Hardening SSH Server In The DMZ(De Militarised Zone)

Its good to harden your box which is in DMZ.
What is DMZ?
Ans : DMZ is a De Militarised Zone where we will be keeping our servers, so that they can be access by out side people. Let me explain more about this DMZ. Who are not familiarise(And this activity is most of the time a Network admin work).
1. DMZ is a place where we will be isolate machines from companies local LAN.
2. These DMZ machines will have different IP address range and subnet.
3. The communication between two machines in DMZ is blocked for security reasons.
4. We cannot login to Local LAN machine from a DMZ machine, but we can login to DMZ machine from local LAN(only one way communication from LAN).
5. Ping to these machines will be disabled(most of the companies will do this for security reasons).
6. The way these machines communicate totally depends on network team what type of rule they set on their routers.
7. The security of DMZ machines are more when compared to local LAN machines(in other ways every thing is restricted to DMZ machines).
8. Only required ports are opened on DMZ machines and remaining ports are in closed or reject state(This should be done on system by Linux admin and on network level done by companies network engineer).

Once you keep your Linux machine in DMZ first and far-most thing to do is to secure SSH logins to the server.

In this post we will see some security measures for SSH to be taken when system is kept in DMZ. Most of the SSH settings are located in /etc/ssh/sshd_config (Red hat/Debian based systems).

1. Set Maximum failed login attempts, so after that many login attempts connection to the server is reseted and once again we have to connect to server.
MaxAuthTries 3
Here I have set failed login attempts to 3.

2. Disable root to login through SSH. This is a good option to force the user not to use root user to login to the server
PermitRootLogin no
Here we set it to no which indicates root can not login.

3. We should disable logging of users who donot have passwords.
PermitEmptyPasswords no

4. Allow only users who have passwords.
PasswordAuthentication yes

5. Specify who should access this server. I can say this one is more secure because SSH will allow only the users who are specified here.
AllowUsers test1 test2
Here I have allowed only two users i.e. test1 and test2.

6. Set-up a login banner to give warnings to the users how are logging in to that server
Banner /etc/ssh-banner
Please specify the warning message in /etc/ssh-banner.

Once done the above changes in /etc/ssh/sshd_config file just reload the ssh server.

Note : Don't restart SSH service on production servers. Its not advisable to do it. so in-order to update your changes always use reload option. Most of the services will support reload option with service command.
#service sshd reload

Please share your experience which you feel not mentioned in this post.

Like the post? Please Subscribe to free RSS feed to get updates

How To : FTPS Server Configuration

I used to astonish all the time when I see the FTP package name. vsftpd which abrivated to Very Secure File Transfer Demon(vsftpd). But when we see the security prospective of this package there is no much security included with this package. I mean when you login to server the credentials are transfered in plain text. So by defalut root user is not allowed to login to ftp server.

To eliminate transfering data in plain text and to encrypt the entire transmission we can take help from open ssl to generate a certificate and use SSL certificate when communicating with FTP server. This is nothing but a FTPS server.

Some file transfers you should know are.
1. TFTP(Trivial File Transfer Protocol which uses UDP for transmission) –high data rates/not secure
2. (This protocol uses SSH in backend, so you no need to run an FTP server) –secure
3. FTP(This is normal ftp transfer which uses TCP) –not secure
4. FTPS(FTP+SSL certificate to encrypt data transmission)
5. Over SSH(this is a kind of ftp tunnel on SSH protocol)

In this post we will see how you can configure SSL certificate for VSFTPD.

Step1 : Check the following packages on the server and if they are not install please install them.
#yum install openssl
#yum install vsftpd

Step2 : Generate rsa key in /etc/vsftpd folder as below.
#cd /etc/vsftpd
#/usr/bin/openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout vsftpd.pem -out vsftpd.pem

The clipped output for your reference
[root@v-itig42 vsftpd]# /usr/bin/openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout vsftpd.pem -out vsftpd.pem

Generating a 1024 bit RSA private key

....................................................++++++

..........................................++++++

writing new private key to 'vsftpd.pem'

-----

You are about to be asked to enter information that will be incorporated.
into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank.

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [GB]:IN

State or Province Name (full name) [Berkshire]:Andhra Pradesh
Locality Name (eg, city) [Newbury]:Vijaywada
Organization Name (eg, company) [My Company Ltd]:Linuxnix Systems Limited
Organizational Unit Name (eg, section) []: IT admin Group
Common Name (eg, your name or your server's hostname) []:ftp2.linuxnix.co.in

Email Address []:surendra@linuxnix.co.in

Step3 : Once the Certificate is generated, certificate is kept in /etc/vsftpd folder. We have to provide this entry in vsftpd.conf along some ssl configurations.

Step4 : Edit vsftpd.conf and give enteris at the last of the file.
#vi /etc/vsftpd/vsftpd.conf
#For SSL on specify yes to below option.
ssl_enable=YES
# To allow anonysonomous users to use SSL
allow_anon_ssl=YES
# if you want local users to use both ssl as well unsecure way of transmission of data plz specify no to below option.
force_local_data_ssl=NO
#If you want to allow all the login credentials which are transmitted should be sent with encryption #pleas use below option to force them to use only ssl connection at the time of login.
force_local_logins_ssl=YES
# Permit TLS v1 protocol connections. TLS v1 connections are preferred
ssl_tlsv1=YES
# Permit SSL v2 protocol connections. TLS v1 connections are preferred
ssl_sslv2=NO
# permit SSL v3 protocol connections. TLS v1 connections are preferred
ssl_sslv3=NO
#Please pecifies the location of the RSA certificate to use for SSL encrypted connections
, which we #created some time back.
rsa_cert_file=/etc/vsftpd/vsftpd.pem
Now save and exit the vsftpd file

Step5 : Restart the vsftpd service.
# service vsftpd restart
Shutting down vsftpd: [ OK ]
Starting vsftpd for vsftpd: [ OK ]


Start accessing the ftp server with user name credentials with filezila or some other FTP clients which will support SSL/TSL. If you want to access ftps sites through browsers its not possible. We have to have addon called fireftp. Then only we can access ftps:// site. Here in this example I used filezila.

Like the post? Please Subscribe to free RSS feed to get updates

IPTables In Linux Explained

IPtables (Netfilter) :
IPtables is the default firewall for Linux. Its a vast subject which can not be covered in one post. I will try to give as much info as possible at the same time not to make it complex. Lets start with basics.

What is a firewall?
Ans : A firewall is a part of a computer system or network that is designed to block unauthorized access while permitting authorized communications --Wikipedia.org
A IPtables firewall contains tables which in tern contains rules to block or unblock a perticular communication.

A table can be a
1.Filter table -- Used to filter packets.
2.NAT(Network Adress Translator) table -- Used for NATing of source and destination ip address(Used for sharing internet)
3.Mangale table -- Its a combination of Filter and NAT tables
4.RAW table -- Used to for marking packets not to track.

1.Filter table : This is the default table which contaions three chains.
a.INPUT Chain : To apply a rule on packets which are coming into the system.
b.FORWARD Chain : For packets being routed through the system
c.OUTPUT Chain : For packets locally generated which are going out from the system.

2.NAT table : This table is having three chains.
a.PREROUTING Chain : For altering the packets as soon as they come in to the system
b.OUTPUT Chain : For packets locally generated which are going out from the system.
c.POSTROUTING Chain : For altering the packets which are about to go out from the system.

3.MANGLE Table : This is a combination of forwording, security and translating packets. We can say this one as hybride table of both FILTER and NAT table. This contains five chains.
1.PREROUTING
2.OUTPUT
3.INPUT
4.FORWARD
5.POSTROUTING

4.RAW Table : Contaions two chains.
1.PREROUTING
2.OUTPUT

So lets go to the configuration of IPTables : In the following examples I will be taking FILTER Table to explain.

Example1 : To see/list what are the rules configured in the system
#iptables -L -t filter
This will list all the rules which are created under FILTER Table
-L for listing
-t for specifying table type(here table type is FILTER)
#iptables -L -t nat
#iptables -L -t mangle
#iptables -L -t raw
These three iptables are self explantory.

Example2 : Inserting a rule in to a table
#iptables -I INPUT 2 -t filter -s 192.168.0.1/24 -j DROP

-I for inserting a rule in to a table, so in this example I am inserting an INPUT rule and position two(2). So depending on number we can insert a rule in any position of a table.
-s for specifying the source of this packet. This source may be a IP adress/netmaks or a network-adress/netmask. -j for specifying what to do on the target packet. Here we specified to drop any packet which comes from 192.168.0.1, so there is no reply to the source about the packet status. With -j these are the options we can specify.

1.DROP -- For droping a packet with out informing the status of this packets to the source/destination. So there is no inforamtion to source/destination about the status of the packet.
2.REJECT -- Will reject the packets and information is sent to source/destantion about the rejection of packet by the server.
3.ACCEPT -- Will accpet for the delevery of the packet to designated destination.
4.QUEUE -- this is used to queue the packets to user space. Let me put in this way.. this is just to forward all the packets to some other utility(such as SNORT) which take care of packet filtering.

What actually this rule is specifying?
Ans : This rule specifies its an input rule at second position of the filter table to drop all the communication which is originating from 192.168.0.1

Example3 : To append a rule in to a table
#iptables -A INPUT -t filter -d 132.160.0.0/16 -j REJECT
-A for append a rule at the end of a table
-d for specifying the destination of this packet. This destination may be a IP adress/netmaks or a network-adress/netmask.

What actually this rule is specifing?
Ans : This rule specifies its an input rule which is appended to a filter table to reject all the packets which are destinated to 132.160.0.0 network.

Example4 : Deleting perticular rule
#iptables -D INPUT 3 -t filter
-D for specifing deletion of a rule

What actually this rule is specifing?
Ans : This rule specifies delete an input rule which is in third position of the filter table.

Example5 : Flushing/removeing entire table
#iptables -F -t filter
-F for specifing to flush/remove a table from iptables configuration.

What actually this rule is specifing?
Ans : This rule specifies flush/remove all the rules which are in filter table.

From here we will see how to block a
1.Blocking network
2.Blocking an ip address
3.Blockign Entire protocal stack
4.Blocking protocol
5.Blocking port(source port or Destination port)

Example6 : Blocking(Rejecting) a perticular network
#iptables -A INPUT -t filter -s 192.168.0.0/24 -j REJECT

What actually this rule do?
Ans : This rule specifies under filter table please block(REJECT) all traffic from 192.168.0.0 to 192.168.0.225 ip addresses, nothing but entire 192.168.0.0/24 network.

Example7 : Blocking(Rejecting) a perticular ip address
#iptables -A INPUT -t filter -s 123.45.0.1 -j REJECT

What acutally this rule do?
Ans : This rule specifies under filter table please block(REJECT) all the traffic originating from 192.168.0.1 ip address.

Example8 : Blocking(Rejecting) entire protocol stack.
#iptables -A INPUt -t filter -s 192.168.0.1 -p all -j REJECT

What acutally this rule do?
Ans : This rule specifies under filter table please block all the traffic with all the protocols(such as TCP,UDP,ICMP etc) which are origenating from 192.168.0.1 ip address.

Example9 : Blocking a perticular protocol
#iptables -A INPUT -t filter -s 192.168.0.1 -p tcp -j REJECT

What acutally this rule do?
Ans : This rule specifies under filter table please block all the traffic which uses tcp protocol to communicate from 192.168.0.1 ip address.

Example10 : Blocking perticular destination port
#iptables -A INPUT -t filter -s 192.168.0.1 -p tcp -dport 21 -s 192.168.0.1 -j REJECT

What acutally this rule do?
Ans : This rule specifies under filter table please block all the FTP(port no:21) traffic orignating from 192.168.0.1 ip address.

Example11 : Blocking perticular source port
#iptables -A OUTPUT -t filter -d 192.168.0.1 -p udp -sport 1929 -j REJECT

What acutally this rule do?
Ans : This rule specifies under filter table please block all the traffic which is origanting from server through port 1929 destinated to 192.168.0.1 to be blocked.

5.Saving iptable :
#service iptables save

Why we actually require to save iptables?
Ans : Most of the services in linux have their own configuration files so same will be applicable for the iptables. So when ever we do iptables save the configuration by default will be saved to /etc/sysconfig/iptables

6.Satrting iptables :
#service iptables start

7.Restarting iptables :
#service iptables restart

Checking wether iptables is running or not
#service iptables status

Please comment your thoughts regarding this post:-)

Like the post? Please Subscribe to free RSS feed to get updates

How To Use IPtables to Block ICMP (Internet Control Message Protocol) Requests?

How to use IPtables to block ICMP (Internet Control Message Protocol) requests?

Ans : To do this we have understand why we require this thing should be done.

When Hackers try to hack in to any machine first thing they will do is a basic ping test.

Code :
#ping target-machine
If this is succeed they will come to a conclusion that system is up and they can go forward and they can do DDOS attacks or try to find some other open ports using NMAP command.

Code :
#nmap target-machine
So if you are exposing a machine to outer world from your network, first disable incoming ping requests to your machine as follows.

So this can be done by two ways through IPtables

1. Reject the ICMP packets.

2. Drop the ICMP packets.

In the above mentioned methods best thing is to drop the ICMP packets, by doing this we are not giving any clue to hacker whether the system is alive or not. Where as if we do reject definitely hacker will come to know that ICMP packets are blocked and the system is live.

Step1 : Executing following command to drop all the incoming ICMP packets

#iptables –A INPUT –p icmp --icmp-type echo-request –j DROP

Let me explain this command

-A is to append this rule to already existing one.

INPUT specifies that it’s a

Step2 : Save this changes to IPtables file (/etc/sysconfig/iptables), restart the IPtables service and check your IPtables status whether your IPtables chain is updated or not.
#service iptables save
#service iptables restart
#iptables –L

How to allow icmp ping request in case you want them,First we have to remove the rule which we created for blocking the icmp ping.
#iptables –D INPUT –p icmp --icmp-type echo-request –j DROP

Then execute the following commands
#iptables –A INPUT –p icmp --icmp-type echo-request –j ACCEPT
#service iptables save
#service iptables restart

Some points to be noted
What are the methods used by hackers using this ICMP ping?
Though these are old denial-of-service attack (DoS attack), worth to learn them
Ping flood
Smurf attack
Ping to death

Please comment your thoughts regarding this post:-)

Like the post? Please Subscribe to free RSS feed to get updates

SNORT(IDS/IPS) Configuration and Implemenation

Lets start how to install SNORT which is An Intrusion detection system (IDS) and an Intrusion Prevention System (IPS). We tested installation of SNORT on RHEL5.

Step1 : Download following packages
libpcap-1.0.0.tar.gz
pcre-8.00.tar.gz
libnet-1.0.2a.tar.gz (This is optional package if you want SMB popup alerts on window’s machines.)
snort-2.8.5.1.tar.gz
acid-0.9.6b23.tar.gz

Note : Don’t try to install SNORT through rpm packages, try to install them from source packages because there will be so many dependencies. And install the above packages in the same order to resolve dependencies.

Step2 : Untar packages one by one.
#tar xvfz packagename.tar.gz

Step3 : Change the directory to libpcap-1.0.0 and Just run ./configure shell script, this will check system attributes and generate make file, which is used to install libpcap package as following.

#cd libpcap-1.0.0

#./configuration

#make

#make install

Note : If anything goes wrong please search that error message in google..

Step4 : After installing libpcap install pcre package for doing regular expression query in checking the packet capture to match multiple entries. First change the directory to pcre-8.00 then start executing following commands

#cd ../pcre-8.00

#./configure

#make

#make check

#make install

Step5 : Now install libnet package..
#cd ../libnet-1.0.2a
#./configure
#make
#make check
#make install

Step6 : Now install the important package in our game of implementing IDS/IDP ie our SNORT package. Just follow below commands to install SNORT. You have to be careful in this step because we can install SNORT in standalone system or a complete system with DB/web server/acid support. If you are planning to install SNORT in standalone just execute ./configure after changing to snort-2.8.5.1 directory. But here I am going to build a complete SNORT system will all the capabilities. Before that we should know what are the content of snort source directory. Please get some knowledge on it and read the required readme files in doc/ folder.

Note : Before installing SNORT do the following things (Before installation you can do this).

1. Make sure that you copy etc/ content in source directory to /etc directory

2. Create /var/log/ snort directory for snort logging activity (remember we have to mention this path in main configuration file, in our case it will be /etc/snort/etc/snort.conf.

3. Create /etc/snort/rules directory for creating rules files for snort.

#mkdir /etc/snort

# cp -ar ./etc /etc/snort/

#mkdir /var/log/snort

# mkdir /etc/snort/rules

Now start installing SNORT

# ./configure --with-mysql --with-snmp --enable-smbalerts --enable-flexresp

#make

#make check

#make install

Hmm..! good we are done with the installation of SNORT

So in the next post I will show you how to configure, integrate SNORT with Mysql and ACID.

Please Comment your thoughts regarding this post:-)

Like the post? Please Subscribe to free RSS feed to get updates

Which Reverse Proxy Is Good?

Recently I was assigned to work on reverse proxies So I did some brain storming of some know proxies such as Apache and Squid then Googled to find which are other good reverse proxies are available. There are so many open source reverse proxies in market. Out of these most popular are
1.Apache(this is having lots of disadvantages)
2.Squid
3.Pound

Which reverse proxy is good?
There are so many good reverse proxies some of them ar as below. Please comment on this with your favorite Reverse proxy servers.

Let us have a look on some proxies.
1.Lighttpd (pronounced "lighty" or "Light-TPD") is a web server designed to be secure, fast, standards-compliant and flexible while being optimized for speed-critical environments. Its low memory footprint (compared to other web servers), light CPU load and speed goals make lighttpd suitable for servers that are suffering load problems, or for serving static media separately from dynamic content. Run by many companies where requests are high. Lighttpd is used by some of the biggest websites, including sites such as meebo. Wikimedia runs Lighttpd servers as does SourceForge. Three of the most famous torrent listing websites, the Pirate Bay, Mininova and ISOHunt, which have more than 1,000 hits per second, also use Lighttpd.

Some Features:
1. Load-balancing FastCGI, SCGI and HTTP proxy support
2. Chroot support
3. Select()-/poll()-/epoll() based web server
4. Support for more efficient event notification schemes like kqueue and epoll
5. Conditional rewrites (mod_rewrite)
6. SSL and TLS support, via OpenSSL.
7. Authentication against an LDAP server
8. RRDtool statistics
9. Rule-based downloading with possibility of a script handling only Authentication
Server Side Includes support
10. Flexible virtual hosting
Modules support
11. Cache Meta Language (currently being replaced by mod_magnet) using the Lua programming language
12. Minimal WebDAV support
13. Servlet (AJP) support (in versions 1.5.x and up)
HTTP compression using mod_compress and the newer mod_deflate (1.5.x)
14. Light-weight (less than 1 MB)
Single-process design with only several threads. No processes or threads started per connection.

2.Nginx (pronounced as "engine X") is a lightweight, high performance
webserver/reverse proxy and e-mail (IMAP/POP3) proxy. It can serve 500 million requests per day. Currently nginx doing reverse proxy can serve over tens of millions of HTTP requests per day (that’s a few hundred per second) on a *single server*. At peak load it uses about 15MB RAM and 10% CPU. Under the same kind of load, apache falls over (after using 1000 or so processes and god knows how much RAM), pound falls over (too many threads, and using 400MB+ of RAM for all the thread stacks), and lighty *leaks* more than 20MB per hour (and uses more CPU, but not significantly more). Used by wordpress.com for high performance.
1. Handling of static files, index files and auto-indexing
2. Reverse proxy with caching
3. Load balancing
4. Fault tolerance
5. SSL support
6. FastCGI support, with caching.
7. Name- and IP-based virtual servers
8. FLV streaming
9. MP4 streaming, using the MP4 streaming module
10. Web page access authentication
11. SMTP, POP3 and IMAP proxy
12. STARTTLS support
13. SSL support

3.Pound is a lightweight open source reverse proxy program suitable to be used as a web server load balancing solution. Developed by an IT security company, it has a strong emphasis on security. Using regular expression matching on the requested URLs, Pound can pass different kinds of requests to different backend server groups.
1. Detects when a backend server fails or recovers, and bases its load balancing decisions on this information: if a backend server fails, it will not receive requests until it recovers
2. Decrypts https requests to http ones
3. Rejects incorrect requests
4. Can be used in a chroot environment
5. Has no special requirements concerning which web server software or browser to use
6. Supports virtual hosts

4.Varnish is an HTTP accelerator designed for content-heavy dynamic web sites. Good for even static content too. Varnish supports load balancing using both a round-robin and a random director, both with a per-backend weighting. Basic health-checking of back ends is also available.

5.Perlbal is a Perl-based reverse proxy load balancer and web server. The program is usually used by large web sites, to distribute the load over a number of servers. Perlbal also features a so-called "re-proxy" mechanism.

References:

http://www.ruby-forum.com/topic/96361
http://en.wikipedia.org/wiki/Reverse_proxy

Like the post? Please Subscribe to free RSS feed to get updates

How To Use VNSTAT To Monitor Bandwidth Usage.

There are so many tools to monitor network such as MRTG, now I am going to explain such tool which monitors bandwidth for a system, ie vnstat(view network statistics). Its very much easy to install and configure.

This tool can give you full details about how much bandwidth used on the basics of,

Per month.

Per week.

Per day.

Per hour.

Per second.

Even we can see live traffic. This is awesome tool .

So all the tools will not only have advantages but also disadvantages, here are they:

1)Can not monitor multiple interfaces at a time.

2)Can not monitor remote host.

3)Can not monitor per host statistics(which is verymuch useful to find the network hogger, if you want per host bandwidth analyser then use iptables counters for it).

Before configuring vnstat, one thing we have to keep in mind that vnstat is a aggregating tool which is required to run at regular intervals to monitor network bandwidth. So by default when we install vnstat a cron job is created at /etc/cron.d folder.

Step1 : installing vnstat

#rpm –ivh vnstat-1.6-2.fc9.i386.rpm

Step2 : Configuring vnstat.

As I mention earlier that vnstat is an aggregate tool so it should run background by using crontab, So first edit the cron job

Vi /etc/cron.d/vnstat

*/5 * * * * vnstat /usr/sbin/vnstat.cron

Add the above line to the file, then save it and exit.

Step3 : Specifying which interface to monitor

#vnstat –I interfacename

Example :

[root@test ~]# vnstat -i eth0

Error :

Unable to read database "/var/lib/vnstat/eth0".

eth0: Not enough data available yet.

Don’t worry about error intitially it will show error because it’s the first time you are executing that command, so it has to create DB.

Step4 : Monitoring bandwidth with different intervals

Type1 : For live traffic

#vmstat –l

-l is nothing but live

Example:

[root@test ~]# vnstat -l

Monitoring eth0... (press CTRL-C to stop)

rx: 8.32 kB/s 30 p/s tx: 0.19 kB/s 0 p/s

eth0 / traffic statistics

rx tx

--------------------------------------+----------------------------------------

bytes 206 kB 4 kB

--------------------------------------+----------------------------------------

max 11.19 kB/s 0.24 kB/s

average 7.96 kB/s 0.19 kB/s

min 6.35 kB/s 0.11 kB/s

--------------------------------------+----------------------------------------

packets 695 16

--------------------------------------+----------------------------------------

max 61 p/s 2 p/s

average 26 p/s 0 p/s

min 9 p/s 0 p/s

--------------------------------------+----------------------------------------

time 26 seconds

Type2 :For monitoring traffic per second

#vmstat –tr 5

This command will monitor bandwidth for 5 seconds and give you the output.

Type3 : For hourly

#vmstat –h

Example :

[root@test ~]# vnstat -h

eth0 21:00

^ r

r

r

r

r

r

r

r

r

r

-+--------------------------------------------------------------------------->

22 23 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21

h rx (kB) tx (kB) h rx (kB) tx (kB) h rx (kB) tx (kB)

22 0 0 06 0 0 14 0 0

23 0 0 07 0 0 15 0 0

00 0 0 08 0 0 16 0 0

01 0 0 09 0 0 17 0 0

02 0 0 10 0 0 18 0 0

03 0 0 11 0 0 19 0 0

04 0 0 12 0 0 20 12,614 41

05 0 0 13 0 0 21 0 0

 
Type4:For dialy

#vmstat –d

Example :

[root@test ~]# vnstat -d

eth0 / daily

day rx tx total

------------------------+-------------+----------------------------------------

09.09. 12.32 MB 41 kB 12.36 MB %%%%%%%%%%%%%%%%%%%%%%%%%

------------------------+-------------+----------------------------------------

estimated -- -- --

Type5 : For weekly

#vmstat –w

Example :

[root@test ~]# vnstat -w

eth0 / weekly

rx tx total

----------------------------+---------------+--------------

last 7 days 12.32 MB 41 kB 12.36 MB

current week 12.32 MB 41 kB 12.36 MB

----------------------------+---------------+--------------

estimated -- -- --

Type6 : For monthly

#vmstat –m

Example :

[root@test ~]# vnstat -m

eth0 / monthly

month rx tx total

-------------------------+--------------+--------------------------------------

Sep '09 12.32 MB 41 kB 12.36 MB %%%%%%%%%%%%%%%%%%%%%%

-------------------------+--------------+--------------------------------------

Please comment your thoughts about VNSTAT.

Like the post? Please Subscribe to free RSS feed to get updates

Disabling SELinux

Some basics of SELinux :
How to disable SElinux?
SElinux is a security feature which was shipped with RHEL5, it is much secure than any other security priviously such as PAM and Initd




Here we are going to see some basics of SElinux.

Step1:Seeing whether SELinux is enabled or not ?

#getenforce

Step2:To see SELinux status in elaborated way you can use sestatus
#sestatus
SElinux status : enabled
SELinux mount : /selinux
Current mode : enforcing
Mode from config file : enforcing
Policy version : 21
Policy from config file : targeted

From the above output we can see that SElinux is enabled and its in enforced mode.
and to see detailed status you can use -b option, this will give which service are SElinux enabled and which services are disabled.

setenforce
/etc/grub.conf and /etc/selinux/config

Step3:disabling SElinux
We can do it in two ways
1)Perminant way : edit /etc/selinux/config

change the status from enable to disable and selinux type from strict to targeted, after changes are made we have to restart, if the server's are in production and don't want to restart the server follow the temporary way of disabling it.

2)Temporary way : echo 0 > /selinux/enforceFor your info if you want to enable it again, try below commandecho 1 > /selinux/enforce.
Selinux is a vast subject and can not deal in one post, see for my other posts regarding Selinux.

Like the post? Please Subscribe to free RSS feed to get updates