Jump to content

RDM Implementation Details in a Single html

From TetraWiki


Contents[edit]

Deafault ACLs[edit]

Default ACLs

To set defualt ACL, we have to set defualt permissions by below command. Whenever a file will be created it's owner will be file creator and permission will be as u:rwx,g:r-x,o:---

  1. setfacl --set u::rwx,g::r-x,o::--- test

below commands will set default acl to newly created files and directories.

  1. setfacl -m d:u:a0016:rwx test
  2. setfacl -m d:u:a0019:rwx test
  3. setfacl -m d:u:a0032:r-x test

But if these three users does not have a permissoin to access the test dir, then please do set permission as given below

  1. setfacl -m u:a0016:rwx test
  2. setfacl -m u:a0019:rwx test
  3. setfacl -m u:a0032:r-x test

This will give default permission to a Group.

  1. setfacl -m d:g:RADLH:rw- testdir

DNS[edit]

DNS

services of the DNS

/etc/init.d/named start /etc/init.d/named stop /etc/init.d/named restart /etc/init.d/named status

config file path vim /var/named/chroot/etc/named.conf

zone files path /var/named/chroot/var/named/

dns log file tail -f /var/log/messages


OpenLDAP master/master replication[edit]

OpenLDAP master/master replication

master 172.20.1.14 slave 172.20.1.24 binddn="cn=manager,dc=rdm,dc=co,dc=in"


on master

vim /etc/openldap/slapd.conf 

       replica host=172.20.1.24:389
       binddn="cn=Manager,dc=rdm,dc=co,dc=in"
       bindmethod=simple
       credentials=rdmsecret4u001
       replogfile /var/lib/ldap/openldap-master-replog

touch /var/lib/ldap/ldaprep.log chown ldap.ldap /var/lib/ldap/ldaprep.log above file should be writable by ldap, whatever chages are made to ldap are written to this file and when they are reflicated to slave they were be deleted from the file.

on slave

vim /etc/openldap/slapd.conf 

       updatedn "cn=Manager,dc=rdm,dc=co,dc=in"
       updateref ldap://172.20.1.14

nessus

install add user registor download plugin start if not then start services directly.


NTP Server[edit]

NTP Server

NTP services /etc/init.d/ntpd status /etc/init.d/ntpd stop /etc/init.d/ntpd restart /etc/init.d/ntpd status

NTP Client

below two commands can be used on linux ntp clients to see the status and query to NTP server

ntpdc -p ntpdc -l

ossec agent linux[edit]

ossec agent linux

below command will be used to add/remove new ossec agents. /var/ossec/bin/manage_agents

below commands can be used to start/stop the ossec agent

/var/ossec/bin/ossec-control start /var/ossec/bin/ossec-control stop /var/ossec/bin/ossec-control restart /var/ossec/bin/ossec-control status

ossec logs can be check by below command. tail -f /var/ossec/logs/ossec.log

ossec configuration file is /var/ossec/etc/ossec.conf

ossec agent windows

The ossec agent interface on windows can be started via start->program-> ossec->manage agent

From this interface you can check the logs and config file.


OSSEC Server[edit]

OSSEC Server

Use below commands start/stop the ossec services

/var/ossec/bin/ossec-control status /var/ossec/bin/ossec-control stop /var/ossec/bin/ossec-control restart /var/ossec/bin/ossec-control status

ossec services log tail -f /var/ossec/logs/ossec.log

ossec alerts log tail -f /var/ossec/logs/alerts/alerts.log

ossec configuration file is /var/ossec/etc/ossec.conf

rootcheck/rootkit logs can be found at the below path /var/ossec/queue/rootcheck/

syscheck/integrity logs can be found at the below path /var/ossec/queue/syscheck/

Starting Second OSSEC server

when first ossec is not working then follows below process to up Second ossec server login to 10.10.10.27 and change ip to 10.10.10.17(down first machine) and start ossec service


OSSIM

http://10.10.10.18/ossim/index.php User : admin Pass :


Openldap Password Policy on 172.20.1.24[edit]

Openldap Password Policy on 172.20.1.24

Password Policy is defined on the 172.20.1.24 server. Every day it will generate the email alerts for the locked and expired email accounts. The attributes of this policy is as follows

pwdMinAge: 1 minute pwdMaxAge: 45 days pwdMinLength: 7 pwdExpireWarning: 40 days pwdGraceAuthNLimit: 3 pwdLockoutDuration: 10 minute pwdMaxFailure: 5


The policy can be change by http://172.20.1.24/phpldapadmin/htdocs/index.php and select "cn=Standard,ou=Policies,dc=rdm,dc=co,dc=in" and do the required change e.g.

pwdExpireWarning, pwdGraceAuthNLimit, pwdLockoutDuration, pwdMinAge etc.

Openldap Password Policy on 172.20.1.24

yum install openldap-servers-overlays


vi /etc/openldap/slapd.conf

add below lines

include /etc/ldap/schema/ppolicy.schema

moduleload ppolicy


overlay ppolicy ppolicy_default "cn=Standard,ou=Policies,dc=rdm,dc=co,dc=in" ppolicy_use_lockout ppolicy_hash_cleartext


vi ppolicy.ldif

dn: ou=Policies,dc=rdm,dc=co,dc=in ou: Policies description: Directory policies. objectclass: organizationalUnit

dn: cn=Standard,ou=Policies,dc=rdm,dc=co,dc=in cn: Standard description: Standard password policy. pwdAttribute: 2.5.4.35 pwdMinAge: 60

  1. 30 days: 60 sec * 60 min * 24 hr * 30 days

pwdMaxAge: 2592000 pwdCheckQuality: 1 pwdMinLength: 7

  1. Warn three days in advance

pwdExpireWarning: 2160000 pwdGraceAuthNLimit: 3 pwdLockout: TRUE pwdLockoutDuration: 1200 pwdMaxFailure: 5 pwdFailureCountInterval: 1200 pwdMustChange: TRUE pwdAllowUserChange: TRUE pwdSafeModify: TRUE objectclass: device objectclass: pwdPolicy

ldapadd -acvx -D"cn=manager,dc=rdm,dc=co,dc=in" -w rdmsecret4u001 -f ppolicy.ldif

/etc/init.d/ldap restart


Email Alert Scripting

vim /root/ppolicy/ppolicy.sh

  1. !/bin/sh
  2. search qmail users

ldapsearch -x '(&(objectclass=qmailUser))' uid|grep uid:|tr -d ' '|cut -d: -f2 > /root/ppolicy/email_users

  1. turncat user_expire and locked_user files.

echo > /root/ppolicy/user_expire echo > /root/ppolicy/locked_user

  1. search for account expired users

for i in `cat /root/ppolicy/email_users` do ldapsearch -x "(&(objectclass=qmailUser)(uid=$i)(pwdChangedTime<=`date '+%Y%m%d%k%M%SZ' -d "30 days ago"`))" uid|grep uid: |tr -d ' ' |cut -d: -f2 >> /root/ppolicy/user_expire

  1. search for account locked users

locked=`ldapsearch -x "(&(objectclass=qmailUser)(uid=$i))" pwdGraceUseTime -LL |grep -c pwdGraceUseTime` if [ "$locked" == "3" ] then echo $i >> /root/ppolicy/locked_user fi done

  1. generate alerts

sh /root/ppolicy/expireAlert.sh

vim /root/ppolicy/expireAlert.sh

  1. !/bin/sh
  2. send email password expiration alert to user and edp

for i in `cat /root/ppolicy/user_expire` do cat /root/ppolicy/expiremsg |mail -s "Password Expiration Notice" $i@rdm.co.in done

  1. send email to edp about locked users

cat /root/ppolicy/locked_user | mail -s "Email Account Locked Users " edp@rdm.co.in


NFS Details[edit]

NFS

below command can be used to start/stop NFS service

/etc/init.d/nfs start /etc/init.d/nfs stop /etc/init.d/nfs restart /etc/init.d/nfs status


Qmail Details[edit]

Qmail

There are two qmail instance. First instance sends(local) and receive all mails. Second instance sends non-local mails

qmailctl stat

vi /etc/inittab ;init q

  1. SV:123456:respawn:/command/svscanboot

comment will stop qmail and uncoment will start the qmail server

SV:123456:respawn:/command/svscanboot

below commands can be used to see the current logs.

tail -f /var/log/qmail/qmail-send/current |tai64nlocal tail -f /var/log/qmail/qmail-smtp/current |tai64nlocal tail -f /var/log/qmail/qmail-pop3d/current |tai64nlocal

tail -f /var/log/qmail2/qmail2-send/current |tai64nlocal tail -f /var/log/qmail2/qmail2-smtp/current |tai64nlocal

tail -f /var/log/maillog

below log file is of scanner logs tail -f /var/spool/qmailscan/qmail-queue.log

commands to strat and stop spamassassin.

/etc/init.d/spamassassin status /etc/init.d/spamassassin stop /etc/init.d/spamassassin restart

to start imap service /etc/init.d/imap start

to start imapproxy /usr/local/sbin/in.imapproxyd

to start clam Anti Virus servie /usr/local/sbin/clamd


There are two nfs mounting. First qmailnfs and second is sophosAV

below command will mount the NFS from 10.10.10.16 in /home/vmail mount -t nfs -o tcp,rsize=32768,wsize=32768 10.10.10.16:/home/vmail /home/vmail/

The mounting parameter for sophos is configured into /etc/fstab. to mount sophos below command can be used. mount -a


below commands are for ldap server /etc/init.d/ldap status /etc/init.d/ldap stop /etc/init.d/ldap restart /etc/init.d/ldap status


Other Details[edit]

rsync_ossec

15 * * * * rsync -auvrl --delete /var/ossec rsync://10.10.10.27/OSSEC

above cron job runs on every hour at 15 Minutes

backup from 10.10.10.17:/var/ossec 10.10.10.27:/var/ossec


rsync_qmailnfs

0 2 * * * /root/rsync_qmailnfs.sh above cron job take mail backup

backup from 10.10.10.16:/home/vmail to 10.10.10.26:/home/vmail rsync_sambanfs

0 * * * * /root/rsync_sambanfs.sh above cron job run on starting of every hour and take backup

backup is from 10.10.10.15:/data to 10.10.10.25:/data


rsync_update_backup

30 * * * * /root/rsync_update_backup.sh above cron job runs on every hour at 30 Minutes

backup from /data to /backup_update_only

You have to delete old /backup_update_only weekly or monthly

NFS

below command can be used to start/stop NFS service /etc/init.d/nfs start /etc/init.d/nfs stop /etc/init.d/nfs restart /etc/init.d/nfs status

use below command to open truecrypt GUI panel truecrypt

cronjob -l

0 * * * * /root/rsync_sambanfs.sh

This cron job take backup from new SambaNFS to old SambaNFS every hour.


Samba[edit]

Samba

audit logs can be see by below command tail -f /var/log/samba/audit.log

All other logs will be into below directory cd /var/log/samba/

samba start/stop commands. /etc/init.d/smb status /etc/init.d/smb stop /etc/init.d/smb restart /etc/init.d/smb status


There are two nfs mounting. First sambanfs and second is sophosAV

below command will mount the NFS from 10.10.10.15 in /home and /data mount -t nfs -o rsize=32768,wsize=32768,timeo=15,tcp 10.10.10.15:/data /data mount -t nfs -o rsize=32768,wsize=32768,timeo=15,tcp 10.10.10.15:/home /home

The mounting parameter for sophos is configured into /etc/fstab. to mount sophos below command can be used. mount -a


below commands are for fedora directory server /etc/init.d/dirsrv status /etc/init.d/dirsrv stop /etc/init.d/dirsrv restart /etc/init.d/dirsrv status

below commands are for fedora directory server admin console /etc/init.d/dirsrv-admin status /etc/init.d/dirsrv-admin stop /etc/init.d/dirsrv-admin restart /etc/init.d/dirsrv-admin status

ldapsearch -x will show all the users including their attributes

below command will start the fedora DS admin console. 389-console


Second samba 10.10.10.24 starting process

down first samba 10.10.10.14 (dns1) and login to second samba(dns2) 10.10.10.24 (aditional ip)(the second samba should be up for Fedora DS replication, it's Fedora DS is read only, no changes directly on it will work)

run below commands on second samba 10.10.10.24 ifup eth0 ifup eth0:0 ifup eth0:1 ifup eth0:2 ifup eth0:3 ifup eth0:4 ifup eth0:5 service smb start

above service and ip will be up temporerly, when this machine will reboot this has to do again.

LRS Samba

10.10.10.28 57.56.131.200 samba pdc with ldap


below commands are for ldap server /etc/init.d/ldap status /etc/init.d/ldap stop /etc/init.d/ldap restart /etc/init.d/ldap status


All other logs will be into below directory cd /var/log/samba/

samba start/stop commands. /etc/init.d/smb status /etc/init.d/smb stop /etc/init.d/smb restart /etc/init.d/smb status

Sophos Anti Virus[edit]

Sophos AV

start/stop commands.

/etc/init.d/sav-protect start/stop/restart/status /etc/init.d/sav-rms start/stop/restart/status /etc/init.d/sav-web start/stop/restart/status

WEB GUI url

http://127.0.0.1:8081 User : sc Pass : sc123

Sophos installation path

/opt/sophos-av/


Sudo Details[edit]

SUDO

visudo

tetra ALL=(ALL) ALL vineet ALL=(ALL) ALL pradeep ALL=(ALL) ALL sunil ALL=(ALL) ALL

    1. Sudo Log
    2. Details By Tetra

Defaults logfile=/var/log/sudo.log

remote root login disabled as follows.


vim /etc/ssh/sshd_config

chanage

  1. PermitRootLogin no

to PermitRootLogin no

Then restart sshd service.

/etc/init.d/sshd restart


tail -f /var/log/sudo.log


Truecrypt Encryption[edit]

truecrypt

Truecrypt partition mounting at 10.10.10.28 LRS_Samba

open truecrypt interface select device "/dev/xvda3" click mount click "options >" enter password(tc123), mount directory , and "mount options :" acl

or

command line mount: truecrypt -p tc123 /dev/xvda3 /FTPDATA --fs-options=acl --protect-hidden=no --keyfiles= 2>/dev/null


command line unmount: truecrypt -d /FTPDATA/

Linux Servers Users[edit]

Linux Servers Users and Password

The root user login on all linux servers is not allowed. To do some administrative work on linux, login with your given user name and use sudo before every admin command to run that command. e.g.

sudo tail -f /var/log/qmail/qmail-send/current


The users are

tetra vineet pradeep sunil root - remote login disabled.

Sophos AV linux client GUI user and pass for all linux clients

url http://127.0.0.1:8081

User : sc Pass : sc123


Fedora DS console Login

389-console User : admin Pass : ADMIN_rdm23

Ossec Web GUI

url http://10.10.10.17/ossec

User : admin Pass : admin


Nessus

Installed on Anshu machine url https://10.10.10.204:8834 User : admin Pass : admin

OSSIM

http://10.10.10.18 User : admin Pass : rdm_sys_0510

Web

http service start/stop commands

/etc/init.d/httpd start /etc/init.d/httpd stop /etc/init.d/httpd restart /etc/init.d/httpd status

html/website pages path /var/www/website/

http log files are give below tail -f /var/log/httpd/www.rdm.co.in-access_log tail -f /var/log/httpd/www.rdm.co.in-error_log tail -f /var/log/httpd/www.rdmfamily.in-error_log tail -f /var/log/httpd/www.rdmfamily.in-access_log tail -f /var/log/messages


FTP[edit]

FTP

ftp service start/stop commands

/etc/init.d/vsftpd start /etc/init.d/vsftpd stop /etc/init.d/vsftpd restart /etc/init.d/vsftpd status

ftp log file tail -f /var/log/messages

FTP users are

User home direcotry

logistics /var/www/website/rdmfamily/Routes hr /var/www/website/rdmfamily admin /var/www/website

to change ftp users password run below command passwd logistics passwd hr passwd admin


Webmin[edit]

Webmin is installed on all Linux servers


URL access http://ip:10000

User : root Pass : <rootpass>


XEN Services[edit]

XEN services/vm status/start/stop commands

To start and stop use below xen commands

/etc/init.d/xend status /etc/init.d/xend start /etc/init.d/xend stop /etc/init.d/xend restart

/etc/init.d/xendomains status /etc/init.d/xendomains start /etc/init.d/xendomains stop /etc/init.d/xendomains restart

below command will list running virtual machines. xm list

below command will start the qmail from the command line.

xm create qmail

below command will open virt-manager to see virtual machines. virt-manager -- will open GUI

Retrieved from "https://wiki.tetrain.com/index.php?title=RDM_Implementation_Details_in_a_Single_html&oldid=1577"