Linux Services Sirak Kaewjamnong Linux DHCP Server DHCP

Linux Services Sirak Kaewjamnong

Linux DHCP Server DHCP is an IP address dynamically assigned from DHCP server. ¡ PC client will most likely get its IP address at boot time from the home router instead ¡ The DHCP server RPM's filename usually starts with the word dhcp followed by a version number ¡ l dhcp-3. 0. 1 rc 14 -1. i 386. rpm. 2

The /etc/dhcpd. conf File ¡ ¡ When DHCP starts, it reads the file /etc/dhcpd. conf. The standard DHCP RPM package doesn't automatically install a /etc/dhcpd. conf file, but a sample copy of dhcpd. conf is in the following directory l /usr/share/doc/dhcp-<version-number>/dhcpd. conf. sample 3

/etc/dhcpd. conf example file ddns-update-style interim; ignore client-updates; subnet 172. 27. 21. 0 netmask 255. 0 { # --- default gateway option routers option subnet-mask option option # 172. 27. 21. 254; 255. 0; nis-domain "cp. su. ac. th"; domain-name-servers 202. 28. 72. 66; domain-name-servers 202. 44. 135. 9; time-offset -18000; # Eastern Standard Time option netbios-node-type 2; range dynamic-bootp 172. 27. 21. 200 172. 27. 21. 250; default-lease-time 21600; max-lease-time 43200; } } 4

How to get DHCP started ¡ Use the chkconfig command to get DHCP configured to start at boot: [root@bigboy tmp]# chkconfig dhcpd on ¡ Use the service command to instruct the /etc/init. d/dhcpd script to start/stop/restart DHCP after booting ]root@bigboy tmp]# service dhcpd start [root@bigboy tmp]# service dhcpd stop [root@bigboy tmp]# service dhcpd restart 5

SAMBA ¡ Samba is a suite of utilities that allows your Linux server to share files and other resources, such as printers, with Windows clients. 6

Get SMB started ¡ Configure Samba to start at boot time using the chkconfig command: [root@bigboy tmp]# chkconfig smb on ¡ Start/stop/restart Samba after boot time using the smb initialization script as in the examples below: [root@bigboy tmp]# service smb start [root@bigboy tmp]# service smb stop [root@bigboy tmp]# service smb restart ¡ Note: Unlike many Linux packages, Samba does not need to be restarted after changes have been made to its configuration file, as it is read after the receipt of every client request. 7

The Samba Configuration File The /etc/samba/smb. conf file is the main configuration Section ]global[ ]printers[ Description General Samba configuration parameters Used for configuring printers ]homes[ Defines treatment of user logins ]netlogon[ A share for storing logon scripts. )Not created by default(. ]profile[ A share for storing domain logon information such as "favorites" and desktop icons. )Not created by default(. 8

Samba's SWAT web interface ¡ ¡ SWAT, Samba's web based configuration tool to enables smb. conf file without needing to remember all the formatting. Each SWAT screen is actually a form that covers a separate section of the smb. conf file into which admin fill in the desired parameters, each parameter box has its own online help 9

Samba SWAT Main Menu 10

Basic SWAT Setup ¡ ¡ Root must always remember that SWAT edits the smb. conf file but also strips out any comments that may have manually entered into it beforehand. The original Samba smb. conf file has many worthwhile comments in it, you should save a copy as a reference before proceeding with SWAT. l For example, you could save the original file with the name /etc/samba/smb. conf. original ]root@tmp]# cp /etc/samba/smb. conf. original 11

Basic SWAT Setup ¡ The enabling and disabling, starting and stopping of SWAT is controlled by xinetd via a configuration file named /etc/xinetd. d/swat service swat { port = 901 socket_type = stream protocol = tcp wait = no user = root server = /usr/sbin/swat log_on_failure += USERID disable = no only_from = localhost } 12

Basic SWAT Setup ¡ ¡ The disable parameter must be set to no to accept connections. This can automatically be switched between yes and no. The default configuration only allows SWAT web access from the VGA console only as user root on port 901 with the Linux root password. l ¡ This means root have to enter "http: //127. 0. 0. 1: 901" in browser to get the login screen. root can make SWAT accessible from other servers by adding IP address entries to the only_from parameter of the SWAT configuration file. l An example of an entry to allow connections only from 192. 168. 1. 3 and localhost. only_from = localhost 192. 168. 1. 3 13

Controlling SWAT ¡ ¡ ¡ Same as all xinetd-controlled applications, the chkconfig command automatically modifies the disable field accordingly in the configuration file and activates the change. Before SWAT can be used, the xinetd program which controls it must be activated in advance. You can start/stop/restart xinetd after boot time using the xinetd initialization 14

xinetd Programs ¡ ¡ ¡ Many network enabled Linux applications do not rely on themselves to provide restricted access or bind to a particular TCP port instead they often offload a lot of this work to a program suite made just for this purpose, xinetd The xinetd RPM is installed by default in Fedora Linux and uses /etc/xinetd. conf as its main configuration file 15

Controlling xinetd ¡ ¡ The starting and stopping of the xinetd daemon is controlled by the by scripts in the /etc/init. d directory and it is behavior at boot time is controlled by chkconfig. You can start/stop/restart xinetd after booting by using the following commands: ]root@bigboy tmp]# service xinetd start [root@bigboy tmp]# service xinetd stop [root@bigboy tmp]# service xinetd restart ¡ To get xinetd configured to start at boot you can use the chkconfig command. [root@bigboy tmp]# chkconfig xinetd on 16

Controlling xinetd-Managed Applications ¡ ¡ ¡ Xinetd-managed applications all store their configuration files in the /etc/xinetd. d directory. Each configuration file has a disable statement that can set to yes or no. This governs whether xinetd is allowed to start them or not. You don't have to edit these files to activate or deactivate the application. The chkconfig command does that automatically will also stops or starts the application accordingly too 17

Telnet ¡ ¡ ¡ Telnet is a program that allows users to log into server and get a command prompt just as if they were logged into the VGA console. The Telnet server RPM is installed and disabled by default on Fedora Linux. One of the disadvantages of Telnet is that the data is sent as clear text. A more secure method for remote logins would be via Secure Shell (SSH) which uses varying degrees of encryption. The older Telnet application remains popular. Many network devices don't have SSH clients, making telnet the only means of accessing other devices and servers from them 18

Installing The Telnet Server Software ¡ Older versions of Red. Hat had the Telnet server installed by default. Fedora Linux does not l ¡ ¡ you will have to install it yourself. Most Linux software products are available in a precompiled package format. Downloading and installing packages When searching for the file, the Telnet server RPM's filename usually starts with the word "telnet-server" followed by a version number as in telnet-server-0. 1728. i 386. rpm. 19

Setting Up A Telnet Server ¡ To set up a Telnet server use the chkconfig command to activate Telnet. ]root@bigboy tmp]# chkconfig telnet on ¡ Use the chkconfig command to deactivate telnet, even after the next reboot. [root@bigboy tmp]# chkconfig telnet off 20

Let Telnet Listen On Another TCP Port ¡ ¡ Letting telnet run on an alternate TCP port does not encrypt the traffic, but it makes it less likely to be detected as telnet traffic. Remember that this is not a foolproof strategy; good port scanning programs can detect telnet and other applications running on alternative ports. 21

Let Telnet Listen On Another TCP Port 1. Edit /etc/services file and add an entry for a new service. Call it stelnet. # Local services stelnet 7777/tcp 2. # "secure" telnet Copy the telnet configuration file called /etc/xinetd. d/telnet and call it /etc/xinetd. d/stelnet: ]root@bigboy tmp]# cp /etc/xinetd. d/telnet /etc/xinetd. d/stelnet 22

Let Telnet Listen On Another TCP Port 3. Edit the new /etc/xinetd. d/stelnet file. Make the new service stelnet and add a port statement for TCP port 7777. # default: on # description: The telnet server serves telnet sessions # unencrypted username/password pairs for authentication. service stelnet { flags = REUSE socket_type = stream wait = no user = root server = /usr/sbin/in. telnetd log_on_failure += USERID disable = no port = 7777 } 4. Use chkconfig to activate stelnet. ]root@bigboy tmp]# chkconfig stelnet on 23

Let Telnet Allow Connections From Trusted Addresses ¡ ¡ Root can restrict telnet logins access to individual remote servers by using the only_from keyword in the telnet configuration file. Add a list of trusted servers to the /etc/xinetd. d/telnet file separated by spaces: service telnet { flags = REUSE socket_type = stream wait = no user = root server = /usr/sbin/in. telnetd log_on_failure += USERID disable = no only_from = 192. 168. 1. 100 127. 0. 0. 1 192. 168. 1. 200 } ¡ Restart telnet by # chkconfig telnet off # chkconfig telnet on 24

Linux FTP ¡ ¡ ¡ The File Transfer Protocol (FTP) is used as one of the most common means of copying files between servers over the Internet. Most web based download sites use the built in FTP capabilities of web browsers and therefore most server oriented operating systems usually include an FTP server application as part of the software suite. Fedora linux ftp sever using default Very Secure FTP Daemon (VSFTPD) package 25

FTP overview ¡ FTP relies on a pair of TCP ports to get the job done. It operates in two connection channels l l FTP Control Channel, TCP Port 21: All commands send and the ftp server's responses to those commands will go over the control connection. FTP Data Channel, TCP Port 20: This port is used for all subsequent data transfers between the client and server. 26

How To Get VSFTPD Started ¡ With Fedora, Redhat, Ubunbtu and Debian You can start, stop, or restart VSFTPD after booting by using these commands: ]root@bigboy tmp]# /etc/init. d/vsftpd start [root@bigboy tmp]# /etc/init. d/vsftpd stop [root@bigboy tmp]# /etc/init. d/vsftpd restart ¡ With Redhat / Fedora you can configure VSFTPD to start at boot you can use the chkconfig command. ]root@bigboy tmp]# chkconfig vsftpd on 27

The Apache Web Server ¡ ¡ Apache is probably the most popular Linux-based Web server application in use. When searching for the file, the Redhat / Fedora Apache RPM package's filename usually starts with the word httpd followed by a version number, as in httpd -2. 0. 48 -1. 2. rpm 28

Get Apache started ¡ Use the chkconfig command to configure Apache to start at boot: [root@bigboy tmp]# chkconfig httpd on ¡ Use the httpd<code> init script in the <code>/etc/init. d directory to start, stop, and restart Apache after booting: ]root@bigboy tmp]# /etc/init. d/httpd start [root@bigboy tmp]# /etc/init. d/httpd stop [root@bigboy tmp]# /etc/init. d/httpd restart 29

General Configuration Steps ¡ ¡ ¡ The configuration file used by Apache is /etc/httpd/conf/httpd. conf in Redhat / Fedora distributions /etc/apache*/httpd. conf in Debian / Ubuntu distributions. As for most Linux applications, you must restart Apache before changes to this configuration file take effect 30

Where To Put Web Pages ¡ All the statements that define the features of each web site are grouped together inside their own <Virtual. Host> section, or container, in the httpd. conf file. ¡ The most commonly used statements, or directives, inside a <Virtual. Host> container are: l servername: Defines the name of the website managed by the <Virtual. Host> container. This is needed in named virtual hosting only, as I'll explain soon. l Document. Root: Defines the directory in which the web pages for the site can be found. 31

Where To Put Web Pages ¡ ¡ By default, Apache searches the Document. Root directory for an index, or home, page named index. html. Example, if a servername of www. my-site. com with a Document. Root directory of /home/www/site 1/ Apache displays the contents of the file /home/www/site 1/index. html when someone enter http: //www. my-site. com in his browser. 32

The Default File Location ¡ ¡ By default, Apache expects to find all its web page files in the “/var/www/html/” directory with a generic Document. Root statement at the beginning of httpd. conf Apache will display Web page files as long as they are world readable, all the files and subdirectories in Document. Root should have the correct permissions l Change the permissions on the /home/www directory to 755, which allows all users, including the Apache's httpd daemon, to read the files inside. 33

Named Virtual Hosting ¡ Apache allow to make Web server host more than one site per IP address by using Apache's named virtual hosting feature. ¡ Use the Name. Virtual. Host directive in the /etc/httpd/conf/httpd. conf file to tell Apache which IP addresses will participate in this feature. ¡ The <Virtual. Host> containers in the file then tell Apache where it should look for the Web pages used on each Web site. ¡ Admin must specify the IP address for which each <Virtual. Host> container applies. 34

Named Virtual Hosting Example Server. Name localhost Name. Virtual. Host 97. 158. 253. 26 <Virtual. Host *> Document. Root /home/www/site 1 </Virtual. Host> <Virtual. Host 97. 158. 253. 26> Document. Root /home/www/site 2 Server. Name www. my-site. com Server. Alias my-site. com, www. my-cool-site. com </Virtual. Host> <Virtual. Host 97. 158. 253. 26> Document. Root /home/www/site 3 Server. Name www. test-site. com </Virtual. Host> <Virtual. Host 97. 158. 253. 26> Document. Root /home/www/site 4 Server. Name www. another-site. com </Virtual. Host> 35

Protect Web Page Directories With Passwords ¡ ¡ ¡ Use Apache's htpasswd password utility to create username/password combinations independent of system login password for Web page access. Specify the location of the password file, and if it does not yet exist, should include a -c, or create, switch on the command line. Placing the file in /etc/httpd/conf directory, away from the Document. Root tree where Web users could possibly view it. 36

htpasswd Example ]root@bigboy tmp]# htpasswd -c /etc/httpd/conf/. htpasswd peter New password: Re-type new password: Adding password for user peter [root@bigboy tmp]# htpasswd /etc/httpd/conf/. htpasswd paul New password: Re-type new password: Adding password for user paul [root@bigboy tmp]# 37

Protect Web Page Directories With Passwords ¡ Make the. htpasswd file readable by all users. ]root@bigboy tmp]# chmod 644 /etc/httpd/conf/. htpasswd ¡ Create a. htaccess file in the directory to which you want password control with these entries. Auth. User. File /etc/httpd/conf/. htpasswd Auth. Group. File /dev/null Auth. Name Enter. Password Auth. Type Basic require user peter 38

Protect Web Page Directories With Passwords ¡ Set the correct file protections on new. htaccess file in the directory /home/www. ]root@bigboy tmp]# chmod 644 /home/www/. htaccess ¡ ¡ Make sure your /etc/httpd/conf/http. conf file has an Allow. Override statement in a <Directory> directive for any directory in the tree above /home/www. In this example below, all directories below /var/www/ require password authorization. <Directory /home/www/*> Allow. Override Auth. Config </Directory> 39

Protect Web Page Directories With Passwords ¡ Make sure that a <Virtual. Host> directive that defines access to /home/www or another directory higher up in the tree. <Virtual. Host *> Server. Name 97. 158. 253. 26 Document. Root /home/www </Virtual. Host> ¡ Restart Apache 40

Linux firewall ¡ Linux uses “iptable” for firewall solutions l A router that will use NAT and port forwarding to both protect home network and have another web server on home network while sharing the public IP address of firewall 41

iptable Features ¡ ¡ ¡ Integration with the Linux kernel with the capability of loading iptables-specific kernel modules designed for improved speed and reliability. Stateful packet inspection. This means that the firewall keeps track of each connection passing through it and in certain cases will view the contents of data flows in an attempt to anticipate the next action of certain protocols. Filtering packets based on a MAC address and the values of the flags in the TCP header. 42

iptable Features ¡ ¡ System logging that provides the option of adjusting the level of detail of the reporting. Network address translation. Support for transparent integration with such Web proxy programs as Squid. A rate limiting feature that helps iptables block some types of denial of service (Do. S) attacks 43

Start iptable ¡ Start iptable with: [root@bigboy tmp]# service iptables start [root@bigboy tmp]# service iptables stop [root@bigboy tmp]# service iptables restart ¡ Sample of iptable command iptables -A FORWARD -s 0/0 -i eth 0 -d 192. 168. 1. 58 -o eth 1 -p TCP --sport 1024: 65535 --dport 80 -j ACCEPT l l iptables is being configured to allow the firewall to accept TCP packets for routing when they enter on interface eth 0 from any IP address and are destined for an IP address of 192. 168. 1. 58 that is reachable via interface eth 1. The source port is in the range 1024 to 65535 and the destination port is port 80 44

Secure Remote Logins ¡ ¡ ¡ Open. SSH, which provides a number of ways to create encrypted remote terminal and file transfer connections between clients and servers. The Open. SSH Secure Copy (SCP) and Secure FTP (SFTP) programs are secure replacements for FTP, Secure Shell (SSH) is often used as a stealthy alternative to TELNET 45

Starting Open. SSH ¡ ¡ ¡ Open. SSH is installed by default during Linux installations SSH and SCP are part of the same application, they share the same configuration file and are governed by the same /etc/init. d/sshd startup script configure SSH to start at boot by using the chkconfig command when running Fedora [root@bigboy tmp]# chkconfig sshd on 46

The /etc/sshd_config File ¡ The SSH configuration file is called /etc/sshd_config. By default SSH listens on all NICs and uses TCP port 22. # # The strategy used for options in the default sshd_config shipped with Open. SSH is to specify options with their default value where possible, but leave them commented. Uncommented options change a default value. #Port 22 #Protocol 2, 1 #Listen. Address 0. 0 #Listen. Address : : ¡ start, stop, and restart SSH with service comand 47

Other Linux services NTP ¡ Sendmail ¡ DNS ¡ MRTG ¡ Network File System (NFS( ¡ Etc. ¡ 48