone for: 'linuxcbt.internal'
1505   a1. '/etc/named.conf' - define zone here
1506   a2. '/var/named/linuxcbt.internal' - create zone file with records
1507   a3. 'service named reload' - reload | restart service
1508   a4. 'dig @localhost www.linuxcbt.internal'
1509
1510zone "linuxcbt.internal" IN {
1511	type master;
1512	file "linuxcbt.internal";
1513	allow-update { none; };
1514};
1515
1516Note: TTLs can be defined:
1517  a. per-file and/or per DNS record
1518Note: DNS records/zones cached by authoritative servers always reflect the full TTL of the zone/record
1519   b. Extend the primary zone with more records of various types: 'linuxcbt.internal'
1520   c. Add another mail server
1521   d. Define primary zone: 'linuxcbt.external' on host: 'linuxcbtserv1'
1522
1523zone "linuxcbt.external" IN {
1524	type master;
1525	file "linuxcbt.external";
1526	allow-update { none; };
1527};
1528
1529 4. Secondary Server Configuration
1530Note: Any DNS server can play the role of secondary for one or more zones
1531  a. Make: 'linuxcbtserv1' secondary for the zone: 'linuxcbt.internal'
1532  a1. Define 'linuxcbtserv1' as an NS server in the primary configuration
1533  a2. Setup slave (secondary) zone on: 'linuxcbtserv1'
1534zone "linuxcbt.internal" IN {
1535	type slave;
1536	masters { 192.168.75.21;  };
1537	#file "linuxcbt.external";
1538	allow-update { none; };
1539};
1540Note: Above entry caches the zone in-memory:
1541
1542  b. Make: 'linuxcbtserv2' secondary for the zone: 'linuxcbt.external'
1543Note: Repeat steps above
1544zone "linuxcbt.external" IN {
1545	type slave;
1546	masters { 192.168.75.20;  };
1547	#file "linuxcbt.external";
1548	allow-update { none; };
1549};
1550  c. Committ changes to master zones
1551  d. Save secondary files to disk
1552
15535. Reverse Zones
1554Resolves: IP-to-Name
1555  a. Write a reverse zone for: '192.168.75.0/24' subnet
1556zone "75.168.192.in-addr.arpa" IN {
1557	type master;
1558	file "192.168.75.zone";
1559	allow-update { none; };
1560};
1561
1562  b. 'dig @localhost -x 192.168.75.21' - returns forward (PTR) names
1563
15646. IPv6 Entries: Forward & Reverse Records
1565 a. Insert forward records for connected hosts
1566
1567linuxcbtserv2 IN AAAA 2002:4687:db25:2:211:11ff:fea2:a2d0 
1568linuxcbtbuild1  IN AAAA	2002:4687:db25:2:211:11ff:fe5b:7053
1569linuxcbtserv1  IN AAAA 2002:4687:db25:2:211:43ff:fe5a:bce5
1570linuxcbtrouter1 IN AAAA 2002:4687:DB25:2:21A:2FFF:FEE3:F240 
1571
1572  b. Query using 'dig' IPv6 AAAA records
1573   b1. 'dig @192.168.75.21 linuxcbtrouter1.linuxcbt.internal AAAA'
1574Note: Forward: IPv6 records need not be fully expanded
1575Note: Reverse: IPv6 records MUST be expanded fully when describing the zone
1576
1577  c. Construct Reverse Zone for: '2002:4687:db25:2/64' - Network ID: /64 prefix
1578
1579zone "2.0.0.0.5.2.b.d.7.8.6.4.2.0.0.2.ip6.arpa" IN {
1580	type master;
1581	file "2.0.0.0.5.2.b.d.7.8.6.4.2.0.0.2.reverse";
1582	allow-update { none; };
1583};
1584
1585Note: ::1 is the IPv6 loopback address, which really means: ALL zeroes terminating with 1
15865.e.c.b.a.5.e.f.f.f.3.4.1.1.2.0 IN PTR linuxcbtserv1.linuxcbt.internal.
15870.d.2.a.2.a.e.f.f.f.1.1.1.1.2.0 IN PTR linuxcbtserv2.linuxcbt.internal.
15883.5.0.7.b.5.e.f.f.f.1.1.1.1.2.0 IN PTR linuxcbtbuild1.linuxcbt.internal.
15890.4.2.f.3.e.e.f.f.f.F.2.A.1.2.0 IN PTR linuxcbtrouter1.linuxcbt.internal.
1590
1591Note: When writing IPv6 reverse addresses, expand ALL zeroes that are truncated in the addresses.
1592
1593
1594###Samba - Clients###
1595Features:
1596 1. Lan Manager/NETBIOS-like support for Linux | Unix
1597
1598Tasks:
1599 1. Install/Explore Samba Client Package:
1600  a. '/usr/bin/findsmb' - finds Samba hosts on your subnet
1601  b. 'smbtree' - equivalent to 'My Network Places' - Prints workgroups, hosts, and shares
1602
1603WORKGROUP
1604	\\MACBOOK1       		Dean Davis's MacBook
1605		\\MACBOOK1\IPC$           	IPC Service (Dean Davis's MacBook)
1606LINUXGENIUS
1607	\\LINUXCBTBUILD1 		linuxcbtbuild1 server
1608		\\LINUXCBTBUILD1\lj2100         	lj2100
1609		\\LINUXCBTBUILD1\print$         	Printer Drivers
1610		\\LINUXCBTBUILD1\IPC$           	IPC Service (linuxcbtbuild1 server)
1611AD
1612	\\LINUXCBT2K8    		
1613		\\LINUXCBT2K8\SYSVOL         	Logon server share 
1614		\\LINUXCBT2K8\NETLOGON       	Logon server share 
1615		\\LINUXCBT2K8\IPC$           	Remote IPC
1616		\\LINUXCBT2K8\C$             	Default share
1617		\\LINUXCBT2K8\ADMIN$         	Remote Admin
1618Note: In order to reveal Active Directory shares, you must supply authentication credentials
1619
1620  c. 'smbclient' - Connects to shares and facilitates file transfers - interactive app.
1621   c1. 'smbclient -U administrator //linuxcbt2k8/c$'
1622Domain=[AD] OS=[Windows Server (R) 2008 Standard 6002 Service Pack 2] Server=[Windows Server (R) 2008 Standard 6.0]
1623  d. 'smbget' - like 'wget' - downloads files from SMB shares, non-interactively
1624   d1. 'smbget -u administrator smb://linuxcbt2k8/temp2/DB_Backup_ALL_messages_tables.only'
1625
1626  e. 'smbtar' - Backs-up SMB shares to TAR archive
1627   e1. 'smbtar -s linuxcbt2k8 -x temp2 -u linuxcbt -t temp2.tar.`date +%F` -p password && gzip -c temp2.tar.`date +%F` > temp2.tar.`date +%F`.gz'
1628Note: This will create TARball then gzipped file
1629
1630
1631###Samba Server###
1632Features:
1633 1. NETBIOS | SMB | CIFS Server
1634 2. Emulates Windows
1635 3. Implemented as 2 daemons: 'nmbd'(NETBIOS naming) & 'smbd'(file serving)
1636 4. Creates one log-file per connected host
1637 5. Linux | Unix security (/etc/{passwd,shadow}) permissions are used to grant access to shares
1638
1639Tasks:
1640 1. Install 'samba' package
1641 2. Explore default configuration:
1642  a. '/etc/samba/smb.conf' - monolithic configuration file
1643Note: Within the context of: SELinux, consult: /etc/samba/smb.conf for more information on lifting restrictions
1644Note: '/etc/samba/smb.conf' - arranged, largely, into 2 sections: global & shares
1645
1646  b. '/etc/samba/smbusers' - Samba Server translation accounts DB. Used when not using AD mode.
1647
1648
1649 3. Change configuration and start service
1650  a. 'nano /etc/samba/smb.conf' - make changes: i.e. default workgroup
1651  b. 'service smb start && chkconfig smb on && service nmb start && chkconfig nmb on'
1652  c. 'netstat -ntlp ' - TCP:139(SMB), TCP:445 (CIFS) are controlled by: 'smbd'
1653  d. 'netstat -nulp' - UDP:137(NMB), UDP:138(NMB) - NETBIOS Naming
1654
1655 4. Implement User Security and test connectivity and ability read/write content
1656
1657
1658###Winbind Configuration###
1659Features:
1660 1. Active Directory Integration
1661 2. Precludes the maintenance of multiple user accounts DBs
1662
1663Steps:
1664 1. Install 'samba-winbind' - 'yum install samba-winbind'
1665 2. Edit: '/etc/security/pam_winbind.conf'
1666 3. Confirm the presence of Kerberos: 'rpm -qa | grep krb5'
1667 4. Edit: '/etc/krb5.conf' - with appropriate ADS realm
1668 5. Edit: '/etc/hosts' - with server information for ADS box
1669 6. Edit: '/etc/nsswitch.conf' - controls default resolver
1670 7. Edit: '/etc/pam.d/system-auth' - general system authentication
1671 8. Edit: '/etc/samba/smb.conf' - include Winbind-related directives
1672
1673'/etc/samba/smb.conf' - directives
1674security = ads
1675idmap uid = 10000-20000
1676idmap gid = 10000-20000
1677template shell = /bin/bash
1678template homedir /home/%D/%U
1679 8. 'net ads join -U administrator'
1680 9. Start Winbind: 'service winbind start'
168110. Configure service to auto-start in SYSV levels: 2-5
1682  a. 'chkconfig winbind on'
1683
168411. 'wbinfo -u'
1685
1686
1687
1688###Apache Configuration###
1689Features:
1690 1. HTTPD Server
1691
1692Tasks:
1693 1. Explore the configuration
1694  a. 'rpm -qa | grep httpd'
1695  'httpd-tools' - useful tools
1696  b. '/etc/httpd' - top-level config directory
1697  c. '/etc/httpd/conf/httpd.conf' - main Apache config file
1698  d. '/etc/httpd/conf.d' - add-on configuration files
1699  e. '/etc/logrotate.d/httpd' - managed by LogRotate
1700  f. '/etc/sysconfig/httpd' - startup parameters
1701
1702Note: Apache launches its initial process as: 'root'
1703Note: Subsequent Apache processes are launched as: 'apache'
1704Note: HTTP clients (mobile(iPhone|Droid), browser on the desktop) connect to non-privileged processes running as user: 'apache'
1705Note: One reason why Apache need 'root' privileges is to be able to bind to well-known ports (<1024)
1706tcp        0      0 :::80                       :::*                        LISTEN      1818/httpd          
1707tcp        0      0 :::443                      :::*                        LISTEN      1818/httpd 
1708Note: Apache auto-binds to both: IPv4|6
1709
1710
1711###Apache Logging###
1712Features:
1713 1. Error: '/var/log/httpd/access_log' - HTTP hits end-up here: 2xx, 3xx(redirects)
1714 2. Access: '/var/log/httpd/error_log' - Errors accessing content: 4xx, 5xx(server problems)
1715 3. Vars are defined in: /etc/httpd/conf/httpd.conf
1716 4. Log Vars are arranged into groups that are reference per virtual host: 'LogFormat'
1717
1718Tasks:
1719 1. '/etc/httpd/conf/httpd.conf'
1720LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
1721LogFormat "%h %l %u %t \"%r\" %>s %b" common
1722LogFormat "%{Referer}i -> %U" referer
1723LogFormat "%{User-agent}i" agent
1724
1725  a. '%h' - connecting host's IP address (IPv4|6)
1726  b. '%l' - ident check - typically '-' - not used much anymore
1727  c. '%u' - connecting user - often unknown '-'
1728  d. '%t' - timestamp, day(2-digit)/Month(3 letters/Year(4-digit):Hour:Minute:Second - TimeZone)
1729  e. '%r' - request method (GET/POST/etc.)
1730  f. '%>s' - status code returned to client - 200-500-related errors
1731  g. '%b' - size of content returned to client
1732  h. '%{Referer}' - Contains IP of sending host
1733  i. '%{User-Agent}' - Type of HTTP client: i.e. Droid, iPhone, Safari, IE, Firefox, etc.
1734
17352002:4687:db25:2:211:11ff:fea2:a2d0 - - [26/Jan/2011:09:27:35 -0500] "GET /icons/apache_pb2.gif HTTP/1.1" 304 - "http://[2002:4687:db25:2:211:11ff:fea2:a2d0]/" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.9) Gecko/20100827 Red Hat/3.6.9-2.el6 Firefox/3.6.9"
1736
1737Note: You may log traffic using multiple LogFormats simultaneously to separate files
1738
1739###Apache Virtual Hosts###
1740Features:
1741 1. Two types supported:
1742  a. IP-Based - one site per IP address
1743  b. Host Header Names - multiple sites per IP address
1744
1745Tasks:
1746 1. Configure IP-based Virtual Hosts
1747Note: The 'default host' is a catch-all for all undefined Virtual Hosts
1748  a. 'httpd -S' - enumerates virtual host(s) configuration
1749
1750<VirtualHost 192.168.75.22>
1751	ServerAdmin root@linuxcbtserv2.linuxcbt.internal
1752	ServerName site1.linuxcbt.internal
1753	DocumentRoot /var/www/site1.linuxcbt.internal
1754	DirectoryIndex index.ggg
1755	<Directory /var/www/site1.linuxcbt.internal>
1756		Order allow,deny
1757		Allow from all
1758	</Directory>
1759</VirtualHost>
1760Note: By not placing a default document, Aapache served us the default page
1761
1762
1763 2. Configure Host-Header Virtual Hosts
1764   a. 'NameVirtualHost 192.168.75.22:80'
1765
1766
1767###MySQL###
1768Features:
1769 1. RDBMS
1770 2. May be administered via: shell, web browser (PHPMyAdmin), or GUI
1771
1772Tasks:
1773 1. Explore current environment:
1774  a. 'rpm -qa | grep mysql && yum search mysql'
1775
1776 2. Install MySQL Server
1777  a. 'yum -y install mysql-server'
1778
1779 3. 'rpm -ql mysql-server'
1780'/var/lib/mysql' - DATA directory
1781'/var/log/mysqld.log' - log file
1782'/var/run/mysqld' - PID directory
1783 4. 'rpm -ql mysql' - enumerates common user-binaries: i.e. 'mysqldump', 'mysqladmin', 'mysql', etc.
1784'/usr/bin/mysql' - terminal monitor client - facilitates client/server communications interface with MySQLD back-end
1785
1786 5. 'rpm -ql mysql-libs' - reveals: '/etc/my.cnf' - system-wide config file
1787  a. '/etc/my.cnf' - read by clients and mysqld server
1788
1789 6. Start 'mysqld' - ' service mysqld start'
1790Note: By default, 'root' password is undefined
1791
1792/usr/bin/mysqladmin -u root password 'abc123'
1793/usr/bin/mysqladmin -u root -h linuxcbtserv2.linuxcbt.internal password 'new-password'
1794
1795Note: MySQL represents users as: user@host : i.e. 'root@localhost', 'root@linuxcbtserv2.linuxcbt.internal'
1796Note: Default configuration permits anonymous connections sans password
1797
1798 7. Change passwords within terminal monitor:
1799  a. 'set password for 'root'@'linuxcbtserv2.linuxcbt.internal' = password('abc123');
1800  b. 'set password for 'root'@'127.0.0.1' = password('abc123');
1801  c. 'flush privileges;' - required after permissions changes
1802
1803 8. Remove anonymous users:
1804  a. 'DELETE FROM mysql.user WHERE user = ''; '
1805  b. 'flush privileges;'
1806
1807 9. MySQL reads a hierarchy of config files upon invocation:
1808  a. '/etc/my.cnf' - system-wide file
1809  b. '$HOME/.my.cnf' - user-wide file
1810  c. Command Line Interface (CLI)
1811
181210. Create an addressbook DB:
1813  a. 'create database addressBook;'
1814  b. 'create table contacts ( `fname` char(20), `lname` char(20), `bus_phone1` char(20), `email` char(30), PRIMARY KEY (`email`)   );
1815
1816  c. 'INSERT INTO contacts VALUES ('Dean','Davis','888-573-4943','info@LinuxCBT.com'  );
1817  d. 'INSERT INTO contacts (fname,lname,bus_phone1) VALUES ('Diana','Mckenzie','888-573-4943');
1818  e. 'update contacts set email = 'support@LinuxCBT.com' where fname = 'Diana';'
1819  f. 'delete from contacts where email = 'support@linuxcbt.com'; '
1820
1821
1822###PHP###
1823Features:
1824 1. Dynamic web programming/content generation
1825
1826Tasks:
1827 1. Ensure pre-requisites are in-place
1828  a. 'rpm -qi php-mysql'
1829  b. 'yum -y install php-mysql'
1830
1831Note: Confirm connection configuration prior to executing script
1832 a. Change script to use routed address
1833 b. Check SELinux booleans  
1834  b1. 'getsebool -a | grep httpd' - ensure that HTTPD 'can' connect to 'db'
1835
1836 c. Revert script to use: 'loopback' address after rectifying SELinux problems
1837
1838 d. Confirm whether SELinux vars for 'mysql' influences Apache's ability to source outbound connections to MySQL
1839  d1. The lone 'httpd' variable controls Apache's ability to connect to MySQL
1840
1841
1842###Network File System###
1843Features:
1844 1. Transparent access to remote file systems
1845 2. Support for NFS versions: 2(nfs),3(default,nfs),4(nfs4)
1846 3. Supports both: TCP (default) & UDP
1847 4. Relies upon the RPC portmapper service, which dynamically allocates ports
1848Caveat: Dynamic ports don't always work well with firewalls
1849 5. Auto-transfers UID/GID information from client to server
1850
1851Tasks:
1852 1. Explore tools like: 'showmount'
1853 2. Start service and explore network stats
1854  a. 'service nfs start && chkconfig nfs on'
1855  b. 'netstat -ntlp ' - search for 'rpc*'
1856Note: 'rpcbind' - is the RPC manager, which dynamically allocates ports for NFS-related services: quotad, statd, mountd, lockmgr, etc.
1857 
1858 3. Export directory to remote clients
1859  a. '/etc/exports' - share directories via NFS here
1860   a1. '/projectx *(rw)' - (rw) export to ALL NFS clients that have IP access to our host
1861   a2. 'exportfs -v' - dumps current exports and permissions
1862   a3. 'showmount --exports linuxcbtserv2' - dumps exports of host: 'linuxcbtserv2'
1863
1864  b. Mount '/projectx' on remote system
1865   a. 'mount -t nfs linuxcbtserv2.linuxcbt.internal:/projectx /projectx'
1866Note: Default mounts are 'root' squashed. This means that when remote clients mount exports, 'root's I/O is equated to: 'nfsnobody' (anonymous)
1867
1868  c. Re-export: '/projectx' as Read-Only
1869    a. 'nano /etc/exports'
1870
1871###SELinux###
1872Features:
1873 1. Mandatory Access Controls (MACs)
1874 2. Standard Linux | Unix permissions are based on: Discretionary Access Controls (DACs)
1875i.e. 
1876-rw-rw-r--. 1 linuxcbt linuxcbt 2129783 Jan  7 17:06 temp.zip
1877 3. A sophisticated labeling system is applied to: subjects & objects
1878 4. Subjects -> users and/or processes
1879 5. Objects -> Files
1880 6. SELinux via MACs: provides a way to separate: users, processes, and objects via labeling and monitors/controls their interaction via: Advanced Vector Cache (AVC)
1881 7. Labels are known as types, which create the silos around: subjects & objects
1882 8. DACs are checked prior to MACs
1883 9. SELinux is enabled in 'enforcing' mode
188410. SELinux operates in 3 modes: disabled (DAC), enabled(DAC/MAC), enforcing(DAC/MAC/Enforced)
188511. Log information: '/var/log/audit/audit.log' - AVC logs here - Denials
188612. Policy information is defined in the: 'targeted' policy
1887
1888
1889Tasks:
1890 1. Explore common tools
1891  a. 'sestatus -v' - displays current status
1892  b. 'setenforce 0|1(permissive|enforcing) modes'
1893  c. '/etc/sysconfig/selinux' - primary config file
1894  d. '/selinux' - '/proc'-like FS (Virtual) - maintains SELinux information
1895  e. 'setsebool ' - sets boolean values for SELinux - use '-P' to make changes persistent across reboots
1896  f. '-Z' - Use with common commands: i.e. 'ls', 'ps', 'id'
1897  g. Use: 'restorecon -R /var/www/html' - resets ALL files to proper type
1898Note: 'restorecon' is necessary if files are moved about the FS and have incorrect contexts
1899
1900
1901 2. Switch SELinux mode to: 'permissive' and evaluate with Apache->MySQL
1902  a. 'setenforce 0' - sets SELinux to 'permissive'
1903  b. 'setsebool  httpd_can_network_connect_db off' - disables Apache's ability to talk to MySQL
1904  c. 'setenforce 1' - sets SELinux to 'enforcing'
1905  d. Try to invoke Apache->MySQL session: fails
1906
1907 3. Move and Copy content and evaluate SELinux context changes
1908Note: Moves will preserve SELinux file (object) context
1909Note: Copies will NOT preserve SELinux file (object) context. In this case, the object (file) will inherit the SELinux context of the target directory as defined by the SELinux 'targeted' policy.
1910
1911 4. Relabel full FS of remote server
1912  a. 'touch /.autorelable && reboot'
1913Note: More files means more time to reboot
1914
1915
1916
1917###NMap###
1918Features:
1919 1. Port Scanning
1920 2. Host | Device detection
1921 3. Service Detection
1922 4. OS Fingerprinting
1923 5. Multi-target scanning
1924
1925Tasks:
1926 1. Install 'Nmap'
1927 2. Explore the package
1928  a. '/usr/bin/nmap' - primary binary
1929  b. '/usr/share/nmap/nmap-services' - translates well-known ports to service names
1930  c. '/usr/share/nmap/nmap-protocols' - translates IP protocols to names
1931
1932 3. Use NMap
1933  a. 'nmap -v 192.168.75.0/24'
1934Note: As 'root' user, 'nmap' executes 'TCP:SYN' scans - half-open connections
1935Note: As non-privileged user, 'nmap' executes 'TCP:CONNECT' scans - full connections
1936  b. Perform service scan
1937   b1. 'nmap -v -sV target'
1938Note: Leftmost 24-bits of MAC address represent the vendor, the rightmost 24-bits represent the unique NIC
1939
1940
1941###IPTables###
1942Features:
1943 1. IPv4 Firewall - User-space tool
1944 2. Typically manipulates layers 3&4 of the OSI model
1945  a. Layer-3 - Routing (IPv4 | IPv6) - Source and/or Destination filtering
1946  b. Layer-4 - Transport (TCP | UDP | ICMP) - Source and/or Destination port filtering
1947
1948Tasks:
1949 1. Explore the current configuration
1950  a. '/sbin/iptables' - key binary for managing firewall rules
1951  b. '/sbin/iptables-restore' - restores rules after reboot and/or flush
1952  c. '/sbin/iptables-save' - archives current rule-set and counters
1953  d. 'iptables -L' - enumerates the default table: 'FILTER'
1954
1955Note: IPTables maintains a number of tables: FILTER (Default), NAT, Mangle
1956Note: Each table maintains a number of chains.
1957Note: A chain is simply a list of firewall (filtration) rules
1958
1959FILTER:
1960  -INPUT - Traffic destined to one of the interfaces governed by the host and sourced by an external host (party)
1961
1962  -FORWARD - Traffic destined to be routed through the host
1963
1964  -OUTPUT - Traffic sourced by OUR host, destined to a remote host
1965
1966 2. Write INPUT chain rules to filter traffic & test
1967  a. 'iptables -A INPUT -s 192.168.75.105 -p TCP --dport 22 -j DROP'
1968  b. 'iptables -R INPUT 2 -p tcp --dport 22 -j DROP'
1969 3. Write OUTPUT chain rule to restrict outbound TCP:25
1970  a. 'iptables -A OUTPUT -p tcp --dport 25 -j DROP'
1971
1972
1973###IP6Tables###
1974Features:
1975 1. Management of IPv6 filtering
1976
1977Tasks:
1978 1. Explore configuration
1979  a. '/sbin/ip6tables ' - primary binary
1980 2. Usage
1981  a. 'ip6tables -L'
1982Note: With both IPv4 & IPv6, the default policy is 'ACCEPT', which may be switched to: 'DENY', which will require explicit rules allowing traffic
1983
1984 3. Write IPv6 Rules
1985  a. 'ip6tables -A INPUT -p tcp --dport 22 -j LOG --log-level debug'
1986  b. 'ip6tables -A INPUT -p tcp --dport 22 -j DROP'
1987
1988
1989###TCPDump###
1990Features:
1991 1. Packet Capturing
1992 2. Layers 2-7 of OSI
1993 3. Driven by Three Qualifiers
1994  a. Type - host|net|port
1995  b. Dir - src, dst, src or dst, src and dst
1996  c. Proto - ip, tcp, udp, arp, etc. 
1997 4. Supports BPFs
1998 5. Uses promiscuous mode to intercept traffic not bound for local system
1999
2000Tasks:
2001 1. Explore configuration
2002  a. '/usr/sbin/tcpdump'
2003
2004 2. Usage
2005  a. 'tcpdump -v ' - dumps traffic to STDOUT
200613:48:06.854768 IP (tos 0x0, ttl 64, id 34654, offset 0, flags [DF], proto TCP (6), length 1500)
2007    linuxcbtserv2.linuxcbt.internal.5902 > 192.168.75.14.63276: Flags [.], cksum 0x3402 (correct), seq 27453037:27454485, ack 615, win 108, options [nop,nop,TS val 446941871 ecr 385595866], length 1448
2008
2009  b. 'tcpdump -i eth0' - binds to indicated interface
2010  c. 'tcpdump -D ' - enumerates the interfaces
2011  d. 'tcpdump -i eth0 -w filename'
2012  e. 'tcpdump -r tcpdump.full.log.2011-01-28'
2013  f. 'tcpdump -e tcpdump -r tcpdump.full.log.2011-01-28' - dumps link-level header - L2
201413:56:09.105343 00:25:4b:a9:ba:3e (oui Unknown) > 00:11:11:a2:a2:d0 (oui Unknown), ethertype IPv4 (0x0800), length 66: 192.168.75.14.63276 > linuxcbtserv2.linuxcbt.internal.5902: Flags [.], ack 9101188, win 65535, options [nop,nop,TS val 385600686 ecr 447424118], length 0
2015
2016  g. 'tcpdump -A -r tcpdump -r tcpdump.full.log.2011-01-28' - L3-L7
2017  h. 'tcpdump -e -A -r tcpdump -r tcpdump.full.log.2011-01-28' - dumps L2-L7
2018  i. 'tcpdump -n -e -A -r tcpdump -r tcpdump.full.log.2011-01-28' - dumps L2-L7, suppresses name resolution (hosts and/or services)
2019 3. Use BPFs to filter traffic
2020  a. 'tcpdump -w tcpdump.bpf.sans.vnc.1 not port 5902' 
2021  b. 'tcpdump -w tcpdump.bpf.sans.vnc.1 not tcp and port 5902'  - Filters all but TCP and TCP:5902
2022 c. 'tcpdump -w tcpdump.bpf.sans.vnc.1 not tcp port 5902' - Filters out TCP:5902
2023
2024
2025###Apache SSL/TLS###
2026Features:
2027 1. Secure communications for web services
2028 2. TCP:443 - https
2029 3. Multiple SSL/TLS sites can be bound to the same IP address so long as you use distinct TCP ports. i.e. TCP:443, TCP:4443, TCP:444
2030 4. SSL/TLS will read both: private and public (certificate) keys from the same file
2031Note: Simply reference the same file with private and certificate directives
2032  
2033Requires:
2034 1. HTTPD - Apache
2035 2. 'openssl' - SSL/TLS library
2036 3. 'mod_ssl' - Apache Module
2037 4. 'crypto-utils' - includes 'gen-key'
2038
2039
2040Tasks:
2041 1. Exploration of current setup
2042  a. 'rpm -ql mod_ssl'
2043/etc/httpd/conf.d/ssl.conf - first virtual host, and, default SSL server
2044/usr/lib/httpd/modules/mod_ssl.so - SSL/TLS Module
2045
2046  b. 'rpm -ql crypto-utils'
2047  '/usr/bin/genkey' - useful in generating various types of certificates: i.e. self-signed, CSRs, etc.
2048
2049  c. 'rpm -ql openssl'
2050   '/etc/pki' - hierarchy of public key encryption files
2051   '/usr/bin/openssl' - key OpenSSL binary used to generate certificates, etc.
2052
2053 2. Explore the default SSL site
2054  a. '/etc/httpd/conf.d/ssl.conf'
2055
2056 3. Use 'tcpdump' to enumerate clear-text and SSL/TLS-protected traffic
2057  a. 'tcpdump -vv -Ae tcp port 80 or 443'
2058  b. 'curl http://192.168.75.21' - initiates HTTP clear-text communications
2059  c. 'curl -k https://192.168.75.21' - initiates HTTPS encrypted communications
2060
2061 4. Generate new usage keys for default site
2062  a. 'genkey linuxcbtserv2.linuxcbt.internal'
2063
2064 5. Update: '/etc/httpd/conf.d/ssl.conf' with new SSL keypair
2065  a. Replace cert/private key lines with pointers to new files
2066
2067 6. Generate usage keys for: 'site1.linuxcbt.internal'
2068  a. '/etc/pki/tls/certs/make-dummy-cert' - works faster than 'gen-cert'
2069
2070
2071###VSFTPD with SSL###
2072Features:
2073 1. Implicit SSL -> TCP:990
2074 2. Explicit SSL -> TCP:21
2075 3. Encryption of: 
2076  a. Control Channel
2077  b. Data Channel
2078
2079Tasks:
2080 1. Explore Current Configuration
2081  a. Use LFTP to force SSL connection
2082  '~/.lftprc'
2083   'set ftp:ssl-force yes'
2084   'set ftp:ssl-protect-data yes'
2085 2. Use 'tcpdump' to sniff clear-text traffic
2086 3. Setup VSFTPD server with SSL support
2087  a. 'ssl_enable=yes' - This will require local logins (non-anonymous users) to use SSL/TLSv1
2088  b. 'ssl_tlsv1=yes' (Default)
2089  c. 'rsa_cert_file=/etc/pki/tls/certs/linuxcbtserv2.linuxcbt.internal.crt' - This will allow VSFTPD to read both: private & public keys from the same file
2090  d. 'rsa_private_key_file=/etc/pki/tls/certs/linuxcbtserv2.linuxcbt.internal.key' - Set this if the private key exists in a separate file
2091  e. 'openssl ciphers -v'
2092   Defaul Cipher: 'DES-CBC3-SHA'
2093'openssl ciphers -v | grep 'DES-CBC3-SHA'
2094DES-CBC3-SHA            SSLv3 Kx=RSA      Au=RSA  Enc=3DES(168) Mac=SHA1
2095
2096  f. 'service vsftpd restart' - restart for SSL settings to take effect
2097 4. Test SSL/TLS connectivity from various FTP clients
2098  a. 'lftp linuxcbt@localhost' - this will generate a certificate mismatch
2099  b. 'lftp linuxcbt@linuxcbtserv2.linuxcbt.internal' - this works
2100
2101 5. Test clear-text FTP connection
2102  a. 'nano ~/.lftprc'
2103
2104 6. Configure VSFTPD to support both: SSL/TLS and Clear-text connections
2105  a. 'force_local_logins_ssl=no'
2106  b. 'force_local_data_ssl=no'
2107
2108 7. Windows with FileZilla
2109  a. Try both clear-text and FTP Explicit SSL connections
2110
2111###Tighten Configuration###
2112Features:
2113 1. Improves your security posture
2114 2. Publish only necessary services
2115 3. Reduces risk/exposure to mal clients
2116
2117Tasks:
2118 1. Identify IPv4 unnecessary addresses
2119  a. 'ifconfig -a'
2120  b. 'eth0:1' & 'eth0:2'
2121  c. 'ifcfg eth0:1 del 192.168.75.22 && ifcfg eth0:2 del 192.168.75.23'
2122
2123 2. Disable: 'eth1'
2124  a. 'ifcfg eth1 stop'
2125
2126 3. Reconnaissance Scan
2127  a. 'nmap -v -sS -sU localhost'
2128PORT     STATE         SERVICE
212921/tcp   open          ftp
213022/tcp   open          ssh
213125/tcp   open          smtp
213253/tcp   open          domain
213380/tcp   open          http
2134111/tcp  open          rpcbind
2135139/tcp  open          netbios-ssn
2136443/tcp  open          https
2137445/tcp  open          microsoft-ds
2138514/tcp  open          shell
21392049/tcp open          nfs
21403306/tcp filtered      mysql
21414443/tcp open          pharos
21425902/tcp open          vnc-2
214353/udp   open          domain
214467/udp   open|filtered dhcps
214569/udp   open|filtered tftp
2146111/udp  open          rpcbind
2147123/udp  open          ntp
2148137/udp  open          netbios-ns
2149138/udp  open|filtered netbios-dgm
2150514/udp  open|filtered syslog
21512049/udp open          nfs
21525353/udp open|filtered zeroconf
2153
2154 4. Define system baseline
2155  a. SSHD
2156  b. HTTPD
2157  c. DNS
2158  d. SYSLOGD
2159  e. NTPD
2160  f. FTPS - Explicit-mode FTP w/SSL/TLS
2161  g. MySQL - bound to loopback
2162  h. VNC
2163  i. SMTP - bound to loopback - Default
2164
2165 4. 'netstat -ntulp' - enumerate TCP & UDP listeners
2166 
2167 5. Bind MySQL to: loopback
2168  a. 'nano /etc/my.cnf'
2169  b. 'bind=127.0.0.1'
2170  c. 'service mysqld restart'
2171
2172 6. Disable 'rpcbind'
2173  a. 'service rpcbind stop && chkconfig rpcbind off && chkconfig --list rpcbind'
2174  b. 'netstat -ntlp | grep 111'
2175
2176 7. Disable 'NFS'
2177  a. 'service nfs stop && chkconfig nfs off && netstat -ntlp | grep 2049'
2178
2179 8. Disable 'Samba'
2180  a. 'service smb stop && chkconfig smb off && netstat -ntlp | grep 445'
2181  b. 'service nmb stop && chkconfig nmb off && netstat -nulp | grep 137'
2182  c. 'service winbind stop && chkconfig winbind off'
2183
2184 9. Disable 'DHCPD'
2185  a. 'chkconfig dhcpd off && service dhcpd stop'
2186
218710. Disable 'TFTPD'
2188  a. 'chkconfig tftp off' - this disables & stops the XINETD-controlled service
2189
219011. Configure VSFTPD to use SSL/TLS ONLY
2191  a. 'nano /etc/vsftpd/vsftpd.conf'
2192  b. 'force_local_logins_ssl=yes'
2193  c. 'force_local_data_ssl=yes'
2194  d. Use 'lftp' to confirm that VSFTPD permits SSL/TLSv1 connections ONLY
2195  e. Ensure that LFTP is configured to NOT use SSL to see whether or not the server will permit non-SSL/TLSv1 connections
2196
219712. Restrict SSHD to users: 'root' & 'linuxcbt'
2198 a. '/etc/ssh/sshd_config'
2199 b. 'AllowUsers root linuxcbt'
2200 c. 'service sshd restart'
2201 d. Test SSH connectivity as allowed and disallowed users
220213. Restrict SSHD to non-privileged user: 'linuxcbt' & 'linuxcbt2'
2203  a. 'AllowUsers linuxcbt linuxcbt2'
2204
220514. Post-Reconnaissance Check
2206 a. 'nmap -v -sU -sS localhost'
2207 b. 'nmap -v -sU -sS 192.168.75.21' - execute from a remote host
2208 c. 'nmap -v -6 2002:4687:db25:2:211:11ff:fea2:a2d0' - execute IPv6 remote reconnaissance