Editing RDM Implementation Details in a Single html

[[category:RDM]]

=Contents=


==Deafault ACLs==
-------------------------------
Default ACLs
-------------------------------

To set defualt ACL, we have to set defualt permissions by below command.
Whenever a file will be created it's owner will be file creator and
permission will be as u:rwx,g:r-x,o:---

#setfacl --set u::rwx,g::r-x,o::--- test

below commands will set default acl to newly created files and directories.

#setfacl -m d:u:a0016:rwx test
#setfacl -m d:u:a0019:rwx test
#setfacl -m d:u:a0032:r-x test

But if these three users does not have a permissoin to access the test
dir, then please do set permission as given below
#setfacl -m u:a0016:rwx test
#setfacl -m u:a0019:rwx test
#setfacl -m u:a0032:r-x test

This will give default permission to a Group.
#setfacl -m d:g:RADLH:rw- testdir

==DNS==

---------
DNS
---------
services of the DNS

/etc/init.d/named start
/etc/init.d/named stop
/etc/init.d/named restart
/etc/init.d/named status

config file path
vim /var/named/chroot/etc/named.conf

zone files path
/var/named/chroot/var/named/

dns log file
tail -f /var/log/messages


==OpenLDAP master/master replication==
---------------------------------
OpenLDAP master/master replication
---------------------------------
master 172.20.1.14
slave 172.20.1.24
binddn="cn=manager,dc=rdm,dc=co,dc=in"


on master

vim /etc/openldap/slapd.conf
-------------------------------------
        replica host=172.20.1.24:389
        binddn="cn=Manager,dc=rdm,dc=co,dc=in"
        bindmethod=simple
        credentials=rdmsecret4u001
        replogfile /var/lib/ldap/openldap-master-replog
-------------------------------------

touch /var/lib/ldap/ldaprep.log
chown ldap.ldap /var/lib/ldap/ldaprep.log
above file should be writable by ldap, whatever chages are made to ldap are written to this file and when they are reflicated to slave they were be deleted from the file.

on slave

vim /etc/openldap/slapd.conf
-------------------------------------
        updatedn "cn=Manager,dc=rdm,dc=co,dc=in"
        updateref ldap://172.20.1.14
-------------------------------------
nessus

install
add user
registor
download plugin
start if not
then start services directly.


==NTP Server==

---------
NTP Server
---------
NTP services
/etc/init.d/ntpd status
/etc/init.d/ntpd stop
/etc/init.d/ntpd restart
/etc/init.d/ntpd status

---------
NTP Client
---------
below two commands can be used on linux ntp clients to see the status and query to NTP server

ntpdc -p
ntpdc -l

==ossec agent linux==

----------------------
ossec agent linux
----------------------
below command will be used to add/remove new ossec agents.
/var/ossec/bin/manage_agents

below commands can be used to start/stop the ossec agent

/var/ossec/bin/ossec-control start
/var/ossec/bin/ossec-control stop
/var/ossec/bin/ossec-control restart
/var/ossec/bin/ossec-control status

ossec logs can be check by below command.
tail -f /var/ossec/logs/ossec.log 

ossec configuration file is 
/var/ossec/etc/ossec.conf

----------------------
ossec agent windows
----------------------
The ossec agent interface on windows can be started via start->program-> ossec->manage agent

From this interface you can check the logs and config file.


==OSSEC Server==

-----------------
OSSEC Server
-----------------
Use below commands start/stop the ossec services

/var/ossec/bin/ossec-control status
/var/ossec/bin/ossec-control stop
/var/ossec/bin/ossec-control restart
/var/ossec/bin/ossec-control status

ossec services log
tail -f /var/ossec/logs/ossec.log 

ossec alerts log
tail -f /var/ossec/logs/alerts/alerts.log

ossec configuration file is 
/var/ossec/etc/ossec.conf

rootcheck/rootkit logs can be found at the below path
/var/ossec/queue/rootcheck/

syscheck/integrity logs can be found at the below path
/var/ossec/queue/syscheck/

Starting Second OSSEC server
---------------------------
when first ossec is not working then follows below process to up Second ossec server
login to 10.10.10.27 and change ip to 10.10.10.17(down first machine) and start ossec service


OSSIM
-------------
http://10.10.10.18/ossim/index.php
User : admin
Pass : 


==Openldap Password Policy on 172.20.1.24==

--------------------------
Openldap Password Policy on 172.20.1.24
--------------------------

Password Policy is defined on the 172.20.1.24 server. Every day it will generate the email alerts for the locked and expired email accounts.
The attributes of this policy is as follows

pwdMinAge: 1 minute
pwdMaxAge: 45 days
pwdMinLength: 7
pwdExpireWarning: 40 days
pwdGraceAuthNLimit: 3
pwdLockoutDuration: 10 minute
pwdMaxFailure: 5


The policy can be change by http://172.20.1.24/phpldapadmin/htdocs/index.php and select "cn=Standard,ou=Policies,dc=rdm,dc=co,dc=in" and do the required change e.g. 

pwdExpireWarning, pwdGraceAuthNLimit, pwdLockoutDuration, pwdMinAge etc.

--------------------------
Openldap Password Policy on 172.20.1.24
--------------------------

yum install openldap-servers-overlays


vi /etc/openldap/slapd.conf
---------------------------
add below lines

include /etc/ldap/schema/ppolicy.schema

moduleload ppolicy


overlay ppolicy
ppolicy_default "cn=Standard,ou=Policies,dc=rdm,dc=co,dc=in"
ppolicy_use_lockout
ppolicy_hash_cleartext

---------------------------


vi ppolicy.ldif
---------------------------
dn: ou=Policies,dc=rdm,dc=co,dc=in
ou: Policies
description: Directory policies.
objectclass: organizationalUnit

dn: cn=Standard,ou=Policies,dc=rdm,dc=co,dc=in
cn: Standard
description: Standard password policy.
pwdAttribute: 2.5.4.35
pwdMinAge: 60
# 30 days: 60 sec * 60 min * 24 hr * 30 days
pwdMaxAge: 2592000
pwdCheckQuality: 1
pwdMinLength: 7
# Warn three days in advance
pwdExpireWarning: 2160000
pwdGraceAuthNLimit: 3
pwdLockout: TRUE
pwdLockoutDuration: 1200
pwdMaxFailure: 5
pwdFailureCountInterval: 1200
pwdMustChange: TRUE
pwdAllowUserChange: TRUE
pwdSafeModify: TRUE
objectclass: device
objectclass: pwdPolicy
---------------------------

ldapadd -acvx -D"cn=manager,dc=rdm,dc=co,dc=in" -w rdmsecret4u001 -f ppolicy.ldif

/etc/init.d/ldap restart


Email Alert Scripting
----------------------

vim /root/ppolicy/ppolicy.sh 
----------------------
#!/bin/sh
#search qmail users
ldapsearch  -x '(&(objectclass=qmailUser))' uid|grep uid:|tr -d ' '|cut -d: -f2 > /root/ppolicy/email_users
#turncat user_expire and locked_user files.
echo > /root/ppolicy/user_expire
echo > /root/ppolicy/locked_user
#search for account expired users
for i in `cat /root/ppolicy/email_users`
do
ldapsearch  -x "(&(objectclass=qmailUser)(uid=$i)(pwdChangedTime<=`date '+%Y%m%d%k%M%SZ' -d "30 days ago"`))" uid|grep uid: |tr -d ' ' |cut -d: -f2 >> /root/ppolicy/user_expire
#search for account locked users
locked=`ldapsearch  -x "(&(objectclass=qmailUser)(uid=$i))" pwdGraceUseTime -LL |grep -c pwdGraceUseTime`
if [ "$locked" == "3" ]
then
echo $i >> /root/ppolicy/locked_user
fi
done
#generate alerts
sh /root/ppolicy/expireAlert.sh
----------------------

vim /root/ppolicy/expireAlert.sh 
----------------------
#!/bin/sh
#send email password expiration alert to user and edp
for i in `cat /root/ppolicy/user_expire`
do
cat /root/ppolicy/expiremsg |mail -s "Password Expiration Notice" $i@rdm.co.in
done
#send email to edp about locked users
cat /root/ppolicy/locked_user | mail -s "Email Account Locked Users " edp@rdm.co.in
----------------------


==NFS Details==

----------
NFS
----------
below command can be used to start/stop NFS service

/etc/init.d/nfs start
/etc/init.d/nfs stop
/etc/init.d/nfs restart
/etc/init.d/nfs status


==Qmail Details ==
-----------
Qmail
-----------
There are two qmail instance.
First instance sends(local) and receive all mails.
Second instance sends non-local mails 

qmailctl stat

vi /etc/inittab ;init q
--------------------------------------
#SV:123456:respawn:/command/svscanboot

comment will stop qmail
and uncoment will start the qmail server

SV:123456:respawn:/command/svscanboot
--------------------------------------

below commands can be used to see the current logs.

tail -f /var/log/qmail/qmail-send/current |tai64nlocal
tail -f /var/log/qmail/qmail-smtp/current |tai64nlocal
tail -f /var/log/qmail/qmail-pop3d/current |tai64nlocal 
 
tail -f /var/log/qmail2/qmail2-send/current |tai64nlocal
tail -f /var/log/qmail2/qmail2-smtp/current |tai64nlocal

tail -f /var/log/maillog

below log file is of scanner logs
tail -f /var/spool/qmailscan/qmail-queue.log 

commands to strat and stop spamassassin.

/etc/init.d/spamassassin status
/etc/init.d/spamassassin stop
/etc/init.d/spamassassin restart

to start imap service
/etc/init.d/imap start

to start imapproxy
/usr/local/sbin/in.imapproxyd

to start clam Anti Virus servie
/usr/local/sbin/clamd


There are two nfs mounting. First qmailnfs and second is sophosAV 

below command will mount the NFS from 10.10.10.16 in /home/vmail
mount -t nfs -o tcp,rsize=32768,wsize=32768 10.10.10.16:/home/vmail /home/vmail/

The mounting parameter for sophos is configured into /etc/fstab.
to mount sophos below command can be used.
mount -a


below commands are for ldap server
/etc/init.d/ldap status
/etc/init.d/ldap stop
/etc/init.d/ldap restart
/etc/init.d/ldap status



==Other Details==

rsync_ossec
----------------
15 * * * * rsync -auvrl --delete /var/ossec rsync://10.10.10.27/OSSEC

above cron job runs on every hour at 15 Minutes

backup from 10.10.10.17:/var/ossec 10.10.10.27:/var/ossec


rsync_qmailnfs

0 2 * * * /root/rsync_qmailnfs.sh
above cron job take mail backup

backup from 10.10.10.16:/home/vmail to 10.10.10.26:/home/vmail
rsync_sambanfs
----------------
0 * * * * /root/rsync_sambanfs.sh
above cron job run on starting of every hour and take backup 

backup is from 10.10.10.15:/data to 10.10.10.25:/data



rsync_update_backup
---------------------
30 * * * * /root/rsync_update_backup.sh
above cron job runs on every hour at 30 Minutes

backup from /data to /backup_update_only

You have to delete old /backup_update_only weekly or monthly
----------
NFS
----------
below command can be used to start/stop NFS service
/etc/init.d/nfs start
/etc/init.d/nfs stop
/etc/init.d/nfs restart
/etc/init.d/nfs status

use below command to open truecrypt GUI panel
truecrypt

cronjob -l
-------------------------
0 * * * * /root/rsync_sambanfs.sh
-------------------------
This cron job take backup from new SambaNFS to old SambaNFS every hour.


==Samba==

--------------
Samba
--------------
audit logs can be see by below command
tail -f /var/log/samba/audit.log

All other logs will be into below directory
cd /var/log/samba/

samba start/stop commands.
/etc/init.d/smb status
/etc/init.d/smb stop
/etc/init.d/smb restart
/etc/init.d/smb status


There are two nfs mounting. First sambanfs and second is sophosAV 

below command will mount the NFS from 10.10.10.15 in /home and /data
mount -t nfs -o rsize=32768,wsize=32768,timeo=15,tcp   10.10.10.15:/data /data 
mount -t nfs -o rsize=32768,wsize=32768,timeo=15,tcp   10.10.10.15:/home /home

The mounting parameter for sophos is configured into /etc/fstab.
to mount sophos below command can be used.
mount -a


below commands are for fedora directory server
/etc/init.d/dirsrv status
/etc/init.d/dirsrv stop
/etc/init.d/dirsrv restart
/etc/init.d/dirsrv status

below commands are for fedora directory server admin console
/etc/init.d/dirsrv-admin status
/etc/init.d/dirsrv-admin stop
/etc/init.d/dirsrv-admin restart
/etc/init.d/dirsrv-admin status

ldapsearch -x 
will show all the users including their attributes

below command will start the fedora DS admin console.
389-console 


Second samba 10.10.10.24 starting process
----------------------------------------
down first samba 10.10.10.14 (dns1) and login to second samba(dns2) 10.10.10.24 (aditional ip)(the second samba should be up for Fedora DS replication, it's Fedora DS is read only, no changes directly on it will work)

run below commands on second samba 10.10.10.24
ifup eth0
ifup eth0:0
ifup eth0:1
ifup eth0:2
ifup eth0:3
ifup eth0:4
ifup eth0:5
service smb start

above service and ip will be up temporerly, when this machine will reboot this has to do again.
------------------------------------------

LRS Samba
------------------------------------------
10.10.10.28
57.56.131.200
samba pdc with ldap


below commands are for ldap server
/etc/init.d/ldap status
/etc/init.d/ldap stop
/etc/init.d/ldap restart
/etc/init.d/ldap status


All other logs will be into below directory
cd /var/log/samba/

samba start/stop commands.
/etc/init.d/smb status
/etc/init.d/smb stop
/etc/init.d/smb restart
/etc/init.d/smb status

==Sophos Anti Virus ==

------------------------------------------
Sophos AV
----------
start/stop commands.

/etc/init.d/sav-protect start/stop/restart/status
/etc/init.d/sav-rms start/stop/restart/status 
/etc/init.d/sav-web start/stop/restart/status

WEB GUI url

http://127.0.0.1:8081
User : sc
Pass : sc123

Sophos installation path

/opt/sophos-av/


== Sudo Details ==

------
SUDO
------

visudo
-----------------------------
tetra   ALL=(ALL)       ALL
vineet  ALL=(ALL)       ALL
pradeep ALL=(ALL)       ALL
sunil   ALL=(ALL)       ALL

## Sudo Log
##Details By Tetra
Defaults logfile=/var/log/sudo.log
------------------------------

remote root login disabled as follows.


vim /etc/ssh/sshd_config
------------------------------
chanage
#PermitRootLogin no
to
PermitRootLogin no
------------------------------

Then restart sshd service.

/etc/init.d/sshd restart


tail -f /var/log/sudo.log


== Truecrypt Encryption==


truecrypt
------------------
Truecrypt partition mounting at 10.10.10.28 LRS_Samba

open truecrypt interface select device "/dev/xvda3" 
click mount 
click "options >"
enter password(tc123), mount directory , and "mount options :" acl

or 

command line mount: 
truecrypt -p tc123 /dev/xvda3 /FTPDATA --fs-options=acl --protect-hidden=no --keyfiles= 2>/dev/null


command line unmount: 
truecrypt -d /FTPDATA/

==Linux Servers Users ==

--------------------------------
Linux Servers Users and Password
--------------------------------
The root user login on all linux servers is not allowed. To do some administrative work on linux, login with your given user name and use sudo before every admin command to run that command.
e.g.

sudo tail -f /var/log/qmail/qmail-send/current


The users are

tetra
vineet
pradeep
sunil
root - remote login disabled.
--------------------------------

Sophos AV linux client GUI user and pass for all linux clients
--------------------------------
url 
http://127.0.0.1:8081

User : sc
Pass : sc123
--------------------------------


Fedora DS console Login
--------------------------------
389-console
User : admin
Pass : ADMIN_rdm23
--------------------------------

Ossec Web GUI
--------------------------------
url 
http://10.10.10.17/ossec

User : admin
Pass : admin
--------------------------------


Nessus
--------------------------------
Installed on Anshu machine
url https://10.10.10.204:8834
User : admin
Pass : admin
--------------------------------

OSSIM
--------------------------------
http://10.10.10.18
User : admin
Pass : rdm_sys_0510
--------------------------------
--------
Web
--------
http service start/stop commands

/etc/init.d/httpd start
/etc/init.d/httpd stop
/etc/init.d/httpd restart
/etc/init.d/httpd status

html/website pages path
/var/www/website/

http log files are give below
tail -f /var/log/httpd/www.rdm.co.in-access_log
tail -f /var/log/httpd/www.rdm.co.in-error_log
tail -f /var/log/httpd/www.rdmfamily.in-error_log
tail -f /var/log/httpd/www.rdmfamily.in-access_log
tail -f /var/log/messages


==FTP==

--------
FTP
--------
ftp service start/stop commands

/etc/init.d/vsftpd start
/etc/init.d/vsftpd stop
/etc/init.d/vsftpd restart
/etc/init.d/vsftpd status

ftp log file
tail -f /var/log/messages

FTP users are
--------------------------------
User		home direcotry
--------------------------------
logistics	/var/www/website/rdmfamily/Routes
hr		/var/www/website/rdmfamily
admin		/var/www/website

to change ftp users password run below command
passwd logistics
passwd hr 
passwd admin



==Webmin==

--------------
Webmin is installed on all Linux servers


URL access
http://ip:10000

User : root
Pass : <rootpass>


==XEN Services==

------------------------------------------
XEN services/vm status/start/stop commands
------------------------------------------

To start and stop use below xen commands

/etc/init.d/xend status
/etc/init.d/xend start
/etc/init.d/xend stop
/etc/init.d/xend restart

/etc/init.d/xendomains status
/etc/init.d/xendomains start
/etc/init.d/xendomains stop
/etc/init.d/xendomains restart

below command will list running virtual machines.
xm list

below command will start the qmail from the command line.

xm create qmail 

below command will open virt-manager to see virtual machines.
virt-manager -- will open GUI