Linux RAID (RedHat,CentOS,Fedora,SELinux)

Hi Everyone,
Today, I am going to explain that how you can create a software RAID in Linux (RedHat families). In this case, I am creating a RAID-5 with 3 disks and each disk has only 1 Giga bytes capacity. As you probably know, for RAID-5, we need at least 3 disks with the same size. So, RAID-5 writes data blocks to N-1 disks, in this case 2, and parity blocks to N disk which is 3 in this case. This means that we have 2 Giga bytes to use and RAID-5 always uses one disk for parity. And you may say that we are wasting 1 Giga bytes or 1 disk here, however you protect the system against the failure of one disk. Therefore, if one disk fails, you can replace it easily by another disk without being worry about losing data. Of course, RAID-5 has its own advantages and disadvantages but it is not related to this topic now.

So, I added 3 new raw disks. I can confirm that by running the fdisk -l command (Figure 1).

                                                                                Figure 1

The md command (Multiple Disks)is used to create a software RAID. The following command builds a RAID-5 array from my 3 disks (Figure 2) and activates it:

mdadm --create /dev/md0 --level=5 --raid-devices=3 /dev/sdb /dev/sdc /dev/sdd

                                                                               Figure 2

/proc/mdstat contains a summary of RAID/Array status. Run the following command:
cat /proc/mdstat (Figure 3)

                                                                             Figure 3

Also, take a look at the /var/log/messages file (Figure 4):

                                                                     Figure 4

Now, we need to dump the current RAID setup into a configuration file. Then, the configuration file can be read at startup or shutdown to esaily manage the array. Run the following commands (Figure 5):

echo "DEVICE /dev/sdb /dev/sdc /dev/sdd" > /etc/mdadm.conf
mdadm --detail --scan >> /etc/mdadm.conf

                                                                     Figure 5

The following command enables array to read the /etc/mdadm.conf file at startup:
mdadm -As /dev/md0

To stop the array manually, run the following command:
mdadm -S /dev/md0

To monitor our array and send notifications for any problems by email, add a MAILADDR line to the /etc/mdadm.conf. Then, start the service (Figure 6):

echo "MAILADDR root@localhost.localdomain" >> /etc/mdadm.conf
service mdmonitor start

To start mdmonitor at boot time, run the following command:
chkconfig mdmonitor on

                                                                        Figure 6

To simulate a failed disk, run the following command and then read the email notifications (Figure 7,8):
mdadm /dev/md0 -f /dev/sdc

Figure 7

Figure 8

Also, take a look at /var/log/messages file (Figure 9):

                                                                         Figure 9

To remove the disk from array and array configuration, run the following command (Figure 10):
mdadm /dev/md0 -r /dev/sdc

Now, replace the disk (if it supports Hot-swap drive hardware, otherwise turn off system) and run the following command to add the disk back to array (Figure 10):

mdadm /dev/md0 -a /dev/sdc

Take a look at the log file again (Figure 10):

                                                                         Figure 10

In order to use this RAID5 array, we need to format it and then mount it. Afterward, use df -h command to verify it (Figure 11):

                                                                             Figure 11

To mount the array at boot time, edit /etc/fstab and add the following line (Figure 12):
/dev/md0    /media/RAID5    ext4    defaults    0 0

                                                                          Figure 12

And that's all.
Hope you enjoyed.
Khosro Taraghi

tcpdump (Packet Sniffer)

Hello Everybody,
Today, I want to talk about very interesting tools called Tcpdump. Tcpdump is a packet sniffer like Wiresharck. It listenes to network traffic and record or print packets that meet your criteria of your choice.

Tcpdump is good for troubleshooting your network. For example, when you don't know what is the issue in your network or you know the issue but you want to discover the root of problem, Tcpdump can help you to solve these kind of issues.Tcpdump is also good for security purposes. For instance, you can find the source ip address of attackers to your network.

Tcpdump is installed in Linux by default. If not, you can install it by the following command:

yum install tcpdump

Tcpdump adjusts on the first network interface by default, for example eth0. However, you can change it the interface with -i flag.

tcpdump -i eth1

You can skip name lookups with tcpdump using -n flag. For instance, when the DNS is broken, you can use the following command:

tcpdump -n

The -v flag produces verbose output such as time to live, identification, total length and options in an IP paket. The -vv flag produces even more verbose output.

You can filter the packets by specific machine or network. For example, the following command filters the packets by source ip address:

tcpdump host 192.168.2.12

                                                                    Figure 1

                                                                  Figure 2

You can dump the output to a file for later use/review with -w flag. Note that tcpdump -w saves only packet headers by default. Use the -s option with a value of 1560 (MTU size) to capture whole packets.

                                                                  Figure 3

                                                                  Figure 4

Note:
You can't use cat command or other editors to look at the captured output file by above command. Look at the following picture (Figure 5).

                                                                    Figure 5

Instead, use the -r flag to see the output:
tcpdump -r name-of-file

                                                                   Figure 6

If you look at the above picture, the fist packet shows 192.168.2.12 with port number of 49025 sending a dns lookup request about mytestmachine.localhost to R1J. Since the server port number (53) is well known, tcpdump shows its symbolic name, Domain.

17:42:07.993359 IP 192.168.2.12.49025 > R1J.domain: 2821+ A? mytestmachine.localhost. (41)

In short, tcpdump is a tool known as packet sniffers. It listens to network traffic and record or print packets that meet your criteria of your choice in human-readable form.

Hope you enjoyed.
Khosro Tataghi

OSSEC: Host-Based Intrusion Detection In Linux (RedHat Families)

Hello Everybody,
Today, I would like to talk about a very interesting tools called OSSEC. OSSEC detects intrusions and attempted intrusions and it's also hosed-based intrusion detection system(HIDS). OSSEC is a free software under the GNU General Public License and it's available for Linux, Windows, Solaris,HP-UX, and AIX.

OSSEC provides the following services:

1. Log analysis
2. Rootkit detection
3. File integrity checking
4. Policy monitoring
5. Real-time and time-based alerting
6. Active response

So, you can activate OSSEC on your servers and it will send you alerts or take a proper action according to a set of rules that you define and configure if something goes wrong since it monitors your servers. So, it's like a 24/7 body guard for your servers.

OSSEC has two important elements:
1. OSSEC Manager (Server)
2. OSSEC Agent (Client)

Ossec manager stores all data related to file integrity checking, logs, events, rules, and configuration options for entire network. The OSSEC manager connects to OSSEC agent and get alls necessary information regardless of its operation system. And, of course, all communications between servers and agents is encrypted and secure. You need to create a key for each agent on the server. I explained it below.

OSSEC Server Installation
Unfortunately, you can't install OSSEC from repository with yum command and it's not in repository yet. So, you will need to download the source code. Login to the computer that you want to install OSSEC Server and download the source code directly or use wget command:

wget http://ossec.net/files/ossec-hids-latest.tar.gz

                                                                     Figure 1

Use tar command to decompress the file:
tar -zxvf ossec-hids-latest.tar.gz
Change directory:
cd ossec-hids-*
Run install.sh script to start OSSEC installation
./install.sh

                                                                    Figure 2


Type "server" and press enter. (Figure 3)
Press Enter again to accept the default location. (Figure 3)

                                                                   Figure 3

Type "y" to accept email notifications and then enter your email address. The easiest way for test purposes is that enter you local root email address if you don't have SMTP server, in this case: root@localhost.localdomain.
Enter127.0.0.1 for the ip of your smtp server.If you have smtp server,change it accordingly(Figure 4).
Enter "y" to run integrity check deamon (Figure 4).
Enter "y" to run the rootkit detection engine (Figure 4).
Enter "y" to enable enable active response (Figure 4).
Enter "y" to enbale the firewall-drop response (Figure 4).

                                                                 Figure 4

The ip of white list is up to you, in this case I entered "n" (Figure 5).
Enter "y" to enable remote syslog (Figure 5).

                                                                     Figure 5

Take a look to the comments before finishing installation. It's self explanatory.

                                                                     (Figure 6)

As it said in the comments (Figure 7), run /var/ossec/bin/manage_agents to add agents

                                                                     (Figure 7)

Select "A" to add an agent (Figure 8).
Type a unique name for the new agent, in this case: MyRemoteTestMachine (Figure 8).
Enter the ip address of ossec agent(client) (Figure 8).
And enter "y" to confirm adding agent (Figure 8). Pay attention to agent id of 001.

                                                                               (Figure 8)

Now, enter "E" to generate a key for agent (Figure 9).
enter agent id, in this case 001 (Figure 9).
Copy and paste or keep the generate key. We need the key later to import it in ossec agent.

                                                                                (Figure 9)


OSSEC Agent installation (Client)
Same as server, download, extract, and run installation script in the client computer (Figure 10).
This time, select "Agent" and accept the default path for installation (Figure 10).
Enter the ip of OSSEC server (Figure 10).

                                                                      Figure 10

Enter "y" for running integrity check deamon, rootkit detection engine, and avtive response (Figure 11)

                                                                      Figure 11

Take a look at comments now (Figure 12).

                                                                          Figure 12

Run /var/ossec/bin/manage_agents to import the key (Figure 13).
select "I" and paste the key here. Then confirm it (Figure 13).

Open port 1514 (UDP) if there is a firewall between the server and the agents (not applicable to the local installation type)
iptables -I INPUT -p udp --dport 1514 -j ACCEPT

After you have made this changes, restart the OSSEC agent and OSSEC server:
/var/ossec/bin/ossec-control restart



Testing OSSEC
In order to test our configured OSSEC, try to login to root with incorrect password in the client (Figure 14)

                                                                            (Figure 14)

Now, go to OSSEC server and login in as root. Then open your emails with mail command (Figure 15)

                                                                             (Figure 15)

Open your email and see notification (Figure 16)

                                                                   (Figure 16)

The majority of the configuration is stored on the server in the /var/ossec/etc/ossec.conf file.

Conclusion
OSSEC is a host-based intrusion detection system (HIDS). OSSEC is free software and is available as source code under the GNU General Public License. OSSEC runs on the systems of interest and monitors their activity. It can send alerts or take action according to a set of rules that you configure.

Hope you enjoyed.
Khosro Taraghi

The Samba Web Administration Tool (SWAT)

Hello everybody,
Today, I would like to talk about a very interesting tools for Samba. It's called The Samba Web Administration Tool (SWAT). Redhat families no longer use GUI tools for configuring Samba. Instead, they use a web-based administration tools for this purpose. It's really easy to use and it's fully funcational with sufficient help pages.

In order to install Samba server, Samba client, and SWAT, you need to install the following
packages:
yum install samba samba-client samba-common samba-doc samba-domainjoin-gui samba-swat

To activate SWAT, you need to start/restart xinetd service. Also, you can use chkconfig command to enable SWAT after rebooting machine:
chkconfig swat on
service xinetd start  
service xinetd restart   ---> if it already started

Then, you can access the SWAT by using the following url in local machine:

http://localhost:901

For sure, you can access SWAT from a remote location, but you need to open port 901 in firewall by following command: 
iptables -I INPUT -p tcp --dport 901 -j ACCEPT

Also, you must change the
only_from = 127.0.0.1
line in the /etc/xinetd.d/swat file to
only_from = ip-address-of-remote-machine
which is 192.168.2.6 in my case. Please adjust your ip address accordingly.

                                                                         Figure 1

Then restart xinetd:      service xinetd restart
In browser, when you connect to swat, it will ask you for username and password. Enter the root user account and its password, then you will see the SWAT homepage:

                                                                            Figure 2

In Homepage, you can find a very good Samba documentation.
In Global, by clicking GLOBALS icon on top Menu, you can change the global setting in the smb.conf configuration file. For example,
workgroup = MYGROUP   --> It’s set to the default workgroup for Microsoft Windows 7. If you are using workgroup in your network, you can adjust it accordingly.
or
netbios name = LOCALHOST   -->It can be the same hostname used for the system. This becomes what other clients see in network browse lists such as those shown from a Microsoft net view command or a regular Linux smbclient command.

You can always switch between Basic and Advance view of configurations. Advance view gives you sufficient details:

                                                                         Figure 3

I am not going to explain every single line in this tools since it's a lot and beyond of this discussion. I assumed that you know the Samba configuration and this topic is just to introduce SWAT. Nevertheless, I will show you how to share a folder in Samba with this tools.Also, there is always a link (Help) beside each option that gives you a lot of information.

Note: when you change something in options, you must click on Commit Changes button to save your changes. 

Note: You must open firewall for samba server. To do this, enter the following command:

iptables -I INPUT -p tcp --dport 139 -j ACCEPT
iptables -I INPUT -p tcp --dport 445 -j ACCEPT
iptables -I INPUT -p udp --dport 137 -j ACCEPT
iptables -I INPUT -p udp --dport 138 -j ACCEPT

Now, I am going to show you how to create a share folder in Samba server to be accessible by all Linux and Windows clients by using SWAT.

Make a directory that you want to share and put some dummy files in Samba server.
 
mkdir /home/khosro/Samba-Test
touch /home/khosro/Samba-Test/test.txt

In GLOBALS, change netbios name to whatever you want. In this case, KHOSROHOST. This becomes what other clients see in network browse lists.
In SHARES, enter the path to the directory that you made above. In this case: /home/khosro/Samba-Test and then click on Create Share button.

                                                                               Figure 4

Next, select the created share path in drop down menu and press Choose Share button. It will open the Basic Options view for share folder.

                                                                               Figure 5

Next, I just put my comment in Comment, my username(khosro) as valid users, change Read Only to No and Available to Yes. Then click Commit Changes.

Now, click STATUS icon on top menu and start smbd service:

                                                                         Figure 6

Next, create a samba user either by clicking PASSWORD icon or through terminal in samba server:
smbpasswd -a khosro

 

Figure 7

Click on VIEW icon to see your configurations:

                                                                         Figure 8

Now, open My Computer in Windows client and enter the samba server's ip address:
in this case: \\192.168.2.2

It prompts you for username and password. Enter your samba username and password that you created in previous step:

                                                                          Figure 9

After entering username and password, it shows you all shares:

                                                                         Figure 10

Now, if you click on share folder, you will see the following error:

                                                                         Figure 11

Because of SELinux setting, you see this error. Don't panic. You can solve this error by following command in samba server:

chcon -t samba_share_t /home/khosro
chcon -R -t samba_share_t /home/khosro/Samba-Test

In addition, to make sure the changes survive a relabel of SELinux, you’ll want to set up the file_contexts.local file in the /etc/selinux/targeted/contexts/files directory with a command such as the following:

semanage fcontext -a -t samba_share_t /home/khosro/Samba-Test 
semanage fcontext -a -t samba_share_t /home/khosro

Now, you are able to go to only /home/khosro/Samba-Test directory as a share folder and you don't have access to other folders under /home/khosro

 

Figure 12

By clicking the Server Status icon, you would see the current server status:

                                                                       Figure 13

And that's all. Hope you enjoyed.
Khosro Taraghi

What Is TCP Wrappers And How To Configure It

Hello everybody,

TCP Wrappers protects Linux services, and of course, protects those services that communicate using the TCP protocol. It's really useful and very important because it gives you an extra layer of protection, especially for those services, such as vsFTP, that you can NOT limit access by IP address in the main configuration file; you can limit access by user and chroot jail in configuration file of vsFTP, but you should use TCP Wrappers to limit access by IP address.

How Do You Find a Service Is Protected by TCP Wrappers:

First, you should install the service that you want to use or make sure the service has been installed. For example, the following command will return all ssh packages that already installed
rpm -qa | grep ssh

Second, the word associated with TCP Wrappers is "hosts_access". So, you can use the "strings" command to look for "hosts_access" string in all binary files of services. Here is a script that I created to help you to find those services that support TCP Wrappers (Figure 1):

                                                                             Figure 1


Now, the associated library wrapper file linked to services is libwrap.so.0. So, you can use the ldd command to list the libraries used by the services, and of course, you can filter out the output by grep command (Figure 2):

                                                                             Figure 2

In this case, I used sshd service. After running the above command, I was sure that TCP Wrappers support sshd.

Configure TCP Wrappers

The configuration files for TCP Wrappers are /etc/hosts.allow and /etc/hosts.deny. So, users and clients listed in hosts.allow have access to desired service and users and clients listed in hosts.deny have not access to desired service. And here is the order of precedence:

1.  First, it goes through the /etc/hosts.allow file. If it finds any match, it gives access and does NO more action or search.
2. If it doesn't match anything in /etc/hosts.allow, it goes through /etc/hosts.deny file. If it finds any match, it will deny access.
3. If it doesn't find any match in both hosts.allow and hosts.deny files, it gives access to the client by default.

Here is the format of both file:
daemon_list : client_list [ : shell command ]

• daemon list is a list of one or more daemon process names, such as sshd or xinetd.

• client list is a list of one or more host names, host addresses, patterns or wildcard that will be match against the client host name or address.

• Shell Command is optional and can run a shell command if it matches any.

Let's say some examples:
ALL : ALL  ---> This line in "hosts.allow" file means grant access for all services to everybody

sshd : 10.0.0.153  ---> This line in hosts.deny file means deny access for sshd service to just 10.0.0.153 ip address(figure 3)
Obviously, if this line exists in both file, the mentioned ip address will be granted because hosts.allow has precedence to hosts.deny

ALL : .khosro.com  ---> (.) means all hosts with the specified domain name or IP network address. In this case, access to all hosts on the khosro.com domain for all services if it's in the hosts.allow

sshd : 10.0.0.0/255.255.255.0 EXCEPT 10.0.0.153  ---> You can specify IP network address with subnet mask and CIDR notation is NOT allowed, like 10.0.0.0/24. You can make an exception with EXCEPT operator. In this case, all IPs in 10.0.0.0/255.255.255.0 network have not access to sshd except 10.0.0.153 if this line exist in hosts.deny file.

sshd, xinetd : 10.0.0.153  ---> You can setup multiple services and addresses with commas.

sshd : user1@khosro.linux.com  ---> Grant access to the specific user if this line exists in the hosts.allow

Figures 3 to 5 show some good examples of TCP Wrappers with shell command:

Server A:

                                                                    Figure 3


Server B:

                                                                   Figure 4

Server A:

                                                                    Figure 5

"mail -s %d-%h root" is the command that send information to root user. The following expansions are available within shell commands:
%a (%A)              The client (server) host address.
%c                        Client information: user@host, user@address, a host name, or just an address, depending on how much information is available.
%d                       The daemon process name.
%h (%H)             The client (server) host name or address, if the host name is unavailable.
%n (%N)             The client (server) host name (or "unknown" or "paranoid").
%p                       The daemon process id.
%s                       Server information: daemon@host, daemon@address, or just a daemon name, depending on how much information is available.
%u                      The client user name (or "unknown").
%%                     Expands to a single ‘%´ character.
Characters in % expansions that may confuse the shell are replaced by underscores.

The safe_finger command comes with the tcpd wrapper. It limits possible damage from data sent
 by the remote finger server. It gives better protection than the standard finger command.

And that's all.
Hope you enjoyed.

Khosro Taraghi