Pluggable Authentication Modules (PAM)

Programs which grant users access to a system verify each user's identity through a process called authentication. Historically, each such program had its own way of performing the task of authentication. Under Red Hat Enterprise Linux, many such programs are configured to use a centralized authentication mechanism called Pluggable Authentication Modules or PAM.

PAM uses a pluggable, modular architecture, which affords the system administrator a great deal of flexibility in setting authentication policies for the system.

In most situations, the default PAM configuration file for a PAM-aware application is sufficient. However, sometimes it may become necessary to edit a PAM configuration file. Because misconfiguration of PAM can compromise system security, it is important to understand the structure of these files before making any modifications.

Advantages of PAM

PAM offers the following advantages:

• It provides a common authentication scheme that can be used with a wide variety of applications.
• It allows a large amount of flexibility and control over authentication for both system administrators and application developers.
• It allows application developers to develop programs without creating their own authentication scheme.

More detailed information about Pluggable Authentication Module can be found in below link

http://www.puschitz.com/SecuringLinux.shtml#EnforcingStrongerPasswords

change the default password length

The default password length is usually 8 characters. In order to improve security longer passwords can be enforced. Pluggable Authentication Module (PAM) is used for login authentication. We will make changes to the pam_cracklib module to control how the user authenticates.

Important: Make sure to make a backup of your /lib/security directory and your /etc/pam.d/system-auth before making any changes. Making changes to PAM can cause a system to become inaccessible.

Create backup then list contents of the tar file:

# tar -cvf backup.tar /etc/pam.d/system-auth /lib/security/*
# tar -tf backup.tar

Open file /etc/pam.d/system-auth file with an editor such as vi. Inside the /etc/pam.d/system-auth file you will find line:

password    requisite     /lib/security/$ISA/pam_cracklib.so retry=3 type=

Replace the line with:

password    requisite     /lib/security/$ISA/pam_cracklib.so retry=3  minlen=10

Notes:

• Make the changes carefully. If a change is made and the system becomes inaccessible, go into rescue mode and replace the files with the backup files previously created.
• Once the proper changes have been made to the system-auth file and everything is working as desired, a backup of the new system-auth should be made. If the authconfig command is used, it will overwrite the system-auth file.
• If a single digit number is used in the password, an extra character must be used in the password.

blocking network access for a single user

You can use the iptables userid match and block all outgoing traffic initiated by that user.


iptables -I OUTPUT -o -m owner --uid-owner -j REJECT
service iptables save

How To Back Up MySQL Databases Without Interrupting MySQL

Normally, when you want to create a MySQL backup, you either have to stop MySQL or issue a read lock on your MySQL tables in order to get a correct backup; if you don't do it this way, you can end up with an inconsistent backup. To get consistent backups without interrupting MySQL, I use a little trick: I replicate my MySQL database to a second MySQL server, and on the second MySQL server I use a cron job that creates regular backups of the replicated database.

Preliminary Note

To follow this tutorial, you need a second MySQL server (the slave), and you have to set up MySQL replication from your first MySQL server (the system from where you want to take backups, the master) to the slave, e.g. as described in this tutorial: http://www.howtoforge.com/mysql_database_replication. Setting up MySQL replication is beyond the scope of this document.

The whole setup that I describe here has to be done on the slave MySQL server!

I have tested this on a Debian system; this should work on other distributions as well, but it's possible that some paths differ (in the script /usr/local/sbin/mysqlbackup.sh).


Doing Automated Backups Of The Replicated Databases On The Slave

After you have set up a working MySQL replication from the master to the slave, I assume that you want to do automatic backups of the slave database to the directory /home/sqlbackup. First, we must create that directory:

mkdir /home/sqlbackup

Next we create the shell script /usr/local/sbin/mysqlbackup.sh that stops the slave, makes an SQL dump of the whole MySQL database in /home/sqlbackup (the file name of the SQL dump will look like this: backup-20070423-18.sql; this is a dump taken on April 23, 2007, at 18.00h), restarts the slave afterwards (the slave will then catch up on everything that has happened on the master in the meantime so that no data is lost), and deletes all SQL dumps in /home/sqlbackup that are older than two days:

vi /usr/local/sbin/mysqlbackup.sh

#!/bin/sh

datum=`/bin/date +%Y%m%d-%H`

/usr/bin/mysqladmin --user=root --password=yourrootsqlpassword stop-slave

/usr/bin/mysqldump --user=root --password=yourrootsqlpassword --lock-all-tables \
--all-databases > /home/sqlbackup/backup-${datum}.sql

/usr/bin/mysqladmin --user=root --password=yourrootsqlpassword start-slave

for file in "$( /usr/bin/find /home/sqlbackup -type f -mtime +2 )"
do
/bin/rm -f $file
done

exit 0

(Please make sure that you replace yourrootsqlpassword with the password of the root MySQL user on the slave!)

Now we must make the script executable:

chmod 755 /usr/local/sbin/mysqlbackup.sh

Of course, we don't want to run the /usr/local/sbin/mysqlbackup.sh manually; instead, we create a cron job that runs the script automatically every three hours:

crontab -e

0 */3 * * * /usr/local/sbin/mysqlbackup.sh &> /dev/null

Of course, you are free to modify the cron job to run as often as you need it.

That's it, using this method you can now back up your MySQL database without interrupting the MySQL service on the master server.

The Google Story.....

Know about google...



Just completed reading " The google story" by David Wise. Quite an eyeopener on how Serjey and Larry managed to make their dreams into a $80 billion giant. The journey from the Stanford lab to the gates building to the garage to googleplex is worth a read however, some portion of the book might have been better with a more detailed take. Take the case where Overture sues Google for infringement of its propriety ad selling mechanism. Felt somehow lost as I had no idea who was Overture and why on earth did they not capitalize on their patented solution or the case where the founders had no interest in hiring a CEO but were being forced by Kleiner Perkins and Sequoia Capital. Somewhere the seriousness and implications of Larry's and Brin's decision on Googles future was not really discussed to extent that would have made a serious reader satisfied. Anyway's heres my 10 point gyan to anyone interested in knowing a bit about Google and its founders.



1)Google is a mis-spelt word. The original word is Googol which means 1 followed by 100 zeroes.



2)Larry Page's brother Carl page also sold his internet company during the dot com era for an eye popping $500 million.



3)Google's ad model was originally developed by a company named Overture ( Now a Yahoo company)

4)From their original hostel at Stanford, Larry Page and Sergey Brin were shifted to a newly constructed building named William Gates building.



5)Though a tech company Google followed the practices of media companies during its IPO. To protect itself from unwanted takeover threats the company issued class A and B types of shares. Valued similarly the two classes of shares differed only in their voting rights. The company also developed an auction based system of allotting its stake to prevent unwanted volatility just after listing.


6)Google had lost the Amazon Europe ad deal to Yahoo. Larry and Serjey were traveling on their private jet when they got this news. With much persuation the founders arranged a secret meeting with Amazon's CEO. Google raised its bid to such a level that Yahoo was eventually forced to back out of the deal saying that it did not make business sense for the latter.



7)Google's inhouse chef Charlie Ayers is one of the few chefs in the world who became a millionaire by selling personal Google shares given to him.



8)Its very rare to find Kleiner Perkins and sequoia capital investing in the same venture. Larry and Sergie played a sleek game pitting the two VC'c against each other resulting in the two firms investing $12.5 million each.


9)Google has a policy where employees are allowed to spend 20% of their time persuing their interests. Googlenews, Gmail and a host of other applications are a result of employee ideas which originated during this 20% time.


10)Google has one of the largest hardware infrastructure and computing power in the world. This can be gauged from the fact that the company crawl the entire web and saves it in its computers. When a user searches for something, the google computers searches through the saved pages and throws out relevant results within seconds.

cpanel Useful scripts

Install Zend Optimizer /scripts/installzendopt
Hostname A Entry Missing! /scripts/fixndc then restart bind and apache
Install Cron on New Server /scripts/installrpm anacron vixie-cron ; /etc/rc.d/init.d/crond start
Bandwidth issues /scripts/cleanbw
/scripts/fixwebalizer (To fix problem in webalizer that stop updating stats)
/scripts/fixcommonproblems
/scripts/fixeverything
Fixing Mail List MailMan /usr/local/cpanel/bin/convertmailman2
Reinstall MailMan /scripts/reinstallmailman
Fix Permissions on accounts: /scripts/fixhome
Edit mySQL conf file: pico /etc/my.cnf
Edit php.ini: pico /usr/local/lib/php.ini
Edit Apache Conf: pico /etc/httpd/conf/httpd.conf
Checking Real Time Top Processes Login to SSH and run: top
Run cpanel backup /scripts/cpbackup
To try and fix domain controller: /scripts/fixndc

Quotas /scripts/initquotas - takes a while to run
/scripts/resetquotas
/scripts/fixquotas - takes a while to run

/scripts/adddns Add a Dns Entry
/scripts/addfpmail Install Frontpage Mail Exts
/scripts/addservlets Add JavaServlets to an account (jsp plugin required)
/scripts/adduser Add a User
/scripts/admin Run WHM Lite
/scripts/apachelimits Add Rlimits (cpu and mem limits) to apache.
/scripts/dnstransfer Resync with a master DNS Server
/scripts/editquota Edit A User’s Quota
/scripts/finddev Search For Trojans in /dev
/scripts/findtrojans Locate Trojan Horses
Suggest Usage
/scripts/findtrojans > /var/log/trojans
/scripts/fixtrojans /var/log/trojans
/scripts/fixcartwithsuexec Make Interchange work with suexec
/scripts/fixinterchange Fix Most Problems with Interchange
/scripts/fixtrojans Run on a trojans horse file created by findtrojans to remove them
/scripts/fixwebalizer Run this if a user’s stats stop working
/scripts/fixvaliases Fix a broken valias file
/scripts/hdparamify Turn on DMA and 32bit IDE hard drive access (once per boot)
/scripts/initquotas Re-scan quotas. Usually fixes Disk space display problems
/scripts/initsuexec Turn on SUEXEC (probably a bad idea)
/scripts/installzendopt Fetch + Install Zend Optimizer
/scripts/ipusage Display Ipusage Report
/scripts/killacct Terminate an Account
/scripts/killbadrpms Delete “Security Problem Infested RPMS”
/scripts/mailperm Fix Various Mail Permission Problems
/scripts/mailtroubleshoot Attempt to Troubleshoot a Mail Problem
/scripts/mysqlpasswd Change a Mysql Password
/scripts/quicksecure Kill Potential Security Problem Services
/scripts/rebuildippool Rebuild Ip Address Pool
/scripts/remdefssl Delete Nasty SSL entry in apache default httpd.conf
/scripts/restartsrv Restart a Service (valid services: httpd,proftpd,exim,sshd,cppop,bind,mysql)
/scripts/rpmup Syncup Security Updates from RedHat/Mandrake
/scripts/runlogsnow Force a webalizer/analog update.
/scripts/secureit Remove non-important suid binaries
/scripts/setupfp4 Install Frontpage 4+ on an account.
/scripts/simpleps Return a Simple process list. Useful for finding where cgi scripts are running from.
/scripts/suspendacct Suspend an account
/scripts/sysup Syncup Cpanel RPM Updates
/scripts/unblockip Unblock an IP
/scripts/unsuspendacct UnSuspend an account
/scripts/upcp Update Cpanel
/scripts/updatenow Update /scripts
/scripts/wwwacct Create a New Account

/scripts/runweblogs account username for awstats to run manually

Sometimes such behavior of apache/httpd (taking more and more memory until it dies or crashes the server) can be caused by corrupted MySQL database. Try to do the following:
1) Kill the mysql server
/etc/rc.d/init.d/mysql stop

2) Repair all SQL databases:
myisamchk -r /var/lib/mysql/*/*.MYI

3) Start mysql again:
/etc/rc.d/init.d/mysql start