RH302 Practice Questions

Do the following steps as:

1.iptables –t filter –A INPUT –s ! 192.168.0.0/24 –p tcp –d 192.168.0.254 --dport 20 –j DROP

2.iptables –t filter –A INPUT –s ! 192.168.0.0/24 –p tcp –d 192.168.0.254 --dport 21 –j DROP

iptables is the build-in firewall tools, used to filter the packets and for nat. By identifying Source Address, Destination Address, type of protocol, source and destination port we can filter the packets.

-sSource Address

-dDestination Address

-pLayer 3 Protocol

-dDestination Address

--sportSource Prot

--dportDestination Port

-iIncoming Interface

-oOutgoing Interface

-tTable either filter or nat or mangle

-AChain can be either INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTIN

G.  

Do the following steps as:

1.vi /etc/vsftpd/vsftpd.conf

anon_upload_enable=yes

chown_uploads=yes

chown_username=username

2.service vsftpd start| restart

3.directory owner should be ftp user: chown ftp directory path allowedto upload files.

4.Write permission should be set to owner user.

By default anonymous user can only download files from the ftp. Should write anon_upload_enable=yes to enable anonymous upload files. Default Directory for anonymous is /var/ftp.

Do the following steps as:

1.vi /etc/exports

/data*.example.com(rw,sync)

2.service nfs start

3.service portmap restart

4.chkconfig nfs on

5.chkconfig portmap on

In Linux to share the data we use the /etc/exports file. Pattern is:

Pathclient(permission)

Shared Directory Path, Client can be single host or domain name or ip address. Permission should specify without space with client lists in parentheses. NFS is RPC service so, portmapper service should restart after starting the nfs service.

Do the following steps as:

1.vi /etc/samba/smb.conf

[global]

netbios name=station?

workgroup = mygroup

server string=Share from Linux Server

security=user

smb passwd file=/etc/samba/smbpasswd

encrypt passwords=yes

hosts allow=192.168.0.

[data]

path=/data

writable=yes

public=no

browsable=yes

2.service smb start| restart

3.chkconfig smb on

Samba servers helps to share the data between linux and windows. Configuration file is /etc/samba/smb.conf. There are some pre-defined section, i. globaluse to define the global options, ii. Printersuse to share the printers, iii. homesuse to share the user’s home directory.

Security=uservalidation by samba username and password. May be there are other users also. To allow certain share to certain user we should use valid users option.

smbpasswdHelps to change user’s smb password. –a option specifies that the username following should be added to the local smbpasswd file.

If any valid users option is not specified, then all samba users can access the shared data. By Default shared permission is on writable=no means read only sharing. Write list option is used to allow write access on shared directory to certain users or group members.

To allow access the shared directory only from certain network or hosts, there is a option hosts allow= host or network. If this option is applied on global option, then it will apply to all shared directory.

Do the following steps as:

1.vi /etc/security/time.conf

login;*;user1|user2|user3;Al0900-1700

2.vi /etc/pam.d/login

accountrequiredpam_time.so

For Time based authentication, we should configured in /etc/security/time.conf

Syntax of /etc/security/time.conf

services;ttys;users;times

services

is a logic list of PAM service names that the rule applies to.

ttys

is a logic list of terminal names that this rule applies to.

users

is a logic list of users to whom this rule applies.

times

the format here is a logic list of day/time-range entries the days are specified by a sequence of two character entries, MoTuSa for example is Monday Tuesday and Saturday. Note that repeated days are unset MoMo = no day, and MoWk = all weekdays bar Monday. The two character combinations accepted are

Mo Tu We Th Fr Sa Su Wk Wd Al

the last two being week-end days and all 7 days of the week respectively. As a final example, AlFr means all days except Friday.

pam_time modules checks the file /etc/security/time.conf for authentication. So, we should call the pam_time modules in /etc/pam.d/login.

Do the following steps as:

1.vi /etc/security/time.conf

login;*;user15|user16;Sa0000-2400

2.vi /etc/pam.d/login

accountrequiredpam_time.so

For Time based authentication, we should configured in /etc/security/time.conf

Syntax of /etc/security/time.conf

services;ttys;users;times

services

is a logic list of PAM service names that the rule applies to.

ttys

is a logic list of terminal names that this rule applies to.

users

is a logic list of users to whom this rule applies.

times

the format here is a logic list of day/time-range entries the days are specified by a sequence of two character entries, MoTuSa for example is Monday Tuesday and Saturday. Note that repeated days are unset MoMo = no day, and MoWk = all weekdays bar Monday. The two character combinations accepted are

Mo Tu We Th Fr Sa Su Wk Wd Al

the last two being week-end days and all 7 days of the week respectively. As a final example, AlFr means all days except Friday.

pam_time modules checks the file /etc/security/time.conf for authentication. So, we should call the pam_time modules in /etc/pam.d/login.

Do the following steps as:

1.vi /etc/squid/squid.conf

#detault:

http_port8080

#Recommended minimum configuration:

# Near the src acl src section

acl allownet src 192.168.0.0/255.255.255.0

acl msnnet dstdomain .msn.com

#Default:

# http_access deny all

#Under Herehttp_access deny msnnet

http_access allow allownet

2.service squid start

3.chkconfig squid on

squid is a proxy caching server, using squid we can share the internet, block the internet, to certain network. First we should define the port for squid, the standard port for squid is 3128. We can run squid on different port by specifying http_port portnumber.

To block or allow the Internet access to hosts, we should create the acl (Access Control List). In this file we can specify only the IP address.

Example: acl aclname src IP/NetmaskAfter creating acl we can block or allow the Internet to specified acl.

http_access allow | deny alcname

Do the following steps as:

1.iptables –t filter –A INPUT –s ! 192.168.0.0/24 –p tcp --dport 22 –j DROP

iptables is the build-in firewall tools, used to filter the packets and for nat. By identifying Source Address, Destination Address, type of protocol, source anddestination port we can filter the packets.

-sSource Address

-dDestination Address

-pLayer 3 Protocol

-dDestination Address

--sportSource Prot

--dportDestination Port

-iIncoming Interface

-oOutgoing Interface

-tTable either filter or nat or mangle

-AChain can be either INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTIN

G.  

ssh service use the 22 port so we can block connection from outside the LAN.

Do the following steps as:

1.vi /etc/httpd/conf/httpd.conf

<VirtualHost 192.100.0.1>

ServerNamewww.abc.com

DocumentRoot /var/www/abc/

<Directory /var/www/abc>

AllowOverrideauthconfig

</Directory>

DirectoryIndexindex.html

ServerAdminwebmaster@abc.com

ErrorLog logs/error_abc.logs

CustomLog logs/custom_abc.logs common

</VirtualHost>

2.Create the directory and index page on specified path. (Index page can download fromftp://server1.example.comat exam time)

3.vi /var/www/abc/.htaccess

AuthName“Only to Authorized Users”

AuthTypebasic

AuthUserFile/etc/httpd/conf/mypasswd

requirevalid-user

htpasswd –c /etc/httpd/conf/mypasswd user5

htpasswd –m /etc/httpd/conf/mypasswd user6

chgrp apache /etc/httpd/conf/mypasswd

chmod g+r /etc/httpd/conf/mypasswd

service httpd restart

chkconfig httpd on

AllowOverride Authconfig is used to specify which and how much configuration can be overridden by directory specific .htaccess files.

One of the most common tasks performed in users’ .htaccess files is adding authorization. Typically, a user will setup authorization for directories that hold sensitive information with a configuration.

By default user1 can remove user2’s files due to directory permission to group member. We can prevent of deleting files from others users using Sticky Bits.

chmod o+t /data

Verify /data: ls -ld /data

You will get: drwxrwx—T