What is NAT ??

NAT is nothing but the network address translation. It is an IETF standard. What NAT will do?
Nat enables the LAN- local area network to use the two set of IP address, one is for internal traffic and another is for external traffic. All the address translation are taking place in the LAN interface with the Internet. It will keep track on each session.

What is GNU?

The GNU Project was launched in 1984 to develop a complete Unix-like operating system.

GNU's kernel wasn't finished, so GNU is used with the kernel Linux. The combination of GNU and Linux is the GNU/Linux operating system, now used by millions. (Sometimes this combination is incorrectly called Linux.)

There are many distributions of GNU/Linux. The GNU/Linux distributions that are 100% free software; in other words, entirely freedom-respecting.

The name “GNU” is a recursive acronym for “GNU's Not Unix”; it is pronounced g-noo, as one syllable with no vowel sound between the g and the n.

Secure the Apache HTTP server

The Apache HTTP Server is one of the most stable and secure services that ships with Red Hat Enterprise Linux. There are an overwhelming number of options and techniques available to secure the Apache HTTP Server.

FollowSymLinks

This directive is enabled by default, so be careful when creating symbolic links to the document root of the Web server. For instance, it is a bad idea to provide a symbolic link to /.

The Indexes Directive

This directive is enabled by default, but may not be desirable. To prevent visitors from browsing files on the server, remove this directive.

The UserDir Directive

The UserDir directive is disabled by default because it can confirm the presence of a user account on the system. To enable user directory browsing on the server, use the following directives:

UserDir enabled
UserDir disabled root

These directives activate user directory browsing for all user directories other than /root/. To add users to the list of disabled accounts, add a space delimited list of users on the UserDir disabled line.

Do Not Remove the IncludesNoExec Directive

By default, the server-side includes module cannot execute commands. It is ill advised to change this setting unless absolutely necessary, as it could potentially enable an attacker to execute commands on the system.

Restrict Permissions for Executable Directories

Be certain to only assign write permissions to the root user for any directory containing scripts or CGIs. This can be accomplished by typing the following commands:

chown root
chmod 755

Also, always verify that any scripts running on the system work as intended before putting them into production.

Changing extensions and files to lowecase!!

change extensions from .abc to .123, use one of the following:

for i in *.abc; do mv $i `echo $i|sed 's/.abc$/.123$/'`; done # ©2007 dsplabs.com.au
for i in *; do mv $i `basename $i .abc`.123; done # ©2007 dsplabs.com.au

The following bash one-liners convert filenames to lowercase:

for f in `find *`; do mv "$f" "`echo "$f" | tr A-Z a-z`"; done # ©2007 dsplabs.com.au
for f in `find . -type f -name "*[A-Z]*"`; do mv "$f" "`echo "$f" | tr A-Z a-z`"; done # ©2007 dsplabs.com.au

tar — how to create and extract tar.gz and tar.bz2 archives

Creating archives

To create a tar archive the c switch is used. To further encode it using gzip compression the j option is also added, or for bzip2 compression the j switch is included. Note that tar program pipes its output into gzip and bzip2 tools in order to create the tar.gz and tar.bz2 archives, respectively. OK, to compress a directory called dir into dir.tar, dir.tar.gz and dir.tar.bz2 archives, the following commands are used, respectively.

tar cf dir.tar dir/  # ©2007 linux.dsplabs.com.au
tar czf dir.tar.gz dir/  # ©2007 linux.dsplabs.com.au
tar cjf dir.tar.bz2 dir/



Extracting archives

Extracting archives is also very simple. Instead of the c switch the x is used and the archive name is given as the only other parameter. The commands for archive extraction shown below correspond to the archive creation commands given earlier.

# ©2007 linux.dsplabs.com.au # ©2007 linux.dsplabs.com.autar xf dir.tar
tar xzf dir.tar.gz
tar xjf dir.tar.bz2

The verbose mode

The v switch can be used to enable the verbose mode. This can be useful if you would like to see a list of files being compressed or extracted. For example, lets extract the dir.tar.gz archive, with verbose mode enabled, using the following command.

tar xvzf dir.tar.gz # ©2007 linux.dsplabs.com.au

The above command produces a list of inflated files as shown in the following output.

dir/
dir/NVIDIA_DRIVER_README.txt
dir/NVIDIA_LICENSE.txt
dir/readme.txt

cat /etc/*-release — finding out Linux release version

cat /etc/*-release — finding out Linux release version">


If you have a lot of different Linux distributions installed on many different machines it is easy to forget what distribution version runs on which PC. Well worry not! It is easy enough to findout. On Novell’s Open SuSE Linux, the distribution release information is contained in the /etc/SuSE-release file. Simply cat it to see its content in your terminal.

cat /etc/SuSE-release  # ©2007 dsplabs.com.au

The above command produced the following output on one of our Linux boxes.

SUSE LINUX 10.0 (X86-64) OSS
VERSION = 10.0

The following command is used to findout the release version on RedHat’s Fedora Linux.

cat /etc/redhat-release  # ©2007 dsplabs.com.au

The output will look something like this

Fedora Core release 6 (Zod)

or like this

Fedora release 8 (Werewolf)

depending on what version of Fedora you are running. Thus, the naming convention used should be quite clear by now. If you do not even know what type of the distribution is installed, simply run the following command.

cat /etc/*-release  # ©2007 dsplabs.com.au

On our Ubuntu Linux box the output is as follows.

DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=7.10
DISTRIB_CODENAME=gutsy
DISTRIB_DESCRIPTION="Ubuntu 7.10"

If you really want to know in which file the above information is contained in, then simply run the following find command from shell.

find /etc -iname "*release*"  # ©2007 dsplabs.com.au

For an Ubuntu distribution, the above command produces the following output.

/etc/lsb-release

cat of this file produces same output as above.

Linux and Unix useful command list, mini version, ping, netstat, ifconfig iptables

Unix/Linux useful commands,

For troubleshooting a Linux system you might,
want to try one of the following Linux commands.
These commands and flags might not be viable on everyones system.

# lspci list all your pci devices
# dhclient eth0 renew your dhcp release
# ifconfig wlan0 check your wireless network configuration
# netstat -arn show your network route information
# netstat -ap 2 | grep EST show established connections, updates every 2 sec
# netstat -Cr print routing information from routing cache
# iptables -nL show your current iptables configuration in numeric form
# ping ping 127.0.0.1 or network ip address for ICMP replies
# ping -c ping X times.
# ping6 ping ipv6 addresses
# dmesg print or control the kernel ring buffer, bootup messages
# dmesg | grep eth0 if you missed the bootup sequence, and need to check eth0
# nmap -vvv localhost scan yourself for open ports, vvv = extra verbose
# ssh secure shell, encrypted remote login program, client
# ssh -l user host ssh as user to host, ssh -l donald server1.sshexample.com
# uptime check your linux servers uptime and load

Unix Linux Install Command List

This mini guide is ment to be of some help for rookies on Linux/Unix started on
installing applications and software on Unix/Linux systems.

Install Howto, commands, mini guide.


Unix Systems/Dialects

Solaris/SunOS Examples: As user root. ( # sign = root, $ sign = user )

# pkgadd -d gcc-2.95.2-sol7-sparc-local (Installs solaris package)
# pkginfo -l (Verify installation)
# pkgrm (Remove package, you will have to answer yes/no)
# patchadd /var/spool/patch/104945-02


Linux Systems/Dialects

Red Hat, Examples: As user root. (# symbolizes user root)

# rpm -ivh kernel-2.6.9-5.EL.rpm (Install command)
# rpm -q kernel-2.6.9-5.EL.rpm (Query/Verify)
# rpm -e kernel-2.6.9-5.EL.rpm (Remove/Delete)


Debian, Examples: As user root.

# apt-get install xchat
# apt-get remove gnome-panel
# apt-get update (update to the latest package info)
# apt-get -u upgrade

# apt-get -u dist-upgrade (upgrade to a new release)


SuSE

Same as Red Hat.

GCC Gnu Cross Compiler

When downloading the source code in a tarball format, you will
usually need to decompress the files. This is done with tar, bunzip,
gunzip, or unzip, depending on how the file is packed.

Enhancing security on Linux and Unix systems.

Here are some applications and tools that can help you harden and tighten the security on your Linux or Unix box. Examples will follow for each application, tool or module in separate blog posts.

bastille System hardening. OS lock down program. Configures daemons, system settings and firewalls to be more secure.

tcpwrapper Add some security to your system with tcwrapper. /etc/hosts.allow and /etc/hosts.deny
samhain File integrity checks on the fly!
tripwire File integrity checks and much more.


SELinux Security-Enhanced Linux. Implements mandatory access control using Linux Security Modules in the Linux kernel. NSA started the development, and the project was later released to the open source community for further development.

Apparmor (Novell, SuSE). Discretionary access control (DAC) model by providing mandatory access control. (MAC)

iptables/netfilter

Packet filter for IPv4 and NAT. Packet filter rules in in the kernel.
The iptables command is for administration of the packet filtering rules and NAT. (Network Address Translation).

Andutteye
Monitor your systems in a most excellent way.

These are just a few of the security tools and programs out there, but if you master these, you will most definitely have a more secure system or server.

Three Linux Modules Commands

lsmod - program to show the status of modules in the Linux Kernel
rmmod - simple program to remove a module from the Linux Kernel
modprobe - program to add and remove modules from the Linux Kernel
See /etc/modprobe.conf

Playing mp3 files on a Linux system

Due to patent issues, many of the Linux distributions does not support mp3 files out of the box.
This is old news, but if you want to support for playing mp3 files, you can simply download xmms-mp3 for the xmms player, or use the excellent mplayer (movie player) from http://www3.mplayerhq.hu. The mplayer is movie player but it can use several kinds of codecs, and is usable from the command line for playing mp3 fles etc.

Make sure you download the Windows Codec Binaries and add them to your /usr/lib/codecs or what ever directory that fits your Linux system. You will need to be root user if you choose the /usr directory.

mp3 support to xmms for Fedora or Red Hat.
# yum install xmms-mp3

Command line syntax for playing mp3 files with xmms or mplayer

$ xmms file.mp3
$ mplayer file.mp3

Bash Shell Shortcuts

Bash, which is the default shell in Linux contains a whole lot of key bindings which makes it really easy to use . The most commonly used shortcuts are listed below :

____________CTRL Key Bound_____________
Ctrl + a - Jump to the start of the line
Ctrl + b - Move back a char
Ctrl + c - Terminate the command
Ctrl + d - Delete from under the cursor
Ctrl + e - Jump to the end of the line
Ctrl + f - Move forward a char
Ctrl + k - Delete to EOL
Ctrl + l - Clear the screen
Ctrl + r - Search the history backwards
Ctrl + R - Search the history backwards with multi occurrence
Ctrl + u - Delete backward from cursor
Ctrl + xx - Move between EOL and current cursor position
Ctrl + x @ - Show possible hostname completions
Ctrl + z - Suspend/ Stop the command
____________ALT Key Bound___________
Alt + < - Move to the first line in the history
Alt + > - Move to the last line in the history
Alt + ? - Show current completion list
Alt + * - Insert all possible completions
Alt + / - Attempt to complete filename
Alt + . - Yank last argument to previous command
Alt + b - Move backward
Alt + c - Capitalize the word
Alt + d - Delete word
Alt + f - Move forward
Alt + l - Make word lowercase
Alt + n - Search the history forwards non-incremental
Alt + p - Search the history backwards non-incremental
Alt + r - Recall command
Alt + t - Move words around
Alt + u - Make word uppercase
Alt + back-space - Delete backward from cursor

----------------More Special Keybindings-------------------

Here "2T" means Press TAB twice

$ 2T - All available commands(common)
$ (string)2T - All available commands starting with (string)
$ /2T - Entire directory structure including Hidden one
$ 2T - Only Sub Dirs inside including Hidden one
$ *2T - Only Sub Dirs inside without Hidden one
$ ~2T - All Present Users on system from "/etc/passwd"
$ $2T - All Sys variables
$ @2T - Entries from "/etc/hosts"
$ =2T - Output like ls or dir

RHCE Study Guide for RHEL5

RHCE Study Guide for RHEL5

I hope people find it useful. Please feel free to comment below. I want to make sure the information is complete and accurate.

Here is the complete guide:

PDF format:
----------------

http://www.systemnotes.org/download/RHCE_Notes_RHEL5.pdf -- pdf, 104k


HTML format (single page):
----------------------------------

-------------------------------------------------------------------------------
---- Systemnotes.org RHCE Study Guide for RHEL 5 ----

-- by scottm, v1.0 2007/12/02 --
-------------------------------------------------------------------------------

It is very important to study the official objectives for any exam, as that is the only way to know what to expect. This is not meant to replace official training courses and manuals, but is meant to help students quickly review, so they can determine where to focus their efforts and study in more detail.

-------------------------------------------------------------------------------

This guide is based on the official redhat objectives for the RHEL5 exam. see:
https://www.redhat.com/certification/rhce/prep_guide/

This guide is freely available from systemnotesorg.blogspot.com at this permalink:
http://systemnotesorg.blogspot.com/2007/12/rhce-study-guide-for-rhel5.html

For more detailed study info on each objective see:
http://systemnotesorg.blogspot.com/search/label/RHCE
-------------------------------------------------------------------------------

This guide was prepared by looking at each objective, and asking the questions:
-- What could they ask in order to test for knowledge of this objective?, or
-- What kind of troubleshooting might be required?
-- How can this requirement be met?

Q: is used to denote possible questions, and
A: for possible answers.

Note that there may be more than one answer based on what the objective is, or depending which method is preferred to meet the objective. Some items and ideas were taken from labs in the RHCE course book, and great care was taken to not give away any hints about what might be on the exam, other than what the labs and official objectives lead one to infer.

-------------------------------------------------------------------------------

RHCT skills

Troubleshooting and System Maintenance

RHCTs should be able to:

1) boot systems into different run levels for troubleshooting and system maintenance

boot single to set root password, or fix mounting, or init problem

Q: Machine won't boot

A: modify /boot/grub/grub.conf

root (hd0,0)

A: Check files

/etc/rc.local

/etc/inittab

A: Fix initrd

mkinitrd initrd-`uname -r`.img `uname -r`

Q: root password not known

A: 1) boot single (at grub screen, "a", "space", "1", enter),

2) passwd root

Items to study: grub, initrd,vmlinuz, inittab, rc.sysinit...

2) diagnose and correct misconfigured networking

system-config-network, or

vi /etc/sysconfig/network-scripts/ifcfg-eth0

check IPADDR, NETMASK, GATEWAY

ONBOOT=yes

PEERDNS=no

vi /etc/sysconfig/network

3) diagnose and correct hostname resolution problems

/etc/resolv.conf

/etc/hosts

4) configure the X Window System and a desktop environment

Remember X troubleshooting should be done from the command prompt, and

not within X.

Files:

/etc/X11/xinit/xinitrc.d

/etc/X11/xorg.conf

Q: Boot to X

A: Set runlevel 5 in /etc/inittab

vi /etc/inittab

change

id:3:initdefault:

to

id:5:initdefault:

Q: X won't load

A: Check config files

A: system-config-display --reconfig

A: /tmp or /home is full

5) add new partitions, filesystems, and swap to existing systems

This one is a little hard to explain. It just takes some practice to understand.

Tools available:

fdisk /dev/hda

t / fd (raid)

partprobe

mdadm -C /dev/md0 -l 5 -n 3 /dev/hda6 /dev/hda7 /dev/hda8

mke2fs -j /dev/md0

Q: mount something, such as: /dev/hda7 on /data

A: make directory, mount, modify /etc/fstab

1) mkdir /data

2) mount -t ext3 /dev/hda7 /data

3) vi /etc/fstab

/data /data ext3 defaults 1 2

view or change label:

e2label /dev/hda2

e2label /dev/vg0/data0 /data

6) use standard command-line tools to analyze problems and configure system

ls, cp, mv, rm, tail, cat, etc

system-config-

Installation and Configuration

RHCTs must be able to:

1) perform network OS installation

Enter the nfs, or ftp server address and path

2) implement a custom partitioning scheme

Probably easiest during GUI install

3) configure printing

probably the easiest thing to do is use:

system-config-printer

/etc/cups/cupsd.conf

lpadmin

lpstat, lpq

reject disable

accept /usr/bin/enable

4) configure the scheduling of tasks using cron and at

Understand how cron fields work:

min hr month_day month weekday

copy script to /etc/cron.daily, /etc.cron.monthly, etc. or

Modify /etc/crontab: crontab -e

List cron jobs: crontab -l

Add an at job: at [-f file] TIME

View at queue: atq

Remove at jog: atrm job

5) attach system to a network directory service, such as NIS or LDAP

1) Install ypbind, portmap

2) system-config-authentication

check: Enable NIS Support, or Enable LDAP Support

click: Configure NIS..., or Configure LDAP...

3) configure firewall, if required

iptables -A INPUT -s 192.168.0.0/255.255.255.0 -p tcp -m tcp --dport 835:837 -j ACCEPT

service iptables save

test:

ypwhich

nisdomainname -y

genent services

getent passwd smith

rpcinfo -p

files:

/etc/yp.conf

/etc/sysconfig/network

/etc/pam.d/system-auth

/etc/nsswitch.conf

6) configure autofs

/etc/auto.master

/home/guests /etc/auto.guests --timeout=60

/etc/auto.guests

* -rw,soft,intr server1:/home/guests/&

service autofs restart

chkconfig portmap on

chkconfig autofs on

7) add and manage users, groups, quotas, and File Access Control Lists

Q: Create group, add users, set primary group

A: Use groupadd, useradd, usermod

groupadd -g 1000 groupname

useradd username

usermod -G groupname username

(-G for primary group)

quotas

Q: Setup a 70kb hard block user quota for user tim on /home/tim:

A: Use a Hard Block user quota (or Soft depending on question).

1) modify /etc/fstab

change defaults to usrquota for /home

2) mount -o remount /home

3) quotacheck -cuf /home

4) quotaon /home

5) setquota -u tim 0 60 0 0 /home

or

5a) edquota tim

Disk quotas for user tim (uid 502):

Filesystem blocks soft hard inodes soft hard

/dev/hda5 16 0 0 8 0 0

6) repquota /home

or

quota tim

7) test

a) quota tim

b) su - tim

c) dd if=/dev/zero of=/home/tim/somefile bs=1024 count=70

d) ls -l

file should be less than 70 kilobytes

Quota Command to remember:

quotacheck -cuf /home

quotaon /home

edquota tim

quota tim

repquota /home

*** Lab: Set a user soft block quota of 1MB for user diskhog on /blackhole,

(or hard block, hard / soft inode). Know when to use each type of quota ***

Enable quotas:

quotacheck -cuf /blackhole

quotaon /blackhole

Set Quota:

block inode

h s h s

setquota -u diskhog 0 1024 0 0 /blackhole

or

edquota -u diskhog

Report on Quota for user or directory:

quota -u diskhog

repquota /blackhole

Password

defaults:

/etc/login.defs

chage [options] username

password files:

/etc/passwd

/etc/shadow

/etc/group

8) configure filesystem permissions for collaboration

Q: Make user alex a member of sales with write permissions to /depts/sales

Q: Make user sales, hr, and web groups in /depts/

A:

mkdir -p /depts/{sales,hr,web}

for GROUP in sales hr web;do chgrp $GROUP /depts/$GROUP;done

chmod 770 /depts/*

chmod g+s /depts/*

Test permissions as alex:

su - alex

9) install and update packages using rpm

You may have to mount a directory over nfs, or install directly from http://

rpm -Uvh filenamex.i386.rpm

rpm --import /usr/share/rhn/RPM-GPG-KEY

rpm -K /tmp/rpmversion.i386.rpm

10) properly update the kernel package

Just remember to use rpm -i, so the old kernel will still be there.

1) mkdir /server1

2) mount server1:/var/ftp/pub /server1

3) cd /server1/Redhat/RPMS

4) rpm -ivh kernel-*

5) vi /boot/grub/grub.conf

default=0

11) configure the system to update/install packages from remote repositories using yum or pup

/etc/yum.conf

12) modify the system bootloader

/boot/grub/grub.conf

13) implement software RAID at install-time and run-time

fdisk /dev/hda

fd (raid)

partprobe

mdadm -C /dev/md0 -l 5 -n 3 /dev/hda6 /dev/hda7 /dev/hda8

mke2fs -j /dev/md0

mount

/etc/fstab

mdadm --detail /dev/md0

recover

mdadm /dev/md0 -a /dev/sda1

14) use /proc/sys and sysctl to modify and set kernel run-time parameters

Q: turn on ip forwardarding

A: 1) vi /etc/sysctl.conf

net.ipv4.ip_forward=1

2) sysctl -p

or

echo 1 > /proc/sys/net/ipv4/ip_forward

to view:

sysctl -a | grep ipv4

to find available options for ipv4:

ls /proc/sys/net/ipv4

15) use scripting to automate system maintenance tasks

Maybe put a script in /etc/cron.daily?

Login Shell Scripts

/etc/profile

/etc/profile.d/*.sh

~/.bash_profile

~/.bashrc

/etc/bashrc

RHCE skills

Troubleshooting and System Maintenance

RHCEs must demonstrate the RHCT skills listed above, and should be able to:

1) use the rescue environment provided by first installation CD

linux rescue

2) diagnose and correct boot failures arising from bootloader, module, and filesystem errors

init

/etc/rc.d/rc.sysinit

/etc/rc.d/rc adn /etc/rc.d/rc?.d

/etc/rc.d/rc.local

grub

/boot/grub/grub.conf

filesystem

/etc/fstab

fsck /dev/hda

3) diagnose and correct problems with network services (see Installation and Configuration below for a list of these services)

4) add, remove, and resize logical volumes

LVM -

Hint: use apropos quota, or just lvm to find commands.

Q: expand or shrink logical volume (RHCE)

A: Make sure there is enough space, and volume is online, use vgconvert if necessary

ext2online /dev/vg0/data0 120M

lvextend -L +100M /dev/vg0/data0

lvreduce -L 120M /dev/vg0/data0

vgdisplay -v vg0

pvdisplay

lvdisplay

Q: Create a logical volume

A: First create physical volume, then volume group, then logical volume

PV -> VG -> LV

pvcreate /dev/hda6 /dev/hda7 /dev/hda8

vgcreate vg0 /dev/hda6 /dev/hda7

lvcreate -L 50M -n data0 vg0

ext2online /dev/vg0/data0

lvextend -L +6M /dev/vg0/data0

resize2fs -L /dev/vg0/data0 40M

lvreduce -L 40M /dev/vg0/data0

vgconvert

5) diagnose and correct networking services problems where SELinux contexts are interfering with proper operation.

SELinux

getenforce

setenforce 1

check context with ls -Z

Q: Set up directory to use context of another directory

A: Use the other directory as a reference

chcon -R --reference /var/www/html /var/www/html/www1

Installation and Configuration

RHCEs must demonstrate the RHCT-level skills listed above, and they must be capable of configuring the following network services:

1) HTTP/HTTPS

install httpd, check context with ls -Z

Q: Create a virtual host www1.example.com w/ subdirectory /var/www/html/www1

A:

1) install httpd, modify /etc/httpd/conf/httpd.conf file

ServerName www1.example.com

DocumentRoot /var/www/html/www1

2) chcon -R --reference /var/www/html /var/www/html/www1

3) service httpd restart

4) chkconfig httpd on

Testing

service httpd configtest

2) SMB

Q: Configure Samba share /home/depts/legal

1) install samba

rpm -Uvh samba-* system-config-samba*(optional)

2) vi /etc/samba/smb.conf

[sharename]

path = /home/depts/legal

browseable = no

writeable = no

3) configure firewall

port 445, 137-139

3) NFS

Q: Export /data directory with nfs

The nfs server is an RPC service, and thus requires portmap

A: Modify /etc/exports, start nfs & portmap (make sure /data directory exists)

1) modify /etc/exports

/data *(sync,rw)

2) start services

service nfs start

service portmap start

chkconfig nfs on

chkconfig portmap on

3) verify config, & check mounts

exportfs -v

showmount -e localhost

rpcinfo -p localhost

4) restart

exportfs -r, or

service nfs reload

Q: Mount server1:/var/ftp/pub with nfs on /server1

1) mkdir /server1

2) vi /etc/fstab

192.168.2.254:/var/ftp/pub /server1 nfs soft,defaults 0 0

3) mount -a

* configure autofs

Automount

Q: Configure automount for nfs mount from nis domain on server1

A:

1) mkdir /net

2) vi /etc/auto.master

# uncomment /net line

/net /etc/auto.net

3) start services

service portmap start

service autofs start

chkconfig autofs on

chkconfig portmap on

Q: Configure automount for nfs mount of /rhome directories from nis domain on server1

A: Create base directory

1) mkdir /rhome

2) vi /etc/auto.master

# copy and modify /misc line

/rhome /etc/auto.rhome

3) vi /etc/auto.rhome

* -rw,soft.intr server1:/home/guests/&

4) start services

service portmap start

service autofs start

chkconfig autofs on

chkconfig portmap on

4) FTP

Q: Configure ftp with /var/ftp/incoming directory

A:

install vsftpd

1) rpm -Uvh vsftpd*

2) service vsftpd start

3) chkconfig vsftpd on

4) create incoming directory

cd /var/ftp

mkdir incoming

chown root:ftp fincoming

chmod 730 incoming

5) vi /etc/vsftpd/vsftpd.conf

uncomment the lines --

#anon_upload_enable=YES

#chown_uploads=YES

#chown_username=whoever

add

anon_umask=077

6) service vsftpd restart

7) configure firewall

iptables -A INPUT -s 192.168.0.0/24 -p tcp --dport 21 -j ACCEPT

service iptables save

5) Web proxy

Q: Install a web proxy and allow a certain network to access it

A: Install & configure squid

1) install squid, and start the service

rpm -ivh --aid squid*

service squid start

chkconfig squid on

2) vi /etc/squid

acl example src 192.168.0.0/24

http_access allow example

3) service squid reload

4) Configure browser to test:

Edit / Preferences /General / Connection Settings

Manual proxy configuration / HTTP Proxy: localhost Port: 3128

Enable port in firewall, if required

iptables -A INPUT -s 192.168.0.0/24 -p tcp --dport 3128 -j ACCEPT

service iptables save

Useful parameters:

http_port 3128

cache_mem 8 MB

cache_dir ufs /var/spool/squid 100 16 256

acl all src 0.0.0.0/0.0.0.0

http_access allow localhost

http_access deny all

hint: find out that port number is 3128

grep squid /etc/services

6) SMTP

install sendmail, sendmail-cf, sendmail-doc (optional)

Q: Configure mail server to accept internet email

A: modify /etc/mail/sendmail.mc

1) cd /etc/mail

2) vi /etc/mail/sendmail.mc

search for 127.0, put dnl at the front of the line

3) make

or m4 sendmail.mc > sendmail.cf

service sendmail restart

Q: Mail alias

A: modify /etc/aliases, run newaliases

Q: Receive mail for DomainX.example.com

A: modify sendmail mc as above, and add domain to /etc/mail/local-host-names

domainx.example.com

Debugging:

mail -v root

mailq, mailq -Ac

sendmail -q

tail -f /var/log/maillog

7) IMAP, IMAPS, and POP3

Q: Configure for pop3 (or imap)

A: 1) install dovecot

2) vi /etc/dovcot.conf

protocols = pop3

3) service dovecot restart

4) chkconfig dovecot on

Testing:

note: root is not permitted to login

echo "pop" | mail -s test student

telnet localhost 110

user student

pass student

stat

list

retr 1

quit

8) SSH

/etc/ssh/

~/.ssh/

9) DNS (caching name server, slave name server)

Q: Setup a slave name server

A:

1) install bind, bind-utils, and caching-nameserver

2) when configuring a slave name server, start with caching, and modify

3) vi /etc/named.conf

comment out dump-file section

add:

zone "example.com" {

type slave;

masters { 192.168.0.254 };

file "slaves/slave-example.com.zone";

};

4) vi 0.168.192.in-addr.arpa

add:

zone "0.168.192.in-addr.arpa" {

type slave;

masters { 192.168.0.254 };

file "slaves/0.168.192.zone";

};

To verify:

named-checkconf

named-checkconf -t /var/named

named-checkzone example.com example.com.zone

5) start named, and make it start at boot

service named restart; tail -f /var/log/messages | grep named

chkconfig named on

Remember to check /etc/resolv.conf on all client machines.

10) NTP

/etc/ntp.conf

For each of these services, RHCEs must be able to:

1) install the packages needed to provide the service

rpm -Uvh packagename.rpm, or

yum install packagename

2) configure SELinux to support the service

getenforce

setenforce 1

check context with ls -Z

chcon -R --reference /var/www/html /var/www/html/www1

3) configure the service to start when the system is booted

chkconfig servicename on

4) configure the service for basic operation

different for each service

5) Configure host-based and user-based security for the service

setuid?

/etc/xinet.d/

RHCEs must also be able to:

1) configure hands-free installation using Kickstart

2) implement logical volumes at install-time

3) use iptables to implement packet filtering and/or NAT

iptables is usually configured to be as restrictive as possible, but this

may be difficult to implement in an exam environment. Read the instructions

carefully, and try to find the best way to implement it.

--- commands ---

iptables -L

iptables -F

service iptables save

service iptables restart

chkconfig iptables on

--- starting config ---

iptables -P INPUT DROP

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED, RELATED -j ACCEPT

--- sample file ---

cat /etc/sysconfig/iptables

*filter

:INPUT DROP [67:11217]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [58:6450]

-A INPUT -s 192.168.0.10 -p tcp -m tcp --dport 22 -j ACCEPT

-A INPUT -s 192.168.0.1 -p tcp -m tcp --dport 22 -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -s 192.168.0.254 -p tcp -m tcp --dport 22 -j ACCEPT

-A INPUT -s 192.168.0.254 -p udp -m udp --sport 53 -j ACCEPT

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -s 192.168.0.0/255.255.255.0 -p tcp -m tcp --dport 22 -j ACCEPT

-A INPUT -s 192.168.0.0/255.255.255.0 -p udp -m udp --dport 53 -j ACCEPT

-A INPUT -s 192.168.0.0/255.255.255.0 -p tcp -m tcp --dport 445 -j ACCEPT

-A INPUT -s 192.168.0.0/255.255.255.0 -p tcp -m tcp --dport 21 -j ACCEPT

-A INPUT -s 192.168.0.0/255.255.255.0 -p tcp -m tcp --dport 2049 -j ACCEPT

-A INPUT -s 192.168.0.0/255.255.255.0 -p udp -m udp --dport 2049 -j ACCEPT

-A INPUT -s 192.168.0.0/255.255.255.0 -p tcp -m tcp --dport 25 -j ACCEPT

-A INPUT -s 192.168.0.0/255.255.255.0 -p tcp -m tcp --dport 110 -j ACCEPT

-A INPUT -s 192.168.0.0/255.255.255.0 -p tcp -m tcp --dport 80 -j ACCEPT

-A INPUT -s 192.168.0.0/255.255.255.0 -p tcp -m tcp --dport 3128 -j ACCEPT

-A INPUT -s 192.168.0.0/255.255.255.0 -p tcp -m tcp --dport 835:837 -j ACCEPT

COMMIT

4) use PAM to implement user-level restrictions

/lib/security/

/etc/pam.d/

what is python??????

Python is a interpreted, interactive, object oriented language. It is same as like Tcl, Perl, Scheme or Java programming language.

Features:
1. Python comprise of classes, exceptions, very high level dynamic data types, and dynamic typing.
2. Bulit in modules are written in C, C++.
3. Python runs in UNIX, on Windows, OS/2, Mac, Amiga, and many other platforms.

Printing readable man pages

Below command will get you the man page in to read and printable format

____________
man command | col -x -b > command.txt
______________

Mysql Auto Installer Version 1 for i386 system and x86 bit based oS

Description about script : Installing mysql for X86 and i386 architecture (with dependency- all libraries).

You may please send me the request for mysql auto installer script to the Email address "venkatachalam@poornam.com" or "venkata.natarajan@gmail.com" and make use of it.

Why is python ??

Python is a open source software. It is developed in C. Python is a interpreter language so there is no need to convert the code in to binary format.

Python is a platform independent (it runs on windows and linux, mac os , unix etc).

Syntax also very simple(easy to learn).


You refer the link http://python.org for further reading insight...

Linux Success Story: New York Stock Exchange Moves to Linux

The New York Stock Exchange is investing heavily in x86-based Linux systems and blade servers as it builds out the NYSE Hybrid Market trading system that it launched last year. Flexibility and lower cost are among the goals. But one of the things that NYSE Euronext CIO Steve Rubinow says he most wants from the new computing architecture is technology independence.

"What we want is to be able to take advantage of technology advances when they happen," Rubinow said. "We're trying to be as independent of any technologies as we can be."

The Hybrid Market system lets NYSE traders buy and sell stocks electronically or on the exchange's trading floor. The NYSE has been turning to x86 technology to power the trading system, largely using servers from Hewlett-Packard Co., the two companies announced this week.

The NYSE has installed about 200 of HP's ProLiant DL585 four-processor servers and 400 of its ProLiant BL685c blades, all running Linux and based on dual-core Opteron processors from Advanced Micro Devices Inc. In addition, the stock exchange is using HP's Integrity NonStop servers, which are based on Intel Corp.'s Itanium processors and run the fault-tolerant NonStop OS operating system, as well as its OpenView management software.

Rubinow said that Linux is mature enough to meet his needs. The open-source operating system may not have all the polish of Unix technologies with 20-plus years of history behind them, "but it's polished enough for us," he said.

The NYSE's shift toward Linux and x86-based hardware illustrates why consulting firm Gartner Inc. is predicting a slight decline in Unix server revenues over the next five years. In comparison, Gartner forecasts strong sales growth for both Windows and Linux servers.

Although Rubinow has the option of using HP-UX, HP's version of Unix, he said that he'd prefer not to. "We don't want to be closely aligned with proprietary Unix," he said. "No offense to HP-UX, but we feel the same way about [IBM's] AIX, and we feel the same way to some extent about Solaris."

The NYSE still runs numerous Unix systems, especially ones with Solaris, which is Sun Microsystems Inc.'s Unix derivative. Rubinow acknowledged that Solaris has the ability to run on multiple hardware platforms, including x86-based systems from Sun server rivals such as HP. But he added that he thinks Linux "affords us a lot of flexibility."

One technology that the NYSE isn't adopting so eagerly is server virtualization, which comes with a system latency price that Rubinow said he can't afford to pay. In a system that is processing hundreds of thousands of transactions per second, virtualization produces "a noticeable overhead" that can slow down throughput, according to Rubinow. "Virtualization is not a free technology from a latency perspective, so we don't use it in the core of what we do," he said.

Charles King, an analyst at Pund-IT Inc. in Hayward, Calif., believes there is a broader concern among IT managers about virtualization overhead and its impact on transaction processing. "It's one of the reasons why even the staunchest advocates of x86 virtualization recommend extensive testing prior to moving systems into production," King said.

Fedora Core 6 No More

As of this last Friday, December 7th Fedora Core 6 is no more. With it goes the last release the Fedora Project had seen the split between “Community” (Extras) and Red Hat sponsored (Core). Those not intimately involved in Fedora might be interested to learn that when the merge happened it was the core packages that ended up having to follow the former “Extras” packaging guidelines and not the other way around. Yet another testament to the power of community.

Fedora often takes a bit of flack over not maintaining a longer release / support cycle. I think the main reason for this is simply because it allows Fedora to take bigger risks then any other operating system out there. By releasing often (now every 6 months) we can take any number of large risks. The worst case is having to fix it during the next release in 6 months, the best case is we integrate yet another killer technology before anyone else. Having been involved in Fedora for about 2 years I can say, 6 months is not very long.

At the same time not having to worry about updates for very long (current release + 1 release + 1 month) allows our developers to be more focused on innovation. Other groups and businesses are taking note of this as well as they integrate software into Fedora. It has become the perfect platform for a company to present new software to the world. Our setup allows us to be incredibly dynamic.

I think it’s best not to think of Fedora as a stand alone distribution but rather as part of a family of Red Hat compatible products. I mean that in terms of the technical specifications, not Red Hat the company. When Fedora is combined with RHEL and CentOS that family can fit into just about any market imaginable and I think that’s the key to the success of each of these distributions.

Fedora 9 is on the horizon and the recently announced FUDCon will be even more exciting then the last one. Those interested in helping just check out: http://fedoraproject.org/join-fedora

Disable ping responses from the system

To configure a Linux system to not respond to a ICMP (ping), run the following
command as the root user.


echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all


To make the changes persistent across reboots, add the following line to
your /etc/sysctl.conf file.


# Ignore all to ICMP (ping)
net.ipv4.icmp_echo_ignore_all = 1