RHCA-RH413(服务器固化)学习笔记

发表于 | 分类于

413-1-operating system update:

  1. CVES and Red Hat Errata
    a. Red Hat Security Advisory(RHSA)
    b. Red Hat Bug Fix Advisory(RHBA)
    c. Red Hat Enhancement Advisory(RHEA)
  2. Check update informaton
    a. yum updateinfo
    b. yum updateinfo –security
    c. yum updateinfo –security list
  3. Apply certain type of update
    a. yum update –security
    b. yum update –bugfix
  4. BugTraq
  5. Package Integrity Check
    a. rpm –import gpa-key-file
    b. rpm K rpm-file
    c. rpm -qa | grep gpg-pubkey
    d. rpm -e gpg-pubkey-keyed
    e. gpgcheck=1 in /etc/yum.conf0
    f. gpgkey=/path/to/file
    g. rpm -qpl rpm-file
    h. rpm -qp –scripts rpm-file
    i. rpm -qp –tiggers rpm-file
    413-2-ecryption:
  6. Linux Unified Key Setup(LUKS)
    a. cryptsetup luksFormat /dev/vg/lv
    b. cryptsetup luksOpen /dev/vg/lv name
    c. mkfs.ext4 /dev/mapper/name
    d. mkdir /secure
    e. mount /dev/mapper/name /secure
    f. umount /secure
    g. cryptserup liksClose name
  7. Persistently Mount Encrypted Volume
    a. dd if=/dev/urandom of=/path/to/password/file bs=4096 count=1
    b. chmod 600 /path/to/password/file
    c. cryptsetup luksAddKey /dev/vg/lv /path/to/password/file
    d. /etc/crypttab
    i. name  /dev/vg/lv  /path/to/password/file
    e. /etc/fstab
    i. /dev/mapper/name  /secure  ext4  defauls 0 0
  8. File System Defauls Mount Options
    a. dev,exec,suid,rw…
    b. nodev
    c. noexec
    d. nosuid
    e. ro
  9. Manae Superblock Mount Options
    a. tune2fs -l /dev/vda1
    b. tune2fs -o ^acl /dev/vda1
    c. tune2fs -o acl /dev/vda1
  10. File System Attributes
    a. chattr +a file(append only只读)
    b. chattr +i file(Immutable免疫)
    c. chattr +j file(Journal)
    d. chattr +S file(Synchronous立即同步磁盘)
    e. lsattr file
  11. Review Specia Permissions
    a. SUID on executables
    b. SGID on executables
    c. SGID on directories
    d. Sticky Bit on directories(or files)
  12. Search special files
    a. find /bin -type f -perm -4000(SUID文件)
    b. find /usr/bin -type f -perm -2000（SGID文件）
    c. find /var -perm -1000
    d. find /usr/bin -perm /7000（所有带特殊位文件
  13. Default File Permissions
    a. umask
    b. Default user mask is 002
    i. file will be:777-002-111=664
ii. directory will be:777-002=775
    c. Default root mask is 022
    i. file will be:777-002-111=644
ii. directory will be:777-022=755
    d. Global change
    i. /etc/profile
ii. /etc/bashrc
    e. Individual change
    i. ~/.bash_profile
ii. ~/.bashrc
  14. ACLs
    a. setfacl -m … dir
    b. setfacl -m d:… dir
    c. serfacl -x … dir
  15. Intrusion Detection
    a. AIDE
    i. yum install aide
ii. vim /etc/aide.conf
iii. aide --init;
iv. mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
v. aide --check
    413-3-password policy
  16. chage passwd
    a. chage -m 3 -M 90 -W 7 -l 356 username
    b. chage -l username
    c. chage -d 0 username
    d. defaults passwd defined in /etc/login.defs
    i. PASS_MAX_DAYS 60
ii. PASS_MIN_DAYS 3

  17. PAM
    a. ls /lib64/security/
    b. ls /etc/pam.d/

    i. more system-auth
ii. more passwd-auth

    c. pam_cracklib.so

    i. minlen
ii. lcredit,ucredit,dcredit,ocredit
iii. minclass
iv. vi /etc/pam.d/system-auth
v. vi /etc/pam.d/passwd-auth

    d. pam_tally2.so

    i. pam_tally2
ii. pam_tally2 --reset -u username

  18. /etc/security/limits.conf
    a. more /etc/security/limits.d/90-nproc.conf
    b. ulimit -a
    413-4-ipa server

  19. IPA project(Identity,Policy,Audit)
    a. LDAP
    b. MIT Kerberos KDC
    c. Dogtag project
    d. NTP service
    e. DNS service
  20. Install IPA Server
    a. chkconfig NetworkManager off
    b. service NEtworkManager stop
    c. config static ipaddr
    d. chkconfig network on
    e. service network restart
    f. yum install ipa-server
    g. ipa-server-install –help
    h. ipa-sever-install –hostname=server1.example.com -n example.com -r EXAMPLE.COM -p redhat123 -a redhat123 -idstart=5000 -idmax=7000 -N -U
    i. service sshd restart
    j. kinit admin
    k. klist
    l. firefox
    m. http://server.example.com
    n. configure browser for SSO
  21. Install IPA Client
    a. yum install ipa-client
    b. ipa-client-install –domian=example.com –server=server.example.com –realm=EXAMPLE.COM -p admin -w redhat123 –mkhomedir -N -U
    c. kinit username
    d. ssh username@server1
  22. Uninstall IPA Client
    a. ipa-client-install –uninstall
    b. rm -rf /etc/ipa/ca.crt
    c. reboot
    413-5(1)-log srver and client:
  23. vi /etc/rsyslog.conf
  24. vi /etc/rsyslog.d/filter.conf
    a. :fromhost, isequal, “desktop1.example.com” /var/log/desktop1.log
    b. :fromhost, isequal, “desktop1.example.com” ~
    413-5(2)-log srver and client:
  25. vi /etc/rsyslog.d/ssl.conf
    413-6-audit file access:
  26. auditd
  27. /vat/log/audit/audit.log
  28. ausearch -i -a 28708
  29. auditctl
  30. vi /etc/audit/audit.rules
  31. /etc/init.d/auditd restart
  32. pam_tty_audit.so
  33. vi /etc/pam.d/system-auth
    a. session required pam_tty_audit.so enable=root
  34. vi /etc/pam.d/passwd-auth
    a. session required pam_tty_audit.so enable=root
  35. /etc/init.d/auditd restart
  36. aureport –tty
    413-7- firewall:
  37. iptables
    a. setup
    b. iptables -L -v -n
  38. /etc/sysconfig/iptables-config
    a. IPTABLES_MODULES=”nf_conntrack_ftp”
    b. /etc/init.d/iptables restart