FatMin

X11 No Worky - Worky

Yikes, was banging my head against a wall trying to get X11 forwarding working on my RHEL 6.1 box. Every time I ssh'd in and attempted to pop an xwindow back to my fedora desktop, I was greeted with the error message below.

# Error: no display specified

Ok, I thought to myself -- X11 forwarding is not enabled in sshd -- lets go fix it. However, when I checked /etc/ssh/sshd_config, I found that X11 forwarding was enabled. See the config item below, these needs to exist, and not set to no.

X11Forwarding yes

Ok so lets check what the display variable is set to. So I ran the command below, which retured absolutely nothing, which meant that its not set to anything at all.

# echo $DISPLAY

So I check my local box and check to make sure that forwarding is enabled. Which it is

#grep X11 /etc/ssh/ssh_config
ForwardX11 yes

After I bit of research on google - I found a bugzilla that sugguested I make sure that the following rpm was installed - xorg-x11-xauth.x86_64.  It wasn't..

yum install xorg-x11-xauth.x86_64

Then logout and back in again. You will be now be greeted by the line below.

/usr/bin/xauth:  creating new authority file /root/.Xauthority

Now check your display variable.

# echo $DISPLAY
localhost:10.0

Ah, much better

 

 

 

RHEL6 - More on Cryptsetup and Luks -- Removing Encryption

Way back in the day -- back in March of two thousand-naught-eleven, I added a blog post on how to encrypt a partion using crypsetup and luks on RHEL. Its title, ironically enought was, RHEL, How to Encrypt a Partition Using Cryptsetup and Luks.

Today we are going to talk about how to revert an encyrpted partion back to its unencrypted state so that i can use my usb drive normally again.

# cryptsetup status freeagent
/dev/mapper/freeagent is active.
  type:    LUKS1
  cipher:  aes-cbc-essiv:sha256
  keysize: 256 bits
  device:  /dev/sdd1
  offset:  4096 sectors
  size:    2930267906 sectors
  mode:    read/write

First take note of the device name and the name the dev mapper has given the device. The former is /dev/sdd1 and the latter is /dev/mapper/freeagent.

So first lets remove the key file mapping. You will be prompted for your LUKS passphrase

#cryptsetup luksRemoveKey /dev/sdd1
Enter LUKS passphrase to be deleted:

Then lets remove the dev/mapper mapping for /dev/sdd1. Once complete we are free to create a new filesystem on the disk as needed.

#cryptsetup remove /dev/mapper/freeagent /dev/sdd1

 

Disk Encryption: High-impact Strategies - What You Need to Know: Definitions, Adoptions, Impact, Benefits, Maturity, Vendors

RHEL6 - How to Setup an Anonymous FTP Server

Today on the fatmin we are going to setup an ftp server on RHEL6 that accepts anonymous uploads. We are going to do so with SELinux support and will be making modifications to iptables as well.

Installation:

First and formost we need to install vsftpd

# yum -y install vsftpd && service vsftpd start && chkconfig vsftpd on

Our anonymous upload directory will be /var/ftp/anon, and we need to change group ownership to the ftp group and then change permissions so that the members of that group can write to it. Note that no one other than root can read or execute anything under /var/ftp/anon.

# chgrp ftp /var/ftp/anon
# chmod 730 /var/ftp/anon
# ls -ld /var/ftp/anon
drwx-wx---. 3 root ftp 4096 Oct 19 13:34 /v1

 

SELinux Support:

Next we need to configure SELinux support and assign the correct context to the /v1 directory and its future contents. Note -a is add -t is type.

# semanage fcontext -a -t public_content_rw_t '/var/ftp/anon(/.*)'

Now lets go ahead and apply the new context. Note -vv is verbose, -F force and R is recursive

# restorecon -vvFR /var/ftp/anon

Now we need to get and set the allow_ftpd_anon_write boolean

# setsebool -P allow_ftpd_anon_write=1

Now lets check to make sure the setting "stuck".

# getsebool -a | grep allow_ftpd_anon_write
allow_ftpd_anon_write --> on

 

Configure Vsftpd:

Now vi /etc/vsftpd/vsftpd.conf and ensure that the following configuration values are set and uncommented. Note that I had to add the last line to my config file.

anonymous_enable=YES

anon_upload_enable=YES

chown_uploads=YES

chown_username=daemon

anon_umask=077

 

Configure iptables:

Add the following to /etc/sysconfig/iptables-config. In my case I only needed to add the ip_nat_ftp part to the line

IPTABLES_MODULES="nf_conntrack_ftp ip_nat_ftp"

Now you are going to want to make sure that these two lines exist in /etc/sysconfig/iptables.

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p tcp --dport 21 -j ACCEPT

Now restart iptables

Addendum:

Note that I ran into issues with the semanage command below.

# semanage fcontext -a -t public_content_rw_t '/var/ftp/anon(/.*)'

It seems that the context assigned to the /var/ftp/anon directory was not changing correctly from public_content_t to public_content_rw_t

# ls -Zd /var/ftp
drwxrwxrwx. root root system_u:object_r:public_content_t:s0 /var/ftp

However when I checked the file_contexts file all looked correct.

#cat /etc/selinux/targeted/contexts/files/file_contexts.local

/var/ftp/anon(/.*)    system_u:object_r:public_content_rw_t:s0

So I ran the chon command seen below and did not run the restorecon command. This worked as afterwards the context on the directory /var/ftp/anon was correct

chcon -R -t public_content_rw_t /var/ftp/anon

RHEL6 - How to Setup a Caching-Only DNS Server

First off lets get this straight, all DNS Servers cache. However, some DNS Servers intended to only provide the caching function.

A Caching-only DNS server does not contain zone information or a zone database. Its cache only contains information based on the results of queries that it has already performed. In this case, the cache takes the place of the zone database file for the lookups that you are already doing.

Here's how its done

First step you need to install bind via yum.

# yum install bind

Then modify /etc/named.conf and change these two lines

listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };

to this

listen-on port 53 { any; };
listen-on-v6 port 53 { any; };

then change this the dnssec-validation line to no as seen below.

dnssec-validation no;

Then configure named to accept lookups from its local network by changing the line below

allow-query     { localhost; };

To what you see below, note that 10.1.224.0 is my local network

allow-query     { localhost; 10.1.224.0/24; };

Now don't forget to insert a forwarders entry to forward requests to your local dns server. Look in your resolv.conf for this info.

forwarders { 10.100.4.16; };

Then modify your /etc/resolv.conf so that your machine uses itself for name lookups, you do this by adding the line below as the first nameserver.

nameserver localhost

Now start named and do an nslookup, the server and address should point back to local host.

# nslookup fatmin.com
Server:         127.0.0.1
Address:        127.0.0.1#53

Non-authoritative answer:
Name:   fatmin.com
Address: 64.202.189.170

RHEL6 - Simple Iptables How To

Your mother and I were talking last night about how important it is to properly configure Iptables, and how despite that fact, many just choose to disable it. So today we are going to discuss iptables.

Overview:

By far the easiest way to setup a simple firewall using Iptables is to use system-config-firewall, or system-config-firewall-tui. I prefer this method as iptables can be a bit confusing on the command line and in its config file (/etc/sysconfig/iptables) is not exactly user friendly. At the very least you can create a basic set of rules and then customize by hand. Lets take a look at the file in its default form on my RHEL 6 box.

But before we do that, lets review a couple of terms that we need to know.

1. INPUT - are inbound packets
2. OUTPUT are outbound packets
3. FORWARD - packets from another machine that the firewall should forward (like to a vm on the host).
4. ACCEPT - the packet is accepted
5. DROP - the packet is dropped as if it never existed
6. REJECT - the packed is rejected and and error message is returned to sender
7. RULE - the basic building block -- tells the firewall what to do with a packet
8. CHAIN - a list of all rules which will be checked in order from first to last
9. POLICY - the default action, like accept, drip, reject, forward

Now that you have memorized the list above, here is my /etc/sysconfig/iptables.

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited.

Now lets run system-config-firewall tui and enable apache and ftp, plus we want to configure our box to respond to ICMP ping requests. This process is pretty self explanitory once you start.

Once that is done lets view /etc/sysconfig/iptables again.

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type echo-request -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p icmp -m icmp --icmp-type echo-reply -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p icmp -m icmp --icmp-type destination-unreachable -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

Iptables Command:

The iptables command can be used in several different ways.

List the current rules in use, similar to viewing the /etc/sysconfig/iptables file

#iptables -L

To set a default policy use iptables -P, in the example below we are setting the default INPUT policy to DROP.

#iptables -P INPUT DROP

Now lets say we want to delete all our existing rules, note that i did not say policy

#iptables -F

To add a rule use iptables -a, for example lets say you have a default policy of INPUT DROP but we want to accept all established and related packets. Note that -m must be used when adding rules to a chain as it forces modprobe to load any necessary modules.

#iptables -A INPUT -m state --state ESTABLISHED, RELATED

Now lets say that we want to reject all packets from 192.168.10.10. Note -j specifies the action that the rule is to take -- in the case below, REJECT

#iptables -A INPUT -s 192.168.10.10 -j REJECT

Now lets say we want to ACCEPT all ICMP traffic from our local subnet. The -p is protocol

#iptables -A INPUT -p ICMP -s 192.168.1.0/24 -j ACCEPT

Please note that under RHEL you can use following commands to save firewall rules.Make sure that you do this before you restart iptables.

#service iptables save

 

RHEL6 -- Troubleshooting SELinux Violations

Dear Reader: Welcome to my third and not final installment on SELinux. The first two can be read here and here. They are exciting reads and are sure to have you on the edge of your seat.

Anyway, the best way to implement SELinux sucessfully is to know how to troubleshoot when things aren't going your way. If you panic at the first sign of trouble, you are just going to end up turning off SELinux and not reap the rich rewards that it will bring you in life. Now that I have convinced you to run SELinux lets get started.

First install the package setroubleshoot, which will send SELinux messages to our messages file.

yum -y install setroubleshoot-server.x86_64

Now you can search the messages file for SELinux Violations. Use sealert -l UUID to find information on a specific incident, or sealert -a  /var/log/audit.log to search an entire log file for violations.

In this specfic example, I created a test file and dropped it in /var/www/html, however I did not set the context to httpd_sys_content_t, then i attempted to view the file in a browser. Obviously access was denied. The output of sealert shows me the error and then tells me how to fix it.

Summary:

SELinux is preventing /usr/sbin/httpd "getattr" access to /var/www/html/file3.

Detailed Description:

SELinux denied access requested by httpd. /var/www/html/file3 may be a
mislabeled. /var/www/html/file3 default SELinux type is httpd_sys_content_t, but
its current type is admin_home_t. Changing this file back to the default type,
may fix your problem.

...TRUNCATED...

Allowing Access:

You can restore the default system context to this file by executing the
restorecon command. restorecon '/var/www/html/file3', if this file is a
directory, you can recursively restore using restorecon -R
'/var/www/html/file3'.

Fix Command:

/sbin/restorecon '/var/www/html/file3'

Boom goes the dynomite! Problem solved.

RHEL6 - Managing SELinux Booleans

This is my second post on SELinux. In case you missed the first one you can read it here. Today we are going to specifically discuss SELinux booleans

According to fedoraproject.org ,"SELinux booleans enable runtime customization of the SELinux policy. SELinux policy in Fedora has several booleans that allow you to quickly toggle a particular change in the policy." However i think its easier to explain them as SELinux configurations and settings that can be easily toggled on or toggled off.

The command getsebool -a is used to display available booleans, while setsebool is used to modify them. Using setsebool with the -P options makes that modification persistent across reboots.

To display a detailed list or booleans with descriptions run semanage boolean -l

Some common SELinux booleans are below.

_{ftp_home_dir   -> off   Allow ftp to read and write files in the user home directories}

_{httpd_enable_cgi     -> on    Allow httpd cgi support}

_{sftpd_anon_write      -> off   Allow anon internal-sftp to upload files, used for public file transfer services. Directories must be labeled public_content_rw_t.}

_{allow_ftpd_anon_write   -> off   Allow ftp servers to upload files,  used for public file transfer services. Directories must be labeled public_content_rw_t.}

 

 

 

RHEL6 - SELinux Modes and Contexts

SELinux, or Security-Enhanced Linux as its known by the guy who invented it, is a Linux feature that provides an additional level of security by setting rules for which processes can access which files, directories, ports, etc.

Display and Modify SELinux Modes:

You can use /etc/sysconfig/selinux to change the default SELinux mode at boot, and the setenforce command can be used to change the default level on the fly. Getenforce can be used to determine the current SELinux mode. 

# getenforce
Enforcing

Display SELinux Contexts:

Under SELinux, every file, process, directory, or port is assigned a special security label called a context.

To view the contexts assigned to a file or directory use the '-Z' option. Coupled with and 'ls" or a 'ps" this is a formidable command.

To view a list of all possible assigned contexts use semanage.

# semanage fcontext -l

Modify SELinux Contexts:

For example, lets create two test files in /tmp called testfile1 and testfile2, and then lets check their contexts.

# ls -lZ test*
-rw-r--r--. root root unconfined_u:object_r:user_tmp_t:s0 testfile1
-rw-r--r--. root root unconfined_u:object_r:user_tmp_t:s0 testfile2

Now compare this to the default context assigned to apache content

# ls -ldZ /var/www/html
drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html

So lets say that I want to move testfile1 to /var/www/html and make it accessable via a webbrowser; in order to do this I must assign the correct context to the file using the restorecon command.

# restorecon -Rv /var/www/html

The command above restores or even better, allows the testfiles to inherit the contexts assigned to the parent directory, which in this case is /var/www/html/

Add SELinux Contexts:

Now lets say that you need to add a directory and apply a context directly to that directory, instead of allowing a context to be inheritted. For example, lets say that I need to setup an apache virtual server under /virtual_server2, so lets first create the directory and a simple index.html

# mkdir /virtual_server2
# vi /virtual_server2/index.html
# ls -Zd /virtual_server2
drwxr-xr-x. root root unconfined_u:object_r:default_t:s0 /virtual_server2

# ls -Zd /virtual_server2/index.html
-rw-r--r--. root root unconfined_u:object_r:default_t:s0 /virtual_server2/index.html

Now we need to set and apply the correct http content context to /virtual_server2 and its contents (say that 5 times fast)

# semanage fcontext -a -f "" -t httpd_sys_content_t '/virtual_server2(/.*)?'

# restorecon -RFvvv /virtual_server2/

restorecon reset /virtual_server2 context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0
restorecon reset /virtual_server2/index.html context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0

Now that our context is correct apache should have no issue serving up our new content (once configured on the apache side)

# ls -Zd /virtual_server2/
drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 /virtual_server2/

 

 

 

 

 

 

RHEL6 - Snapshotting an LVM Volume

Snapshotting in the context of LVM is the process of taking a point-in-time image of a filesystem and creating a separate copy of that filesystem on another filesystem... using LVM of course.

Snapshoting can be useful if you need to take a backup of a filesystem but want the filesystem to be a quiesced state when you do so. Using LVM and snapshots you just backup the snapshot of the original filesystem.

First lets create the "master" filesystem using /dev/sdc1 which has partitioned as Linux LVM in fdisk.

So create the physical volume

_{>pvcreate /dev/sdc1}

Then create a volume group containing the physical volume

_{>vgcreate test_vg /dev/sdc1}

Then create a logical volume called v1 which is 5gb in size. Note that this volume group is 10gb in total size.

_{>lvcreate -n v1 -L 5G test_vg}

Then create a filesystem on that volume

_{>mkfs -t ext4 /dev/test_vg/v1}

Then mount this volume to /v1 and put some data in it.

_{>mkdir /v1}

_{>mount /dev/test_vg/v1 /v1}

_{>cp /var/tmp/VMwareTools-8.3.2-257589.tar /v1}

Ok, now that we have a logical volume with some data in it, lets make a snapshot of it. 

First lets make a mountpoint for our snapshot

_{>mkdir /v2}

Now lets make the snapshot of /dev/test_vg/v1. Note that a snapshot volume can be as large or a small as you like but it must be large enough to hold all the changes that occur on the original volume during the lifetime of the snapshot. In this example I am creating a snapshot of 4gb.

_{>lvcreate -n snapvol -L 4G -s /dev/test_vg/v1}

Using lvs or lvscan you can take a look at the snapshot volume.

_>lvscan

  _{ACTIVE   Original '/dev/test_vg/v1' [5.00 GiB] inherit
  ACTIVE   Snapshot '/dev/test_vg/snapvol' [4.00 GiB] inherit}

Now lets mount the snapshot readonly.

_{>mount -o ro /dev/test_vg/snapvol /v2}

Now you can browse the contents of the snapshot, unmount it and mount it as needed. And back it up as well. Make sure that you remove the snapshot when done backing it up

_{>lvremove /dev/test_vg/snapvol}

 

RHEL6 - Managing Swap Space

Swap space on a Linux box is an area on disk that is used to hold intactive memory pages. This occurs when the system needs more memory then is currently availiable, so it swaps these inactive memory pages to disk.

To create additonal swap space on the fly you are either going to need a spare disk or free partition on a disk that you can use.

First, using fdisk,  you will need to make sure that the partition type for the disk (or partiton) is set to 82.

Then setup the swap area using mkswap. In this example I am using /dev/sdb2, but your setup is bound to be different.

_{>mkswap /dev/sdb2}

Then determine the UUID of the new swap space.

_{>blkid /dev/sdb2}

Then add an entry to the /etc/fstab, so that the swap space is mounted at boottime. The show in the example below is the output of the blkid command above.

UUID=7b05f0a9-18d5-42e5-b259-78ba3a8cc1b7 swap                    swap    defaults        0 0

Then activate your new swap space

_{>swapon -a}

Then check to make sure everything worked by checkign for your new swap partition in the output of the command below.

_{>swapon -s}

/dev/sdb2                             partition       4193276 7480    0