Shashanksharma: master ldap's entries sorted properly. no changes have been made in terms of commands/file edit.

2014-03-02T05:01:54Z

master ldap's entries sorted properly. no changes have been made in terms of commands/file edit.

← Older revision		Revision as of 05:01, 2 March 2014
Line 65:		Line 65:
	vim /etc/openldap/slapd.conf		vim /etc/openldap/slapd.conf
	-------------------------------------		-------------------------------------
	replica host=172.20.1.24:389		replica host=172.20.1.24:389
	binddn="cn=Manager,dc=rdm,dc=co,dc=in"		binddn="cn=Manager,dc=rdm,dc=co,dc=in"
	bindmethod=simple		bindmethod=simple
	credentials=rdmsecret4u001		credentials=rdmsecret4u001
	replogfile /var/lib/ldap/openldap-master-replog		replogfile /var/lib/ldap/openldap-master-replog
	-------------------------------------		-------------------------------------

Line 80:		Line 80:
	vim /etc/openldap/slapd.conf		vim /etc/openldap/slapd.conf
	-------------------------------------		-------------------------------------
	updatedn "cn=Manager,dc=rdm,dc=co,dc=in"		updatedn "cn=Manager,dc=rdm,dc=co,dc=in"
	updateref ldap://172.20.1.14		updateref ldap://172.20.1.14
	-------------------------------------		-------------------------------------
	nessus		nessus

Biswajit: /* =Webmin */

2013-01-02T03:57:00Z

=Webmin

← Older revision		Revision as of 03:57, 2 January 2013
Line 715:		Line 715:


	==Webmin=		==Webmin==

	--------------		--------------

Biswajit: Created page with "category:RDM =Contents= ==Deafault ACLs== ------------------------------- Default ACLs ------------------------------- To set defualt ACL, we have to set defualt permi..."

2013-01-02T03:55:31Z

Created page with "category:RDM =Contents= ==Deafault ACLs== ------------------------------- Default ACLs ------------------------------- To set defualt ACL, we have to set defualt permi..."

New page

[[category:RDM]]

=Contents=

==Deafault ACLs==
-------------------------------
Default ACLs
-------------------------------

To set defualt ACL, we have to set defualt permissions by below command.
Whenever a file will be created it's owner will be file creator and
permission will be as u:rwx,g:r-x,o:---

#setfacl --set u::rwx,g::r-x,o::--- test

below commands will set default acl to newly created files and directories.

#setfacl -m d:u:a0016:rwx test
#setfacl -m d:u:a0019:rwx test
#setfacl -m d:u:a0032:r-x test

But if these three users does not have a permissoin to access the test
dir, then please do set permission as given below
#setfacl -m u:a0016:rwx test
#setfacl -m u:a0019:rwx test
#setfacl -m u:a0032:r-x test

This will give default permission to a Group.
#setfacl -m d:g:RADLH:rw- testdir

==DNS==

---------
DNS
---------
services of the DNS

/etc/init.d/named start
/etc/init.d/named stop
/etc/init.d/named restart
/etc/init.d/named status

config file path
vim /var/named/chroot/etc/named.conf

zone files path
/var/named/chroot/var/named/

dns log file
tail -f /var/log/messages

==OpenLDAP master/master replication==
---------------------------------
OpenLDAP master/master replication
---------------------------------
master 172.20.1.14
slave 172.20.1.24
binddn="cn=manager,dc=rdm,dc=co,dc=in"

on master

vim /etc/openldap/slapd.conf
-------------------------------------
replica host=172.20.1.24:389
binddn="cn=Manager,dc=rdm,dc=co,dc=in"
bindmethod=simple
credentials=rdmsecret4u001
replogfile /var/lib/ldap/openldap-master-replog
-------------------------------------

touch /var/lib/ldap/ldaprep.log
chown ldap.ldap /var/lib/ldap/ldaprep.log
above file should be writable by ldap, whatever chages are made to ldap are written to this file and when they are reflicated to slave they were be deleted from the file.

on slave

vim /etc/openldap/slapd.conf
-------------------------------------
updatedn "cn=Manager,dc=rdm,dc=co,dc=in"
updateref ldap://172.20.1.14
-------------------------------------
nessus

install
add user
registor
download plugin
start if not
then start services directly.

==NTP Server==

---------
NTP Server
---------
NTP services
/etc/init.d/ntpd status
/etc/init.d/ntpd stop
/etc/init.d/ntpd restart
/etc/init.d/ntpd status

---------
NTP Client
---------
below two commands can be used on linux ntp clients to see the status and query to NTP server

ntpdc -p
ntpdc -l

==ossec agent linux==

----------------------
ossec agent linux
----------------------
below command will be used to add/remove new ossec agents.
/var/ossec/bin/manage_agents

below commands can be used to start/stop the ossec agent

/var/ossec/bin/ossec-control start
/var/ossec/bin/ossec-control stop
/var/ossec/bin/ossec-control restart
/var/ossec/bin/ossec-control status

ossec logs can be check by below command.
tail -f /var/ossec/logs/ossec.log

ossec configuration file is
/var/ossec/etc/ossec.conf

----------------------
ossec agent windows
----------------------
The ossec agent interface on windows can be started via start->program-> ossec->manage agent

From this interface you can check the logs and config file.

==OSSEC Server==

-----------------
OSSEC Server
-----------------
Use below commands start/stop the ossec services

/var/ossec/bin/ossec-control status
/var/ossec/bin/ossec-control stop
/var/ossec/bin/ossec-control restart
/var/ossec/bin/ossec-control status

ossec services log
tail -f /var/ossec/logs/ossec.log

ossec alerts log
tail -f /var/ossec/logs/alerts/alerts.log

ossec configuration file is
/var/ossec/etc/ossec.conf

rootcheck/rootkit logs can be found at the below path
/var/ossec/queue/rootcheck/

syscheck/integrity logs can be found at the below path
/var/ossec/queue/syscheck/

Starting Second OSSEC server
---------------------------
when first ossec is not working then follows below process to up Second ossec server
login to 10.10.10.27 and change ip to 10.10.10.17(down first machine) and start ossec service

OSSIM
-------------
http://10.10.10.18/ossim/index.php
User : admin
Pass :

==Openldap Password Policy on 172.20.1.24==

--------------------------
Openldap Password Policy on 172.20.1.24
--------------------------

Password Policy is defined on the 172.20.1.24 server. Every day it will generate the email alerts for the locked and expired email accounts.
The attributes of this policy is as follows

pwdMinAge: 1 minute
pwdMaxAge: 45 days
pwdMinLength: 7
pwdExpireWarning: 40 days
pwdGraceAuthNLimit: 3
pwdLockoutDuration: 10 minute
pwdMaxFailure: 5

The policy can be change by http://172.20.1.24/phpldapadmin/htdocs/index.php and select "cn=Standard,ou=Policies,dc=rdm,dc=co,dc=in" and do the required change e.g.

pwdExpireWarning, pwdGraceAuthNLimit, pwdLockoutDuration, pwdMinAge etc.

--------------------------
Openldap Password Policy on 172.20.1.24
--------------------------

yum install openldap-servers-overlays

vi /etc/openldap/slapd.conf
---------------------------
add below lines

include /etc/ldap/schema/ppolicy.schema

moduleload ppolicy

overlay ppolicy
ppolicy_default "cn=Standard,ou=Policies,dc=rdm,dc=co,dc=in"
ppolicy_use_lockout
ppolicy_hash_cleartext

---------------------------

vi ppolicy.ldif
---------------------------
dn: ou=Policies,dc=rdm,dc=co,dc=in
ou: Policies
description: Directory policies.
objectclass: organizationalUnit

dn: cn=Standard,ou=Policies,dc=rdm,dc=co,dc=in
cn: Standard
description: Standard password policy.
pwdAttribute: 2.5.4.35
pwdMinAge: 60
# 30 days: 60 sec * 60 min * 24 hr * 30 days
pwdMaxAge: 2592000
pwdCheckQuality: 1
pwdMinLength: 7
# Warn three days in advance
pwdExpireWarning: 2160000
pwdGraceAuthNLimit: 3
pwdLockout: TRUE
pwdLockoutDuration: 1200
pwdMaxFailure: 5
pwdFailureCountInterval: 1200
pwdMustChange: TRUE
pwdAllowUserChange: TRUE
pwdSafeModify: TRUE
objectclass: device
objectclass: pwdPolicy
---------------------------

ldapadd -acvx -D"cn=manager,dc=rdm,dc=co,dc=in" -w rdmsecret4u001 -f ppolicy.ldif

/etc/init.d/ldap restart

Email Alert Scripting
----------------------

vim /root/ppolicy/ppolicy.sh
----------------------
#!/bin/sh
#search qmail users
ldapsearch -x '(&(objectclass=qmailUser))' uid|grep uid:|tr -d ' '|cut -d: -f2 > /root/ppolicy/email_users
#turncat user_expire and locked_user files.
echo > /root/ppolicy/user_expire
echo > /root/ppolicy/locked_user
#search for account expired users
for i in `cat /root/ppolicy/email_users`
do
ldapsearch -x "(&(objectclass=qmailUser)(uid=$i)(pwdChangedTime<=`date '+%Y%m%d%k%M%SZ' -d "30 days ago"`))" uid|grep uid: |tr -d ' ' |cut -d: -f2 >> /root/ppolicy/user_expire
#search for account locked users
locked=`ldapsearch -x "(&(objectclass=qmailUser)(uid=$i))" pwdGraceUseTime -LL |grep -c pwdGraceUseTime`
if [ "$locked" == "3" ]
then
echo $i >> /root/ppolicy/locked_user
fi
done
#generate alerts
sh /root/ppolicy/expireAlert.sh
----------------------

vim /root/ppolicy/expireAlert.sh
----------------------
#!/bin/sh
#send email password expiration alert to user and edp
for i in `cat /root/ppolicy/user_expire`
do
cat /root/ppolicy/expiremsg |mail -s "Password Expiration Notice" $i@rdm.co.in
done
#send email to edp about locked users
cat /root/ppolicy/locked_user | mail -s "Email Account Locked Users " edp@rdm.co.in
----------------------

==NFS Details==

----------
NFS
----------
below command can be used to start/stop NFS service

/etc/init.d/nfs start
/etc/init.d/nfs stop
/etc/init.d/nfs restart
/etc/init.d/nfs status

==Qmail Details ==
-----------
Qmail
-----------
There are two qmail instance.
First instance sends(local) and receive all mails.
Second instance sends non-local mails

qmailctl stat

vi /etc/inittab ;init q
--------------------------------------
#SV:123456:respawn:/command/svscanboot

comment will stop qmail
and uncoment will start the qmail server

SV:123456:respawn:/command/svscanboot
--------------------------------------

below commands can be used to see the current logs.

tail -f /var/log/qmail/qmail-send/current |tai64nlocal
tail -f /var/log/qmail/qmail-smtp/current |tai64nlocal
tail -f /var/log/qmail/qmail-pop3d/current |tai64nlocal

tail -f /var/log/qmail2/qmail2-send/current |tai64nlocal
tail -f /var/log/qmail2/qmail2-smtp/current |tai64nlocal

tail -f /var/log/maillog

below log file is of scanner logs
tail -f /var/spool/qmailscan/qmail-queue.log

commands to strat and stop spamassassin.

/etc/init.d/spamassassin status
/etc/init.d/spamassassin stop
/etc/init.d/spamassassin restart

to start imap service
/etc/init.d/imap start

to start imapproxy
/usr/local/sbin/in.imapproxyd

to start clam Anti Virus servie
/usr/local/sbin/clamd

There are two nfs mounting. First qmailnfs and second is sophosAV

below command will mount the NFS from 10.10.10.16 in /home/vmail
mount -t nfs -o tcp,rsize=32768,wsize=32768 10.10.10.16:/home/vmail /home/vmail/

The mounting parameter for sophos is configured into /etc/fstab.
to mount sophos below command can be used.
mount -a

below commands are for ldap server
/etc/init.d/ldap status
/etc/init.d/ldap stop
/etc/init.d/ldap restart
/etc/init.d/ldap status

==Other Details==

rsync_ossec
----------------
15 * * * * rsync -auvrl --delete /var/ossec rsync://10.10.10.27/OSSEC

above cron job runs on every hour at 15 Minutes

backup from 10.10.10.17:/var/ossec 10.10.10.27:/var/ossec

rsync_qmailnfs

0 2 * * * /root/rsync_qmailnfs.sh
above cron job take mail backup

backup from 10.10.10.16:/home/vmail to 10.10.10.26:/home/vmail
rsync_sambanfs
----------------
0 * * * * /root/rsync_sambanfs.sh
above cron job run on starting of every hour and take backup

backup is from 10.10.10.15:/data to 10.10.10.25:/data

rsync_update_backup
---------------------
30 * * * * /root/rsync_update_backup.sh
above cron job runs on every hour at 30 Minutes

backup from /data to /backup_update_only

You have to delete old /backup_update_only weekly or monthly
----------
NFS
----------
below command can be used to start/stop NFS service
/etc/init.d/nfs start
/etc/init.d/nfs stop
/etc/init.d/nfs restart
/etc/init.d/nfs status

use below command to open truecrypt GUI panel
truecrypt

cronjob -l
-------------------------
0 * * * * /root/rsync_sambanfs.sh
-------------------------
This cron job take backup from new SambaNFS to old SambaNFS every hour.

==Samba==

--------------
Samba
--------------
audit logs can be see by below command
tail -f /var/log/samba/audit.log

All other logs will be into below directory
cd /var/log/samba/

samba start/stop commands.
/etc/init.d/smb status
/etc/init.d/smb stop
/etc/init.d/smb restart
/etc/init.d/smb status

There are two nfs mounting. First sambanfs and second is sophosAV

below command will mount the NFS from 10.10.10.15 in /home and /data
mount -t nfs -o rsize=32768,wsize=32768,timeo=15,tcp 10.10.10.15:/data /data
mount -t nfs -o rsize=32768,wsize=32768,timeo=15,tcp 10.10.10.15:/home /home

The mounting parameter for sophos is configured into /etc/fstab.
to mount sophos below command can be used.
mount -a

below commands are for fedora directory server
/etc/init.d/dirsrv status
/etc/init.d/dirsrv stop
/etc/init.d/dirsrv restart
/etc/init.d/dirsrv status

below commands are for fedora directory server admin console
/etc/init.d/dirsrv-admin status
/etc/init.d/dirsrv-admin stop
/etc/init.d/dirsrv-admin restart
/etc/init.d/dirsrv-admin status

ldapsearch -x
will show all the users including their attributes

below command will start the fedora DS admin console.
389-console

Second samba 10.10.10.24 starting process
----------------------------------------
down first samba 10.10.10.14 (dns1) and login to second samba(dns2) 10.10.10.24 (aditional ip)(the second samba should be up for Fedora DS replication, it's Fedora DS is read only, no changes directly on it will work)

run below commands on second samba 10.10.10.24
ifup eth0
ifup eth0:0
ifup eth0:1
ifup eth0:2
ifup eth0:3
ifup eth0:4
ifup eth0:5
service smb start

above service and ip will be up temporerly, when this machine will reboot this has to do again.
------------------------------------------

LRS Samba
------------------------------------------
10.10.10.28
57.56.131.200
samba pdc with ldap

below commands are for ldap server
/etc/init.d/ldap status
/etc/init.d/ldap stop
/etc/init.d/ldap restart
/etc/init.d/ldap status

All other logs will be into below directory
cd /var/log/samba/

samba start/stop commands.
/etc/init.d/smb status
/etc/init.d/smb stop
/etc/init.d/smb restart
/etc/init.d/smb status

==Sophos Anti Virus ==

------------------------------------------
Sophos AV
----------
start/stop commands.

/etc/init.d/sav-protect start/stop/restart/status
/etc/init.d/sav-rms start/stop/restart/status
/etc/init.d/sav-web start/stop/restart/status

WEB GUI url

http://127.0.0.1:8081
User : sc
Pass : sc123

Sophos installation path

/opt/sophos-av/

== Sudo Details ==

------
SUDO
------

visudo
-----------------------------
tetra ALL=(ALL) ALL
vineet ALL=(ALL) ALL
pradeep ALL=(ALL) ALL
sunil ALL=(ALL) ALL

## Sudo Log
##Details By Tetra
Defaults logfile=/var/log/sudo.log
------------------------------

remote root login disabled as follows.

vim /etc/ssh/sshd_config
------------------------------
chanage
#PermitRootLogin no
to
PermitRootLogin no
------------------------------

Then restart sshd service.

/etc/init.d/sshd restart

tail -f /var/log/sudo.log

== Truecrypt Encryption==

truecrypt
------------------
Truecrypt partition mounting at 10.10.10.28 LRS_Samba

open truecrypt interface select device "/dev/xvda3"
click mount
click "options >"
enter password(tc123), mount directory , and "mount options :" acl

or

command line mount:
truecrypt -p tc123 /dev/xvda3 /FTPDATA --fs-options=acl --protect-hidden=no --keyfiles= 2>/dev/null

command line unmount:
truecrypt -d /FTPDATA/

==Linux Servers Users ==

--------------------------------
Linux Servers Users and Password
--------------------------------
The root user login on all linux servers is not allowed. To do some administrative work on linux, login with your given user name and use sudo before every admin command to run that command.
e.g.

sudo tail -f /var/log/qmail/qmail-send/current

The users are

tetra
vineet
pradeep
sunil
root - remote login disabled.
--------------------------------

Sophos AV linux client GUI user and pass for all linux clients
--------------------------------
url
http://127.0.0.1:8081

User : sc
Pass : sc123
--------------------------------

Fedora DS console Login
--------------------------------
389-console
User : admin
Pass : ADMIN_rdm23
--------------------------------

Ossec Web GUI
--------------------------------
url
http://10.10.10.17/ossec

User : admin
Pass : admin
--------------------------------

Nessus
--------------------------------
Installed on Anshu machine
url https://10.10.10.204:8834
User : admin
Pass : admin
--------------------------------

OSSIM
--------------------------------
http://10.10.10.18
User : admin
Pass : rdm_sys_0510
--------------------------------
--------
Web
--------
http service start/stop commands

/etc/init.d/httpd start
/etc/init.d/httpd stop
/etc/init.d/httpd restart
/etc/init.d/httpd status

html/website pages path
/var/www/website/

http log files are give below
tail -f /var/log/httpd/www.rdm.co.in-access_log
tail -f /var/log/httpd/www.rdm.co.in-error_log
tail -f /var/log/httpd/www.rdmfamily.in-error_log
tail -f /var/log/httpd/www.rdmfamily.in-access_log
tail -f /var/log/messages

==FTP==

--------
FTP
--------
ftp service start/stop commands

/etc/init.d/vsftpd start
/etc/init.d/vsftpd stop
/etc/init.d/vsftpd restart
/etc/init.d/vsftpd status

ftp log file
tail -f /var/log/messages

FTP users are
--------------------------------
User home direcotry
--------------------------------
logistics /var/www/website/rdmfamily/Routes
hr /var/www/website/rdmfamily
admin /var/www/website

to change ftp users password run below command
passwd logistics
passwd hr
passwd admin

==Webmin=

--------------
Webmin is installed on all Linux servers

URL access
http://ip:10000

User : root
Pass : <rootpass>

==XEN Services==

------------------------------------------
XEN services/vm status/start/stop commands
------------------------------------------

To start and stop use below xen commands

/etc/init.d/xend status
/etc/init.d/xend start
/etc/init.d/xend stop
/etc/init.d/xend restart

/etc/init.d/xendomains status
/etc/init.d/xendomains start
/etc/init.d/xendomains stop
/etc/init.d/xendomains restart

below command will list running virtual machines.
xm list

below command will start the qmail from the command line.

xm create qmail

below command will open virt-manager to see virtual machines.
virt-manager -- will open GUI

RDM Implementation Details in a Single html - Revision history

Shashanksharma: master ldap's entries sorted properly. no changes have been made in terms of commands/file edit.

Biswajit: /* =Webmin */

Biswajit: Created page with "category:RDM =Contents= ==Deafault ACLs== ------------------------------- Default ACLs ------------------------------- To set defualt ACL, we have to set defualt permi..."