System admin tools collection: Linux

Showing posts with label Linux. Show all posts

Linux Kernel v2.6.24.1 - Final

Linux Kernel v2.6.24.1 - Final

Links
http://rapidshare.com/files/91016320/linux-2.6.24.1.tar.bz2

Patch:
http://rapidshare.com/files/91016196/patch-2.6.24.1.bz2

Changelog:
http://rapidshare.com/files/91016198/ChangeLog-2.6.24.1

13 security practices for SysAdmins

This information has been compiled to help system administrators certify that good security practices are being used BEFORE a computer is connected to the network.

Installing System Patches

It is recommended that based on the requirement, you install every patch recommended for your computer which isn’t
yet installed. Since some patches restore default configurations, it’s important that patches are put in place before any further security precautions are taken.

Before Recording System Defaults

Before starting to record system defaults, a directory should be created to store them. For example;

mkdir /usr/adm/checks

If an unauthorized user does gain access to root privileges on the computer and changes the accounting system, the
administrator will still have an original copy of it for comparison. For safety, the system administrator should check the files against the original about once a month.

Recording SUID and SGID Programs

Before any software is added to the basic operating system release, the system administrator should check for SUID and SGID programs. If unauthorized access occurs, frequently the intruder will leave a program that enables privileged
re-entry. The list of SUID and SGID programs should be stored both on and off the computer. The version on the computer will be used by a daily cron job to check for changes, while the version stored off of the computer will ensure that even if root access is acquired, a record of the system’s original state is available.

The command to list SUID and SGID files is:

find / -type f \( -perm -002000 -o -perm -004000 \)

-type f: looks only at regular files
-perm:   checks for permissions

-002000: checks for SGID programs
-004000: checks for SUID programs

Check and Record Permissions on all Device Files

By changing the permissions on device files, an unauthorized user can gain access to devices, using this access to change files, impersonate another user, or listen in on conversations. Record the permissions on the device files on and off the computer using:

ls -al /dev/* | sort > /usr/adm/checks/devices

Passwords and Shells on System Accounts

Check the system password file to ensure that all accounts have passwords. Many vendors ship their computers with no passwords on the system accounts. System accounts such as bin, lp, and sync should have a ‘*’ for the password field. No account should be left without a password.

Also, the system administrator should check to see if the computer comes with any passwords already assigned. Some
vendors give default passwords to system accounts. Since anyone who has the same type of system knows what the default passwords are, passwords should be changed immediately.

Every account needs to have a shell assigned to it. Most administrative accounts should have /bin/nologin as the shell, which
would disallow crackers from gaining shell access using obscure system holes.

Expire Inactive Accounts

Computers with large numbers of users tend to have accounts that become inactive. The beginning of a new fiscal year often
brings changes in who is using the computer, as users’ funding sources change. The system administrator needs to be sensitive to those accounts that become inactive, and disable them by replacing the password field in the /etc/password file with an ‘*’. If the user has left important data on the computer, eventually they will contact the system administrator to make arrangements to retrieve the data. Once this data is retrieved, the account should be removed.

Restrict Root Login to the Console

The ability to login to the root account should be restricted to the console. Anyone not at the console should have to use ’su’ to
become root. Tries to ’su’ are recorded in a file in /usr/adm such as /usr/adm/sulog, for accounting purposes

Check for Duplicate Groups

Replace any duplicated group with a group of its own. This will remove ambiguity and make membership in a group clearer.

Do Not Establish Guest Accounts

Do not establish accounts for guest usage. These accounts, often appearing as an account with login guest and password
account, are common holes exploited by unauthorized users. Every user of the computer should undergo the same security procedures, receive the same security briefing, and be held accountable to the same standards. When users are finished using the computer, their accounts should be removed from the password file.

‘remote’ Commands

Commands preceded by the letter ‘r’, such as ‘rlogin‘ or ‘rsh‘, should be disabled. They are a source of many attacks on sites
across the Internet. If you must use ‘r’ commands, make sure you filter the TCP ports (512,513,514) at the router; it is important to note this will only stop outsiders from abusing the commands.

Double Check the System Before Long Weekends

Double check the computer before long weekends to ensure there are no security problems with it. A backup just
before a long weekend is advisable.

Do a Monthly System Check

Run the cron script against the cron stored on the removable media in case the unauthorized user gained root access and altered the system without being noticed.

System Security Diary

Keep a diary of the security checks done on the computer and what their results are. Also, document what actions are taken if holes are found or problems occur. If there is a problem, others will want to know what the system administrator has been doing to secure the computer.

Hope these tips would help you in your day-to-day life.

Incresing a swap space on Linux OS

This is simple method for Increase your available swap space with a swap file

All of your devices function, and everything is configured just the way you like it. At least you think so, until you start running out of memory when you have Open Office.org and lots of browser tabs open simultaneously. You realize you should have specified a larger swap partition during your install. this simple method of installing gain .swap partition.

There’s more than one way to maintain your Linux system. Instead of creating a swap file, you could instead resize and or reshuffle your partitions with parted or its graphical front end QtParted.

To start , see how much swap space you already have. At a command line by typing ,
swapon -s (you might need to prepend /sbin/ if you’re not root)
the command should produce a message :

Filename Type Size Used Priority
/dev/hda2 partition 128044 92472 -1

The numbers under “Size” and “Used” are in kilobytes.

Let’s figure out where to put it. Running df -m from a command line should produce output something like this:

Filesystem 1M-blocks Used Available Use% Mounted on
/dev/hda1 11443 6191 5252 55% /

The -m switch we used provided us with output in megabytes. Under the “Available” column we have approximately 5GB of free space on our root partition. Let’s steal 512MB of that for our auxiliary swap file. You might want more or less, depending on your memory needs, how much swap space you already have available, and how much free disk space you have. The general rule of thumb for swap size is that your total available swap space should be around double your RAM size. If you have additional partitions, and one of those is a better candidate than the / partition, feel free to use it instead.

Please make Back up your important data before proceeding. If you carefully follow the steps below you should be fine,

In order to create our supplementary swap file, we’re going to use the dd (data dump) command. You’ll need to become root to perform the next few steps. su - and enter your root password. When you’re ready,

dd if=/dev/zero of=/extraswap bs=1M count=512

replacing 512 with the number of megabytes you want in your auxiliary swap file. if= and of= are short for infile and outfile. The /dev/zero device file will give us zeroes to be written to the output file. If you want this file on a different partition, say your /var partition, you would replace /extraswap with /var/extraswap.

Now we have a file the size we want on disk, and we can prepare it for use as a swap partition. We’ll use the mkswap command to make our file swap-consumable for the Linux kernel. Again as root,
#mkswap /extraswap

To turn on our swap file, we run swapon /extraswap. Now when we run swapon -s we should see our existing swap partition and our new swapfile. Also, the free command should show an increase in total swap space.

But we’re still not done yet. If we reboot our machine now, our new swapfile won’t be active, and we’ll have to run swapon /extraswap again. to make things more permanent, you need to edit our /etc/fstab file.

make a copy of the file. Something like this should do the trick:

cp /etc/fstab /etc/fstab.mybackup

open /etc/fstab in your favorite text editor and find a line about your swapfile that looks something like this:

/dev/hda2 none swap sw 0 0

You’ll need another line like that underneath it pointing to your new swap file. Replace the first column with the location of your new swap file. For our example, the new line should look like this:

/extraswap none swap sw 0 0

Save the file. Mistaken changes to /etc/fstab could render your system unbootable, so just to make sure you didn’t accidently change anything else in /etc/fstab, run diff /etc/fstab.mybackup /etc/fstab to check for differences. That should output only the single line you added, with a “>” sign in front of it. If you see anything else in diff’s output, edit /etc/fstab again, fix it, and run the above diff command again.

In practical terms, there’s a minimal performance hit from this extra step. By the time you’ve run out of RAM and are beginning to swap, you’re already suffering a massive performance hit. After your original swap partition is full and you’re spilling into your auxiliary swap file, your system should be suffering badly enough that the added performance hit will be completely imperceptible.

In order to avoid this sort of problem entirely with your next install, using Linux’s Logical Volume Manger is probably a good idea, and there are other Linux memory management techniques. Of course the ideal solution is to just install additional RAM.

Creating CD-ROM ISO image in Linux

dd is a perfect tool for copy a file, converting and formatting according to the operands. It can create exact CD-ROM ISO image.

This is useful for making backup as well as for hard drive installations require a working the use of ISO images.
How do I use dd command to create an ISO image?

Put CD into CDROM

Do not mount CD. Verify if cd is mounted or not with mount command:

# mount

If cd was mouted automatically unmout it with umount command:

# umount /dev/cdrom

OR

# umount /mnt/cdrom

Create CD-ROM ISO image with dd command:

# dd if=/dev/cdrom of=/tmp/cdimg1.iso

Where,

* if=/dev/cdrom: Read from /dev/cdrom (raw format)
* of=/tmp/cdimg1.iso: write to FILE cdimg1.iso i.e. create an ISO image

Now you can use cdimg1.iso for hard disk installation or as a backup copy of cd. Please note that dd command is standard UNIX command and you should able to create backup/iso image under any UNIX like operating system.

System admin tools collection

Linux Kernel v2.6.24.1 - Final

13 security practices for SysAdmins

list of Linux troubleshooting sites

Incresing a swap space on Linux OS

Creating CD-ROM ISO image in Linux

Blog Archive

Labels