Pass the RedHat RHCE RH302 Questions and answers with CertsForce

Do the following steps as:

1. Rename the file named.caching-nameserver.conf into named.conf file located into /var/named/chroot/etc

#mv /var/named/chroot/etc/named.caching-nameserver.conf /var/named/chroot/etc/named.conf

2. Check the permission and ownership as well as SELinux Context should be like as:

-rw-r----- root named system_u:object_r:named_conf_t /var/named/chroot/etc/named.conf

If selinux context is mismatch use the restorecon –R /var command

3.vi /etc/named.conf

zone “example.com” IN {

type master;

file “example.com.zone”;

};

/var/named/chroot/etc/named.conf file is used to register the zone as well as specify the global option for DNS server. There are two types of zone, i. Master, which contains the original data. ii. Slave, backup of master. Here is the example of master zone configuration.

4.vi /var/named/chroot/var/named/example.com.zone

$TTL 345345

@ IN SOA @ webmaster.example.com.(

101;Serial Number

1H;Refresh Time

1M;Retry Time

1W;Expire Time

1D;Minimum Time to Live

)

@ IN NS 192.100.0.X

www 0 IN A 192.100.0.1

www 0 IN A 192.100.0.2

www 0 IN A 192.100.0.3

www 0 IN A 192.100.0.4

www 0 IN A 192.100.0.5

3.service named start

4.rndc reload

5.chkconfig named on

6. Check the permission as well as SELinux Context should like this:

-rw-r--r-- root named root:object_r:named_zone_t /var/named/chroot/var/named/example.com.zone

If selinux context is mismatch use the restorecon –R /var command

7.service named start

8.rndc reload

9.chkconfig named on

Zone file should create on /var/named/chroot/var/named. Default Directory Path is specified on /var/named/chroot/etc/named.conf file.

$TTLTime To Live, How much seconds cache server stores the information about DNS. And Five Parameters specified Serial Number used by slave to synchronize withmaster server. Refresh and Retry Time used by slave server. NS is the Name (DNS) server where lookup the domain. A (Associated IP) for particular host.

Do the following steps as:

1.vi /etc/hosts.deny

vsftpd:ALL EXCEPT .example.com

or

1.vi /etc/hosts.deny

vsftpd:ALL

2.vi /etc/hosts.allow

vsftpd:.example.com

We can secure the services using tcp_wrappers. There are main two files, /etc/hosts.allow and /etc/hosts.deny.

There will be three stage access checking

- Is access explicitly permitted? Means permitted from /etc/hosts.allow?

- Otherwise, Is access explicitly denied? Means denied from /etc/hosts.deny?

- Otherwise, by default permit access if neither condition matched.

To deny the services we can configure /etc/hosts.deny file using ALL and EXCEPT operation. Pattern of /etc/hosts.allow and /etc/hosts.deny file is:

Demon_list:client_list:options

In Client list can be either domain name or IP address.

Do the following steps as:

1.vi /etc/hosts.deny

dovecot:ALL EXCEPT .example.com, .cracker.org

We can secure the services using tcp_wrappers. There are main two files, /etc/hosts.allow and /etc/hosts.deny.

There will be three stage access checking

- Is access explicitly permitted? Means permitted from /etc/hosts.allow?

- Otherwise, Is access explicitly denied? Means denied from /etc/hosts.deny?

- Otherwise, by default permit access if neither condition matched.

To deny the services we can configure /etc/hosts.deny file using ALL and EXCEPT operation. Pattern of /etc/hosts.allow and /etc/hosts.deny file is:

Demon_list:client_list:options

In Client list can be either domain name or IP address.

Do the following steps as:

1.vi /etc/dhcpd.conf

ddns-update-style none;

option routers 192.168.0.1;

option domain-name “example.com”;

option domain-name-servers 192.168.0.254;

default-lease-time 21600;

max-lease-time 43200;

subnet 192.168.0.0 netmask 255.255.255.0

{

range 192.168.0.1 192.168.0.254;

host dns1 {

hardware ethernet 00:50:FC:98:8D:00;

fixed-address 192.168.0.254;

}

host dns2 {

hardware ethernet 00:50:FC:98:8C:00;

fixed-address 192.168.0.253;

}

}

/etc/dhcpd.conf file is used to configure the DHCP. Some global options i.e Gateway, domainname, DNS server specified using option keyword. To assign as static ip from dhcp server, required the mac address of interface.

2. Check the SELinux Context, should be like this:

-rw-r--r-- root root system_u:object_r:dhcp_etc_t /etc/dhcpd.conf

3. Use the restorecon –R /etc command to restore the selinux context of the file.

4.service dhcpd start | restart

Do the following steps as:

1.vi /etc/mail/local-host-names

example.com

2.vi /etc/mail/sendmail.mc

dnl # DEAMON_OPTIONS(`Port=smtp,Addr=127.0.0.1,Name=MTA`)dnl

3.m4 /etc/mail/sendmail.mc >/etc/mail/sendmail.cf

4.vi /etc/mail/access

192.168.0RELAY

@cracker.orgREJECT

5.service sendmail start | restart

6.chkconfig dovecot on

7.vi /etc/dovecot.conf

protocols = pop3 pop3s imap imaps

8.service dovecot start | restart

9.chkconfig dovecot on

10.vi /etc/aliases

user5:user2

11.newaliases

/etc/mail/local-host-names file contains the aliases to hostname. Mail server program reads the /etc/mail/sendmail.cf. To change the configuration on mail server, we should edit the /etc/mail/sendmail.mc file and should generate the sendmail.cf using m4 command.

By default sendmail server allows to connect to local host only. So we should edit the /etc/mail/sendmail.mc file to allow connect to other hosts.

By default sendmail server will not forward mail. we should specify on /etc/mail/access to relay or to block mail coming from domain or network or individual email address.

By default dovecot service start only the imap protocol. To start pop protocol with dovecot, we should write in /etc/dovecot.conf file.

Using /etc/aliases file we can map the user name to send mail of one user to another user. To rebuild database we use the newaliases command.

Slave DNS is the backup of master DNS. Automatically within a certain time slave DNS synchronizes with the Master DNS server.

1.vi /var/named/chroot/etc/named.conf

zone “example.com” IN {

type slave;

masters { 192.100.0.254; };

file “example.com.zone”;

};

named-checkconf command checks the syntax for /var/named/chroot/etc/named.conf file.

service named start | restart

Do the following steps as:

1.touch /etc/nologin

2.vi /etc/securetty

comment all available terminall then first.

If /etc/nologin file is created, then pam modules pan_nologin deny to all non-root users to login locally.

/etc/pam.d/login file calls the module.

#%PAM-1.0

auth requiredpam_securetty.so

auth requiredpam_stack.so service=system-auth

auth requiredpam_nologin.so

account requiredpam_stack.so service=system-auth

password requiredpam_stack.so service=system-auth

# pam_selinux.so close should be the first session rule

session requiredpam_selinux.so close

session requiredpam_stack.so service=system-auth

session optionalpam_console.so

# pam_selinux.so open should be the last session rule

session requiredpam_selinux.so multiple open

pam_securetty modules checks the /etc/securetty file, which terminal are available to root. If terminal is not available in this file then pam_securetty module deny to login on unavailable terminal to root user.

Do the following steps as:

1.vi/var/named/chroot/etc/named.conf

acl localnet { 192.168.0.0/24; };

options {

allow-query { localnet; };

};

2.service named restart | start

allow-query is a global option on/var/named/chroot/etc/named.conf, specifies an address match list of hosts allowed to query this server. If this option is not set, any host can query the server.

Here your Local LAN means your domain named example.com.

1.vi /etc/mail/local-host-names

example.com

2.vi /etc/mail/sendmail.mc

dnl # DEAMON_OPTIONS(`Port=smtp,Addr=127.0.0.1,Name=MTA`)dnl

3.m4 /etc/mail/sendmail.mc >/etc/mail/sendmail.cf

4.vi /etc/mail/access

192.168.0RELAY

5.service sendmail start | restart

6.chkconfig sendmail on

/etc/mail/local-host-names file contains the aliases to hostname. Mail server program reads the /etc/mail/sendmail.cf. To change the configuration on mail server, we should edit the /etc/mail/sendmail.mc file and should generate the sendmail.cf using m4 command.

By default sendmail server allows to connect to local host only. So we should edit the /etc/mail/sendmail.mc file to allow connect to other hosts.

By default sendmail server will not forward mail. we should specify on /etc/mail/access to relay or to block mail coming from domain or network or individual email address.

7.vi /etc/aliases

john:jane

8.newaliases

We can redirect the mail of one user to another user using /etc/aliases file. In example all mail of john goes to jane user.

At exam Lab example.com domain resides on 172.24.0.0/16 Network and my133t.org resides on 172.25.0.0/16 Network.

1.vi /etc/squid/squid.conf

#detault:

http_port8080

#Recommended minimum configuration:

# Near the src acl src section

acl allownet src 172.24.0.0/255.255.0.0

acl denynet src 172.25.0.0/255.255.0.0

#Default:

# http_access deny all

#Under Herehttp_access allow allownet

http_access deny denynet

2.service squid start

3.chkconfig squid on

squid is a proxy caching server, using squid we can share the internet, block the internet, to certain network. First we should define the port for squid, the standard port for squid is 3128. We can run squid on different port by specifying http_port portnumber.