Section 3 - Network Services

Install the Packages Needed to Provide the Service



            # to list all installed packages

            yum list installed

            

            # to install a package

            yum install telnet

            

            # download only, use yumdownloader

# will download the telnet rpm file

            yumdownloader telnet

            

            # install using the rpm

            yum localinstall package.rpm

            

            # search if package available in the repo

            yum search packagename

            

            # which package provide a feature

            yum provides tcsd.conf

            

            # check if update available

            yum check-update

            

            # update all packages

            yum update

            

            # update specific package

            yum update telnet

            

            # if there is full revision update

            yum upgrade

            

            # update about the package

            yum info telnet

back to Objectives

Configure SELinux to support the Service



            # check current stattus

            getenforce

            

            # set for the current running session

            setenforce 1

            

            # more details of the status

            sestatus

back to Objectives

Use SELinux Port Labelling to Allow Services to use non-standard port

### Example for apache httpd service## install the httpd service and the elinks browser

[root@rhel7server1 ~]# yum install -y httpd elinks ## enable and start the service [root@rhel7server1 ~]# systemctl enable httpd Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service. [root@rhel7server1 conf]# systemctl start httpd ## Check the current list of ports labelled for httpd [root@rhel7server1 conf]# semanage port -l | grep ^http_port http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000 ## if we change the Listen port to 81 [root@rhel7server1 conf]# cd /etc/httpd/conf [root@rhel7server1 conf]# vi httpd.conf ... Listen 81 ... ## save and restart [root@rhel7server1 conf]# systemctl restart httpd ## we still can load the default web page [root@rhel7server1 conf]# elinks http://localhost:81 ## if we change the Listen port to 82 [root@rhel7server1 conf]# cd /etc/httpd/conf [root@rhel7server1 conf]# vi httpd.conf ... Listen 82 ... ## save and restart root@rhel7server1 conf]# systemctl restart httpd Job for httpd.service failed because the control process exited with error code. See "systemctl status httpd.service" and "journalctl -xe" for details. ## if we check the error [root@rhel7server1 conf]# journalctl -xe .... Mar 14 10:14:56 rhel7server1 setroubleshoot[17289]: SELinux is preventing /usr/sbin/httpd from name_bind access Mar 14 10:14:56 rhel7server1 python[17289]: SELinux is preventing /usr/sbin/httpd from name_bind access on the t ... ## fix it by [root@rhel7server1 conf]# semanage port -a -t http_port_t -p tcp 82 [root@rhel7server1 conf]# semanage port -l | grep ^http_port http_port_t tcp 82, 80, 81, 443, 488, 8008, 8009, 8443, 9000 ## now we can start httpd service [root@rhel7server1 conf]# systemctl restart httpd ## and we can load the website at port 82 [root@rhel7server1 conf]# elinks http://localhost:82

back to Objectives

Configure the Service to Start when the system is booted

### e.g. httpd Services # to check status systemctl status httpd # to enable (auto start on reboot) # if the service is not running, this will not start it, but will start at next reboot systemctl enable httpd # to start the service now systemctl start httpd # to disable (autostart on reboot) # if the service is already running, it remains running, but will not start at next reboot systemctl disable httpd # to prevent from being started by systemctl start <servicename> # or by systemctl restart <servicename> e.g. [root@rhel7server1 ~]# systemctl mask httpd Created symlink from /etc/systemd/system/httpd.service to /dev/null. [root@rhel7server1 ~]# systemctl start httpd Failed to start httpd.service: Unit is masked# to undo mask systemctl unmask httpd # to list services that are enabled systemctl list-unit-files --state=enabled --type=service # to list services that are disabled systemctl list-unit-files --state=disabled --type=service

back to Objectives

Configure the Service for Basic Operation

### eg. for httpd service# check service status # note the process is /usr/bin/httpd [root@rhel7server1 ~]# systemctl status httpd ● httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor preset: disabled) Active: active (running) since Sun 2020-03-15 05:29:46 EDT; 9min ago Docs: man:httpd(8) man:apachectl(8) Process: 3437 ExecStop=/bin/kill -WINCH ${MAINPID} (code=exited, status=0/SUCCESS) Main PID: 3441 (httpd) Status: "Total requests: 0; Current requests/sec: 0; Current traffic: 0 B/sec" CGroup: /system.slice/httpd.service ├─3441 /usr/sbin/httpd -DFOREGROUND ├─3443 /usr/sbin/httpd -DFOREGROUND ├─3445 /usr/sbin/httpd -DFOREGROUND ├─3446 /usr/sbin/httpd -DFOREGROUND ├─3447 /usr/sbin/httpd -DFOREGROUND └─3448 /usr/sbin/httpd -DFOREGROUND # check process status ps aux | grep httpd # to start systemctl start httpd ## after making configuration change,# Either, reload systemctl reload httpd # root process id stays the same, but the child process will change # does not force terminate any existing connections [root@rhel7server1 ~]# systemctl reload httpd [root@rhel7server1 ~]# ps -ef | grep httpd root 3441 1 0 05:29 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND apache 3672 3441 0 05:43 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND apache 3673 3441 0 05:43 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND apache 3674 3441 0 05:43 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND apache 3676 3441 0 05:43 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND apache 3677 3441 0 05:43 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND root 3684 2848 0 05:43 pts/0 00:00:00 grep --color=auto httpd
# Or, restart [root@rhel7server1 ~]# systemctl restart httpd [root@rhel7server1 ~]# ps -ef | grep httpd root 3725 1 5 05:45 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND apache 3726 3725 0 05:45 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND apache 3727 3725 0 05:45 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND apache 3728 3725 0 05:45 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND apache 3729 3725 0 05:45 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND apache 3730 3725 0 05:45 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND root 3738 2848 0 05:45 pts/0 00:00:00 grep --color=auto httpd# in this case process id gets changed for the root and child processes # existing connections are terminated # check dependency [root@rhel7server1 ~]# systemctl list-dependencies httpd httpd.service ● ├─-.mount ● ├─system.slice ● └─basic.target ● ├─alsa-restore.service ● ├─alsa-state.service ● ├─microcode.service ● ├─rhel-autorelabel-mark.service ● ├─rhel-autorelabel.service ● ├─rhel-configure.service ● ├─rhel-dmesg.service ● ├─rhel-loadmodules.service ● ├─selinux-policy-migrate-local-changes@targeted.service ● ├─paths.target ● ├─slices.target ● │ ├─-.slice ● │ └─system.slice ● ├─sockets.target ● │ ├─avahi-daemon.socket ● │ ├─cups.socket ● │ ├─dbus.socket ● │ ├─dm-event.socket ● │ ├─iscsid.socket ● │ ├─iscsiuio.socket ● │ ├─rpcbind.socket ● │ ├─systemd-initctl.socket ● │ ├─systemd-journald.socket ● │ ├─systemd-shutdownd.socket ● │ ├─systemd-udevd-control.socket ● │ ├─systemd-udevd-kernel.socket ● │ ├─virtlockd.socket ● │ └─virtlogd.socket ● ├─sysinit.target ● │ ├─dev-hugepages.mount ● │ ├─dev-mqueue.mount ● │ ├─dmraid-activation.service ● │ ├─iscsi.service ● │ ├─kmod-static-nodes.service ● │ ├─lvm2-lvmetad.socket ● │ ├─lvm2-lvmpolld.socket ● │ ├─lvm2-monitor.service ● │ ├─multipathd.service ● │ ├─plymouth-read-write.service ● │ ├─plymouth-start.service ● │ ├─proc-sys-fs-binfmt_misc.automount ● │ ├─sys-fs-fuse-connections.mount ● │ ├─sys-kernel-config.mount ● │ ├─sys-kernel-debug.mount ● │ ├─systemd-ask-password-console.path ● │ ├─systemd-binfmt.service ● │ ├─systemd-firstboot.service ● │ ├─systemd-hwdb-update.service ● │ ├─systemd-journal-catalog-update.service ● │ ├─systemd-journal-flush.service ● │ ├─systemd-journald.service ● │ ├─systemd-machine-id-commit.service ● │ ├─systemd-modules-load.service ● │ ├─systemd-random-seed.service ● │ ├─systemd-sysctl.service ● │ ├─systemd-tmpfiles-setup-dev.service ● │ ├─systemd-tmpfiles-setup.service ● │ ├─systemd-udev-trigger.service ● │ ├─systemd-udevd.service ● │ ├─systemd-update-done.service ● │ ├─systemd-update-utmp.service ● │ ├─systemd-vconsole-setup.service ● │ ├─cryptsetup.target ● │ ├─local-fs.target ● │ │ ├─-.mount ● │ │ ├─boot.mount ● │ │ ├─home.mount ● │ │ ├─rhel-import-state.service ● │ │ ├─rhel-readonly.service ● │ │ └─systemd-remount-fs.service ● │ └─swap.target ● │ └─dev-mapper-rhel\x2dswap.swap ● └─timers.target ● ├─systemd-tmpfiles-clean.timer ● └─unbound-anchor.timer

back to Objectives

Configure host-based and user-based security for the service



            ### Host based Security

            

            ## SSH

            

            # open firewall on the server

            

            firewall-cmd --permanent --add-service=ssh

            

            # deny specific client by their hostname, address

            

            /etc/hosts.deny

            sshd: someserver.hackernet.net

            sshd: .hacker.net

            sshd: 131.155.72.0/255.255.255.0

            sshd: 131.155.72.0/24

            sshd: 131.155.

            

            # for more help : man hosts.deny

            

            # allow specific client(s) by their hostname, address

            

            /etc/hosts.alow

            sshd: someserver.whitehat.net

            sshd: .whitehat.net

            sshd: 131.155.73.0/255.255.255.0

            sshd: 131.155.73.0/24

            sshd: 131.155.

            

            # for more help : man hosts.allow

            

            # Precedence : /etc/hosts.allow first and then /etc/hosts.deny.  First matching ACL applies

            

            

            

            ## HTTP/HTTPS

            

            # open firewall on the server

            

            firewall-cmd --permanent --add-service=http

firewall-cmd --permanent --add-service=https

            

            # deny, allow specific client(s)

            

            # first check to confirm that authz_core_module is loaded

            

            [root@rhel7server1 conf]# httpd -M | grep authz_core

             authz_core_module (shared)

            

            add the following to /etc/httpd/conf/httpd.conf

            

            ## within <Directory /var/www/html> .. </Directory>

            

            <RequireAll>

              Require all granted

              Require not host someserver.hacker.net

              Require not ip 192.168.0.20

            </RequireAll>

            

            ## create a test.html file in /var/www/html directory 

            ## test by accessing http://rhel7server1/test.html before and after adding the "Require not ip" directive

            

            

            ## DNS

            

            # open firewall on the server

            

            firewall-cmd --permanent --add-service=dns

            

            # allow specific clients

            

            /etc/unbound/unbound.conf 

            access-control: 131.155.72.0/24 allow

            

            # by default everyhing is refused

            

            

            ## NFS

            

            # open firewall on the server

            

            firewall-cmd --permanent --add-service=nfs

            

            # allow specific clients

            

            /etc/exports

            /nfsshare *.rhce.local(ro)

            

            

            ## SMB

            

            # open firewall on the server

            

            firewall-cmd --permanent --add-service=samba

            

            

            # allow specific clients

            

            /etc/samba/smb.conf

            hosts allow = 10.8.8.

            

            

            ## SMTP (Postfix)

            

            # open firewall on the server

            

            firewall-cmd --permanent --add-service=smtp

            

            # allow specific clients

            

            /etc/postfix/access

            rhce.local            OK

            someserver.hacker.net REJECT

            

            # run postmap

            postmap /etc/postfix/access

            

            # edit postfix config

            

            /etc/postfix/main.cf

            smtpd_client_restrictions = check_client_access hash:/etc/postfix/accessq

            

            

            

            ### User based Security

            

            ## SSH

            

            /etc/ssh/sshd_config

            AllowUsers sandy

            DenyUsers root

            

            

            ## HTTP/HTTPS

            

            /etc/httpd/conf/httpd.conf

            <Directory "/var/www/html">

               AuthType Basic

               AuthName "Login Required"

               AuthUserFile "/etc/httpd/conf/htpasswd"

               Require valid-user

            </Directory>

            

            htpasswd -c /etc/httpd/conf/htpasswd sandy

            

            systemctl restart httpd

            

            

            

            ## SMB

            

            /etc/samba/smb.conf

            valid users = sandy, alice

            write list = alice

            read list = sandy

            

            ## SMTP

            

            /etc/postfix/access

            user@domain   REJECT

            

            # run postmap

            postmap /etc/postfix/access

            

            # edit postfix config

            

            /etc/postfix/main.cf

            smtpd_client_restrictions = check_client_access hash:/etc/postfix/access

back to Objectives