RH302 Sample Questions Answers

Do the following steps as:

Use fdisk /dev/hdaTo create new partition.

Type nFor New partitions

It will ask for Logical or Primary Partitions. Press l for logical.

It will ask for the Starting Cylinder: Use the Default by pressing Enter Key.

Type the Size: +100MYou can Specify either Last cylinder of Size here.

Press P to verify the partitions lists and remember the partitions name.

Press w to write on partitions table.

Either Reboot or use partprobe command.

Use mkfs –t ext3 /dev/hda?

Or

mke2fs –j /dev/hda? To create ext3 filesystem.

vi /etc/fstab

Write:

/dev/hda?/dataext3defaults0 0

Verify by mounting on current Sessions also:

mount /dev/hda? /data

Do the following steps as:

1.vi /etc/sysconfing/network

NETWORKING=yes

HOSTNAME=station?.example.com

GATEWAY=192.168.0.254

2.service network restart

Or

1.vi /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0

ONBOOT=yes

BOOTPROTO=static

IPADDR=X.X.X.X

NETMASK=X.X.X.X

GATEWAY=192.168.0.254

2.ifdown eth0

3.ifup eth0

To automatically mount at boot time we use the /etc/fstab file. Because /etc/rc.d/rc.sysinit file reads and mount all file system specified in /etc/fstab. To mount Network Sharing Files also use the /etc/fstab but filesystem is nfs.

vi /etc/fstab

192.168.0.254:/data/commonnfsdefaults0 0

reboot the system.

Do the following steps as:

hostname station?.example.comThis will set the host name only for current session. To set hostname permanently.

vi /etc/sysconfig/network

HOSTNAME=station?.example.com

service network restart

Do the following steps as:

1. Rename the file named.caching-nameserver.conf into named.conf file located into /var/named/chroot/etc

#mv /var/named/chroot/etc/named.caching-nameserver.conf /var/named/chroot/etc/named.conf

2. Check the permission and ownership as well as SELinux Context should be like as:

-rw-r----- root named system_u:object_r:named_conf_t /var/named/chroot/etc/named.conf

If selinux context is mismatch use the restorecon –R /var command

3.vi /etc/named.conf

zone “example.com” IN {

type master;

file “example.com.zone”;

};

/var/named/chroot/etc/named.conf file is used to register the zone as well as specify the global option for DNS server. There are two types of zone, i. Master, which contains the original data. ii. Slave, backup of master. Here is the example of master zone configuration.

4.vi /var/named/chroot/var/named/example.com.zone

$TTL 345345

@ IN SOA @ webmaster.example.com.(

101;Serial Number

1H;Refresh Time

1M;Retry Time

1W;Expire Time

1D;Minimum Time to Live

)

@ IN NS 192.100.0.X

www 0 IN A 192.100.0.1

www 0 IN A 192.100.0.2

www 0 IN A 192.100.0.3

www 0 IN A 192.100.0.4

www 0 IN A 192.100.0.5

mail IN A 192.100.0.6

mail1 IN A 192.100.0.7

mail2 IN A 192.100.0.8

@ IN MX 5 mail.example.com.

@ IN MX 8 mail1.example.com.

@ IN MX 10 mail2.example.com.

3.service named start

4.rndc reload

5.chkconfig named on

6. Check the permission as well as SELinux Context should like this:

-rw-r--r-- root named root:object_r:named_zone_t /var/named/chroot/var/named/example.com.zone

If selinux context is mismatch use the restorecon –R /var command

7.service named start

8.rndc reload

9.chkconfig named on

Zone file should create on /var/named/chroot/var/named. Default Directory Path is specified on /var/named/chroot/etc/named.conf file.

$TTLTime To Live, How much seconds cache server stores the information about DNS. And Five Parameters specified Serial Number used by slave to synchronize with master server. Refresh and Retry Time used by slave server. NS is the Name (DNS) server where lookup the domain. A (Associated IP) for particular host.

DNS has mechanism to load balance the request from clients. You can verify using hostwww.example.com command. MX resource records are used to define mail handler or exchanger for the domain. MX record must pass the positive integer value. This integer value is used by remote Mail Transport Agent (MTA) to determine, which host has delivery priority for the zone. The Lowest integer value will get the priority.

Do the following steps as:

1.vi /etc/hosts.deny

dovecot:ALL EXCEPT .example.com, .my133t.org

We can secure the services using tcp_wrappers. There are main two files, /etc/hosts.allow and /etc/hosts.deny.

There will be three stage access checking

- Is access explicitly permitted? Means permitted from /etc/hosts.allow?

- Otherwise, Is access explicitly denied? Means denied from /etc/hosts.deny?

- Otherwise, by default permit access if neither condition matched.

To deny the services we can configure /etc/hosts.deny file using ALL and EXCEPT operation. Pattern of /etc/hosts.allow and /etc/hosts.deny file is:

Demon_list:client_list:options

In Client list can be either domain name or IP address.

Do the following steps as:

1.touch /etc/nologin

2.vi /etc/securetty

comment all available terminall then first.

If /etc/nologin file is created, then pam modules pan_nologin deny to all non-root users to login locally.

/etc/pam.d/login file calls the module.

#%PAM-1.0

auth requiredpam_securetty.so

auth requiredpam_stack.so service=system-auth

auth requiredpam_nologin.so

account requiredpam_stack.so service=system-auth

password requiredpam_stack.so service=system-auth

# pam_selinux.so close should be the first session rule

session requiredpam_selinux.so close

session requiredpam_stack.so service=system-auth

session optionalpam_console.so

# pam_selinux.so open should be the last session rule

session requiredpam_selinux.so multiple open

pam_securetty modules checks the /etc/securetty file, which terminal are available to root. If terminal is not available in this file then pam_securetty module deny to login on unavailable terminal to root user.

Do the following steps as:

1.vi /etc/hosts.deny

sshd: 192.168.0. EXCEPT 192.168.0.4

We can secure the services using tcp_wrappers. There are main two files, /etc/hosts.allow and /etc/hosts.deny.

There will be three stage access checking

-Is access explicitly permitted? Means permitted from /etc/hosts.allow?

- Otherwise, Is access explicitly denied? Means denied from /etc/hosts.deny?

- Otherwise, by default permit access if neither condition matched.

To deny the services we can configure /etc/hosts.deny file using ALL and EXCEPT operation. Pattern of /etc/hosts.allow and /etc/hosts.deny file is:

Demon_list:client_list:options

In Client list can be either domain name or IP address.

Do the following steps as:

1.vi /etc/security/time.conf

login;*;user15|user16;Sa0000-2400

2.vi /etc/pam.d/login

accountrequiredpam_time.so

For Time based authentication, we should configured in /etc/security/time.conf

Syntax of /etc/security/time.conf

services;ttys;users;times

services

is a logic list of PAM service names that the rule applies to.

ttys

is a logic list of terminal names that this rule applies to.

users

is a logic list of users to whom this rule applies.

times

the format here is a logic list of day/time-range entries the days are specified by a sequence of two character entries, MoTuSa for example is Monday Tuesday and Saturday. Note that repeated days are unset MoMo = no day, and MoWk = all weekdays bar Monday. The two character combinations accepted are

Mo Tu We Th Fr Sa Su Wk Wd Al

the last two being week-end days and all 7 days of the week respectively. As a final example, AlFr means all days except Friday.

pam_time modules checks the file /etc/security/time.conf for authentication. So, we should call the pam_time modules in /etc/pam.d/login.

We can control the services for current session and for next reboot time. For current Session, we use service servicename start or restart or stop or status. For automatically at next reboot time:

chkconfig servicename on or off

eg: chkconfig nfs on

chkconfig portmap on

or

ntsysv

Select the nfs and portmap services.

Reboot the system and identify whether services are running or not.

Do the following steps as:

vi /etc/auto.master

/mnt/etc/auto.misc--timeout=50

vi /etc/auto.misc

data-rw,soft,intrserver1.example.com:/data

service autofs restart

chkconfig autofs on

When you mount the other filesystem, you should unmount the mounted filesystem, Automount feature of linux helps to mount at access time and after certain seconds, when user unaccess the mounted directory, automatically unmount the filesystem.

/etc/auto.master is the master configuration file for autofs service. When you start the service, it reads the mount point as defined in /etc/auto.master.

It is due to either default runlevel or runlevel specific scripts.

id:?:initdefault:Where default runlevel is specified. It shouldn’t be 6.

l3:3:wait:/etc/rc.d/rc 6It reads the scripts of runlevel 6 while booting system on rulevel 3.

It should be like:

si::sysinit:/etc/rc.d/rc.sysinit

l0:0:wait:/etc/rc.d/rc 0

l1:1:wait:/etc/rc.d/rc 1

l2:2:wait:/etc/rc.d/rc 2

l3:3:wait:/etc/rc.d/rc 3 Should be like this

l4:4:wait:/etc/rc.d/rc 4

l5:5:wait:/etc/rc.d/rc 5

l6:6:wait:/etc/rc.d/rc 6

#vi /etc/resolv.conf

nameserver 172.24.254.254

# dig server1.example.com

#host server1.example.com

DNS is the Domain Name System, which maintains a database that can help your computer translate domain names such as www.redhat.com to IP addresses such as 216.148.218.197. As no individual DNS server is large enough to keep a database for the entire Internet, they can refer requests to other DNS servers.

DNS is based on thenameddaemon, which is built on the BIND (Berkeley Internet Name Domain) package developed through the Internet Software Consortium

Users wants to access by name so DNS will interpret the name into ip address. You need to specify the Address if DNS server in each and every client machine. In Redhat Enterprise Linux, you need to specify the DNS server into /etc/resolv.conf file.

After Specifying the DNS server address, you can verify using host, dig and nslookup commands.

Do the following steps as:

1.rename the file named.caching-nameserver.conf into named.conf file located into /var/named/chroot/etc

#mv /var/named/chroot/etc/named.caching-nameserver.conf /var/named/chroot/etc/named.conf

2. Check the permission and ownership as well as SELinux Context should be like as:

-rw-r----- root named system_u:object_r:named_conf_t /var/named/chroot/etc/named.conf

If selinux context is mismatch use the restorecon –R /var command

3. vi /var/named/chroot/etc/named.conf

zone “example.com” IN {

type master;

file “example.com.zone”;

};

/var/named/chroot/etc/named.conf file is used to register the zone as well as specify theglobal option for DNS server. There are two types of zone, i. Master, which contains the original data. ii. Slave, backup of master. Here is the example of master zone configuration.

4.vi /var/named/chroot/var/named/example.com.zone

$TTL 345345

@ IN SOA @ webmaster.example.com.(

101;Serial Number

1H;Refresh Time

1M;Retry Time

1W;Expire Time

1D;Minimum Time to Live

)

@ IN NS 192.100.0.X

www IN A 192.100.0.20

5. Check the permission as well as SELinux Context should like this:

-rw-r--r-- root named root:object_r:named_zone_t /var/named/chroot/var/named/example.com.zone

If selinux context is mismatch use the restorecon –R /var command

6.service named start

7.rndc reload

8.chkconfig named on

Zone file should create on /var/named/chroot/var/named. Default Directory Path is specified on /var/named/chroot/etc/named.conf file.

$TTLTime To Live, How much seconds cache server stores the information about DNS. And Five Parameters specified Serial Number used by slave to synchronize with master server. Refresh and Retry Time used by slave server. NS is the Name (DNS) server where lookup the domain. A (Associated IP) for particular host.

Do the following steps as:

1.vi /etc/mail/local-host-names

example.com

2.vi /etc/mail/sendmail.mc

dnl # DEAMON_OPTIONS(`Port=smtp,Addr=127.0.0.1,Name=MTA`)dnl

3.m4 /etc/mail/sendmail.mc >/etc/mail/sendmail.cf

4.vi /etc/mail/access

example.comRELAY

RELAY

5.service sendmail start | restart

6.chkconfig sendmail on

/etc/mail/local-host-names file contains the aliases to hostname. Mail server program reads the /etc/mail/sendmail.cf. To change the configuration on mail server, we should edit the /etc/mail/sendmail.mc file and should generate the sendmail.cf using m4command.

By default sendmail server allows to connect to local host only. So we should edit the /etc/mail/sendmail.mc file to allow connect to other hosts.

By default sendmail server will not forward mail. we should specify on /etc/mail/access to relay or to block mail coming from domain or network or individual email address.

Your local domain mean example.com domain. Lookup the example.com using

host example.com you will get the IP address 192.168.0.254.

1.vi /etc/httpd/conf/httpd.conf

ServerNamesexample.com

DocumentRoot /var/www/example

DirectoryIndexindex.html

ServerAdminwebmaster@example.com

2.mkdir /var/www/example

3.Download the index.html file from the ftp server specified in question

4.Rename thewww.html file to index.html

Check the SELinux context of index page , should like this:

-rw-r--r-- root root system_u:object_r:httpd_sys_content_t /var/www/html/index.html

If SELinux Context is mismatched, use the restorecon –R /var command

5.service httpd start|restart

6.chkconfig httpd on

7.check using: links http://example.com

Do the following steps as:

1.vi /etc/security/access.conf

-:jack:ALL EXCEPT station10.example.com

2.vi /etc/pam.d/system-auth

accountrequired/lib/security/pam_access.so

/etc/security/access.conf file helps to allow or deny login to users on the basis of origin.

Syntax of /etc/security/access.conf

permission : users : origins

The first field should be a "+" (access granted) or "-" (access denied) character.

The second field should be a list of one or more login names, group names, or ALL (always matches). A pattern of the form user@host is matched when the login name matches the "user" part, and when the "host" part matches the local machine name.

The third field should be a list of one or more tty names (for non-networked logins), host names, domain names (begin with "."), host addresses, internet network numbers (end with "."), ALL (always matches) or LOCAL (matches any string that does not contain a "." character).

The EXCEPT operator makes it possible to write very compact rules

Do the following steps as:

useradd eric

passwd eric

vi /etc/passwd

eric:x:505:505::/home/eric:/sbin/nologin

Which shell or program should start at login time is specified in /etc/passwd file. By default Redhat Enterprise Linux assigns the /bin/bash shell to the users. To deny the interactive login, you should write /sbin/nologin or /bin/false instead of login shell.

Do the following steps as:

1.groupadd sysadmin

groupadd command is used to create the group and all group information is stored in /etc/group file.

Do the following steps as:

1.chmod 770 /data

2.Verify using : ls –ld /data

Preview should be like:

drwxrwx--- 2 root sysadmin 4096 Mar 16 18:08 /data

To change the permission on directory we use the chmod command. According to the question that only the owner user (root) and group member (sysadmin) can fully access the directory so: chmod 770 /data

Questions asking you to install the dialog package from the server. In your Lab FTP server as well as NFS server are configured. You can install either through FTP or NFS.

1.Just Login to server1.example.com through FTP: ftp server1.example.com

2.Enter to pub directory: cd pub

3.Enter to RedHat/RPMS: cd RedHat/RPMS

4.Download the Package: mget dialog-*

5.Logout from the FTP server: bye

6.Install the package: rpm -ivh dialog-*

7.Verify the package either installed or not: rpm -q dialog

Do the following steps as:

vi /etc/auto.master

/mnt/etc/auto.misc--timeout=50

vi /etc/auto.misc

data-rw,soft,intrserver1.example.com:/data

service autofs restart

chkconfig autofs on

When you mount the other filesystem, you should unmount the mounted filesystem, Automount feature of linux helps to mount at access time and after certain seconds, when user unaccess the mounted directory, automatically unmount the filesystem.

/etc/auto.master is the master configuration file for autofs service. When you startthe service, it reads the mount point as defined in /etc/auto.master.

Do the following steps as:

1.useradd eric

Very tricky question given to you that this user should not belongs to sysadmin group.

According to question, log server is already configured. We have to configure the mail, web and dns server for log redirection.

In mail, web and dns server:

1.vi /etc/syslog.conf

mail.*@logserveraddress

2.service syslog restart

mail is the facility and * means the priority. It sends all logs of mail service to mail into log server.

Do the following steps as:

1. Insert the CD on CD-ROM and start the system.

2. In Boot: Prompt typelinux askmethod

3. It will display the language, keyboard selection.

4. It will ask you for the installation method.

5. Select the NFS Image from the list

6. It will ask the IP Address, Net mask, Gateway and Name Server. Select Use

Dynamic IP Configuration: because DHCP Server will be configured in your exam lab.

7. It will ask for the NFS Server Name and Redhat Enterprise Linux Directory.

Specify the NFS Server: 172.24.254.254

Directory: /var/ftp/pub

8. After Connecting to the NFS Server Installation start in GUI. Go up to the partition screen by selecting the different Options.

9. Create the partition According to the Question because Size and what-what partition should you create at installation time is specified in your question

10.Create the two RAID partitions having equal size of remaining all free space.

11.Click on RAID button

12.Type mount point /data

13.Select RAID Level 0

14.Click on ok

15. Then select the MBR Options, time zone and go upto package selections.

It is another Most Important Time of installation. Due to the time limit, you should care about the installation packages. At Exam time you these packages are enough.

X-Window System

GNOME Desktop

(these two packages are generally not required)

Administration Tools.

System Tools

Windows File Server

FTP Servers

Mail Servers

Web Servers

Network Servers

Editors

Text Based Internet

Server Configuration Tools

Base

Printing Supports

When installation will complete, your system will reboot. Jump for another Question.

Do the following steps as:

1.rpm –ivh ftp://server1.example.com/pub/zsh-*

2.Package will install

rpm command is used to install, update and remove the package, -i means install, -v means verbose and -h means display the hash mark.

Do the following steps as:

1. Go to on that directory where you want to restore.

2. restore –rf /dev/st0

To restore from backup we use the restore command. Here backup will restore from /dev/st0 on current Directory.

Do the following steps as:

1.vi /var/schedule

30 17 * * * /sbin/dump -0u /dev/st0 /dev/hda7

2.crontab /var/schedule

3.service crond restart

We can add the cron schedule either by specifying the scripts path on /etc/crontab file or by creating on text file on crontab pattern.

cron helps to schedule on recurring events. Pattern of cron is:

MinuteHourDay of MonthMonthDay of WeekCommands

0-590-231-311-120-7 where 0 and 7 means Sunday.

Note * means every. To execute the command on every two minutes */2.

While you load the X Window System, you will get the problem. To troubleshoot follow the following steps:

1.Check the /tmp is full ?

2.Check your quota, hard limit is already crossed ?

3.Check xfs service is running ?

4.Boot the system on runlevel 3 and execute the system-config-display command

5.Edit the /etc/inittab to set default runlevel 5.

id:5:initdefault:

This is boot related problem. There will be same questions repeated two times but problem is different.

First When you restart the system you will get the Error:

File Not Found

mount: error 15 mounting ext3

mount: error 2 mounting none

switchroot: mount failed: 22

umount /initrd/dev/: 2

Kernel Panic: no syncing: Attempted to kill init !

Restart the System

Check the grub boot loader configuration by pressing e shortcut key.

You will see like:

root (hd0,0)

kernel /vmlinuz-2.6.9-5.EL ro root= / rhgb quiet

initrd /initrd-2.6.9-5.EL.img

OR

root (hd0,0)

kernel /vmlinuz-2.6.9-5.EL ro root=LABEL=/root rhgb quiet

initrd /initrd-2.6.9-5.EL.img

Then Edit Boot loader to make like

root (hd0,0)

kernel /vmlinuz-2.6.9-5.EL ro root=LABEL=/ rhgb quiet

initrd /initrd-2.6.9-5.EL.img

Check all lines and edit as same as above. Press b to boot the system

After booting the system you should correct the /etc/grub.conf file.

If still you are getting Error likeFile not found, it seems that either kernel file or initrd file is missing. To troubleshoot with these problem, boot the system on rescue mode.

linux rescue

chroot /mnt/sysimage

Check the files on /boot, if not available install the kernel package from ftp or nfs server

Create the initrd image file on boot using: mkinitrd initrd-2.6.9-5.EL.img `uname –r`

Do the following steps as:

1.rpm –ivhftp://server1/example.com/pub/updates/zsh-*

or

1.Login to ftp server : ftpftp://server1.example.comusing anonymous user.

2.Change the directory: cd pub and cd updates

3.Download the package: mget zsh-*

4.Quit from the ftp prompt : bye

5.Install the package

6.rpm -ivh zsh-*

7.Verify Either package installed or not : rpm -q zsh

We know that every files/directories are owned by certain user and group. And Permissions are defines to owner user, owner group and other.

-rwxr-x---Full permission to owner user, read and write to owner group and no permission to others.

According to question: We should give the full permission to user user1 without changing the previous permission.

ACL (Access Control List), in ext3 file system we can give permission to certain user and certain group without changing previous permission. But that partition should mount using acl option. Follow the steps

vi /etc/fstab

/dev/hda14/dataext3defaults,acl0 1

Either Reboot or use: mount –o remount /data

setfacl –m u:user1:rwx /data

Verify using: getfacl /data

Do the following steps as:

1.First check the size of Logical Volume: lvdisplay /dev/vo/myvol

2.Increase the Size of Logical Volume: lvextend -L+121M /dev/vo/myvol

3.Make Available the size on online: ext2online /dev/vo/myvol

4.Verify the Size of Logical Volume: lvdisplay /dev/vo/myvol

5.Verify that the size comes in online or not: df -h

We can extend the size of logical Volume using the lvextend command. As well as to decrease the size of Logical Volume, use the lvresize command. In LVM v2 we can extend the size of Logical Volume without unmount as well as we can bring the size of Logical Volume on online using ext2online command.

Do the following steps as:

Quotas are used to limit a user's or a group of users' ability to consume disk space. This prevents a small group of users from monopolizing disk capacity and potentially interfering with other users or the entire system. Disk quotas are commonly used by ISPs, by Web hosting companies, on FTP sites, and on corporate file servers to ensure continued availability of their systems.

Without quotas, one or more users can upload files on an FTP server to the point of filling a filesystem. Once the affected partition is full, other users are effectively denied upload access to the disk. This is also a reason to mount different filesystem directories on different partitions. For example, if you only had partitions for your root (/) directory and swap space, someone uploading to your computer could fill up all of the space in your root directory (/). Without at least a little free space in the root directory (/), your system could become unstable or even crash.

You have two ways to set quotas for users. You can limit users by inodes or by kilobyte-sized disk blocks. Every Linux file requires an inode. Therefore, you can limit users bythe number of files or by absolute space. You can set up different quotas for different filesystems. For example, you can set different quotas for users on the /home and /tmp directories if they are mounted on their own partitions.

Limits on disk blocks restrict the amount of disk space available to a user on your system. Older versions of Red Hat Linux included LinuxConf, which included a graphical tool to configure quotas. As of this writing, Red Hat no longer has a graphical quota configuration tool. Today, you can configure quotas on RHEL only through the command line interface.

1. vi /etc/fstab

/dev/hda11/dataext3defaults,usrquota 1 2

2. Either Reboot the System or remount the partition.

Mount –o remount /dev/hda11 /data

3. touch /data/aquota.user

4. quotacheck –ufm /data

5. quotaon -u /data

6. edquota –u user1 /data

and Specified the Soft limit and hard limit on opened file.

To verify either quota is working or not:

Soft limit specify the limit to generate warnings to users and hard limit can’t cross by the user. Use the quota command or repquota command to monitor the quota information.

Do the following steps as:

1. /proc is the virtual filesystem, we use /proc to modify the kernel parameters at running time.

# echo “1” >/proc/sys/net/ipv4/ip_forward

2. /etc/sysctl.confwhen System Reboot on next time, /etc/rc.d/rc.sysinit scripts reads the file /etc/sysctl.conf. To enable the IP forwarding on next reboot also you need to set the parameter.

net.ipv4.ip_forward=1

Here 0 means disable, 1 means enable.

Very Easy question, nameserver is specified in question,

1.vi /etc/resolv.conf

nameserver 192.168.0.254

2.host server1.example.com

This is boot related problem. There will be same questions repeated two times but problem is different.

First When you restart the system you will get the Error:

mount: error 15 mounting ext3

mount: error 2 mounting none

switchroot: mount failed: 22

umount /initrd/dev/: 2

Kernel Panic: no syncing: Attempted to kill init !

This error occurred in your system before showing welcome redhat linux. That means problem in grub boot loader.

Restart the System

Check the grub boot loader configuration by pressing e shortcut key.

You will see like:

root (hd0,0)

kernel /vmlinuz-2.6.9-5.EL ro root= / rhgb quiet

initrd /initrd-2.6.9-5.EL.img

OR

root (hd0,0)

kernel /vmlinuz-2.6.9-5.EL ro root=LABEL=/root rhgb quiet

initrd /initrd-2.6.9-5.EL.img

Then Edit Boot loader to make like

root (hd0,0)

kernel /vmlinuz-2.6.9-5.EL ro root=LABEL=/ rhgb quiet

initrd /initrd-2.6.9-5.EL.img

Check all lines and edit as same as above. Press b to boot the system

After booting the system you should correct the /etc/grub.conf file.

Do the following steps as:

1.vi /etc/mail/local-host-names

example.com

2.vi /etc/mail/sendmail.mc

dnl # DEAMON_OPTIONS(`Port=smtp,Addr=127.0.0.1,Name=MTA`)dnl

3.m4 /etc/mail/sendmail.mc >/etc/mail/sendmail.cf

4.vi /etc/mail/access

192.168.0RELAY

@cracker.orgREJECT

5.service sendmail start | restart

6.chkconfig dovecot on

7.vi /etc/dovecot.conf

protocols = pop3 pop3s imap imaps

8.service dovecot start | restart

9.chkconfig dovecot on

10.vi /etc/aliases

user5:user2

11.newaliases

/etc/mail/local-host-names file contains the aliases to hostname. Mail server program reads the /etc/mail/sendmail.cf. To change the configuration on mail server, we should edit the /etc/mail/sendmail.mc file and should generate the sendmail.cf using m4 command.

By default sendmail server allows to connect to local host only. So we should edit the /etc/mail/sendmail.mc file to allow connect to other hosts.

By default sendmail server will not forward mail. we should specify on /etc/mail/access to relay or to block mail coming from domain or network or individual email address.

By default dovecot service start only the imap protocol. To start pop protocol with dovecot, we should write in /etc/dovecot.conf file.

Using /etc/aliases file we can map the user name to send mail of one user to another user. To rebuild database we use the newaliases command.

Do the following steps as:

1.iptables –t filter –A INPUT –s ! 192.168.0.0/24 –p tcp --dport 22 –j DROP

iptables is the build-in firewall tools, used to filter the packets and for nat. By identifying Source Address, Destination Address, type of protocol, source anddestination port we can filter the packets.

-sSource Address

-dDestination Address

-pLayer 3 Protocol

-dDestination Address

--sportSource Prot

--dportDestination Port

-iIncoming Interface

-oOutgoing Interface

-tTable either filter or nat or mangle

-AChain can be either INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING.

ssh service use the 22 port so we can block connection from outside the LAN.

Do the following steps as:

1.vi /etc/samba/smb.conf

[global]

netbios name=station?

workgroup = mygroup

server string=Share from Linux Server

security=user

smb passwd file=/etc/samba/smbpasswd

encrypt passwords=yes

[data]

path=/data

writable=yes

public=no

browsable=yes

valid users=user1 user2

2.smbpasswd –a user1

3.smbpasswd –a user2

4.service smb start | restart

5.chkconfig smb on

Samba servers helps to share the data between linux and windows. Configuration file is /etc/samba/smb.conf. There are some pre-defined section, i. globaluse to define the global options, ii. Printersuse to share the printers, iii. homesuse the share the user’s home directory.

Security=uservalidation by samba username and password. May be there are other users also. To allow certain share to certain user we should use valid users option.

smbpasswdHelps to change user’s smb password. –a option specifies that the username following should be added to the local smbpasswd file.

Do the following steps as:

1.vi /etc/hosts.deny

nfs,portmap:ALL EXCEPT .example.com, trusted.cracker.org

We can secure the services using tcp_wrappers. There are main two files, /etc/hosts.allow and /etc/hosts.deny.

There will be three stage access checking

-Is access explicitly permitted? Means permitted from /etc/hosts.allow?

- Otherwise, Is access explicitly denied? Means denied from /etc/hosts.deny?

- Otherwise, by default permit access if neither condition matched.

To deny the services we can configure /etc/hosts.deny file using ALL and EXCEPT operation. Pattern of /etc/hosts.allow and /etc/hosts.deny file is:

Demon_list:client_list:options

In Client list can be either domain name or IP address.

Do the following steps as:

1.vi /etc/hosts.deny

sshd: 192.168.0. EXCEPT 192.168.0.4

We can secure the services using tcp_wrappers. There are main two files, /etc/hosts.allow and /etc/hosts.deny.

There will be three stage access checking

-Is access explicitly permitted? Means permitted from /etc/hosts.allow?

- Otherwise, Is access explicitly denied? Means denied from /etc/hosts.deny?

- Otherwise, by default permit access if neither condition matched.

To deny the services we can configure /etc/hosts.deny file using ALL and EXCEPT operation. Pattern of /etc/hosts.allow and /etc/hosts.deny file is:

Demon_list:client_list:options

In Client list can be either domain name or IP address.

Do the following steps as:

1.vi /etc/hosts.deny

ALL:.cracker.org EXCEPT trusted.cracker.org

We can secure the services using tcp_wrappers. There are main two files, /etc/hosts.allow and /etc/hosts.deny.

There will be three stage access checking

-Is access explicitly permitted? Means permitted from /etc/hosts.allow?

- Otherwise, Is access explicitly denied? Means denied from /etc/hosts.deny?

- Otherwise, by default permit access if neither condition matched.

To deny the services we can configure /etc/hosts.deny file using ALL and EXCEPT operation. Pattern of /etc/hosts.allow and /etc/hosts.deny file is:

Demon_list:client_list:options

In Client list can be either domain name or IP address.

Do the following steps as:

1.vi /etc/hosts.deny

dovecot:ALL EXCEPT .example.com, .my133t.org

We can secure the services using tcp_wrappers. There are main two files, /etc/hosts.allow and /etc/hosts.deny.

There will be three stage access checking

- Is access explicitly permitted? Means permitted from /etc/hosts.allow?

- Otherwise, Is access explicitly denied? Means denied from /etc/hosts.deny?

- Otherwise, by default permit access if neither condition matched.

To deny the services we can configure /etc/hosts.deny file using ALL and EXCEPT operation. Pattern of /etc/hosts.allow and /etc/hosts.deny file is:

Demon_list:client_list:options

In Client list can be either domain name or IP address.

Do the following steps as:

1.vi /etc/security/limits.conf

user1,user2-maxlogins1

@training-maxlogins5

2.vi /etc/pam.d/system-auth

sessionrequired/lib/security/pam_limits.so

To limit the number of process or number of logins, we should configure on /etc/security/limits.conf. First Columns contains the username separated by comma or @group name. Second column either hard or soft limits. Third columns called the item, maxloigns or nproc etc.

To identify the session of users we should call the pam_limits module in /etc/pam.d/system-auth.

Do the following steps as:

1.vi /etc/mail/local-host-names

example.com

2.vi /etc/mail/sendmail.mc

dnl # DEAMON_OPTIONS(`Port=smtp,Addr=127.0.0.1,Name=MTA`)dnl

MASQUERADE_AS(`example.com')dnl

define(`SMART_HOST',`smtp.abc.com')

3.m4 /etc/mail/sendmail.mc >/etc/mail/sendmail.cf

4.vi /etc/mail/virtusertable

info@example.comadmin@example.com

5.vi /etc/mail/access

192.168.0RELAY

/etc/mail/local-host-names file contains the aliases to hostname. Mail server program reads the /etc/mail/sendmail.cf. To change the configuration on mail server, we should edit the /etc/mail/sendmail.mc file and should generate the sendmail.cf using m4 command.

By default sendmail server allows to connect to local host only. So we should edit the/etc/mail/sendmail.mc file to allow connect to other hosts.

By default sendmail server will not forward mail. We should specify on /etc/mail/access to relay or to block mail coming from domain or network or individual email address.

To masquerade the address, MASQUERADE_AS option is in /etc/mail/sendmail.mc. SMART_HOST deliver all local mail locally and outgoing mail through another mail server.

/etc/mail/virtusertable file is used map virtual address to real address.

Eg.

info@example.comuser1@example.com

enquiry@example.comadmin@abc.com