Disallowing root access

Disallowing root access directly login from users is for the security purpose.
There are few way of doing it and depends on which suitable to your environment.

Changing the root shell

Edit the /etc/passwd file and change the shell from /bin/bash to /sbin/nologin for root

This will prevent access to the root shell and log the attempt. The following programs are prevented from accessing the root account. The following programs are prevented from accessing the root account:

• login
• gdm
• kdm
• xdm
• su
• ssh
• scp
• sftp

Programs that do not require a shell, such as FTP clients, mail clients, and many setuid programs are not effected. The following programs are also not prevented from accessing the root acount

• sudo
• FTP cleitns
• email clients

For sudo, users are not allow to use #sudo -i  to get access to root as this will load root profile settings and was prevented since we have make /sbin/nologin. However, you still can use #sudo -s

Disabling root SSH logins

Edit the /etc/ssh/sshd_config file and set the PermitRootLogin parameter to no.

This will prevents root access via the OpenSSH suite of tools. The following programs are prevented from accessing the root account:

• ssh
• scp
• sftp

If you intend to allow public key to access to root access, then you can change the PermitRootLogin parameter to without-password

Install Cacti for CentOS 6.3

Install Cacti in CentOS 6.3

First, install the rpmforge into your server repo from here http://wiki.centos.org/AdditionalResources/Repositories/RPMForge

Now install package needed using yum
# yum install httpd php php-mysql php-snmp mysql mysql-server net-snmp
# yum install cacti

Now Edit the cacti
# cd /etc/httpd/conf.d
# vim cacti.conf
edit the allow from 127.0.0.1 to suit your network

Now start up mysql
# /etc/init.d/mysqld start
For those just install mysql and havent setup yet, please setup using
# /usr/bin/mysql_secure_installation
and follow the guide show

Now lets create a database for cacti
# mysql -u root -p
> create database cacti;
> exit

Import the tables structure into mysql cacti database
# vim /var/www/cacti/cacti.sql
then put this above all command
     use cacti
save and exit
# mysql -u root -p < /var/www/cacti/cacti.sql

Then edit the php
# vim /var/www/cacti/include/config.php
key in the username and password for the mysql

$database_username = "root";
$database_password = "temp1234";

Now restart and start up the services

# /etc/init.d/mysqld restart

# /etc/init.d/httpd start

# /etc/init.d/snmpd start

Use browser to access your cacti

http://<your server IP>/cacti

Click "NEXT" for all

then login cacti interface using "admin" for both username and password

It will force you to change password after that

Congratz~ you are success install the Cacti server

htpasswd to protect a web pages

Lets say you have a have a smokeping services and you wish to protect it with a password. then you can use htpasswd to protect it.

First you need to cd to that folder
# cd  /opt/smokeping

then create a new htpasswd
and add user 'admin'
# htpasswd  -c /opt/smokeping/.htpasswd admin

If you have an existing htpasswd file, then you can just update it using
# htpasswd  /opt/smokeping/.htpasswd admin

after done, you need to enable this in the apache config
you need to add:

<Directory "/var/www/html/smokeping">

     AuthUserFile /opt/smokeping/.htpasswd

     AuthType Basic

     AuthName "Smokeping Admin Pages"

     Require valid-user

</Directory>

Then reload the Apache services

SSL cert

Generate the private key
# openssl genrsa -out myserver.key 2048

then generate the Certificate signing request (CSR) from the private key
# openssl req -new -key myserver.key -out myserver.csr

This key will be given to SSL authority to sign the cert and will return back a .crt file
After you get it, put it into apache server and append this into the httpd.conf


    SSLEngine On
    SSLCertificateKeyFile myserver.key
    SSLCertificateFile myserver.crt
    SSLCACertificateFile RapidSSL_CA_bundle.pem

Monitor System with AIDE and SAR

AIDE, Advanced intrusion detection environment is a tool to check the integrity of files on the system


Steps to deploy AIDE
1. install the aide package
2. customize  /etc/aide.conf  to your preference
3. run  /usr/sbin/aide --init  to build the initial database
4. Store  /etc/aide.conf, /usr/sbin/aide, /var/lib/aide/aide.db.new.gz in a secure location
5. Copy /var/lib/aide/aide.db.new.gz  to  /var/lib/aide/aide.db.gz
6. you can run the checking by # aide --check

Result will be display or save to /var/log/aide/aide.log by default


System Activity report

Install the sysstat package
run # sar -A to display all information collected
run # sar -u 2 5 to display five sample of system CPU usage with interval 2 second

Static route

The routing table for the system is display with the ip route show command.

Routing must be enabled with a tunable kernel parameter, named net.ipv4.ip_forward

- 0 = discard foreign packet
- 1 = forward foreign packets to the network interface determined by the routing table

Edit /etc/sysctl.conf  for permanent change and run sysctl -p to reload it



To add a route dynamically

# ip route add  IP/netmask  via  router_IP

To persistent add a route, edit  /etc/sysconfig/network-scripts/route-iface

ADDRESS0=network
NETMASK0=netmask
GATEWAY0=router_ip

Tuning kernel network parameter

Install kernel-doc RPM for the documentation

# sysctl -a
will show all the list

the kernel parameter are located at
/proc/sys/net/ipv4/