# chkconfig nfslock off
# chkconfig rpcgssd off
# chkconfig rpcidmapd off
# chkconfig portmap off
# chkconfig nfs offDelete nfs-utils and portmap packages using the yum command:
# yum remove portmap nfs-utils
Monday, April 30, 2012
Linux Disable / Remove All NFS Services
NFS was not designed with security in mind, and has a number of weaknesses, both in terms of the protocol itself and because any NFS installation must expose several daemons, running on both servers and clients, to network attack. I use my CentOS based server only to server web pages and nothing else. How do I disable NFS services under RHEL / CentOS / Fedora Linux?
You can easily disable NFS, which is a commonly used for sharing data and files between machines. However, its use opens many potential security holes. If NFS is not needed, improve the security by removing and disabling NFS. Open a command-line terminal (select Applications > Accessories > Terminal), and then type:
Delete nfs-utils and portmap packages using the yum command:
Delete nfs-utils and portmap packages using the yum command:
Linux Iptables Open LDAP Server TCP Ports 389 and 636
The default Iptables configuration under CentOS / Red Hat / RHEL / Fedora Linux does not allow inbound access to LDAP service. How do I update iptables settings to allow access to the LDAP primary TCP #389 and encrypted-only TCP # 636 ports, while keeping all other ports on the server in their default protected state?
Under CentOS / RHEL you need to update /etc/sysconfig/iptables files. Usually you need to restrict access to an appropriate network block and network mask, representing the client machines on your LAN or WAN which will connect to your LDAP server hosted on RHEL.
Add the following lines, before the final LOG and DROP lines to give access only from 192.168.1.0/24 network:
Configure Iptables to Allow Access to the LDAP Server
Edit /etc/sysconfig/iptables using the text editor:# vi /etc/sysconfig/iptablesAdd the following lines, before the final LOG and DROP lines to give access only from 192.168.1.0/24 network:
-A RH-Firewall-1-INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 389 -j ACCEPTSave and close the file. Reload iptables firewall rules and open ports # 389 and 636:
-A RH-Firewall-1-INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 636 -j ACCEPT
# service iptables reload
DenyHosts: Remove / Delete an IP address
I've followed your guide and installed denyhosts to protect on my RedHat 5.3 OpenSSH based server. However, I've been accidentally blocked out from my home ADSL IP address. I tried removing my blocked IP from /etc/hosts.deny, but it did blocked it again quickly. It appears that DenyHosts keeps track of the attempts somewhere on disk or memory. How do I remove my own home IP address from DenyHosts?
Simply removing your IP from /etc/hosts.deny does not work since DenyHosts keeps track of the attempts in the /usr/share/denyhosts/data directory. In order to remove your IP address you will need to do the following.
Delete your IP address. Save and close the file.
You need to edit the following files using vi and remove the lines containing the IP address. Save the file.
Simply removing your IP from /etc/hosts.deny does not work since DenyHosts keeps track of the attempts in the /usr/share/denyhosts/data directory. In order to remove your IP address you will need to do the following.
Step # 1: Stop DenyHosts
# /etc/init.d/denyhosts stopStep # 2: Remove Your IP From /etc/hosts.deny
# vi /etc/hosts.denyDelete your IP address. Save and close the file.
Step # 3: Remove Your IP From /usr/share/denyhosts/data Directory
Cd to /usr/share/denyhosts/data# cd /usr/share/denyhosts/dataYou need to edit the following files using vi and remove the lines containing the IP address. Save the file.
- hosts
- hosts-restricted
- hosts-root
- hosts-valid
- users-hosts
# echo '1.2.3.4' >> allowed-hostsStep # 4: Start DenyHosts
# /etc/init.d/denyhosts start
Debian Linux Stop SSH User Hacking / Cracking Attacks with DenyHosts Software
I've noticed lots of failed login attempt for my Debian Linux VPS root server account. How do I stop automated bot based SSH attacks on my server?
You can use DenyHosts - a Python based script that analyzes the sshd server log messages to determine what hosts are attempting to hack into your system. It is an utility to help sys admins thwart ssh crackers. It also determines what user accounts are being targeted. It keeps track of the frequency of attempts from each host. It will automatically blocks ssh attacks by adding entries to /etc/hosts.deny. DenyHosts will also inform Linux administrators about offending hosts, attacked users and suspicious logins.
Find out version (DenyHosts requires 2.3 or above version)
Output:
Allow sshd from 202.54.1.2 i.e. you never want to block yourself
Save and close the file. Verify and examines your tcp wrapper configuration file and reports all potential and real problems:
Setup your email ID so you would receive emails regarding newly restricted hosts and suspicious logins, set this address to match your email address.
Save and close the file. Here is my own sample configuration file for Debian Linux 4.0 server (config file is documented very well, just open and read it):
You can use DenyHosts - a Python based script that analyzes the sshd server log messages to determine what hosts are attempting to hack into your system. It is an utility to help sys admins thwart ssh crackers. It also determines what user accounts are being targeted. It keeps track of the frequency of attempts from each host. It will automatically blocks ssh attacks by adding entries to /etc/hosts.deny. DenyHosts will also inform Linux administrators about offending hosts, attacked users and suspicious logins.
Step # 1: Make Sure Python is installed
First, make sure python is installed under Debian / Ubuntu Linux:# dpkg --list | grep python2Find out version (DenyHosts requires 2.3 or above version)
$ python -VOutput:
Python 2.5.1Step # 2: Download DenyHosts
Visit official project home page to grab latest source code or packages. Use apt-get command under Debian / Ubuntu Linux, enter$ sudo apt-get install denyhostsDenyHosts configuration - /etc/denyhosts.conf
- The default configuration file is /etc/denyhosts.conf.
- You also need to create / update a whitelist in /etc/hosts.allow. For example, if you have static IP assigned by ISP, enter in this file. You can add all the important hosts that you never want blocked.
Step # 1: Setup a whitelist
Open /etc/hosts.allow:# vi /etc/hosts.allowAllow sshd from 202.54.1.2 i.e. you never want to block yourself
sshd: 202.54.1.2Save and close the file. Verify and examines your tcp wrapper configuration file and reports all potential and real problems:
# tcpdchk -vStep # 1: Configure DenyHosts
Open default configuration file - /etc/denyhosts.conf, enter:# vi /etc/denyhosts.confSetup your email ID so you would receive emails regarding newly restricted hosts and suspicious logins, set this address to match your email address.
ADMIN_EMAIL = vivek@nixcraft.comSave and close the file. Here is my own sample configuration file for Debian Linux 4.0 server (config file is documented very well, just open and read it):
############ THESE SETTINGS ARE REQUIRED ############Restart the daemon:
SECURE_LOG = /var/log/auth.log
HOSTS_DENY = /etc/hosts.deny
PURGE_DENY =
BLOCK_SERVICE = sshd
DENY_THRESHOLD_INVALID = 5
DENY_THRESHOLD_VALID = 10
DENY_THRESHOLD_ROOT = 1
DENY_THRESHOLD_RESTRICTED = 1
WORK_DIR = /var/lib/denyhosts
SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS=YES
HOSTNAME_LOOKUP=YES
LOCK_FILE = /var/run/denyhosts.pid
############ THESE SETTINGS ARE OPTIONAL ############
ADMIN_EMAIL = vivek@nixcraft.org
SMTP_HOST = localhost
SMTP_PORT = 25
SMTP_FROM = DenyHosts <webmaster@cyberciti.com>
SMTP_SUBJECT = DenyHosts Report
AGE_RESET_VALID=5d
AGE_RESET_ROOT=25d
AGE_RESET_RESTRICTED=25d
AGE_RESET_INVALID=10d
######### THESE SETTINGS ARE SPECIFIC TO DAEMON MODE ##########
DAEMON_LOG = /var/log/denyhosts
DAEMON_SLEEP = 30s
DAEMON_PURGE = 1h
# /etc/init.d/denyhosts restart
DenyHosts: Remove / Delete an IP address
I've followed your guide and installed denyhosts to protect on my RedHat 5.3 OpenSSH based server. However, I've been accidentally blocked out from my home ADSL IP address. I tried removing my blocked IP from /etc/hosts.deny, but it did blocked it again quickly. It appears that DenyHosts keeps track of the attempts somewhere on disk or memory. How do I remove my own home IP address from DenyHosts?
Simply removing your IP from /etc/hosts.deny does not work since DenyHosts keeps track of the attempts in the /usr/share/denyhosts/data directory. In order to remove your IP address you will need to do the following.
Delete your IP address. Save and close the file.
You need to edit the following files using vi and remove the lines containing the IP address. Save the file.
Simply removing your IP from /etc/hosts.deny does not work since DenyHosts keeps track of the attempts in the /usr/share/denyhosts/data directory. In order to remove your IP address you will need to do the following.
Step # 1: Stop DenyHosts
# /etc/init.d/denyhosts stopStep # 2: Remove Your IP From /etc/hosts.deny
# vi /etc/hosts.denyDelete your IP address. Save and close the file.
Step # 3: Remove Your IP From /usr/share/denyhosts/data Directory
Cd to /usr/share/denyhosts/data# cd /usr/share/denyhosts/dataYou need to edit the following files using vi and remove the lines containing the IP address. Save the file.
- hosts
- hosts-restricted
- hosts-root
- hosts-valid
- users-hosts
# echo '1.2.3.4' >> allowed-hostsStep # 4: Start DenyHosts
# /etc/init.d/denyhosts start
Allow A Normal User To Run Commands As root Under Linux / UNIX Operating Systems
From my mail bag:
You need to use the sudo command which is use to execute a command as another user. It allows a permitted user to execute a command as the superuser or another user, as specified in the /etc/sudoers (config file that defines or list of who can run what) file. The sudo command allows users to do tasks on a Linux system as another user.
If the invoking user is root or if the target user is the same as the invoking user, no password is required. Otherwise, sudo requires that users authenticate themselves with a password by default. Once a user has been authenticated, a timestamp is updated and the user may then use sudo without a password for a short period of time (15 minutes unless overridden in sudoers).
USER HOSTNAME=COMMAND
Where,
Append the following lines to file:
Save and close file . Now rokcy user can restart Apache web server by typing the following command:
Output:
Sample outputs:
Output:
b) Allow user jadmin to run /sbin/halt without any password i.e. as root without authenticating himself:
c) Allow user charvi to run any command from /usr/bin directory on the system dev02:
I would like to run few commands such as stop or start web server as a root user. How do I allow a normal user to run these commands as root?
You need to use the sudo command which is use to execute a command as another user. It allows a permitted user to execute a command as the superuser or another user, as specified in the /etc/sudoers (config file that defines or list of who can run what) file. The sudo command allows users to do tasks on a Linux system as another user.
sudo command
sudo is more more secure than su command. By default it logs sudo usage, command and arguments in /var/log/secure (Red Hat/Fedora / CentOS Linux) or /var/log/auth.log (Ubuntu / Debian Linux).If the invoking user is root or if the target user is the same as the invoking user, no password is required. Otherwise, sudo requires that users authenticate themselves with a password by default. Once a user has been authenticated, a timestamp is updated and the user may then use sudo without a password for a short period of time (15 minutes unless overridden in sudoers).
/etc/sudoers Syntax
Following is general syntax used by /etc/sudoers file:USER HOSTNAME=COMMAND
Where,
- USER: Name of normal user
- HOSTNAME: Where command is allowed to run. It is the hostname of the system where this rule applies. sudo is designed so you can use one sudoers file on all of your systems. This space allows you to set per-host rules.
- COMMAND: A simple filename allows the user to run the command with any arguments he/she wishes. However, you may also specify command line arguments (including wildcards). Alternately, you can specify "" to indicate that the command may only be run without command line arguments.
How do I use sudo?
Give user rokcy access to halt/shutdown command and restart Apache web server. First, Login as root user. Use visudo command edit the config file:# visudoAppend the following lines to file:
rokcy localhost=/sbin/halt
rokcy dbserver=/etc/init.d/apache-perl restartSave and close file . Now rokcy user can restart Apache web server by typing the following command:
$ sudo /etc/init.d/apache-perl restartOutput:
Password:The sudo command has logged the attempt to the log file /var/log/secure or /var/log/auth.log file:
Restarting apache-perl 1.3 web server....
# tail -f /var/log/auth.logSample outputs:
May 13 08:37:43 debian sudo: rokcy : TTY=pts/4 ; PWD=/home/rokcy ; USER=root ; COMMAND=/etc/init.d/apache-perl restartIf rokcy want to shutdown computer he needs to type command:
$ sudo /sbin/haltOutput:
Password:Before running a command with sudo, users usually supply their password. Once authenticated, and if the /etc/sudoers configuration file permits the user access, then the command is run. sudo logs each command run.
Examples
a) Allow jadmin to run various commands:jadmin ALL=/sbin/halt, /bin/kill, /etc/init.d/httpdb) Allow user jadmin to run /sbin/halt without any password i.e. as root without authenticating himself:
jadmin ALL= NOPASSWD: /sbin/haltc) Allow user charvi to run any command from /usr/bin directory on the system dev02:
charvi dev02 = /usr/bin/*
CentOS / Red Hat: Sudo Allows People In Group Admin To Run All Commands
I like the way Ubuntu Linux works - all people in admin groups should able to run all commands after running it via sudo "command-name". How do I setup sudo under CentOS or Red Hat Enterprise Linux to allow all members of the 'admin' group to run all commands?
/etc/sudoers files allows particular users or groups to run various commands as he root user, without needing the root password. This is useful for delegating roles and permissions to other users without sharing the root password. This file must be edited with the visudo command. Login as the root user and enter:
Append the following line:
Add a user called vivek (existing user) to group admin:
Verify group membership:
Sample Outputs:
To gain root shell, enter:
When prompted for a password, enter vivek's password.
Please note that sudo will normally only log the command it explicitly runs. If a user runs a command such as sudo su or sudo sh, subsequent commands run from that shell will not be logged, nor will sudo’s access control affect them. The same is true for commands that offer shell escapes (including most editors).
# visudoAppend the following line:
## Allows people in group admin to run all commandsSave and close the file. Finally, add a group called admin:
%admin ALL=(ALL) ALL
# groupadd adminAdd a user called vivek (existing user) to group admin:
# usermod -a -G admin vivekVerify group membership:
# id vivekSample Outputs:
uid=5001(vivek) gid=5001(vivek) groups=5001(vivek),10(admin)Login as user vivek and to run any command as the root type:
$ sudo /etc/init.d/httpd restartTo gain root shell, enter:
$ sudo -sWhen prompted for a password, enter vivek's password.
How Do I Keep Track Of All Users In Admin Group?
sudo can log both successful and unsuccessful attempts (as well as errors) to syslog (default is /var/log/secure), a log file, or both. By default sudo will log via syslog but this is changeable at configure time or via the sudoers file.# tail -f /var/log/secure
# grep something /var/log/securePlease note that sudo will normally only log the command it explicitly runs. If a user runs a command such as sudo su or sudo sh, subsequent commands run from that shell will not be logged, nor will sudo’s access control affect them. The same is true for commands that offer shell escapes (including most editors).
Subscribe to:
Posts (Atom)